Marco Hofmann (CTA) retweeted
🚀 Stalwart v1.0 is out: the fastest mail server on the planet, up to 234x faster than Dovecot. stalw.art/blog/stalwart-1-0
Marco Hofmann (CTA) retweeted
If you missed the @RecastSoftware #OSD Ninja session with me and @HarmVeenstra and want to catch up on what's new with #OSDeploy and #OSDCloud ... you can catch the replay at youtube.com/watch?v=YTMAkthr…
Marco Hofmann (CTA) retweeted
Native OpenTelemetry, event correlation, a 10x performance gain over 7.4 and an MCP server for AI-assisted operations all sit inside one platform. 8.0 RC1 is available now, and the LTS release follows.
Swipe through for what changed and why it matters.
#ZabbixSummit
We have issued immediate guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway: bit.ly/4rWRBz4
We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible.
Marco Hofmann (CTA) retweeted
🚨 New critical NetScaler CVE: CVE-2026-107406 (CTX697191, CVSS 9.5) – SAML → RCE. No workaround. 📄 support.citrix.com/external/… SAML IdP on 73.41 / 64.28? Upgrade again to 73.46 / 64.29.
🛠️ Checker v1.16: github.com/ThomasPoppelgaard… #NetScaler #Citrix #CVE2026107406
Marco Hofmann (CTA) retweeted
What if you could manage Zabbix by simply asking your AI assistant? With the new Zabbix MCP server, AI can query data, investigate issues, manage problems and maintenance, and more - all while keeping access controls in place. Find out more: zabbix.com/download?zabbix=8…
Marco Hofmann (CTA) retweeted
Patched @NetScaler for CTX697096 and use SAML? Patch again.
CVE-2026-88779 is a separate bulletin, CTX697174 (CVSS 8.7), not part of CTX697096. It's the SAML attack crashing patched NetScalers since 2 Oct. @citrix sees targeted attacks.
Affected: "add authentication samlAction" or "samlIdPProfile" in ns.conf
Fixed: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, 13.1-37.282
Interim: Global Deny List (NetScaler Console) or Citrix Support's responder policy, -type AAA_REQUEST on every Gateway/AAA vserver
Free checker v1.12 covers both bulletins:
• CVE-2026-88779 on every run
• SAML policy coverage per vserver
• "may have run" window ends at the fix
• 98 IPs, 16 domains, 34 hashes
Thanks to @GothamTG , @BeazleySecurity , @Deyda84 , @citrixguyblog , @rjfaulknerjr @FerroqueSystems, @bishopfox , @watchtowrcyber and the community 🙏
#NetScaler #Citrix #CitrixNetScaler #NetScalerGateway #CVE202688779 #CVE202688771 #CTX697174 #CTX697096 #CyberSecurity #InfoSec #IncidentResponse #ThreatHunting
We have a new security update: Understanding and addressing CVE-2026-88779 in Citrix NetScaler ADC and Citrix NetScaler Gateway: bit.ly/3U8A9uO
Marco Hofmann (CTA) retweeted
If you don't want to run T-POP's fast growing Versionsof his IoC Script on all of your Instances, here's a bit of help, import two Jobs on your NSC / NSC-Service and pull the results globally. Hope this helps and save you guys some time.
#NetScalerCVE
julianjakob.com/netscaler-ru…
Please read our latest security update with guidance for NetScaler SAML authentication deployments: bit.ly/4xZ2stK
Marco Hofmann (CTA) retweeted
#netscaler if you are using ICA Gateway with SAML community.citrix.com/techzon… you better contact Citrix, not sure how critical it is...
Marco Hofmann (CTA) retweeted
New NetScaler zero-day hits PATCHED appliances via SAML. Citrix released a new responder policy today: get it from Citrix Support.
Checker v1.11: SAML status, attempts since 2 Oct flagged "may have run", 95 IPs. Ran v1.10? Run again.
github.com/ThomasPoppelgaard…
#NetScaler #
Marco Hofmann (CTA) retweeted
More ways to troubleshoot. Fewer steps to get things done. Three updates just landed in PDQ:
🤖 Meet PDQ Assistant
💻 Live Shell
📁 File Explorer
Give them a try and tell us what saves you time!
#PDQ #ITSupport #ITleadership #sysadmin
Marco Hofmann (CTA) retweeted
Zabbix 8.0 RC1 is out!
