WinRAR Sells a $150 Bag, Citrix Zero-Days Hit, 16-Year-Old Owns Microsoft Admin, MS Damage

WinRAR may have finally figured out how to get people to give them money, and it only took three decades. The answer wasn't licensing enforcement. It was a $150 messenger bag shaped like the WinRAR icon. Meanwhile, there are credible reports of two actively exploited Citrix NetScaler zero-days, a 16-year-old typed "admin" into a Microsoft analytics platform and got access to 17 trillion rows of data, and Microsoft's Weekly Damage Report is back with another seven days of broken things. This week, John and Logan cover four stories from the strange corners of cybersecurity, software economics, and ongoing Microsoft reliability. Stories in this episode: WinRAR finally gets paid. The company that has spent three decades politely asking people to pay for a software license apparently discovered the actual monetization strategy was always merchandise. WinRAR partnered with fashion brand Tern to release a $150 messenger bag shaped like the WinRAR icon. A single-user license costs about $29. People who refused to pay $29 for the software are apparently willing to pay five times that amount to physically walk around dressed as WinRAR. Citrix NetScaler zero-days hit. There are credible reports of two previously undisclosed remote code execution vulnerabilities in NetScaler ADC and Gateway appliances, and that they may already be under active exploitation. Security firm watchTowr says it has high confidence that multiple unpatched NetScaler RCE vulnerabilities are being exploited in the wild. Some administrators have reportedly been told to shut their NetScalers down, not patch them. 16-year-old owns Microsoft admin. A researcher named Faav found that Microsoft's internal Titan analytics platform validated JWT claims (tenant, audience, application ID, username) but did not actually verify the cryptographic signature. He created an unsigned JWT, changed the username field to "admin," and Titan mapped him to local user ID 1 with the Administrator role. That gave him SQL query access to analytics infrastructure containing an estimated 17 trillion rows across 17 ClickHouse databases, including Bing analytics. The bounty: $5,000. Microsoft's Weekly Damage Report. Office 2016 and 2019 perpetual licenses forgot they were paid for. Teams had a 49 minute connectivity incident. Teams Rooms calls dropped after 30 seconds on certain Poly Android devices. Word saved PDFs to SharePoint by quietly saving them to a local cache instead. Exchange Online could not reply or reply-all to Microsoft 365 Group messages. Copilot could not Copilot. And School Data Sync had a nearly five day education services outage. New episodes weekly. Follow Zero Downtime for cybersecurity, AI, privacy, and the tech stories that actually matter.