In a real sense, OSS is one of the most democratic things humanity has ever done, while also collectively representing far and away the most complex thing it has ever created. That’s actually kind of incredible. The optimism my coworker feels is not about OSS specifically, much less its present state or economics, but about what its existence tells us about Humanity.

I find that to be a remarkable thought.

Update on the situation at The Hague and the shutdown of the Dutch Public Prosecution Service internet access, NCSC Netherlands issued an update today saying all orgs should hunt for CitrixBleed 2 activity, citing my blog.

They also advise clearing all session types, not just the ones Citrix say in their security advisory.

https://advisories.ncsc.nl/advisory?id=NCSC-2025-0196

CitrixBleed 2 update.

- Citrix have finally, quietly admitted exploitation in the wild -- by not commenting to press and then editing an old blog post and not mentioning it on their security update page.

- Orgs have been under attack from threat actors in Russia and China since June

- It's now under spray and pray, wide exploitation attempts.

https://doublepulsar.com/citrixbleed-2-situation-update-everybody-already-got-owned-503c6d06da9f

First exploitation details for CVE-2025-5777 - the Netscaler vuln - are out. https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/

If you call the login page, it leaks memory in the response 🤣

I don’t want to specify too much extra technical info on this yet - but if you keep leaking the memory via requests, there’s a way to reestablish existing ICA sessions from the leaked memory.