Has anyone seen any other indication then DoS ( re...
# citrix-netscalerm
Marius Sandbu
10/03/2026, 12:23 PMHas anyone seen any other indication then DoS ( restart ? ) so much wierd stuff being posted on other social media channels and security vendors spamming with their own IoC and trying to sell products that is rotting my brain.
c
c4rm0
10/03/2026, 12:55 PM@Thomas Poppelgaard's IOC scanner is amazing i have seen these in /var/tmp. I patched on sunday (Few mins after CTX article/Firmware released ) and all IOC scans through netscaler console using the various versions were showing as not compromised. Using SAML so have been hit by the nsaaad restart issue but latest responder policy seems to have stopped the reboots
m
Marius Sandbu
10/03/2026, 1:39 PMthese are from 24, so nothing new the last 24 hours?
d
Devin McCubbins
10/03/2026, 1:58 PMJohn, are you getting hits on your responder policies? No rush I'm just curious.
Devin McCubbins
10/03/2026, 2:00 PMNot seeing anything other than the reboots here effectively.
Devin McCubbins
10/03/2026, 2:00 PM(no reboots recently though)
c
c4rm0
10/03/2026, 2:02 PMyeah seeing hits on the responder policy
d
Devin McCubbins
10/03/2026, 2:02 PMTyvm
Devin McCubbins
10/03/2026, 2:03 PMWe're blocking the ips at firewall so I'm not... Thanks for sharing
t
Thomas Poppelgaard
10/03/2026, 2:06 PMJohn is that MPX
c
c4rm0
10/03/2026, 2:06 PMyeah mpx 5905