Marco Hofmann (CTA) (@xenadmin) header
Marco Hofmann (CTA) (@xenadmin) profile picture

* Citrix Technology Advocate (CTA) * Zabbix Certified Professional * PDQ Deploy & Inventory Fanboy * Wyse ThinOS Knight * I ❤ PowerShell & Visual Studio Code

Germany
Joined June 2009
Photo by Marco Hofmann (CTA) (@xenadmin)Photo by Marco Hofmann (CTA) (@xenadmin)Photo by Marco Hofmann (CTA) (@xenadmin)Photo by Marco Hofmann (CTA) (@xenadmin)Photo by Marco Hofmann (CTA) (@xenadmin)Photo by Marco Hofmann (CTA) (@xenadmin)Photo by Marco Hofmann (CTA) (@xenadmin)Photo by Marco Hofmann (CTA) (@xenadmin)Photo by Marco Hofmann (CTA) (@xenadmin)Photo by Marco Hofmann (CTA) (@xenadmin)
Marco Hofmann (CTA) retweeted
Native OpenTelemetry, event correlation, a 10x performance gain over 7.4 and an MCP server for AI-assisted operations all sit inside one platform. 8.0 RC1 is available now, and the LTS release follows. Swipe through for what changed and why it matters. #ZabbixSummit
1
4
20
1,154
Marco Hofmann (CTA) retweeted
We have issued immediate guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway: bit.ly/4rWRBz4 We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible.
12
33
18
96
39,453
Marco Hofmann (CTA) retweeted
🚨 New critical NetScaler CVE: CVE-2026-107406 (CTX697191, CVSS 9.5) – SAML → RCE. No workaround. 📄 support.citrix.com/external/… SAML IdP on 73.41 / 64.28? Upgrade again to 73.46 / 64.29. 🛠️ Checker v1.16: github.com/ThomasPoppelgaard… #NetScaler #Citrix #CVE2026107406
3
11
2
39
5,556
Marco Hofmann (CTA) retweeted
What if you could manage Zabbix by simply asking your AI assistant? With the new Zabbix MCP server, AI can query data, investigate issues, manage problems and maintenance, and more - all while keeping access controls in place. Find out more: zabbix.com/download?zabbix=8…
4
19
110
7,275
Marco Hofmann (CTA) retweeted
Patched @NetScaler for CTX697096 and use SAML? Patch again. CVE-2026-88779 is a separate bulletin, CTX697174 (CVSS 8.7), not part of CTX697096. It's the SAML attack crashing patched NetScalers since 2 Oct. @citrix sees targeted attacks. Affected: "add authentication samlAction" or "samlIdPProfile" in ns.conf Fixed: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, 13.1-37.282 Interim: Global Deny List (NetScaler Console) or Citrix Support's responder policy, -type AAA_REQUEST on every Gateway/AAA vserver Free checker v1.12 covers both bulletins: • CVE-2026-88779 on every run • SAML policy coverage per vserver • "may have run" window ends at the fix • 98 IPs, 16 domains, 34 hashes Thanks to @GothamTG , @BeazleySecurity , @Deyda84 , @citrixguyblog , @rjfaulknerjr @FerroqueSystems, @bishopfox , @watchtowrcyber and the community 🙏 #NetScaler #Citrix #CitrixNetScaler #NetScalerGateway #CVE202688779 #CVE202688771 #CTX697174 #CTX697096 #CyberSecurity #InfoSec #IncidentResponse #ThreatHunting
3
13
42
4,123
Marco Hofmann (CTA) retweeted
If you don't want to run T-POP's fast growing Versionsof his IoC Script on all of your Instances, here's a bit of help, import two Jobs on your NSC / NSC-Service and pull the results globally. Hope this helps and save you guys some time. #NetScalerCVE julianjakob.com/netscaler-ru…
1
2
3
274
Marco Hofmann (CTA) retweeted
New NetScaler zero-day hits PATCHED appliances via SAML. Citrix released a new responder policy today: get it from Citrix Support. Checker v1.11: SAML status, attempts since 2 Oct flagged "may have run", 95 IPs. Ran v1.10? Run again. github.com/ThomasPoppelgaard… #NetScaler #
5
14
67
9,072
Marco Hofmann (CTA) retweeted
More ways to troubleshoot. Fewer steps to get things done. Three updates just landed in PDQ: 🤖 Meet PDQ Assistant 💻 Live Shell 📁 File Explorer Give them a try and tell us what saves you time! #PDQ #ITSupport #ITleadership #sysadmin
