Certainties in life: Death, taxes, and critical Citrix vulns under attack

Sunday NetScaler patch dump fixes trio of critical vulns and five more serious messes

CVE flood pushes Ubuntu onto weekly kernel release cycle 3 days ago

CVE flood pushes Ubuntu onto weekly kernel release cycle

Mythos has made 2026 patching hell. It might make 2027 a breeze 12 days ago

Mythos has made 2026 patching hell. It might make 2027 a breeze

The vulnpocalypse rains iBugs down on Apple with record-setting number of patches 12 days ago

The vulnpocalypse rains iBugs down on Apple with record-setting number of patches

Homeland security cybercops say patch TrueConf (Russia's Zoom) if you're using it August 21, 2026

Homeland security cybercops say patch TrueConf (Russia's Zoom) if you're using it

Why the 'patchpocalypse' demands immediate isolation July 29, 2026

Why the 'patchpocalypse' demands immediate isolation

Death and taxes are said to be the only certainties in life. Perhaps it’s time to add attackers targeting newly discovered critical flaws in Citrix’s NetScaler application delivery controller and gateway products to that grim list.

On Sunday, the company published a bulletin warning of eight CVEs, the worst of which – CVE-2026-88771 and CVE-2026-88772 – are rated critical with 9.5 CVSS scores.

CVE-2026-88771 allows remote code execution and can allow an unauthenticated attacker to execute arbitrary commands. CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service.

A thread contains an allegation that at least one Citrix channel partner knew of these flaws on Saturday and urged users to take their NetScalers offline - a day before Citrix's disclosure.

Citrix has observed that both vulnerabilities are already under attack.

That sad fact saw the United States’ Cybersecurity and Infrastructure Security Agency on Sunday issue an alert because it too “has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.”

“Because updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities,” the alert adds.

Those risk management efforts will also have to consider a third critical vulnerability, the 9.3-rated CVE-2026-88773, allows HTTP request smuggling – an attack technique that can bypass security controls installed on front-end servers.

Three of the bugs are 8.8-rated memory overflow bugs that can make NetScaler appliances unstable. Another 8.8-rated bug relates to TCP Initial Sequence Number prediction, and there’s also a 7.0-rated feature policy bypass due to improper HTTP URL-based expression usage.

Citrix’s post explains how to detect if your NetScaler needs a fix, and which patches to apply.

Thankfully, the company has already created OS refreshes that contain the fixes.

NetScaler is notoriously buggy. In March 2026, Citrix revealed critical vulns that were quickly attacked . The same thing happened in 2025 , twice , and also in 2023 .

Flaws in NetScaler appeared in the annual most-exploited bugs list published by the cybersecurity agencies of the Five Eyes alliance from 2020 to 2023.

Despite NetScaler’s long history of holes, some users choose not to patch the product. That’s fair enough, given that it’s not always easy to find a change window in which to install a patch. But it’s hard to explain given NetScaler is nearly always under attack, and security vendors’ increasing efforts to create compensating controls that make it possible to use flawed devices safely without patches. ®

Certainties in life: Death, taxes, and critical Citrix vulns under attack

Sunday NetScaler patch dump fixes trio of critical vulns and five more serious messes

Techie assumed boss knew what they were talking and killed Exchange by deleting data

Friday afternoon is not the time for snap decisions, but weekends are useful to cover your tracks

Huawei Cloud Rolls Out Enterprise AI Products Across the Board, Building an Open Agentic Cloud

PARTNER CONTENT: Huawei Cloud strengthens the silicon bedrock on the cloud

OpenAI pauses some training amid allegations its rogue agents behaved more badly than first thought

Amid allegations that agents may have gone off the rails thousands of times, China set up some kind of agentic incident hotline

Big AI's content problem: Take the work, keep the money

The more we learn how AI does business, the more unfair it looks

Amazon evaluating drone deliveries in Australia, Asia

PLUS: Singapore helps Meta find new form of scam; Nothing bets it can create Indian consumer tech giant; Bangkok floods, tech holds on

Astronomer watches Starlink satellites sinking to build a ‘planetary barometer’

Astronomer watches Starlink satellites sinking to build a ‘planetary barometer’

