Marco Hofmann (CTA)

* Citrix Technology Advocate (CTA)
* Zabbix Certified Professional
* PDQ Deploy & Inventory Fanboy
* Wyse ThinOS Knight
* I ❤ PowerShell & Visual Studio Code

[David Segura | MVP | Recast Software @SeguraOSD]

If you missed the @RecastSoftware #OSD Ninja session with me and @HarmVeenstra and want to catch up on what's new with #OSDeploy and #OSDCloud ... you can catch the replay at https://t.co/DiTS6nWwPT

[Zabbix Team @zabbix]

Native OpenTelemetry, event correlation, a 10x performance gain over 7.4 and an MCP server for AI-assisted operations all sit inside one platform. 8.0 RC1 is available now, and the LTS release follows.

Swipe through for what changed and why it matters.

#ZabbixSummit

[Citrix @citrix]

We have issued immediate guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway: https://t.co/tVCgv2hFRd

We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible.

[Thomas Poppelgaard @_POPPELGAARD]

🚨 New critical NetScaler CVE: CVE-2026-107406 (CTX697191, CVSS 9.5) – SAML → RCE. No workaround. 📄 https://t.co/xQzDqAIHmX SAML IdP on 73.41 / 64.28? Upgrade again to 73.46 / 64.29.
🛠️ Checker v1.16: https://t.co/fGlD4MYGta #NetScaler #Citrix #CVE2026107406

[Zabbix Team @zabbix]

What if you could manage Zabbix by simply asking your AI assistant? With the new Zabbix MCP server, AI can query data, investigate issues, manage problems and maintenance, and more - all while keeping access controls in place. Find out more: https://t.co/VmdVQYmzvr

[Thomas Poppelgaard @_POPPELGAARD]

Patched @NetScaler for CTX697096 and use SAML? Patch again.

CVE-2026-88779 is a separate bulletin, CTX697174 (CVSS 8.7), not part of CTX697096. It's the SAML attack crashing patched NetScalers since 2 Oct. @citrix sees targeted attacks.

Affected: "add authentication samlAction" or "samlIdPProfile" in ns.conf
Fixed: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, 13.1-37.282
Interim: Global Deny List (NetScaler Console) or Citrix Support's responder policy, -type AAA_REQUEST on every Gateway/AAA vserver

Free checker v1.12 covers both bulletins:
• CVE-2026-88779 on every run
• SAML policy coverage per vserver
• "may have run" window ends at the fix
• 98 IPs, 16 domains, 34 hashes

Thanks to @GothamTG , @BeazleySecurity , @Deyda84 , @citrixguyblog , @rjfaulknerjr @FerroqueSystems, @bishopfox , @watchtowrcyber and the community 🙏

#NetScaler #Citrix #CitrixNetScaler #NetScalerGateway #CVE202688779 #CVE202688771 #CTX697174 #CTX697096 #CyberSecurity #InfoSec #IncidentResponse #ThreatHunting

[Citrix @citrix]

We have a new security update: Understanding and addressing CVE-2026-88779 in Citrix NetScaler ADC and Citrix NetScaler Gateway: https://t.co/rgWKcHqP6F

[Julian Jakob @jakob_davidson]

If you don't want to run T-POP's fast growing Versionsof his IoC Script on all of your Instances, here's a bit of help, import two Jobs on your NSC / NSC-Service and pull the results globally. Hope this helps and save you guys some time.

#NetScalerCVE

https://t.co/0sWi6Xxjoc

[Citrix @citrix]

Please read our latest security update with guidance for NetScaler SAML authentication deployments: https://t.co/2WM8AHPNxc

[Marius Sandbu @msandbu]

#netscaler if you are using ICA Gateway with SAML https://t.co/Aj8giqSblM you better contact Citrix, not sure how critical it is...

[Thomas Poppelgaard @_POPPELGAARD]

New NetScaler zero-day hits PATCHED appliances via SAML. Citrix released a new responder policy today: get it from Citrix Support.

Checker v1.11: SAML status, attempts since 2 Oct flagged "may have run", 95 IPs. Ran v1.10? Run again.

https://t.co/fGlD4MZeiI

#NetScaler #

[PDQ @admarsenal]

More ways to troubleshoot. Fewer steps to get things done. Three updates just landed in PDQ:

🤖 Meet PDQ Assistant

💻 Live Shell

📁 File Explorer

Give them a try and tell us what saves you time!

#PDQ #ITSupport #ITleadership #sysadmin

[Zabbix Team @zabbix]

Zabbix 8.0 RC1 is out!

