There is an article from a German IT news portal, that claims that the second attack, the SAML based one, was not only denial of service, but also an RCE. Do we know of this is true or a false claim? (PS I'm on vacation so I'm only following this from the sideline at the moment.) https://www.heise.de/news/Netscaler-Admins-aufgepasst-Zero-Day-verursacht-Crashes-und-Codeausfuehrung-11474971.html

It was RCE only if you didn't have the previous patch. If you did have the previous patch, it was just an engine crash.

I thought someone (Kevin Beaumont) said one of his patched honeypots had an exploit. Did he retract that?