Citrix NetScaler Zero-Day: Three Weeks Without a Patch

No patch, no defense. That's how most teams think about zero-days.So what decided how far an AI agent got inside the Dutch Institute for Vulnerability Disclosure (DIVD)?It came in through two unknown flaws in the DIVD's ticketing system, leaving notes in its own code as it went. Some data got out. Then it hit walls, because the ticketing system had never been allowed to reach the rest of the network.Rob Maas, Field CTO at ON2IT, and Gabriel Reis, ON2IT SOC analyst and DIVD volunteer, go through the first three days, including why the DIVD went public before it had the full story.You can't patch what nobody knows about. You can decide today what your "boring" systems are allowed to reach.(00:00) - When the hackers got hacked (01:09) - What the DIVD does (02:11) - The first three days: contain, investigate, go public (05:08) - An AI agent in the ticketing system (06:46) - Two zero-days and why segmentation limited the damage (08:17) - Transparency as a defense (12:26) - What to do next Monday Key topics covered:Public breach disclosure: timing, legal pressure and credibilityAn AI-driven attack that left notes behind, and one defender's prompt-injection countermeasureLimiting how far a zero-day reaches with network segmentationAssume breach as both a technical and a communication principleMapping systems and transaction flows before an incident forces you toRelated ON2IT content & referenced resources:DIVD: https://www.divd.nl/DIVD, We got hacked, here's everything we know: https://www.divd.nl/hacked/DIVD CSIRT case DIVD-2026-00014: https://csirt.divd.nl/cases/DIVD-2026-00014/DIVD CSIRT case DIVD-2026-00015 (Zammad zero-days): https://csirt.divd.nl/cases/DIVD-2026-00015/CVE-2026-102489: https://www.cve.org/CVERecord?id=CVE-2026-102489CVE-2026-102490: https://www.cve.org/CVERecord?id=CVE-2026-102490ON2IT (Zero Trust as a Service): https://on2it.net/Threat Talks: https://threat-talks.com/AMS-IX: https://www.ams-ix.net/amsSubscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.🔔 Follow and Support our channel! 🔔► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...👕 Receive your Threat Talks T-shirt https://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Your board wants to know one thing: are we safer than last year? Alert counts can't answer that. Twice as many events can mean twice as many attacks, or a sensor that finally works. Lieuwe Jan Koning, Co-founder & CTO at ON2IT, asks Rob Maas, Field CTO at ON2IT, what to report instead: one score from one to five that shows whether the business is aligned behind Zero Trust and whether the controls are really in place. Black-and-white criteria, so nobody can polish the number before the board meeting.(00:00) - The one metric worth reporting to your board (00:50) - The worst metric in security: counting events (02:24) - Why minutes to detect is already too late (05:58) - Readiness and fitness: measuring Zero Trust properly (13:45) - Local heroes vs. all talk: why programs stall (20:32) - A score nobody can fudge: binary criteria and 32 controls (26:47) - Do you need level five? Why most organizations aim for three Key Topics Covered:What to report to the board instead of alert volume and mean time to detectWhy Zero Trust programs stall on alignment between the board, the CISO and IT, not on technologyHow to tell if your program depends on a few people who could leave tomorrowA one-to-five maturity score built on true-or-false criteria, based on CMMIWhich level your organization needs, and when aiming higher is worth the budgetRelated ON2IT Content & Referenced Resources: ON2IT (Zero Trust as a Service): https://on2it.net/ON2IT BLOG: https://on2it.net/blog/zero-trust-maturity-score/ Threat Talks website: https://threat-talks.com/MITRE ATT&CK framework: https://attack.mitre.org/Subscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.🔔 Follow and Support our channel! 🔔► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...👕 Receive your Threat Talks T-shirt https://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Citrix left customers exposed to two live zero-days for three and a half weeks. Rob Maas sits down with ON2IT CTI specialist Lars Nobelen to break down how attackers exploited CVE-2026-88771 and CVE-2026-88772 on Citrix NetScaler appliances, why a single log injection bug let them run arbitrary commands, and what actually stopped the attacks before the patch ever arrived.(00:00) - Cold open: three and a half weeks without a patch (00:19) - Meet CTI specialist Lars Nobelen (01:28) - Exploitation timeline: fingerprinting in August to the patch in September (03:09) - Two zero-days: how the log injection technique worked (05:02) - Gaining persistence with disguised web shells (09:10) - Why SSL inspection blocked the exploit before the patch existed (12:17) - Advice: rebuild, patch, and prepare for the next edge device Key Topics CoveredAnatomy of the two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) and the log injection technique behind themWhy exploitation outpaced the patch timeline by over three weeks, and what that gap cost defendersHow SSL/TLS inspection on the firewall blocked exploitation attempts before a patch was availableWhy Citrix's own indicator-of-compromise script could miss an active web shellLessons for any edge device: disabling unused features, network segmentation, and inbound decryptionRelated ON2IT Content & Referenced ResourcesThreat Talks – Citrix NetScaler: Does Remote Work (2024): https://threat-talks.com/citrix-netscaler-zero-day-three-weeks-without-a-patch/ CVE-2026-88771: https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.htmlCVE-2026-88772: https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.htmlWhy SSL Decryption Matters: https://www.youtube.com/watch?v=Xv_jVHVsD9w NCSC.nl advisory on Citrix NetScaler: https://advisories.ncsc.nl/2026/ncsc-2026-0394.htmlZ-CERT (Dutch healthcare sector) advisory: https://z-cert.nl/actueel/nieuws/z-cert-waarschuwt-zorgsector-voor-kritieke-citrix-kwetsbaarhedenSubscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast... 👕 Receive your Threat Talks T-shirt https://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Fifteen minutes after Lars Nobelen's iPhone was stolen at a scrapyard, it was already useless to the men holding it. An hour after that, police had all three of them in custody. Lieuwe Jan Koning talks with Lars Nobelen, ON2IT's Information Security Officer, and Robbert van der Linden, Site Reliability Engineer, about the mobile device management commands that turned a stolen phone into the evidence that caught its own thief.Key Topics CoveredHow mobile device management (MDM) locks and tracks a stolen iPhone through Apple's Lost ModeWhy police can act on a stationary phone location but not a moving oneThe distraction technique three thieves used to steal a phone in secondsZero-touch enrollment: how ON2IT devices join MDM automatically before an employee opens the boxThe MFA "chicken and egg" problem when your authenticator lives on the phone that just got stolenRelated ON2IT Content & Referenced Resources:ON2IT (Zero Trust as a Service): https://on2it.net/ Threat Talks website: https://threat-talks.com/ Episode code for a free Threat Talks T-shirt (email to [email protected]): 100125Subscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.🔔 Follow and Support our channel! 🔔► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...👕 Receive your Threat Talks T-shirt https://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

