The vulnerabilities that make the news are not the ones that fill a triage queue. The news covers the single dramatic CVE with a logo and a countdown. The queue at 03:00 on a Tuesday is a flat, undifferentiated feed:…

Most vulnerability queues we have seen are ordered, explicitly or by habit, on one number: the CVSS base score. Everything scored 9.0 and up goes to the top, the 7-to-9 band is the weekly work, and the rest waits. It…

When we walked through CitrixBleed 2 earlier this year, we treated it as one bug in one product. Step back and it is plainly not that. It is the latest entry in a lineage of memory-disclosure vulnerabilities in perimeter appliances…

Citrix NetScaler had another memory-disclosure bug in 2025, and the security community named it before Citrix finished describing it. CVE-2025-5777, which Kevin Beaumont tagged “CitrixBleed 2,” is a pre-authentication memory leak in NetScaler ADC and Gateway. Citrix rates it critical,…