A brief history of the #PHP2Shell embargo: Tuesday afternoon: CVE IDs leak, with the wrong CVSS score for flavor. Tuesday night: an exploit demo video gets posted by accident. Wednesday morning: patched images ship 6+ hours before the coordinated release. Somewhere a disclosure coordinator is lying face down on the floor. Plan for patch windows the length of a lunch break.

TIL: Rotating every credential on your BeyondTrust appliance before evicting the attackers actually gives them a fresh set too. Remote Support CVE-2026-102764 has been exploited since August. Rebuild first, then rotate.

Metabase’s "reset password" feature turned out to double as "become admin." It even worked on Metabase’s own cloud. CVE-2026-72898 is on KEV and the PoC is public, so maybe patch before lunch.

There’s no workaround for CVE-2026-102255. Your options are 12.4.3-03670, 12.5.0-03082, or hoping. Full story on the blog: f.mtr.cool/o9danyhat4  #SonicWall

Turns out the fastest way to attach a screenshot to a pull request is to publish it to the whole internet. Glow found 13,000+ internal images from 300+ orgs posted this way.

There are currently two different Windows 11 black-screen bugs going around on AVD hosts, from the same update cycle. Microsoft already fixed one of them. The one that's still open, they fixed by turning off the thing that broke it, not by fixing the thing that broke it. That's not a knock, that's just what a rollback is. But if your help desk is treating every black screen ticket as the same ticket, you're about to have a bad week.  #AzureVirtualDesktop

Open source dependencies going stale. Shift-left security nobody funded. Government agile fighting government security posture. New episode of This Is Fine tackles secure software development with Dan Beller and Greg Vanore. Catch the episode here: f.mtr.cool/bihgsgdvxa

Cisco Secure Firewall Management Center had an unauthenticated bug allowing root access. It's already being used to drop JSP shells, run Cyclops Blink, and detonate Qilin ransomware. Feds had until Sept 12 to patch. If you're still checking this off your list, you're not early. #CyberSecurity #InfoSec #Cisco #ThreatIntel

🔥 This Is Fine | QA and Automated Testing "You don't get to be called director of quality assurance if you don't have strong opinions" about skipping tests before a prod deploy. New episode on choosing test automation tools, selling automation to skeptical customers, and testing legacy systems you inherited on printed source code (yes, really). 🎧 f.mtr.cool/ufmutuhbth #TestAutomation #QualityAssurance #GovTech

🔥 This Is Fine | Applied Cyber Threat Intelligence "It's cyber story time with the CTI team." That's what happens when threat intel isn't actionable. New episode on applied CTI, with two clients weighing in from the buyer's side on what makes intelligence worth paying for. 🎧 f.mtr.cool/6gjhbjzvgv #ThreatIntelligence #Cybersecurity #GovTech

🔥This Is Fine | Threat Modeling Techniques in Defense Cybersecurity  "How do we handle it if all of the cloud providers go down? We don't. We go home." That's how you know a threat model has found the right boundary between real risk and pure theory. New episode on STRIDE, PASTA, risk registries, and why threat modeling is still one of cybersecurity's most skipped practices. 🎧 f.mtr.cool/018e8us521 #ThreatModeling #Cybersecurity #DefenseSecurity

@ScrumWhat and @x_a_n_d_e_r_k have landed at this year's Fal.Con event!   #FalCon2026 #CrowdStrike

Introducing the Citrix NetScaler bug! It boasts 36 attacks in just 12 days.  Web shells are already deployed. The kicker? CISA's deadline is August 29.  What should have been a patch deadline just turned into a patch sprint. Hope your change management process likes surprises.  #cybersecurity #CISA #NetScaler

🔥 This Is Fine | Opensource Software Security in the DoD "As long as you're not a cloud, it's fine." That's more or less DoD's current open source policy. New episode: licensing traps, foreign ownership risk, and the wild west of software supply chain governance in the DoD. 🎧f.mtr.cool/ahpmeb4iyy #OpenSource #DoD #Cybersecurity

Never thought these words would be mumbled but here we are... Behold, the advanced persistent threat we should've seen coming. #cybersecurity #phishing #secops