ShinyHunters claims FBI hack: 'This is NOT financially motivated'

ShinyHunters claims FBI hack: 'This is NOT financially motivated'

UPDAted Register reader hit with surprise bill after Microsoft portals disagreed

Register reader hit with surprise bill after Microsoft portals disagreed

Security firm finds naming AI agents after Seinfeld characters helps bots join the team

Security firm finds naming AI agents after Seinfeld characters helps bots join the team

DoJ: Uncle Sam bought forensics software from same Russian operation supplying FSB

DoJ: Uncle Sam bought forensics software from same Russian operation supplying FSB

Who, Me? Boss bought cheap 'printer' from a catalog and was left without a leg to stand on

Boss bought cheap 'printer' from a catalog and was left without a leg to stand on

OPINION Big AI's content problem: Take the work, keep the money The more we learn how AI does business, the more unfair it looks

Big AI's content problem: Take the work, keep the money

The more we learn how AI does business, the more unfair it looks

Google's TPUs to catch some rays in orbit week Part of Project Suncatcher, the proof of concept aims to see how well lightly modified compute fares in orbit

Google's TPUs to catch some rays in orbit week

Part of Project Suncatcher, the proof of concept aims to see how well lightly modified compute fares in orbit

Meta's new AI fidget is a ... Tamagotchi? We hope Zuck's Muse Charm doesn't die if you neglect it

Meta's new AI fidget is a ... Tamagotchi?

We hope Zuck's Muse Charm doesn't die if you neglect it

CVE flood pushes Ubuntu onto weekly kernel release cycle AI-assisted bug hunting is helping pile up vulnerabilities faster than defenders can patch them, so Canonical is picking up the pace

CVE flood pushes Ubuntu onto weekly kernel release cycle

AI-assisted bug hunting is helping pile up vulnerabilities faster than defenders can patch them, so Canonical is picking up the pace

Google to critical infra orgs: Our AI scanners won't be evil, promise Gemini 3.8 Flash Cyber and Wiz's Red Agent team up to protect hospitals, public transit, and tech

Google to critical infra orgs: Our AI scanners won't be evil, promise

Gemini 3.8 Flash Cyber and Wiz's Red Agent team up to protect hospitals, public transit, and tech

Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Russians are posing as Signal support to launch phishing attacks

PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack

PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Black Hat and DEF CON

DEF CON Franklin project enlists hackers to harden critical infrastructure

Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Security EQT buys majority in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

EQT buys majority in Swiss cybersecurity biz Acronis

Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career

Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight

On the plus side, infosec's a good bet for a long, stable career

KDE turns 30 and someone's brought an AI-native desktop proposal Akademy talk imagines Plasma assembling itself around a personal model of each user

KDE turns 30 and someone's brought an AI-native desktop proposal

Akademy talk imagines Plasma assembling itself around a personal model of each user

Shopify extends lifeline to Tailwind as vibe coding erodes web dev platform's bottom line Acquisition gives open source CSS framework 'a stable long-term '

Shopify extends lifeline to Tailwind as vibe coding erodes web dev platform's bottom line

Acquisition gives open source CSS framework 'a stable long-term '

Switzerland tests a FOSS escape route from Microsoft 365 Swiss Army sticks a knife in American cloud apps with its own FOSS push

Switzerland tests a FOSS escape route from Microsoft 365

Swiss Army sticks a knife in American cloud apps with its own FOSS push

Feel peak Windows was 7? You might like Kumander Linux Debian and Xfce – solid, sensible choices – with a pretty skin

Feel peak Windows was 7? You might like Kumander Linux

Debian and Xfce – solid, sensible choices – with a pretty skin

Canonical shuttering some of its legacy chat channels The Ubuntu Pastebin went in June, IRC gets demoted

Canonical shuttering some of its legacy chat channels

The Ubuntu Pastebin went in June, IRC gets demoted

Audacity audio-editing app no longer looks like it's from the early 2000s The FOSS tool for audio editing has a fresh coat of paint, and new features to boot

Audacity audio-editing app no longer looks like it's from the early 2000s

The FOSS tool for audio editing has a fresh coat of paint, and new features to boot