Started in Enterprise InfoSec. Now Automation & DevOps Security for @CyberArk. Gopher. (All views & opinions are my own.)
Tampa, FL
Joined February 2008
- Tweets9.4K
- Following882
- Followers728
- Likes13K
Joe Garcia retweeted
The bug is like a joke.
On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
Joe Garcia retweeted
To check if your Google Workspace has been compromised by the same tool that compromised Vercel:
1. Go to admin.google.com/ac/owl/list…
- This is Google Admin Console > Security > Access and Data Control > API Controls > Manage app access > Accessed Apps
2. Filter by ID = 110671459871-30f1spbu0hptbs6…
- This is the ID of the compromised OAuth app
If you see an app after filtering, you have potentially been compromised
Joe Garcia retweeted
We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin:
vercel.com/kb/bulletin/verce…
Joe Garcia retweeted
this is the MOST important 4 minutes you’ll watch on AI this year.
anthropic built a model so good at finding vulnerabilities they didn’t release it to the public.
>CLAUDE MYTHOS PREVIEW
it’s unreleased to the public and here’s what it did in a few weeks:
>found a 27-year-old vulnerability in OpenBSD
>caught a 16-year-old flaw in FFmpeg that automated tools missed after 5 million tests
>chained together multiple linux kernel exploits autonomously. no human steering.
AWS, google, microsoft, apple, nvidia, crowdstrike, JPMorgan. all got access.
Anthropic committed $100M in credits to let these companies hunt vulnerabilities in their own systems before attackers do.
>93.9% on SWE-bench verified. >77.8% on SWE-bench pro.
nothing else is comes remotely close. Anthropic just pulled away in this AI race…
Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.
It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
anthropic.com/glasswing
Joe Garcia retweeted
“This attack methodology, which abuses legitimate tools, sites, and services, is becoming increasingly common in supply chain attacks aimed at poisoning development environments or stealing credentials for malicious purposes,”
cyberdaily.au/security/12644…
Joe Garcia retweeted
If they can handcuff a U.S. Senator for asking a question, imagine what they will do to you.
Joe Garcia retweeted
From CyberArk’s @InfamousJoeG's session on Ansible’s single machine credential problem to meeting with customers and prospects, this year’s @RedHatSecurity Summit was amazing! Here are some highlights of our team at the show!
#IdentitySecurity #RedHatSummit #cybersecurity
Joe Garcia retweeted
Headed to #RedHatSummit on May 20th? Make sure to stop @InfamousJoeG's session and he'll show you how to solve Ansible's single machine credential problem.
Joe Garcia retweeted
"If AI is going to defend instead of endanger, identity must be the strongest link.” Former CISA Director Jen Easterly underscores the urgent need for robust identity security amid the rapid acceleration of AI at CyberArk IMPACT25.
#IdentitySecurity #CYBRIMPACT #cybersecurity
Joe Garcia retweeted
Any member of Congress who purchased stocks in the last 48 hours should probably disclose that now.
I’ve been hearing some interesting chatter on the floor.
Disclosure deadline is May 15th. We’re about to learn a few things.
It’s time to ban insider trading in Congress.
