Operations | Monitoring | ITSM | DevOps | Cloud

Citrix was facing a major security crisis before its official warning even went out. Companies were already pulling critical network devices offline as attackers exploited serious vulnerabilities in Citrix NetScaler ADC and Gateway systems. In this ShipTalk clip, Adam, Martin, and Starr break down the Citrix zero-day vulnerabilities, the race to respond, and the impossible decision facing security teams: keep potentially compromised infrastructure running or rush to deploy a patch.

Dog-walk thoughts on vulnerabilities at scale More CVEs are being found, disclosed and weaponised faster than ever. For a small team with one product, that's manageable: a CVE lands, you fix it. But if you're running thousands of applications across tens of thousands of repos, "the teams will handle it" stops working. It becomes a governance problem.

Microsoft finally patched a critical Copilot vulnerability nearly eight months after researchers first disclosed it — and the way the attack worked raises some unsettling questions about AI memory. The vulnerability chained together multiple flaws that could allow a malicious prompt hidden inside a webpage to be pulled into Copilot simply by asking it to summarize the page. From there, the attack could potentially access connected data from services like Gmail, Google Drive, and Google Calendar and exfiltrate that information using Copilot’s own capabilities. But the most concerning part may have been persistence.