1
1
2
57
Marco Hofmann (CTA) retweeted
Zabbix 8.0 RC1 is out! 📊 APM + OpenTelemetry: traces, logs, metrics in one place 🔇 Complex event processing: less noise, faster root cause 🛠️ Ad-hoc maintenance 🌙 New dark blue theme LTS is coming. Try the RC: zabbix.com/rn/rn8.0.0rc1
2
44
1
141
11,412
Marco Hofmann (CTA) retweeted
🛠️ NetScaler CTX697096 checker v1.9: every public IoC since v1.8 in one read-only command. nsmon Perl implant, Unit 42 .deb webshell, trace-wiping cron jobs, /tmp/watchTowr marker, 42 attacker IPs. Every attack tagged before/after your fix. ⚠️ The CVE-2026-88772 DTLS tool is public. Can't patch today? Block UDP/443 or disable DTLS. And enable Enhanced ISN: patching alone doesn't close CVE-2026-88778. github.com/ThomasPoppelgaard… Thanks @emilstahl (PitScaler), @Unit42_Intel , @AWNetworks , @watchtowrcyber , @elastic , @Deyda84 🙏 #NetScaler #CVE202688771 #CVE202688772 #CVE202688773 #CVE202688774 #CVE202688775 #CVE202688776 #CVE202688777 #CVE202688778 #Citrix
3
12
1
44
5,089
Marco Hofmann (CTA) retweeted
🚨 NetScaler CTX697096: checker v1.7 is out. If v1.4–v1.6 told you "all attacks came after the fix", run v1.7 again. On a production box, older versions missed an exploit attempt from 1.5 h BEFORE the patch, hidden in a rotated log. v1.7 checks every line and puts [BEFORE fix] on top. Attackers now go for config + keys: one payload tar'ed /flash/nsconfig into a fake .html for download. v1.7 flags it, whatever the name. New: 17 attacker IPs, dropped files, persistence, "ARMED" payloads on unpatched boxes. Citrix also updated the Console IoC scan on 29 Sep. Re-scan. Thanks @GothamTG , @Deyda84 & Michael Shuster @FerroqueSystems 🙏 #NetScaler #CTX697096 #Security #IOC
6
16
1,522
Marco Hofmann (CTA) retweeted
#OpenIntuneBaseline Windows v4.0 is here! 🎉 Highlights include: * Continuing to be the most agile and cutting-edge Intune baseline on the planet! * A shake-up of Compliance policies, allowing true grace period granularity (and ditching the EAS Password policy because it's 🗑️) * Edge settings for days! Simple support for the Edge Management Service and security hardening and user experience improvements. * Updated M365 Apps Security baseline alignment. * Fixed MS breaking the in-box app removal policy. * Defender behaviour tweaks based on real customer feedback, not arbitrary check-boxes. * Deprecated and obsolete settings sent to live on a farm. As always: ✅ Take what you want ✅ Change what doesn't suit your environment ✅ Test it before yeeting to 40,000 endpoints on Friday afternoon ❌ Don't treat any security baseline as a magical compliance button Check out the full release notes at: stte.me/oib26h2 Then, head on over to the OIB Deployer to deploy the new and updated policies, or check your current config vs 4.0 with the Settings Validator! https://deploy[.]openintunebaseline.com And, uhh, keep an eye on Friday, too ;) #OIB #Windows #EndpointSecurity #Community #Capybara
5
27
1
119
5,621
Marco Hofmann (CTA) retweeted
At the moment, public CA SSL/TLS-Certificates use a maximum Lifetime of 199 Days. Until March 2029, it will be reduced to 47 Days. Use Zero-Touch Certificate Management with Auto-Renewal, powered by NetScaler Console or NetScaler Console Service. julianjakob.com/netscaler-ze…
3
5
188
Marco Hofmann (CTA) retweeted
‼️ Save the Date ‼️ Am Donnerstag, den 22.10.2026 laden wir erneut im Rittersaal des Hoepfner Burghofs in Karlsruhe zu einer weiteren Ausgabe #EUCforumDE ein. Jetzt Platz kostenfrei sichern über eucforum.de/22-10-2026-eucfo… Wir freuen uns auf Deine Anmeldung!
2
2
95
Marco Hofmann (CTA) retweeted
[QUICK POST] Check if Citrix Workspace Environment Management (WEM) is LAS activated markuszehnle.com/quick-post-…
2
8
673