Citrix forgot to tell you CVE-2025–6543 has been used as a zero day since May

Comments (1)

worik · 9h ago

> How? Calls are made to the Netscaler box to the endpoint /cgi/api/login, with a client supplied certificate. By sending hundreds of requests, you can overwrite chunks of memory in the hope of executing code.

> I would recommend, if logs exist, checking for web access requests to /cgi/api/login on your Netscaler devices. These will be large POST requests.

So hundreds of invalid certificates? Infeasibly large POST requests? Seems to me that this vulnerability depends on not having good defense in depth

"If logs exist"?! It blows my tiny little mind that keeping logs has gone out of fashion

Our industry is in deep long term shit. We have adopted awful practices because they are cheaper, and secure systems look the same as insecure systems, but cost more.

We can build reliable secure systems from unreliable fault prone parts, we know how, but nobody will let us

I am depressed

Ask HN: The government of my country blocked VPN access. What should I use?

Ask HN: What to learn for math for modeling?

Best up-to-date guides on Vibe Coding

Ask HN: What to do when you suspect your interview is with a state operative?

Staying up to date on the best AI dev workflow?

Ask HN: Why hasn't x86 caught up with Apple M series?

Ask HN: How much better can the LLMs become assuming no AGI

Ask HN: Services for Shutting Down a Startup?

Ask HN: Anyone working on bringing software back from US clouds?

Ask HN: How can I recover and run my old mobile game from the 2010s?

Ask HN: Where can I see a live octopus in Maine?

Ask HN: How to teach a 4 year old to code?

CompactifAI Inference API

Ask HN: Did modern AI's coding abilities make you lose interest in programming?

Anthropick.com Redirects to ChatGPT

Ask HN: What are the best Google alternatives in 2025?

Petition to stop Google from restricting sideloading and FOSS apps

Ask HN: GitHub Copilot down?

Ask HN: What to Do with Old iPads?

Ask HN: Best codebases to study to learn software design?

Units of Economics of LLMs. Reply to Ed Zitron's "AI Is a Money Trap"

Ask HN: Does sentience put stress on the brain?

Ask HN: Windows 11 Update Fail – Linux Distro Suggestions?

Ask HN: Is there a temp phone number like temp email?

Ask HN: How to Learn to Build Agentic AI Systems (Like Claude Code)

Out of curiosity: what kind of people use this "forum" (I mean Hacker News)?

Ask HN: Why are so many services rejecting Google Voice numbers for signups?

Ask HN: What measures are you taking to stop AI crawlers?

Ask HN: Is backlink trading still a problem worth solving?

Ask HN: What should I use to run React Native tests on a device?

Stop squashing your commits. You're squashing your AI too

Ask HN: Are AI filters becoming stricter than society itself?

Ask HN: Any experienced devs who use AI extensively in their work?

Ask HN: I just abandoned my PyCharm subscription, what should I use now?

Tell HN: any reasonably used DB will likely outlast the programs using it

Ask HN: How do you find early stage startups to join

Citrix forgot to tell you CVE-2025–6543 has been used as a zero day since May

Comments (1)