Senior Security Consultant @TrustedSec | Military grade meme poster, researcher, cloud penetration tester, voider of warranties. My thoughts are my own.
In someone’s cloud
Joined April 2009
- Tweets19.6K
- Following1.3K
- Followers27K
- Likes22.1K
Pinned Tweet
Just wanted to remind everyone. Azure Cloud training does not need to be super expensive. You just need to know where to look. Because that is what hackers do.
#Azure #Cloud #Hacking
Books:
amazon.com/Penetration-Testi…
Labs:
github.com/iknowjason/Awesom…
Free SANS Courses (on demand):
sans.org/webcasts/sans-works…
sans.org/webcasts/sans-works…
(Jun8th 2023..live!)
sans.org/webcasts/hands-on-w…
Need more training. Feel Free to check out my blog on this topic:
rootsecdev.medium.com/becomi…
Hello my cloud hacker friends.. I've updated Microburst Secrets hunter with some more fun regex stuff. Detections on secrets now are insane when scanning a microburst output folder. Don't run Microburst and manually hunt for secrets. Hack Smart. Hack efficiently. Enjoy! #TrustedSec
github.com/rootsecdev/Microb…
rootsecdev retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
rootsecdev retweeted
‼️BREAKING: Cloudflare says it is already seeing early attacks on the two leaked PHP flaws, hours before the patch.
Its CTO Dane Knecht says WAF rules for the known exploit vectors are live for all customers, including free plans, but calls them "a STOPGAP only".
Websites are going dark while they wait. NotuBiz, used by 100+ Dutch local governments, pulled council information sites offline, including those of Den Bosch, Breda and Eindhoven.
explain xkcd and the Star Citizen Wiki are down too.
PHP ships the fix at 14:00 UTC today.
‼️ BREAKING: Two leaked remote code execution flaws in PHP are real, watchTowr confirms.
PHP will ship fixes for two critical flaws, both rated CVSS 9.2, on Wednesday 21 October at 14:00 UTC, a day before the embargo was due to lift.
CVE-2026-109618 and CVE-2026-109619 first surfaced in a Hacker News post whose author admitted having no evidence beyond "source: trust me, bro".
Kevin Beaumont flagged the leak, and watchTowr confirmed it two hours later.
PHP says it may release sooner if details go public or exploitation appears. It has not named the CVEs or the affected versions.
Hey everyone, its only tuesday. So its not like we are all reading this on a friday evening. So atleast defenders have that going for them this week.
We live in wild times.
thehackernews.com/2026/10/ex…
rootsecdev retweeted
RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick).
We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵
Did three separate shots at the local clinic office yesterday. Flu, Covid, and pneumonia shots. So tired today. Someone bring me caffeine…STAT
Got up early to work on a few things. Had a shell up on one of my AI agents.
Me: oh hey wait I remember that I needed to do something.
👀
Keep climbing for those deficits. Getting leaned out. Will report back by the end of the month to keep me honest 👌
Time to go lifting 😎
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
unit42.paloaltonetworks.com/…
Nicely done over there @ItsReallyNick
therecord.media/microsoft-ta…
🚨 #BREAKING: Microsoft executive attacks AI training as the "largest theft of labor in human history."