Why did Frodo stop coding?  He ran out of Tolkiens. #cybersecurity #AI #tokens

🔥 This Is Fine | The Most Useless NPM Repos There's an npm package called "none." It does nothing. 300 weekly downloads. There's one called "is-even" that uses AI to check if a number is even. About 80% accurate. "debug" pulls 62M weekly downloads - 10x more than React. New episode: npm's supply chain problem, hiding inside its own comedy. 🎧 f.mtr.cool/wyqiolzejk #npm #SupplyChainSecurity #DevSecOps

The five stages of troubleshooting on a Friday afternoon: hope, doubt, denial, panic, and staring at a blinking cursor blankly... #IT #cybersecurity

This Is Fine🔥 You ever notice that your product is getting worse, even with your devs putting in extra hours? That's a big tell. New episode: Greg Vanore, Scott Hiland & Jeff Segal (Hunter Strategy) on the Team Death Spiral - tech debt, leadership, and why more money rarely saves a struggling team. 🎧: f.mtr.cool/fmkbnkzcme   #EngineeringLeadership #TechDebt #DevOps

Chrome just shipped fixes for 41 vulnerabilities. 6 are critical memory-safety bugs that trigger just by loading a malicious page, no unusual user action required. No exploitation reported... yet.  Patch your fleet: f.mtr.cool/hwijlvgayp  #Cybersecurity #Chrome #InfoSec

PSA: The most common security objections have been debunked since the 1960s. Don't get backhanded by security measures you never implemented. #Cybersecurity #2FA

An AI agent ran its own intrusion campaign this week. Failed against most of its targets, succeeded against 3, then got caught because it left its own staging server wide open. Autonomy cuts both ways. ➡️f.mtr.cool/srxipawfny #ThreatIntel #AISecurity

🔥 "Go get a prime to sponsor you." That's the real advice one small business got for its facility clearance problem. New episode: Nooks co-founder Sean Blackman on why classified access shouldn't be a bro-network problem, and how shared secure facilities can turn a 2-year SCIF build into weeks. 🎧 f.mtr.cool/apdsdyayqd  #SecurityClearance #GovTech #Cybersecurity

Where in the world is Hunter Strategy this week?  Catch the team at @BlackHatEvents!  We have @ScrumWhat, @x_a_n_d_e_r_k, and @trinertech on the ground.  #BlackHatUSA #cybersecurity #BHUSA

🔥 "That's not material" only holds up if you can defend it later. New episode: Lee Kim & @MalwareJake  on how materiality actually gets determined in a DFIR situation - from the SEC's share-price test to pre-built breach scenarios that skip the debate mid-incident. 🎧 f.mtr.cool/beseagjuhw #DFIR #Cybersecurity

Hackers: "What if we hid malware inside software that... actually works?" Groundbreaking! UAC-0099 (Sandworm's delivery guy) skips the exploit entirely and just ships a real, functional Notepad++ next to a plugin that ruins your day. The bar was on the floor and they still tripped over it. Get the details here➡️ f.mtr.cool/oprbmdzuhv  #Cybersecurity #Sandworm

🔥 1,030 NAICS codes exist. Somehow contracting officers still find a way to pick the wrong one. New episode: NAICS abuse, shell companies, and why "just pick the closest code" is doing more damage than you'd think. 🎧: f.mtr.cool/hzwhwlyagd #GovCon #FederalContracting

Meet FortiBleed, a credential harvesting machine running inside your own firewall. 1.16B credential attempts. 86,644 compromised FortiGate devices. Ties confirmed to Inc Ransom and Lynx. Full brief: f.mtr.cool/idochubkgn  #FortiBleed

Words of wisdom: If you give a man a fish, he will eat for a day. If you teach a man to phish, he will spam you for the rest of his life. #Phishing #CyberSecurity

🔥 OMB killed the Common Form attestation in January. Supply chain attacks are up 4x in five years. The homework didn't get easier, it just got personalized. New episode: secure firmware for embedded systems, with @bettersafetynet and @MalwareJake  Certificates, JTAG, and a $0.03 fix that's borderline evil genius. 🎧 f.mtr.cool/ffynpmtnbs  #Cybersecurity #EmbeddedSystems

