Get threat intel for your whole team 👉 go.lowlevel.tv/flarecti

bash scripts running deep inside enterprise gear while paying thousands for security is a special kind of corporate comedy

My IT team was SHITTING bricks lol

I am old enough that I learned Perl when I was in school. One of the first things they taught us was backticks are dangerous and never put user data inside a command that's going out to a shell, ever! That's like day one learn to write perl. You don't need AI to see you're doing it the dumbest way possible.

"Shut. Down. Everything." meme IRL every time a CVE happens be getting old.

Once, while driving, a message appeared on my dash: 'ACHTUNG! PULL OVER AND STOP ENGINE IMMEDIATELY!"  I imagine the feeling I had reading that message is the same that anyone reading or getting an authenticaed Netscaler message would have: "yup, sounds good.  I'll ask questions and think it through later".  (In my driving case, water pump failure lead to an engine overheat condition)

Bash programmer here. This is why you quote your filenames. Spaces in the filename would have broken this.
Doublequotes would have fixed this.  I'm pretty sure 'shellcheck' would have dinged this.
Also, it's 2026, stop using backticks. smh

Citrix is malfunctioning. This is nothing new.

Command injection as root is definitely my preference.

Signed: Mythos

Hey! Just cause I'm in my 50s doesn't mean I automatically know Per....

Oh. Goddamit. Fine. I do.

my god. the lack of thought that has to happen to call out to grep from perl, a language with a robust regex system. (In fact, look at the diff, how they replaced a long command line, chaining grep to sed to awk, with a simple loop with a regex)

It almost is on the level of someone doing it on purpose to create an obscure vulnerability.

Turned 48 this year. I know perl. I feel called out.

I remember noticing that Citrix attempts to inject itself into every running process if you set it up the default way
Only noticed because app armor was complaining about it trying to inject into Firefox. It also broke MATLAB by injecting itself. Literal malware

7:24 I’m 63 and I moved on from Perl to Python decades ago. The idea that critical components in a security system are written in a punctuation driven write only language like Perl is frightening.

The nastiest part here is how many times the attacker-controlled input changes meaning before anything actually executes: login field -> log entry -> filename -> shell syntax. Each step can look harmless in isolation, but the whole chain quietly crosses from "data" into "code." That boundary is where so many security abstractions fall apart.

The very fact a Perl script is using commands like sed to do stuff that Perl itself is great for is a sign you have a Perl script written or  modified by someone who doesn't really know Perl.

There are no appliances.  Just obscure computing devices.

I saw that whole stack when it got banded around and seeing 771 was a true wtf moment, not because it input validation stuff in 2026 is ... or how it was actively being exploited in the wild, or that it allowed them to run effectively anything, not all that, but how that did not get a CVE-10, how could this be any worse?!

Ho lee fuk. That's an absolutely insane vulnerability in a security conscious bit of kit. I'm shocked it only got a 9.5...
It's the sort of exploit that was around pre 2000, I kinda assumed no-one was still shipping stuff like that. Mind blown.

" I'm not 48 so i dont know Perl " SHOTS FIRED!  🤣