v17.43 - crashes, trusted list, share files; rules 2026-10-28e

Second release after v17.29. Script 17.43, rules stand 2026-10-28e.

Correction first. Rules stands 2026-10-23 and 2026-10-27 carried wrong fix builds for CTX697263 (PHP2Shell): 14.1-73.41 and 13.1-64.28, which belong to the SAML bulletin. Citrix published the real remediation versions on 2026-10-27: 14.1-73.49, 13.1-64.32, 14.1-FIPS 73.49, 13.1-FIPS/NDcPP 37.286. Appliances between 73.41 and 73.46 were reported as fixed although they are vulnerable. Replace the rules file; details in docs/releases/rules-2026-10-28.md. The rules format now has pending for “advisory out, no fixed build yet”, so this cannot repeat.

Since v17.29

• CTX697263 (PHP2Shell): build check, management portal ACL check, PHP memory and fatal patterns in admin_ui, Apache worker crashes.
• Crashes as events: Pitboss, kernel, Apache error log and /var/core (files and directories), one event per process and PID with signal, restart counter and core; every crash at least yellow, red for nsaaad on a SAML gateway twice a day, httpd on a vulnerable build, nsppe with DTLS errors, repetition within a day or across days, or a request from outside in the 120 seconds before. Verified on a lab appliance with real kill -SEGV; boot aftermath directories are INFO.
• No more self-hits: nsprofmon CPU snapshots are set aside; identical lines from ns.log and messages count once.
• Trusted list ns_quickcheck.trusted_ips with expiry: scanners and pentesters appear as [TRUST] without affecting the verdict; effect findings stay red.
• Anonymized address lists and a share file per run for a corroborated address feed (two independent appliances before publication).
• Whitelist with three rule forms and hash pins (--pin, --pin-all); directory rules no longer cover code and are not recommended.
• Anonymizer: report words and short accounts are never mapped; host names from config URLs and NT/DNS domains are.
• Report footer, vuln_open, trusted_seen, crashes in the result line; release notes per version under docs/releases/.

Assets
ns_quickcheck.sh SHA-256 15bcf2ef7ba1916b8fc33d8868b7cf4999cf014dd02425f929920fce954db0be,
ns_quickcheck.rules SHA-256 b8ea6f58168ed41f00829c527790aa22ae5358ccded5ffdfd8dc06542a8c5e4d.

Validated on 14.1-73.41, 73.46 and 73.49 (lab and customer gateways); 13.1 and FIPS remain beta. Output language is German, documentation in both languages.

v17.29 - netscaler-quickcheck 17.29, rules 2026-10-22b Latest

First public release of netscaler-quickcheck: security triage for NetScaler ADC and Gateway, run on the appliance, one verdict (OK, UPDATE, INVESTIGATE, FORENSICS_FIRST).

Script 17.29. Build against CTX697096, CTX697174 and CTX697191 with per-CVE conditions; attack traces from syslog, access, error and auth logs (injection with source and download host, dropper requests, webshell probing, management and SSH access); gateway account attacks (password spraying, brute force, sleepers, hits after a failure series); compromise quick check; block list, whitelist and custom rules that survive updates; anonymized reports and address lists; coverage in the result line.

Rules 2026-10-22b. Every indicator traced to its original publisher. Includes the FIPS rows for CVE-2026-88772 and CVE-2026-88778 and the Zscaler ThreatLabz findings of 2026-10-16 (payload path, download server, Nx_7508 webshell files, 27 source addresses). Changelog with SHA-256 per stand in ns_quickcheck.rules.changelog.md.

Validated on NetScaler 14.1 (73.41, 73.46). 13.1 and FIPS: beta, expect yellow findings in block 5 on the first run. Output language is German; field names and verdicts are language-neutral (docs/report-format.md).

Assets
ns_quickcheck.sh SHA-256 033a3802f0dab55702164580e7175e31e3d1491b5a021ab71210707fd80b40df
ns_quickcheck.rules 0ab860a7ca2269d26148ea29960669eddff20b63e552f1efdd8fddf925dcde48

Install: ns_quickcheck_README.md section 1 (German), workflow for new bulletins: WORKFLOW.md. OK means no known pattern matched, not that the appliance is clean; run the vendor’s IoC scan as a second opinion if the appliance was exposed before the fix.