Do first you call the police when you're hacked, or a lawyer?In this episode of Threat Talks, host Lieuwe Jan Koning sits down with Stan Duijf, Head of Operations at the NIS (National Investigations Special Operations) of the Dutch National Police, to break down what actually happens after a data breach. Stan reveals that only 20% of the 150+ reported Dutch data breaches each year ever reach the police, and explains why that gap puts both companies and their customers at risk.They cover when a breach is serious enough to call the police, why paying a ransom never makes your data safe again, and what belongs in your incident response playbook before you ever need it.(00:00) - Cold open: when do you call the police after a hack (00:40) - Meet Stan Duijf, Head of Operations at the NIS (02:03) - The real scale of data breaches in the Netherlands (10:19) - Intrusion vs exfiltration: when the police actually opens a case (14:42) - Why informing victims late leaves them exposed to scams (20:39) - Should you ever pay the ransom (27:01) - Build your playbook: who to call before you're hacked 4. Key Topics CoveredWhen a data breach is serious enough to involve the Dutch police, and why company size is not the deciding factor.What early, confidential police involvement makes possible, from tracing stolen bitcoin to joining ransom negotiations.The three reasons the Dutch police advise never to pay a ransom.Why informing breach victims late exposes them to scams, and what to decide in your breach playbook in advance.How jurisdiction works for multinational breaches, and how private citizens should report sophisticated phishing.5. Related ON2IT Content & Referenced ResourcesThreat Talks – Previous episode with Stan Duijf on the NIS and high-tech crime: https://youtu.be/KL39OfLoDcYON2IT (Zero Trust as a Service): https://on2it.net/Threat Talks website: https://threat-talks.com/6. Subscribe blockSubscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast... 👕 Receive your Threat Talks T-shirt https://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