🔥 We're officially on NASA SEWP VI. Translation for anyone not fluent in government contracting: federal agencies can now bring Hunter Strategy in fast, at one of the lowest access fees in the business, through a vehicle that's been the gold standard for IT procurement since 1993. Ten-year runway. Let's get to work. #SEWPVI #GWAC #GovCon #FederalIT

🔥 Webmail: universities' most boring app and apparently a China-linked group's favorite side door. UNK_MassTraction skips your password entirely and just steals the session. No ransomware or alarms sounding, just quiet access to research data and student records while everyone assumes the "S" in HTTPS is doing its job. Patch Roundcube like it owes you money. Full story here ➡️ f.mtr.cool/vyzimuhoir  #Cybersecurity #HigherEd

🔥 Fixed price. T&M. Cost plus. Everyone throws these terms around. Almost nobody explains them. New episode: John Czaika and Kevin Belanga break down government contract types and who actually holds the risk in each one. 🎧 f.mtr.cool/zxjmetscok #GovCon #FederalAcquisition

Turns out "theoretical vulnerability" has a shelf life. BlueHammer just graduated to full ransomware exploitation, months after the patch was available. If your endpoints skipped April Patch Tuesday, this is the universe reminding you that homework doesn't disappear because you ignored it. ➡️ f.mtr.cool/feaxbhsqoz  #Cybersecurity #Ransomware

Semiquincentennial. Say that five times fast, then go eat a hot dog. From all of us at Hunter Strategy: Happy 250th, America! #America250 #IndependenceDay #Cybersecurity

🔥This Is Fine | Why Purple Team is the Team of the Future "Do not put the C4 in your mouth." Apparently this needed to be said. Repeatedly. @MalwareJake on why "this can't possibly be a problem" is always famous last words - and what that has to do with cloud security documentation. 🎧 New episode:  f.mtr.cool/xqllqxible #Cybersecurity #PurpleTeam

Hunter Strategy has been awarded a Top Workplaces 2026 honor by WTOP News. The award comes from one source: our employees said so. That's the whole story. #TopWorkplaces #Cybersecurity

An attacker posted a GitHub issue. A build agent read it. Secrets left the building. CVSS 10.0. Patch your Gemini CLI. 🔗: f.mtr.cool/tfkayzaizt #Cybersecurity #DevSecOps

🔥 "We really haven't seen cyber warfare." New episode on what it would actually take - and why the gap between the concept and the reality is bigger than most people think, featuring guests @brysonbort and @MalwareJake 🎧 f.mtr.cool/tpguaqqhwc #Cybersecurity #NationalSecurity #ThreatIntelligence

Attackers aren't bringing their own tools anymore. They're using yours. New post: NinjaOne RMM being abused as a backdoor - signed, trusted, and very hard to flag. Get the whole story here: f.mtr.cool/dkwgdbfqxm  #Cybersecurity #ThreatIntelligence

2.6 billion weekly downloads. One phished maintainer account. Malicious updates live for a few hours. That's the blast radius of a npm supply chain attack and it's not hypothetical. 🔗f.mtr.cool/fencoyqmxj #Cybersecurity #SupplyChainSecurity

Microsoft Defender: built to catch threats, currently moonlighting as one. RoguePlanet (CVE-2026-50656) is a local privilege esc that spawns a SYSTEM shell via Defender itself. Patch is coming. But "Coming" isn't "here." 🔗 Full story on our blog: f.mtr.cool/fbrpikzbmm #Cybersecurity #ThreatIntelligence

Today, we recognize Juneteenth, a date that marks the end of slavery in the United States and the fulfillment of a promise long delayed. At Hunter Strategy, we believe in the kind of freedom that actually means something: informed, protected, and enforced. That belief shapes how we show up for the missions we support and the communities we're part of. We're proud to work alongside people who understand that rights on paper aren't enough, they have to be defended. Happy Juneteenth. #Juneteenth #JuneteenthNationalIndependenceDay #HunterStrategy

Proud and humbled to serve those who have served. Helping Hands For Heroes is on the move with their Heroes Refresh Unit and Hunter Strategy is reporting in for duty. This program delivers hot showers, haircuts, hygiene kits, and meals directly to veterans in need without barriers or judgment. Our contribution funded 20 complete transformation experiences for veterans in our community. Even heroes need help. If you're in a position to give, every dollar goes straight to care. Learn more at f.mtr.cool/jzblslszxe  #VeteranSupport #HelpingHandsForHeroes #HeroesRefreshUnit #GivingBack

