Threat Intel
I’ll probably update this later, but I wanted to at least show people some research I’ve been doing recently (with some support from some wonderful people in the cyber security community!)
Here’s a quick PDF! I’ll do an interactive HTML version next, but duty calls!
Read more “Remote Desktop Protocol + NLA Honeypots”
Leadership
‘On July 21, OpenAI disclosed that several of their models had broken out of an isolated test environment by exploiting a previously unknown (“zero-day”) vulnerability.’
But wait, it appears if one AI LAB having terrible security practices isn’t enough, we have another one now saying, after the Open AI incident, they have actually reviewed their logs, and they are terrible at security too!
Read more “Anything you can do, we can do worse!”
Microsoft 365
M365 is the most common cloud based business identity platform (be that native or hybrid mode) and so defending this is a key element to business digital security (it’s clearly not the only thing though…. security is a very broad domain!), so I thought I would take a look at incident commonality and controls.
Read more “Identity Incidents and how to prevent them!”
AI
Imagine building what you describe as the most powerful AI enabled cyber tool…. and then showing the world that you put it in a lab where a single box compromise led to it having unrestricted and unmonitored internet access… that would be awkward would it not? Here’s an LLMs take on this…
Read more “If it’s so powerful, it’s a shame you didn’t use it for defense design”
Research
What better way to test than to eat ones own dogfood right! This site runs WordPress, it is fronted by Cloudflare, has wordfence and has automatic patching enabled (the default) in WordPress. So what better example to show that we can use an LLM + LLM created scripts to conduct assurance activities. This is mixing deterministic and non deterministic technologies to test and then assess.
Read more “Using an LLM for assurance (WP2SHELL)”
AI
We are already watching the fear, uncertainty and doubt industry spin up around AI. It follows a pattern anyone who has sat through a vendor pitch will recognise: take a real, narrow signal, strip out the caveats, and inflate it until it fills a keynote slide or a board paper. The problem is not that AI carries no risk. It carries plenty. The problem is that the loudest claims are almost always the least accurate, and the people making them usually have something to sell — a model, a defence against one, or a regulatory moat.
So let’s take the three narratives I keep hearing, put them next to the evidence, and separate the kernel of truth from the theatre.
Read more “AI: Fear it, so I can sell you the cure!”
Threat Intel
You might see, BREAKING NEWS, RUSSIAN Hackers steal SIGNAL BACKUP KEYS, or other such styled headlines. Wow this sounds super interesting right! Magical hackers are stealing keys form the SECURE messaging platform! oh MY! but wait…. maybe, maybe there’s some devil in the details!
Read more “If you ask people, often they just do things!”
AI
I’m in a bit of a rush with this one but the TLDR; the USA senate was told:
“On June 11th Mark Warner, the vice-chair of the Senate Intelligence Committee, said that General Joshua Rudd, who leads the National Security Agency and the Pentagon’s Cyber Command, had told him that Mythos “broke into almost all of our classified systems, not in weeks, but in hours”
This isn’t really great… and you will hopefully see why!
Read more “Mythos, isn’t magic!”
Threat Intel
There’s a lot of data in the world, and we typically never get to see every bit of it, so I thought I would share some different views from different people on this. Great work from Kevin as normal here:
Read more “Fortibleed continued…”
Threat Intel
We can see from Defused honeypots and conducting a triage that CVE-2026-34910 (updated as I had the wrong CVE number, wrong as in this packet does show a traversal but is the using command exec) is being exploited in the wild!
Read more “CVE-2026-34910 Exploitation ITW – building a botnet (MIRAI)”