📊 APM + OpenTelemetry: traces, logs, metrics in one place
🔇 Complex event processing: less noise, faster root cause
🛠️ Ad-hoc maintenance
🌙 New dark blue theme
LTS is coming. Try the RC: zabbix.com/rn/rn8.0.0rc1
Marco Hofmann (CTA) retweeted
🛠️ NetScaler CTX697096 checker v1.9: every public IoC since v1.8 in one read-only command. nsmon Perl implant, Unit 42 .deb webshell, trace-wiping cron jobs, /tmp/watchTowr marker, 42 attacker IPs. Every attack tagged before/after your fix.
⚠️ The CVE-2026-88772 DTLS tool is public. Can't patch today? Block UDP/443 or disable DTLS. And enable Enhanced ISN: patching alone doesn't close CVE-2026-88778.
github.com/ThomasPoppelgaard…
Thanks @emilstahl (PitScaler), @Unit42_Intel , @AWNetworks , @watchtowrcyber , @elastic , @Deyda84 🙏
#NetScaler #CVE202688771 #CVE202688772 #CVE202688773 #CVE202688774 #CVE202688775 #CVE202688776 #CVE202688777 #CVE202688778 #Citrix
Marco Hofmann (CTA) retweeted
🚨 NetScaler CTX697096: checker v1.7 is out.
If v1.4–v1.6 told you "all attacks came after the fix", run v1.7 again. On a production box, older versions missed an exploit attempt from 1.5 h BEFORE the patch, hidden in a rotated log. v1.7 checks every line and puts [BEFORE fix] on top.
Attackers now go for config + keys: one payload tar'ed /flash/nsconfig into a fake .html for download. v1.7 flags it, whatever the name.
New: 17 attacker IPs, dropped files, persistence, "ARMED" payloads on unpatched boxes.
Citrix also updated the Console IoC scan on 29 Sep. Re-scan.
Thanks @GothamTG , @Deyda84 & Michael Shuster @FerroqueSystems 🙏
#NetScaler #CTX697096 #Security #IOC
Marco Hofmann (CTA) retweeted
#OpenIntuneBaseline Windows v4.0 is here! 🎉
Highlights include:
* Continuing to be the most agile and cutting-edge Intune baseline on the planet!
* A shake-up of Compliance policies, allowing true grace period granularity (and ditching the EAS Password policy because it's 🗑️)
* Edge settings for days! Simple support for the Edge Management Service and security hardening and user experience improvements.
* Updated M365 Apps Security baseline alignment.
* Fixed MS breaking the in-box app removal policy.
* Defender behaviour tweaks based on real customer feedback, not arbitrary check-boxes.
* Deprecated and obsolete settings sent to live on a farm.
As always:
✅ Take what you want
✅ Change what doesn't suit your environment
✅ Test it before yeeting to 40,000 endpoints on Friday afternoon
❌ Don't treat any security baseline as a magical compliance button
Check out the full release notes at: stte.me/oib26h2
Then, head on over to the OIB Deployer to deploy the new and updated policies, or check your current config vs 4.0 with the Settings Validator!
https://deploy[.]openintunebaseline.com
And, uhh, keep an eye on Friday, too ;)
#OIB #Windows #EndpointSecurity #Community #Capybara
Marco Hofmann (CTA) retweeted
At the moment, public CA SSL/TLS-Certificates use a maximum Lifetime of 199 Days.
Until March 2029, it will be reduced to 47 Days.
Use Zero-Touch Certificate Management with Auto-Renewal, powered by NetScaler Console or NetScaler Console Service.
julianjakob.com/netscaler-ze…
Marco Hofmann (CTA) retweeted
‼️ Save the Date ‼️
Am Donnerstag, den 22.10.2026 laden wir erneut im Rittersaal des Hoepfner Burghofs in Karlsruhe zu einer weiteren Ausgabe #EUCforumDE ein.
Jetzt Platz kostenfrei sichern über eucforum.de/22-10-2026-eucfo…
Wir freuen uns auf Deine Anmeldung!
Marco Hofmann (CTA) retweeted
[QUICK POST] Check if Citrix Workspace Environment Management (WEM) is LAS activated
markuszehnle.com/quick-post-…


