🔥 Compliance isn't a moment in time. It's a continuous process. New episode on continuous monitoring and risk assessment — from FISMA mandates to real-time validation, why point-in-time compliance is no longer enough and what a modern risk posture actually looks like. 🎧f.mtr.cool/srlqofxvlk #CyberSecurity #ContinuousMonitoring #RiskManagement

Meta's AI support bot was socially engineered into resetting Instagram account passwords. No zero-day or database breach. Simply a chatbot that was designed to reduce friction - and did exactly that, just not for the intended user. The exploit was straightforward: spoof a VPN location near the target, initiate a password reset, route to the AI support assistant, and ask it to link a new email. The bot complied. A one-time code followed. Account seized. The accounts of the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian content before Meta patched the flow. The takeaway isn't a "bad" bot. It's that AI support layers inherit the same social engineering risks as human support teams but with faster throughput and no gut instinct to hold them back. One thing stopped this attack cold: MFA. Accounts with any form of multi-factor authentication enabled were untouched. Enable it. Enforce it. No exceptions. 🔗Source: f.mtr.cool/lbayrwbewr #Cybersecurity #SocialEngineering #AI #MFA #InfoSec

Friendly reminder that your GitHub OAuth token isn't scoped to one repo. It's scoped to all of them. And apparently, one click is all it takes to hand it over. Full breakdown on the blog: f.mtr.cool/bqykgehwhl #GitHub #AppSec #CyberSecurity #DevSecOps

🔥 This Is Fine | Building a Security Culture "Culture can make or break an organization."    Security isn’t just about tools, controls, or compliance frameworks. It’s about people. In this episode, host Matt Triner (Founder of Hunter Strategy) is joined by Russell Eubanks (Cyverity Co-Founder and SANS Principal Instructor) and Andrew King (Hunter Strategy CISO and IANS Faculty Member) to discuss what it takes to build a lasting security culture inside organizations. From leadership alignment to employee engagement, the conversation explores how organizations can move beyond checkbox security and create environments where security becomes part of how the business operates. Because strong security programs aren’t just implemented. They’re adopted. 🎧 Listen here: f.mtr.cool/zsazzacrcr #CyberSecurity #SecurityCulture #EnterpriseSecurity #SecurityLeadership

North Korean threat group Kimsuky isn't slowing down - and their latest HTTPSpy campaign is a good reminder of how sophisticated social engineering has become. In their most recent activity (observed through March and April 2026), Kimsuky masqueraded as legitimate B2B software installers and a spoofed Cisco Webex troubleshooting page to get victims to run malicious droppers. Once inside, HTTPSpy hands the attacker full remote control: command execution, file exfiltration, screenshots, process injection, and clean self-deletion. They also wired in stolen meeting schedules to redirect targets into real Webex rooms, making the lure look entirely authentic. What makes this campaign notable isn't just the malware - it's the operational discipline. Kimsuky is using legitimate infrastructure (Visual Studio Code Remote Tunnels, Cloudflare Quick Tunnels, DWAgent) to blend covert access into normal IT operations. No noisy C2 traffic. No obvious red flags. For defenders, the takeaway is clear: scrutinize your remote access channels, harden against script-based droppers, and keep a close eye on certificate stores and GPKI paths. The attack surface they're targeting isn't exotic, it's the trust you extend to everyday tools. Read the full breakdown on our blog - get the link in the comments.  #CyberSecurity #ThreatIntelligence #NationStateCyber #Kimsuky #DefensiveOps

Typosquatted npm packages. Stolen cloud credentials. Backdoored CI pipelines. Now, they're poisoning AI coding assistants, too. Supply chain attacks leveled up. Has your pipeline security? 🔗: f.mtr.cool/dmasappebn #CyberSecurity #SupplyChainSecurity #DevSecOps

Webworm's whole strategy is betting your environment is too noisy to notice. Echocreep lives in your event logs. Graphworm looks like normal cloud traffic. Together they just... wait. Spoiler: they're usually right. 🔗Get the whole story here: f.mtr.cool/ekvzxbmsnc #Cybersecurity #ThreatIntelligence #Webworm #DetectionEngineering