My name is Rich and I talk about technology and other nerdy things. Husband, Father, Tech Guy, CCIE 49450. #CiscoChampion
United States
Joined January 2012
- Tweets1.6K
- Following503
- Followers360
- Likes3.1K
RichTechGuy retweeted
New sensitive breach: McKesson was targeted in a ShinyHunters extortion campaign last month. Allegedly sourced data was later published with 6.4M emails from marketing campaigns, patients, staff and others. 66% were already in @haveibeenpwned. More: haveibeenpwned.com/Breach/Mc…
RichTechGuy retweeted
‼️ Two Windows zero-days are being exploited in the wild.
Microsoft patched them alongside a record 974 vulnerabilities. Both flaws can let authorized attackers elevate privileges locally to SYSTEM, and CISA has added them to its KEV catalog.
Read: thehackernews.com/2026/09/mi…
RichTechGuy retweeted
🚨 A critical Cisco Nexus 9000 flaw lets unauthenticated remote attackers run code as root.
CVE-2026-20212 leaves TCP ports 43210 and 43211 reachable in the default Layer 3 VRF on 10 switch models.
Affected models, fixes, and mitigations: thehackernews.com/2026/09/cr…
RichTechGuy retweeted
‼️ Researcher Claims CrowdStrike Falcon 0-Day Privilege Escalation Vulnerability
Details: cybersecuritynews.com/crowds…
A security researcher known as Nightmare-Eclipse, who also goes by the names Chaotic Eclipse and MSNightmare, has released a project that claims to take advantage of a security flaw in the CrowdStrike Falcon Sensor.
This flaw allows for local privilege escalation, which means it could give unauthorized users higher access rights. The project, named FalconFlank, alleges that the issue abuses CrowdStrike’s remediation workflow for malicious Microsoft Office macros on Windows systems.
According to the repository’s README, the claimed flaw affects devices where the “Microsoft Office file malicious macro removal” capability is enabled.
#cybersecuritynews
ALT Researcher Claims CrowdStrike Falcon 0-Day Privilege Escalation Vulnerability
RichTechGuy retweeted
‼️ BREAKING: Nightmare-Eclipse just released another zeroday, this time a proof-of-concept called FalconFlank, which claims a local privilege-escalation flaw in CrowdStrike Falcon — abusing the sensor's own malicious-Office-macro remediation to reach SYSTEM on fully updated Windows 11 25H2 and Server 2025.
github.com/MSNightmare/Falco…
RichTechGuy retweeted
‼️ BREAKING: Dropbox says around 5,000 accounts were accessed without authorisation between 4 and 21 August, with files viewed or downloaded in fewer than a third of them.
Registering a Lenovo ID with someone else's email address was enough. Dropbox trusted Lenovo's verification and handed over a session.
Dropbox has terminated every Lenovo ID session and notified regulators.
RichTechGuy retweeted
Threat actors can take over the mailboxes of all Exchange users, read or send emails, and download all attachments, and the proof-of-concept code is already public. Shadowserver flags nearly 22,000 unpatched Microsoft Exchange instances, most of them in the US and Germany.
Full article: cnews.link/thousands-of-micr…
RichTechGuy retweeted
🛑 A BGP hijack delivered a malicious Virtualizor update that established persistent root access.
A valid certificate prevented connection warnings. One provider found 5 of 34 checked hypervisors compromised.
Virtualizor says check every server.
Read: thehackernews.com/2026/09/bg…
RichTechGuy retweeted
‼️ A malicious repo can run attacker code before some AI agents ask for trust.
Seven agents are affected, including Claude Code, Codex, and Cursor. The repo must arrive as files with .git intact; four were unpatched at publication.
Read how: thehackernews.com/2026/09/ma…
RichTechGuy retweeted
Since X seems to be awash with videos of hysterical women crying and smashing up their own homes, here's a puppy just enjoying life instead.
RichTechGuy retweeted
Attendees from DefCon hacked the inflight WiFi of a Delta Flight travelling from Las Vegas to Atlanta. Harmless fun, or a Serious legal violation?
RichTechGuy retweeted
Interesting and unexpected pairing with Cisco CPO @jpatel41 and head of client computing @jackhuynh. An on prem device to manage agentic policy, observability, model and agent security and security policy and enforcement. Ooh and tokenomics. Halo ready today and Cisco avail early fall. Smart. – at San Francisco, CA
RichTechGuy retweeted
🇺🇸 You can swap your IP address all day. The Windows installation underneath it still carries a dog tag.
That's the quiet lesson in the Peter Stokes case.
Stokes, a 19-year-old dual U.S.-Estonian citizen, is accused of belonging to the hacking crew Scattered Spider.
Prosecutors say his activity ran through a VPN proxy. The VPN did its one job, masking the network address, but it couldn't hide the machine doing the typing.
Microsoft records allegedly tied that activity to a GDID, a persistent device-level ID baked into a Windows installation.
It survives updates, and telemetry can link it to IP addresses and service activity over time.
Once investigators had it, the same fingerprint allegedly lined up with the VPN proxy, the victim's website, and accounts tied to Stokes across Snapchat, Facebook and Apple, plus travel records and timestamps.
The catch is bigger than one arrest.
A persistent identifier that nails a hacker works just as well on a journalist, a dissident, or an abuse victim.
Your VPN can be working perfectly while your computer keeps talking.
Sources: The Register, Tom's Hardware / Writer: Julie
RichTechGuy retweeted
Chrome version 150 and 151, scheduled for deployment in the next 4 weeks or so, will remove the last references to ManifestV2.
Google Chrome developers wrote it is being removed because it is old tech-debt and is littered with vulnerabilities. The real answer is much more nuanced and would result in a discussion on "privacy", speed, software optimization, and code management.
Removing ManifestV2, for the newer ManifestV3, is architecturally more difficult for ad-blockers to be effective.
This has resulted in ad-blockers stopping support for Chromium.
Of course, with the final removal of ManifestV2, a majority of Chromium browsers (meaning, a vast majority of web browsers) will drop support for ad-blockers likely including Edge and Opera.
RichTechGuy retweeted
> be Zuckerberg
> needs AI everywhere (apparently)
> lays off a bunch of employees
> replaces with AI
> fast forward
> AI is dog shit
> AI tricked into stealing accounts
> try to fix
> fail like 5 times
> product now leaking CEOs PII
AI truly is the future, wow
RichTechGuy retweeted
‼️🚨 BREAKING: A new npm supply-chain attack uses a dead-man's switch. The payload plants a watcher on your machine that nukes your home directory the second you revoke the GitHub token it stole from you.
The compromise happened today, across 42 official tanstack npm packages, 84 malicious versions in total. tanstack/react-router alone pulls more than 12 million weekly downloads.
The attacker forked TanStack's repository and pushed a single hidden commit. From there, they tricked TanStack's own release system into signing the malicious packages as if they were the real thing. To npm, and to anyone checking the cryptographic proof of origin (SLSA provenance), the poisoned versions looked 100% legitimate.
Maintainer Tanner Linsley confirmed the whole team had 2FA enabled. It didn't matter. This is the first documented npm worm in history that ships with a valid, signed certificate of authenticity, the same one defenders rely on to know a package wasn't tampered with.
RichTechGuy retweeted
UPS: “Your package is in your city, on a truck driven by Mike. It will arrive on your doorstep at 6:27 p.m. today.”
FedEx: “Your package is coming. You’ll get it when we get there.”
USPS: “What package?”
Amazon: “We are already inside your apartment. Check the bathroom.”
Facebook: “We know you were thinking about getting a toaster yesterday. Here are 20 ads for toaster ovens.”