You report a breach. Does anyone ever get arrested?Stan Duijf, Head of Operations at the NIS, the Dutch National Police unit for national and international investigations, sits down with Lieuwe Jan Koning, Co-founder & CTO at ON2IT, to explain what actually happens on the other side of a cyberattack. One case can span 5 to 20 countries. Arrests are rare, so his team measures something else: how expensive they make crime to run. Takedowns, seized servers, 35 million euros in seized crypto, sanctions, and Operation Endgame, a campaign that hits the same criminal infrastructure twice a year. Arrests still happen, often the moment a suspect travels.You leave knowing why arrests are the wrong metric, what threat intel the police want from your security team, and how AI is speeding up both sides of the fight.Timestamps(00:00) - Who is really on the other side of a breach (01:07) - Why one cybercrime case spans 5 to 20 countries (04:23) - Inside Operation Endgame: the recurring takedown campaign (16:03) - The Dutch specialty: technical skill and the broad intervention strategy (17:07) - Takedowns, seized servers, and 35 million euros in crypto (24:10) - AI is making cybercrime faster, and investigations too (29:29) - What companies can do: sharing threat intel and joint takedowns Key Topics CoveredWhy a single cybercrime investigation spans 5 to 20 countries, and what that does to response timeOperation Endgame: a recurring, campaign-level takedown strategy against info stealers and botnetsThe broad intervention strategy: prevention, disruption, and repression, with arrests as one tool among manyHow crypto seizures work and why they matter more than the arrest countWhat threat intel the police want, and what integrated operations with companies like Microsoft, Palo Alto Networks, and Google look likeRelated ON2IT Content & Referenced ResourcesThreat Talks: https://threat-talks.com/ ON2IT Zero Trust MDR Prevent: https://on2it.net/ AMS-IX: https://www.ams-ix.net/ams Operation Endgame: https://www.operation-endgame.com/ Hack_Shield / Hack_Ride, Dutch police youth offender-prevention programs: https://www.politie.nl/nieuws/2026/maart/4/11-politie-en-hackshield-werken-aan-digitale-weerbaarheid-van-kinderen.htmlSubscribe blockSubscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.🔔 Follow and Support our channel! 🔔► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...👕 Receive your Threat Talks T-shirt https://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

A CISO got breached and could not say how. No entry point, no list of what walked out, nothing to take to the board. He paid the ransom blind. Then he bought MDR.The next time, he had all of it. Who clicked, which data was touched, when it left. He still got breached.So what did the M in MDR actually buy him?Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down at RSA Conference with Nicholai Piagentini, Technical Enablement Engineer at ON2IT and twenty years deep in the Bay Area security scene, to separate what MDR vendors pitch from what MDR delivers.Buyers think MDR is one product. It is five jobs: collect the logs, enrich them, put an experienced human in the loop, remediate, and keep it all retrievable. Most vendors do two of them well, and only inside their own stack. Three questions tell you which two. All three are in the episode, and in the description below.Timestamps(00:00) - The MDR reality check: expectation versus practice (01:33) - What buyers think they are buying (03:35) - Single pane of glass, and why nobody has one (06:40) - Why no vendor is paid to support a competitor's logs (07:42) - Log retention: when everything becomes hot storage (11:06) - Three questions to ask every MDR provider (13:20) - Data sovereignty: who operationally controls your logs (15:02) - The future of MDR, and why detection alone is cleanup (15:36) - The CISO who saw everything and still got breached The three questionsIn practice, what does your platform do with a log it did not create? Ask for the demo on a competitor's telemetry, not your own.Is there tiered storage, or does every log stay hot for the life of the contract?When I escalate, who picks up: someone who knows my environment, or someone reading an LLM's answer back to me?Key topics coveredWhat "managed" means to different MDR vendors, and why a human in the loop is rarely part of the dealWhy EDR, NDR, XDR and DDR all get reskinned as MDR, and what that does to scopeThe economics of vendor data lakes: every log priced as hot storage, with no tiering to warm or coldCommercial incentives that keep cross-vendor log support shallow, and how to test for it before you buyData sovereignty and jurisdiction as a procurement requirement, not a European footnoteRelated ON2IT Content & Referenced Resources:Threat Talks: https://threat-talks.com/ ON2IT Zero Trust as a Service: https://on2it.net/ AMS-IX: https://www.ams-ix.net/amsSubscribe blockSubscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques.🔔 Follow and Support our channel! 🔔► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast...👕 Receive your Threat Talks T-shirt https://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX

A group of teenagers walked into Microsoft, NVIDIA and Okta. No zero-days. No custom malware. No command and control infrastructure. They bought leaked credentials, or they called the service desk and asked for a password reset.Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with threat researcher Yuri Wit and Field CTO Rob Maas to take Lapsus$ apart step by step: bought credentials, MFA fatigue, over-permissioned accounts, and the extortion payday at the end.The uncomfortable part is not how clever the attack was. It is how basic it was. If your help desk resets passwords without proof of identity, if your MFA is a tap-to-approve prompt, if your users carry permissions from two jobs ago, Lapsus$ did not need to be good. They only needed to try.Yuri and Rob also cover what actually stops this: password resets that require physical identification, hardware tokens for sensitive Protect Surfaces, privileged access management with a human in the loop, and why AI is both the fastest way to audit your permissions and the fastest way to recreate the same over-permissioning problem all over again.Timestamps00:00:00 Hacking the largest companies on earth is super easy 00:01:19 Who Lapsus$ were, and why they are in jail 00:02:25 Step one: bought credentials and a phone call to the service desk 00:03:36 Password resets should be a hurdle, not a link 00:06:16 Not all MFA is equal: push fatigue, SMS and SIM swapping 00:09:03 Why your second factor does not belong in your password manager 00:11:09 Inside the network: privilege escalation, exfiltration, extortion 00:13:29 The fix: least privilege, PAM and a human in the loop 00:16:05 AI as auditor, and the agentic over-permissioning problemKey Topics CoveredHow Lapsus$ obtained initial access without a single novel technique: dark web credentials and social engineering of the help deskWhy MFA type matters more than MFA presence, and where push approval, SMS and TOTP each breakPrivilege escalation as the real bottleneck for attackers, and what least privilege plus PAM changesZero Trust Protect Surface thinking as the way to decide which control is appropriate for which dataThe AI double edge: faster permission audits on one side, over-permissioned agent service accounts on the other

Your Outlook account recovery will accept an authenticator code on its own. No password, no inbox, no phone number. Anyone holding that TOTP secret owns the account, and the second factor you bought to survive credential theft becomes the only thing in the way.Koen Kandelaars found one sitting in a PDF on a public help page at the NOS, the largest news organization in the Netherlands. He scanned a QR code out of an onboarding manual and had a real employee's second factor on his phone. Rob Maas, Field CTO at ON2IT, walks the full chain with the attacker himself: eleven vulnerabilities in the first responsible disclosure, a twelfth Koen estimates at 1 to 5 million euros, and the recovery flow nobody tested.Timestamps(00:00) - MFA was on. He got in anyway. (02:04) - Why the biggest news organization became the target (03:24) - Mapping the attack surface before touching anything (04:54) - Eleven findings in the first responsible disclosure (08:50) - The Media Cloud help page and the live TOTP QR code (11:19) - How the password reset removes your second factor (14:29) - The 1 to 5 million euro estimate, and what to fix Key Topics CoveredAttack surface discovery against a large public broadcasterResponsible disclosure done well: response time, remediation, and recognitionWhere the next generation of defenders comes from, and how they choose a sideRelated ON2IT Content & Referenced Resources:Threat Talks: https://threat-talks.com/ ON2IT (Zero Trust as a Service): https://on2it.net/ AMS-IX: https://www.ams-ix.net/ams

You already had the threat intel. The IP was on your blocklist, the file hash was known bad. So why did your MDR only raise an alert instead of blocking it? Lieuwe Jan Koning, Co-founder & CTO at ON2IT, and colleague Nicholai Piagentini, Technical Enablement Engineer at ON2IT, make the case for preemptive cybersecurity: the shift from detect-and-clean-up to block-first, and what it means for the future of MDR.Timestamps:(00:00) - Preemptive cybersecurity: what it means for MDR (00:59) - Why detect-and-clean-up is not enough (the leaking tap) (01:42) - You knew the threat: block first (03:34) - Fusing the SOC and operations teams (05:57) - Speed, seconds, and AI versus AI (08:15) - Data freedom and vendor lock-in (10:33) - Dynamic policy without breaking change control Key Topics Covered:Preemptive cybersecurity as the Gartner-flagged direction, and why MDR has to move past detect-and-respondTurning known indicators of compromise into automated blocks at the endpoint, network, and cloudCollapsing the SOC and operational teams so detection and enforcement act as oneSub-second response, AI-driven attacks, and why MTTD and MTTR need to convergeData freedom and data sovereignty, and avoiding vendor cloud lock-inRelated ON2IT Content & Referenced Resources:Threat Talks website: https://threat-talks.com/ ON2IT (Zero Trust as a Service): https://on2it.net/ AMS-IX: https://www.ams-ix.net/ams