Sam

One bad update took down millions of devices. ISO 27001 says to keep dev, test and production separate and to control changes. CrowdStrike is a good reminder of why. #ISO27001 #CyberSecurity

If your company was hit by ransomware tomorrow, would you pay? and who would make the call on paying?

Google just dismantled a 1.3m-device Android TV botnet. The OEM (Videostrong) allegedly baked the backdoor into the firmware and sold access. If you didn't sign the image, you never really owned the box. Cheap kit isn't cheap

Claude wrote a remote-root PoC for CVE-2026-98432 (Linux TCP, CVSS 9.8) in ~53 mins on MPTCP listeners. Your patch SLA now races a model, not a bored researcher. Ship updates; scanners can wait

A backup you’ve never tested is a hope, not a backup 😆

Same week: a fake Claude Code extension planted SSH keys on up to 5,000 dev machines, and Binance reportedly lost $6.3bn from one engineer's laptop. Dev laptops have prod access and hobby controls.

October in cyber, TL;DR: • Binance: ~$6.3bn stolen, traced to one DevOps laptop • PHP2Shell: ~33m PHP services exposed • Denmark: 8.8m national ID records exposed • Burger King Japan: 11m customer records It's been a rough month

Check your LinkedIn privacy settings today -> Attackers build org charts from it before they ever send a phishing email.

A modern example of how little code a #malware downloader needs: check for internet, grab a file over FTP, run it, wait for it to finish. Don't get hacked, I guess?

A further 400,000 PHP web servers have been patched since last night, good to see

What’s worse, php2shell or log4j?

New tool from Censys (PHP2Shell services) It confirms that 33 MILLION web servers are still vulnerable to PHP2Shell, this is crazy. php2shell.censys.com/

OpenAI have created a Codex skill to check if a website is vulnerable to php2shell github.com/openai/php2shell-…

Over 100k+ PHP servers are still exposed and vulnerable to PHP2shell. The total results only show servers running PHP 8.1, there are hundreds of thousands more vulnerable. shodan.io/search?query=%22X-…

Tool of the day: Wireshark 🦈 See exactly what's travelling across a network, packet by packet. Great for: 🔍 Learning how protocols work 🕵️ Network forensics & CTFs 🛠️ Troubleshooting Free & open source. Favourite Wireshark filter? 👇

Most organisations won't implement security controls until something goes wrong. Don't be like them, and stay proactive.

SMS codes are better than nothing. Authenticator apps are better than SMS. Hardware keys are better than both. Use the best one your account supports and move on.

Want to get into cybersecurity but don't know where to start? Here's a free toolkit to go from zero to hands-on 👇 📂 CYBERSECURITY STARTER KIT ┃ ┣ 📂 01 — Practical Learning ┃ ┣ 📂 TryHackMe ┃ ┣ 📂 HackTheBox ┃ ┗ 📂 PicoCTF Practice ┃ ┣ 📂 02 — Core Tools ┃ ┣ 📂 Kali Linux ┃ ┣ 📂 ParrotOS ┃ ┣ 📂 Nmap ┃ ┣ 📂 Dirbuster ┃ ┣ 📂 Hashcat ┃ ┗ 📂 Google Hacking Database ┃ ┣ 📂 03 — Digital Forensics ┃ ┣ 📂 Autopsy ┃ ┣ 📂 CyberChef ┃ ┣ 📂 Registry Explorer ┃ ┗ 📂 Wireshark ┃ ┗ 📂 04 — Reverse Engineering ┣ 📂 IDA Free ┗ 📂 Ghidra 🔖 Save this for later 🔁 Repost to help someone starting out 💬 What tool would you add? #CyberSecurity #InfoSec #CTF #EthicalHacking #TryHackMe

“password123!” passes most complexity rules and is still a terrible password. Length beats symbols. Four random words will outlast Tr0ub4dor&3.