My name is Rich and I talk about technology and other nerdy things. Husband, Father, Tech Guy, CCIE 49450. #CiscoChampion
United States
Joined January 2012
- Tweets1.6K
- Following503
- Followers360
- Likes3.1K
Pinned Tweet
A short clip from my IP subnetting video talking about how 16 million IP addresses were allocated.
See the full video here: youtu.be/7hIbzlxbebc
OpenCode Console: legacy-system breach may have exposed third-party AI API keys for ~1.4% of linked Console users. Revoke/rotate OpenAI, Anthropic, Google keys at the provider—not only in the tool—and audit usage.
thehackernews.com/2026/10/op…
#AIsecurity
Oct Windows Server security updates can break on-prem Exchange OWA/mail flow (Endpoint Mapper lookup limit under load). Not the Exchange CU itself—use Microsoft’s registry guidance; don’t yank Exchange security patches.
bleepingcomputer.com/news/mi…
ConnectWise Cloud Backup (ex-SkyKick) app identities were abused to sign into Microsoft 365 tenants as the trusted backup principal. Vendor disabled 7 app IDs and suspended the service; audit Entra service principals, role grants, and app secrets. bleepingcomputer.com/news/se… #cybersecurity #M365
Chrome 155.0.8059.84/.85 patches 10 issues including critical prerender UAF CVE-2026-110922. No exploitation reported for this set—still prioritize fleet update. cybersecuritynews.com/google…
Cisco confirms active exploit of SEG CVE-2026-76519 (CVSS 9.8): unauth attacker emails a crafted attachment → arbitrary file write and root commands when AMP file reputation is on and scanner tools are outdated. Second SEG root issue since September. Patch/update scanner tools now. bleepingcomputer.com/news/se…
Palo Alto patched PAN-OS CVE-2026-0322 (CVSS 8.6): authenticated RCE as root via management interface; limited live exploitation confirmed. Cloud NGFW/Prisma Access not affected. Lock down mgmt access to trusted IPs and patch ASAP. bleepingcomputer.com/news/se…
New ClickFix twist (“Adception”): Google ads route via legitimate Bing redirects to a fake Claude macOS installer; copy button swaps the real install command for malware. Ad/search trust as the cloak. bleepingcomputer.com/news/se…
Cisco: five critical NX-OS flaws on Nexus 3000/9000 can yield root RCE or reload DoS when NX-API/NGOAM/MPLS OAM is on. Internal find; no known exploitation yet. Patch or disable unused features. bleepingcomputer.com/news/se…
FBI/DOJ seized 7 domains for Flax Typhoon–linked MicroScan + FishHub (Integrity Tech). Joint advisory: scanning, spear-phish, SoftEther persistence, email theft vs CI and others. CISA KEV adds 5 CVEs (due Oct 11). bleepingcomputer.com/news/se…
Citrix: patch NetScaler ADC/Gateway now for CVE-2026-107406 (memory overflow → RCE/DoS) when SAML IdP/SP is configured. No confirmed exploitation yet; fixed builds listed. Edge appliances stay high-value. bleepingcomputer.com/news/se…
Active exploitation: stored XSS in Ninja Forms and WPC Product Bundles (WooCommerce) used to drop backdoors and rogue WordPress admins. Patch plugins and review admin accounts/persistence.
bleepingcomputer.com/news/se…
SonicWall SMA1000: max-severity pre-auth SSRF (CVE-2026-102255) in WorkPlace. Hotfixes out; vendor reports no exploitation yet. SMA1000 has been hit repeatedly in 2026—patch and shrink internet exposure on remote-access gateways.
bleepingcomputer.com/news/se…
FBI/USSS: FortiBleed remains active against exposed FortiGate/SSL VPN. ~86k credentials, admin lockouts, and ransomware affiliate handoff. Restrict internet management, reset creds, phishing-resistant MFA, review for rogue admin accounts.
thehackernews.com/2026/10/fb…
Learn about the recent changes to Cisco's Security Certifications and strategies for your certification success in this latest episode of Cisco Champions Radio. Thank you @CiscoChampion for having me on this podcast.
It’s Cybersecurity Month! 🛡️
Join our latest Cisco Champion Radio episode to learn how AI, Zero Trust, and fresh CCNP updates are bridging the industry’s biggest skills gaps.
Listen here: smarturl.it/S13E10
LibreOffice/OpenOffice: malicious spreadsheet can run remote Java via JDBC on open—no macro warning (CVE-2026-63277 / CVE-2026-59265). LO: update to 26.2.5 or 26.8.0. OpenOffice: disable Java until 4.1.17. Document-borne initial access still works. thehackernews.com/
ClickFix update from Microsoft: fake CAPTCHA lures + clipboard → Run dialog; payload pre-staged in browser cache to shorten the visible command. No legit CAPTCHA asks users to paste into Win+R. Hunt RunMRU, WScript/PS children, new scheduled tasks. gbhackers.com/microsoft-warn…
Microsoft confirmed unauthorized access to its official X account used to amplify a Clippy-themed crypto token. Account secured; posts removed. Reminder: treat unexpected brand posts as untrusted until verified via secondary channels.
bleepingcomputer.com/news/se…
Operation KillSwitch: LE seizes KillSec leak site/servers, arrests three (alleged admin ID’d as 16). ~500 successful data-extortion attacks under review. Ransomware infrastructure can still be dismantled with coordinated action.
bleepingcomputer.com/news/se…
FortiMail CVE-2026-104286 (CVSS 9.8): unauth path traversal → arbitrary file write, exploited in the wild. CISA KEV due Oct 4. Patches still upcoming for 7.4/7.6/8.0 — disable IBE or lock down mgmt access and hunt IoCs now.
bleepingcomputer.com/news/se…
CISA added CVE-2026-76504 (Cisco Catalyst SD-WAN Manager auth bypass, CVSS 9.8) to KEV after active exploitation. Unauth admin API via URI encoding; no workarounds. FCEB due Oct 3. Hunt encoded j_security_check + patch fixed trains now.
thehackernews.com/2026/10/ci…