📊 APM + OpenTelemetry: traces, logs, metrics in one place
🔇 Complex event processing: less noise, faster root cause
🛠️ Ad-hoc maintenance
🌙 New dark blue theme

LTS is coming. Try the RC: https://t.co/vrQZKfCrLU

[Thomas Poppelgaard @_POPPELGAARD]

🛠️ NetScaler CTX697096 checker v1.9: every public IoC since v1.8 in one read-only command. nsmon Perl implant, Unit 42 .deb webshell, trace-wiping cron jobs, /tmp/watchTowr marker, 42 attacker IPs. Every attack tagged before/after your fix.

⚠️ The CVE-2026-88772 DTLS tool is public. Can't patch today? Block UDP/443 or disable DTLS. And enable Enhanced ISN: patching alone doesn't close CVE-2026-88778.

https://t.co/3SkzytB28X

Thanks @emilstahl (PitScaler), @Unit42_Intel , @AWNetworks , @watchtowrcyber , @elastic , @Deyda84 🙏

#NetScaler #CVE202688771 #CVE202688772 #CVE202688773 #CVE202688774 #CVE202688775 #CVE202688776 #CVE202688777 #CVE202688778 #Citrix

[Thomas Poppelgaard @_POPPELGAARD]

🚨 NetScaler CTX697096: checker v1.7 is out.
If v1.4–v1.6 told you "all attacks came after the fix", run v1.7 again. On a production box, older versions missed an exploit attempt from 1.5 h BEFORE the patch, hidden in a rotated log. v1.7 checks every line and puts [BEFORE fix] on top.
Attackers now go for config + keys: one payload tar'ed /flash/nsconfig into a fake .html for download. v1.7 flags it, whatever the name.
New: 17 attacker IPs, dropped files, persistence, "ARMED" payloads on unpatched boxes.
Citrix also updated the Console IoC scan on 29 Sep. Re-scan.
Thanks @GothamTG , @Deyda84 & Michael Shuster @FerroqueSystems 🙏
#NetScaler #CTX697096 #Security #IOC

[James Robinson | MVP @SkipToEndpoint]

#OpenIntuneBaseline Windows v4.0 is here! 🎉
Highlights include:

* Continuing to be the most agile and cutting-edge Intune baseline on the planet!
* A shake-up of Compliance policies, allowing true grace period granularity (and ditching the EAS Password policy because it's 🗑️)
* Edge settings for days! Simple support for the Edge Management Service and security hardening and user experience improvements.
* Updated M365 Apps Security baseline alignment.
* Fixed MS breaking the in-box app removal policy.
* Defender behaviour tweaks based on real customer feedback, not arbitrary check-boxes.
* Deprecated and obsolete settings sent to live on a farm.

As always:
✅ Take what you want
✅ Change what doesn't suit your environment
✅ Test it before yeeting to 40,000 endpoints on Friday afternoon
❌ Don't treat any security baseline as a magical compliance button

Check out the full release notes at: https://t.co/FS3CVjDVxz

Then, head on over to the OIB Deployer to deploy the new and updated policies, or check your current config vs 4.0 with the Settings Validator!
https://deploy[.]https://t.co/1quHU5axSU

And, uhh, keep an eye on Friday, too ;)

#OIB #Windows #EndpointSecurity #Community #Capybara

[Julian Jakob @jakob_davidson]

At the moment, public CA SSL/TLS-Certificates use a maximum Lifetime of 199 Days.

Until March 2029, it will be reduced to 47 Days.

Use Zero-Touch Certificate Management with Auto-Renewal, powered by NetScaler Console or NetScaler Console Service.

https://t.co/kS65IIjpD8

[EUCForumDE @eucforumde]

‼️ Save the Date ‼️

Am Donnerstag, den 22.10.2026 laden wir erneut im Rittersaal des Hoepfner Burghofs in Karlsruhe zu einer weiteren Ausgabe #EUCforumDE ein.

Jetzt Platz kostenfrei sichern über https://t.co/ipz7CVNMNg

Wir freuen uns auf Deine Anmeldung!

[Markus Zehnle @markuszehnle]

[QUICK POST] Check if Citrix Workspace Environment Management (WEM) is LAS activated

https://t.co/umX1gBvbBw

[James Robinson | MVP @SkipToEndpoint]

🚨#Windows #OIB v3.7 - 25H2 Edition is live!

Try out the OIB Deployer at https://t.co/stvZkT5PcY to get a neat view of new and updated policies and an easy way to get them imported!

Full change notes at https://t.co/mB9rbeGWep