Fellow human being | SANS Principal Instructor | Cybersecurity Consultant | Author | Speaker | Digital nomad
Earth
Joined April 2014
- Tweets1.1K
- Following1.1K
- Followers2.4K
- Likes5.9K
"so openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016.
accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters.
yes, any password. yes. i know. yes."
sshhole.com/
Bryce Galbraith retweeted
BREAKING: World's largest crypto exchange Binance hacked with over $5.6 billion stolen:
• $1.45 billion $BTC
• $875 million $ETH
• $234 million $TRX
• $50 million $XAUT
• $1.57 billion $USDT
• $823 million $USDC
• $75 million $WBETH
• $88.5 million $RLUSD
+ $447.5 million additional cryptocurrencies
This is the largest hack in crypto history.
Big new release of hashcat!
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashcat/b…
Download: hashcat.net/hashcat/
Bryce Galbraith retweeted
1/ EZ Tools 2026.10 is out, all on .NET 10 (LTS)
✅ More accurate: 331K more event log records, hive logs replayed as Windows does, every test hive loads
⚡ Faster: up to 9x; EvtxECmd and Registry 2x
📉 Less memory: up to 82% less
Update with Get-ZimmermanTools 🧵 #DFIR
Bryce Galbraith retweeted
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow
The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
⠀
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.
PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
⠀
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
⠀
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
Bryce Galbraith retweeted
arstechnica.com/security/202…
The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
Bryce Galbraith retweeted
HUGE news about the October release of EZTools is coming soon! You wont believe your eyes! #DFIR
Bryce Galbraith retweeted
🚨BREAKING: Pete Hegseth just announced an INTERNAL AUDIT of Bill Gates-founded company Microsoft's digital cloud system for being used by Chinese Nationals to hack the DoD systems.
Bryce Galbraith retweeted
Roadster xitter.gq/i/broadcasts/1yKAPwNgg…
There's a lot to unpack here but here's a helpful Venn diagram as you read this article...
"How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware.
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world."
citizenlab.ca/research/how-d…
Bryce Galbraith retweeted
Very big deal
We announced an agreement to acquire a nationwide low-band spectrum license portfolio that will pave the way for @Starlink to become a major mobile carrier in the US.
With this new spectrum and our Gen2 constellation, Starlink Mobile can ensure Americans have access to high-speed mobile broadband no matter where they are → spacex.com/updates#starlink-…
Great advice to protect your loved ones...
sans.org/blog/four-conversat…
@HeatherMahalik
Most of the breaches we hear about never should have happened. We know how they're getting in, we know how they escalate privileges and move laterally, and we know how to stop them.
If you're not sure how, come find out in Dallas...
See you there!
@SANSInstitute
