Blue team, incident response, threat intel, OSINT, forensics, malware, blue unicorns, beards, cigars and Muay Thai. Former Kickboxing champion. ΜΟΛΩΝ ΛΑΒΕ
UK
Joined May 2011
- Tweets1.4K
- Following2K
- Followers940
- Likes1.4K
Ste Watts (SecBoyUK) retweeted
The NCSC is urging UK organisations to promptly mitigate vulnerabilities affecting Citrix NetScaler ADC and Gateway, two of which are being actively exploited.
Read more⬇️
ncsc.gov.uk/news/exploitatio…
Ste Watts (SecBoyUK) retweeted
This is akin to daylight robbery. So you totally should do it. If you like tracking baddies and doing cyber intelligence etc.
Ste Watts (SecBoyUK) retweeted
ServiceNow discloses security incident exposing customer data
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Ste Watts (SecBoyUK) retweeted
⚠️ Critical Apache HTTP Server Flaw Exposes Millions of Servers to RCE Attacks
Source: cybersecuritynews.com/apache…
The Apache Software Foundation has released a critical security update for Apache HTTP Server, patching five vulnerabilities, including a dangerous double-free flaw capable of enabling Remote Code Execution (RCE) in version 2.4.67, released on May 4, 2026.
All users running version 2.4.66 or earlier are strongly urged to upgrade immediately. The most severe of the five vulnerabilities is CVE-2026-23918, rated High with a CVSS base score of 8.8.
The flaw is a double-free memory corruption bug triggered within Apache's HTTP/2 protocol implementation during an "early stream reset" sequence.
#cybersecuritynews #vulnerability
Ste Watts (SecBoyUK) retweeted
We’re finishing final tech editing and I’m currently fighting recto/verso page layouts for KDP. Very soon though!
.@joswr1ght just announced a 720-page modern incident response book. 18 months in the making. The first comprehensive update to foundational IR frameworks since 2001. Released to the community for free. “Someone asked me, ‘Do you like writing?’ I say, ‘No, I like having written.’ That’s a different thing altogether. But I wrote this book because I kept seeing the same problems over and over again.” This is what giving back looks like.
➡️ Details in the RSAC deep dive: go.sans.org/nTAdXo
@OneRSAC | #RSAC #Cybersecurtiy #ThreatIntel #IncidentResponse
Ste Watts (SecBoyUK) retweeted
A bunch of folks have asked for the #ClaudeForBlueTeam posts to live in one place, and I'm happy to oblige!
They're now live on: antonlovesdnb.com
Ste Watts (SecBoyUK) retweeted
Audit your Active Directory in minutes with ADPulse. This open-source tool runs 35 automated security checks via LDAP(S) to uncover critical misconfigurations.
meterpreter.org/beyond-the-p…
Ste Watts (SecBoyUK) retweeted
🔴BEWARE: Malicious skills on ClawHub are still live and *very* malicious.
For instance, this one, 'zaycv/clawhub', contains direct download instructions for external binaries in the introduction.
Some patterns we have noticed, monitoring the situation 👇
Ste Watts (SecBoyUK) retweeted
🥷Microsoft Incident Response Ninja Hub
This is a compilation of guides and resources that the Microsoft Incident Response team has developed on threat hunting, case studies, incident response guides, and more. 🫡
#cybersecurity #MicrosoftIRhub
techcommunity.microsoft.com/…
Ste Watts (SecBoyUK) retweeted
We got a new Ninja Training, now for MSEM (Microsoft Security Exposure Management). This is v1 and we will continue to grow and later add certificate of accomplishment, just like other Defender Ninja Trainings.
techcommunity.microsoft.com/…
Ste Watts (SecBoyUK) retweeted
HexStrike AI: The World's Most Advanced AI-Powered Penetration Testing Framework with Autonomous Agents, Intelligent Decision Engine, and 150+ Security Tools.
GitHub: github.com/0x4m4/hexstrike-a…
Ste Watts (SecBoyUK) retweeted
$5 Membership sale is live for the next 24 hours: account.shodan.io/billing/me…
Ste Watts (SecBoyUK) retweeted
🚀 The Phishing Triage Agent is officially in Public Preview! This autonomous Security Copilot agent handles reports of user-submitted phish—streamlining a repetitive task in the SOC. Learn more: msft.it/6013srbIW
Ste Watts (SecBoyUK) retweeted
This is what it takes to work in JUST Entra and Purview alone. LLMs cannot teach you this. Context matters.
What is Entra? 491 pages
learn.microsoft.com/en-us/en…
Entra Authentication: 1356 pages
learn.microsoft.com/pdf?url=…
Entra Application Management: 897 pages
learn.microsoft.com/pdf?url=…
Entra RBAC: 581 pages
learn.microsoft.com/pdf?url=…
Entra User Management: 623 pages
learn.microsoft.com/pdf?url=…
Entra Conditional Access: 424 pages
learn.microsoft.com/pdf?url=…
Entra Device Identity: 399 pages
learn.microsoft.com/pdf?url=…
Entra Hybrid Identity: 2546 pages
learn.microsoft.com/pdf?url=…
Entra Application Provisioning: 742 pages
learn.microsoft.com/pdf?url=…
Entra Application Proxy: 350 pages
learn.microsoft.com/pdf?url=…
Entra Managed Identities for Azure Resources: 210 pages
learn.microsoft.com/pdf?url=…
Application Integrations: 12741 pages - but a reference
learn.microsoft.com/en-us/en…
Entra Monitoring and Health: 438 Pages
learn.microsoft.com/pdf?url=…
Entra Multitenant: 214 pages
learn.microsoft.com/pdf?url=…
Entra Domain Services: 458 pages
learn.microsoft.com/pdf?url=…
it goes on and on and on...
Then you have a separate documentation repository for B2C, probably a few thousand more pages: learn.microsoft.com/en-us/az…
Microsoft Identity Platform: 2182 pages
learn.microsoft.com/pdf?url=…
Purview Documentation: 8876 pages
learn.microsoft.com/pdf?url=…
Ste Watts (SecBoyUK) retweeted
🚨 UPDATE: Full Post-Mortem On Cursor Security Incident
In yesterday’s thread I explained how I got drained after installing a malicious extension in @cursor_ai.
This is the deeper dive into what I found, what I did, and how you can avoid it.
🧵 👇
Ste Watts (SecBoyUK) retweeted
hashcat v7.0.0 released!
After nearly 3 years of development and over 900,000 lines of code changed, this is easily the largest release we have ever had.
Detailed writeup is available here: hashcat.net/forum/thread-133…
Ste Watts (SecBoyUK) retweeted
Update: Microsoft has released security updates that fully protect customers using all supported versions of SharePoint affected by CVE-2025-53770 and CVE-2025-53771.
Microsoft has released security updates that fully protect customers using all supported versions of SharePoint affected by CVE-2025-53770 and CVE-2025-53771. These vulnerabilities apply to on-premises SharePoint Servers only. Customers should apply these updates immediately to ensure they’re protected.
Full guidance and detection details are available in our blog: msft.it/6010sDzSE
Ste Watts (SecBoyUK) retweeted
🚨Today, the NCSC is revealing that Russian military intelligence has been responsible for deploying a sophisticated malware dubbed AUTHENTIC ANTICS as part of its operations.
ncsc.gov.uk/news/uk-call-out…
