🛡️ Governed Defense, Powered by Offense. ⚡AI Teammates do the grunt work, so your team has the time for more important things.
Delaware, United States
Joined July 2025
- Tweets840
- Following9
- Followers159
- Likes50
Pinned Tweet
Security work keeps growing, but security teams don't.
We've spent years getting better at finding security problems. It's everything that happens after that where most teams are feeling the pressure.
Secure.com retweeted
As AI changes how financial firms are targeted, protecting capital means securing the people and approvals behind every transaction.
On 12 November, we're co-hosting a conversation in London with @Securedotcom, bringing together leaders across banking, fintech and Web3 to discuss what it takes to protect capital against the next generation of cyber threats.
Join us: luma.com/ZIGFinancexSecure.c…
Vulns this week, ranked by how hard they made us laugh:
1. Alpine: a really long password gets you in (under the right conditions)
2. Barracuda: the timezone field runs as root
3. MS Paint: has a network attack surface now
4. WordPress: updating is the dangerous part
5. Rails: ImageMagick, again
Anyway, go patch stuff
Us, realizing all of these could live on one page 👇
secure.com/cve?utm_source=x&…
Three HIPAA cloud myths that get teams fined:
1. A signed BAA makes you compliant
2. Cloud apps are exempt because no ePHI is on site
3. There’s an official HIPAA cloud certification
All three are wrong. Your data, user access, and evidence stay with you in every cloud model.
2,828 new CVEs were published this week, and 5 were added to CISA’s exploited list.
We built CVE Radar so you can see which ones those are at a glance, with every new CVE’s CVSS, KEV status, and EPSS score on one page, updated hourly:
secure.com/CVE?utm_source=x&…
What actually tells you what to patch first:
1. Is it on CISA KEV? Someone is exploiting it right now.
2. What’s the EPSS score? That’s how likely it is to be exploited soon.
3. Is it reachable in your environment?
Someone out there is paying $60 a month for “unlimited” AI.
The company whose keys got stolen is covering the rest
How LLMjacking works 👇
What’s the weirdest thing you’ve ever found exposed to the internet at work?
After this week, supermarket fridge controllers will be hard to beat.
A critical Linux kernel flaw (CVE-2026-98432, CVSS 9.8) can be triggered over plain TCP with no login, and installing the patch alone doesn’t close it.
Update your kernels, then reboot, starting with servers that take traffic straight from the internet or through an NLB TCP listener.
See which distributions have a fix today and how to confirm the patched kernel is the one actually running ↓
secure.com/blog/cybersecurit…
Attackers took $6.3bn from Binance in just 20 minutes. The biggest heist in crypto history, yet.
Our new article covers the gap most security programs leave between finding a weakness and proving it’s fixed.👇
The scariest line in every one of these azure/entra leak stories is never "they found a zero-day." It's "they used credentials that worked." Nobody had to break anything.
Most breaches don't start with a genius; they start with an unworked queue. That's the gap we are focusing on closing and what our teammates are built to close.
This is the part of the queue we actually built for. secure.com/risk-governance-t…
"Github is basically infrastructure at this point" is true and also the exact reason nobody has a fallback for it.
Not to be dramatic but the group behind the shell/philips thing is also tracked as "graceful spider" and "chubby scorpius" and honestly at this point threat intel naming conventions are just funnier than anything we could write.
Security math:
"We've never had an incident"
x
"We don't have logs that far back"
=
"We've never had an incident"
A patch sat in someone's backlog since June, doing absolutely nothing, and now it's a headline with Shell's name on it.
