Citrix Patches Critical NetScaler Authentication Bypass Flaw Affecting Gateway Appliances

·1 views

Citrix published two vulnerabilities in its NetScaler ADC and NetScaler Gateway products on 19 August 2026. The critical flaw, CVE-2026-19490, is an authentication bypass that could let an unauthenticated attacker reach the internal network when the appliance runs in Gateway or AAA roles. A second, high-severity flaw, CVE-2026-19489, is a buffer overrun that can cause unpredictable behaviour or denial of service where SIP ALG is enabled for LSN. Norway's National Security Authority reported no known active exploitation yet but expected it soon and urged prompt updates. Citrix has offered no workaround, so applying the security update is the only fix, and administrators are advised to prioritise gateway and AAA devices.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Duplicate Password Reset Emails Traced to Retry Logic in Account Recovery Flows

A developer guide examines how retries in password reset email delivery can produce duplicate reset links in gaming account recovery. It recommends keeping one active reset token per user and request window, and treating token issuance separately from message delivery. Suppression checks should run before each send, with the same idempotency key reused on transport retries. Because the email API offers no webhook stream, the author advises polling delivery events and joining them to internal request IDs to build an audit trail. The piece also argues that retry workers should stop on hard bounces or complaints rather than resend indefinitely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tripo 3D Print Review 2026: Inward-Facing Normals Found on a 2M-Face Mesh

A hands-on test compared Tripo and SupaVoxel by generating 3D models from the same single product photo of a watch stand and analyzing the exported GLB files. Both meshes were watertight with no boundary or non-manifold edges, but Tripo's mesh had inconsistent face winding, so some faces point inward and require a manual repair before printing. Tripo produced cleaner triangles with far fewer sliver faces, while SupaVoxel's files were smaller and cheaper to generate. The author concluded that SupaVoxel suits quick print-ready output, whereas Tripo's cleaner geometry may be worth its higher credit cost for detailed editing in Blender.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tips for Choosing a Memorable Mascot for a Small Software Project

A mascot can give a small software project a recognizable face without needing a full brand system. The article advises keeping shapes simple so the design reads clearly even as a tiny favicon or avatar. It suggests matching expression and color to the project's tone, using one main color plus an accent, and checking visibility on both light and dark backgrounds. It also recommends picking one detail that hints at the project's purpose, confirming commercial-use rights for whatever tool or artist is used, and noting where the design came from.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tool lets AI agents drive your already-logged-in Chrome profile via a cloned session

Browser automation tools used by agents typically start from an empty profile, so they often hit login screens even when the user is already signed in elsewhere. The open-source browser-automate skill for Claude Code and Cursor works around this by copying one Chrome profile's cookies and preferences into a temporary folder and launching a second Chrome on that copy with a DevTools port for Playwright to connect to. Because the clone runs on the same Mac and macOS user, Chrome can decrypt the cookies with its existing Keychain key, letting the copy open already signed in while the everyday window stays open. The skill requires macOS, Google Chrome, Node 18 or newer, Python 3, and the Playwright npm package, and it deletes the temporary copy after each run because it holds live session cookies. The clone is not uploaded anywhere and only functions on the same Mac and user account.

0 comments Read more at DEV Community