I don't know what's xo-updater, maybe an external script, but it's not the upstream one from XOA or XO project.

And yes, there is some patches sometime (for xo-server, which is one package of Xen Orchestra).

For example, xo-server in 5.38.0 never landed in XOA, because we did some QA before and found some issues. We patched it, and then we've done some QA again, and then we decided to release Xen Orchestra 5.33. That's why you can have sometimes some surprises from the sources, because it's not officially tested (unlike in XOA)

Welcome @BenjiReis !

So:

The updates have been made available by Citrix on last wednesday We've published update candidates for testers on thursday Updates for XCP-ng 7.6 have been made available to everyone yesterday Updates for XCP-ng 7.5 have been made available to everyone this morning Blog post published: https://xcp-ng.org/blog/2019/03/12/xcp-ng-security-bulletin-vulnerabilities-pv-guests/

Luckily (or not) XenServer is a tiny part of Citrix strategy/revenue/business. So I'm not concerned by this hack.

Wow... it was like 10years that I was viewing the kung fu panda instead