Identity Security Architect @ TrustedSec. Microsoft Certified Master #ActiveDirectory & former Microsoft MVP. Co-Host @ Enterprise Security Weekly. He/Him. #BLM

4°08'15.0N 162°03'42.0E
To my black family, friends, and people seeing this: I love you You matter I'm here for you #BlackLivesMatter
5
5
141
Sean Metcalf retweeted
arstechnica.com/security/202… The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
21
125
1,025
88,654
Sean Metcalf retweeted
Another chance to catch our Founder and CEO @HackingDave on stage! He’s keynoting at @BSidesColumbus, Friday, November 6 at 9:00AM. Don't miss “This Talk Was Written by AI;” be sure to add it to your schedule! hubs.la/Q04BNqWf0
1
4
5
1,155
Sean Metcalf retweeted
Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.
25
228
1,121
180,009
Sean Metcalf retweeted
How I feel 1 week before DistrictCon CFP closes vs right after @DistrictCon CFP closes Oct 30 midnight pls submit I know y’all are procrastinators but submitting earlier saves my blood pressure 🥹 Sessionize.com/districtcon
2
5
9
1,235
Sean Metcalf retweeted
Building a B2B SaaS is hard. But waking up to new customer sign-ups that came in overnight? That’s the dream. 20 new customers in 4 weeks for Maester Cloud 🔥 Huge thanks to everyone who has supported, shared and championed Maester along the way. Grateful and honoured 🙏 maester.cloud #buildinpublic
6
2
46
4,155
We have reached the point where a former President of the United States has to remind the current president that criticizing him isn't grounds for deportation.
47
1,452
7,473
338,722
Sean Metcalf retweeted
‘COYOTE VS ACME’ has passed ‘SUPERGIRL’ to become the highest-grossing movie produced by Warner Bros this Summer. The film was almost permanently deleted by Warner Bros for a tax write-off.
486
7,241
84,765
1,326,092
Sean Metcalf retweeted
The current MSSP incident reported by Huntress is a good reminder why you should enable app instance property lock for your applications to prevent malicious takeover in a compromised customer tenant. huntress.com/blog/vendor-cre… learn.microsoft.com/en-us/en…
5
37
224
23,827
Sean Metcalf retweeted
Regarding the connectwise supply chain, @ConnectWise just posted 2 new related ips!
2
14
54
4,685
Sean Metcalf retweeted
RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵
10
120
461
114,591
Sean Metcalf retweeted
Let him cook!!! 😂 🔥 Maester ❤️ Microsoft Zero Trust Assessment Two of my babies are growing up together. Maester Packs lets you install, pin & run third-party test packs. The first one we ship is Microsoft’s Zero Trust Assessment. Its results land right in your Maester report. Coming soon 👀
4
3
38
2,631
Sean Metcalf retweeted
This is the developer side of the Application. If you're the customer, you need a relationship with your vendors. Check for overly permitted apps and SPs in privileged roles. I'll be working on a write-up soon. In the meantime, Jeremy links Merills video which covers it briefly.
Re: the ConnectWise incident. App Instance Lock is the default in Entra ID as of June 2026. It's a good idea to go back now make sure it is enabled for multi-tenant apps: learn.microsoft.com/en-us/en…
1
2
503
A huge thank you to Sober in Cyber! 💛 For four years, they've sponsored Wild West Hackin' Fest, creating the welcoming Sober Spot at the Stampede for all to connect and enjoy the night sober or sober-curious.
2
1
35
1,091
Sean Metcalf retweeted
The potential impact of the ConnectWise supply chain attack is massive. One compromised OAuth application with elevated permissions could give attackers access to emails, files, and directory data across hundreds of Microsoft 365 tenants. Even worse, attackers could establish persistent access by adding credentials to other applications, surviving the revocation of the original compromised credentials. And with MSPs involved, the potential blast radius could extend even further to downstream customers. We don't know the full extent of the compromise yet, but this could affect far more organizations than those directly using ConnectWise Cloud Backup. linkedin.com/posts/microsoft…
12
125
448
37,509
Sean Metcalf retweeted
JUST IN: bride surprises her groom with good DistrictCon CFP submissions at their wedding, bringing him to tears. (CFP closes Oct 30 11:59pm pls submit sessionize.com/districtcon)
1
7
18
3,167
Sean Metcalf retweeted
See this dude gets it! how come so many cyber grifters don't??? oh wait..... the first part... grifters! that's the reason!
Ben Affleck says AI is simply matrix multiplication, linear algebra and floating point calculations, and however convincingly it sounds like a person, it has nothing to do with thought, humanity or feeling “Nor do I believe, and I think it’s important to draw the distinction between what AI does, which is simply predict the next token or the next word in a sentence, then add that word on, run it back to the machine, do a lot of computation and pick the next word." "That is a very different thing than sentience or thought. And I think we need to be really clear about that because it can be convincingly, in an illusory way, sound like thought or like a person." "But let’s be real clear. This is matrix multiplication. This is linear algebra. These are floating point calculations. It has nothing to do with thought, humanity, or feeling.”
22
26
291
9,753
Sean Metcalf retweeted
WHAT?
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…
21
9
204
20,846
Sean Metcalf retweeted
If you’re an IT admin and you’re logging into regular user systems with your domain admin account, you’re living on the edge. Those accounts provide an unnecessarily high level of privilege and put your environment at much higher risk should that device become compromised. I’d recommend using RMM tools for remote management or have separate tiered accounts specific for end user system management.
14
15
160
8,956
Sean Metcalf retweeted
BOOM! This is the biggest thing since sliced bread in the Entra world. Security Default is no longer a giant ON/OFF switch. You can now exclude just individual users from policies!!
3
13
89
10,105