Jerry 🦙💝🦙Microsoft must be hoping and praying for a new named critical and pervasive vulnerability to capture our attention
Bill@jerry They jealous of xz-utils?
08956495@jerry I can start creating minor tickets for bugs on the new teams and new outlook so they can ignore them and tell me its a feature before actually focusing on a vulnerability 🤷
@jerry teams was the real vulnerability all along
pH_@jerry i thought they would be busy trying to work into the findings remediations via subscriptions based on which tier the customer is upsold on. /s
Cat 🐈🥗 (D.Burch) 
@jerry Spicy Patch Tuesday confirmed?
Sass, David@jerry I am reading the report and my face look like this:
keen456
keen456@jerry Really unlucky from that standpoint that the xz backdoor news didn't stop on the same day or after the CSRB report...
MatDef@jerry Ivanti to their rescue: https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
Only an 8.2 max, but given that it's Ivanti “In certain conditions this may lead to execution of arbitrary code" probably means “anyone still running this thing”.