Why did I leave Microsoft? To work full time on 🔥 Maester. Over 40,000+ tenants today rely on Maester to monitor their tenants daily. I wanted to make sure that the tests they are running continue to be relevant and evolve as Microsoft 365 and the security landscape evolves. So today I'm announcing the launch of Maester.Cloud Maester Cloud is the portal companion to Maester that lets you track your results over time. It is multi tenant, runs in your cloud (or ours) and more → check out the site for all the features. More importantly Maester Cloud is a way for me to fund the continued development of the open source Maester core and the tests in Maester. That is our mission. In fact I worked with the core team @fabian_bader , @Thomas_Live , @MySnozzberries and @SamErde to create the Maester Manifesto (maester.cloud/manifesto). It is our promise to the community. If you value Maester and would like to support and ensure that Maester continues to grow and be healthy, I would be beyond thrilled if your organisation can sponsor this effort. I would also appreciate it very much if you can share this post with your network to spread awareness. Thanks!

👋 Check out this new Microsoft Entra blog post 👇 Designing smarter access policies for hybrid enterprises techcommunity.microsoft.com/…

Credit to Dario who said pretty much exactly this would happen, and on this timeline, thanks to seeing what Mythos could do. In May, Dario said there's a 6-12 month window before Chinese models catch up was also correct. That was 5 months ago.

Use architectures/designs that don't need secrets. Here's a comparison of the features in major clouds. Learn about workload id federation at learn.microsoft.com/en-us/en… These are the open standards: spiffe.io/docs/latest/spire-…

That's what I was getting to. You basically said No to the apps that wanted LDAP. Which is the right thing to do. It's the same thing I've been trying to say. - Stop using these legacy apps - Move them to using modern auth protocols (which of course meand Entra ID or something else) Somehow the AD folks feel like it's anti-AD to tell customers to move their apps off AD and secure themselves. We can talk about your last poin on 'endpoint logins', well that's not needed anymore. Endpoints don't need line of sight to your AD...

There are a lot of uncomfortable conversations going on in boardrooms across America and elsewhere this morning. Leadership is asking questions which make them squirm like "How come we didn't know we had all these vulnerable software packages in our environment?" And they're being told, by technical people who are terrified of losing their jobs, facing uncertain futures with all this AI crap and misinformed leadership making increasingly poor decisions which only make things worse, that the reason this is all happening is because for years they were hamstrung and prevented from doing those jobs, BY THAT SAME LEADERSHIP. Patching. Updating software. Documentation. Asset Management. I wrote a book on it. Check it out.😉 How can you protect your assets if you don't know how many you have and what they are and where they are? No, you can't have that money in your budget to do your work because we have to use it to spend it on stupid things like tokens. No, you can't take down a production system in the middle of the day and we're not going to approve any overtime either so figure it out. Except it wasn't figured out because in order to update it the system needs to be taken offline. And the technical people need to be able to do those updates without having some megalomaniac breathing down their neck asking the dumbest questions like ETA? 🙄 ETA. When it gets done, dumbass. That's when. Is this harsh? Yes. Once again this is a revealing incident showing that all these companies who love to brag how secure they are, really aren't in reality. But that is not the fault of the technical staff. That's the fault of the guys and gals in the top echelon who are supposedly managing all these businesses but doing a very poor job of it. They never get called out though. I think we need to change that. I think all layoffs need to be in a moratorium status because it's clear to me that the very last thing you want to do is get rid of the individuals in your company who are going to help you clean up from all the vulnerabilities which need to be patched in the coming days weeks and months. Yesterday was a precursor. A taste of what is to come. Now is not the time to be laying off those who have the technical skill to help you recover from the fallout. Stop worrying about vibe coding idiotic projects that aren't going to make your company any money and start worrying about protecting the assets you have today. Invest in the people whose work got you all that money you are spending on this AI shit and prioritize giving them the tools to make your organization even stronger. AI models are not alive. They do not have consciousness now and they're not going to. Play books that they are running right now are based on human technical experts notes. They aren't inventing anything new. They are reading what it is we have done in reality and mimicking that. And they are going to be successful in hacking you because you haven't allowed your technical staff to do their jobs which you hired them to do. Listen to your cybersecurity staff. Listen to your information technology staff. Instead of restructuring your human assets start shuffling around money and shoring up technical budgets so that they can do those jobs properly. And stop with the bullshit excuses. Do you want to get sued? Because that's where this is going to end up if you don't start getting your technical houses in order. That starts with everything I said above. And the very first thing that you need to take offline is those stupid AI chatbots that you put on your websites. Your customers hate them. They loop. They want to speak to a human. And you should try it yourselves. There's a number of them working for you. That's how you get paid the ridiculous salaries you make. How's about talking to them for a change, instead of at them? 🙄

There are much better ways to build your apps than using secrets and API keys and sticking them in .env All major clouds support them, even your GitHub actions can connect to AWS, Azure etc without any keys or secrets Here's a comparison 👇

Two critical remote code execution bugs this week: PHP2Shell, GitLab (CVSS 10). Patch them first. But patch night isn't the end of it. When an app server gets popped, attackers often drop a webshell and look around. There's a high chance they're looking for Active Directory, because once they own AD they own pretty much everything else. There's more than one way an app server can hand AD to an attacker: 1. LDAP sign-in. The app usually keeps a bind account in its config, and every password a user types passes through the app in clear text before it's checked. 2. AD service accounts, with the password in a config file or connection string. 3. Domain-joined servers, which can hold the credentials of admins who sign in interactively. 4. Unconstrained Kerberos delegation, which captures the tickets of users who connect. 5. And most of them need a network path to your domain controllers. The long-term fix is to take these apps off AD and modernise how they authenticate, wherever you can: - Move sign-in to Entra ID with OpenID Connect or SAML. The app gets a signed token, never a password, and Entra handles MFA, passkeys and Conditional Access. GitLab supports this today. - Use managed identities or workload identity federation instead of passwords in config. - Publish legacy Kerberos apps through Entra Private Access with Kerberos SSO. - Remove the bind accounts you no longer need and firewall these servers off from your DCs. The hard part is finding them. PHP hides inside intranet portals, help desks, wikis and appliances, often as an embedded runtime nobody owns. Defender for Identity flags services sending LDAP credentials in clear text, and Private Access application discovery shows which private apps people actually use. None of this fixes the bugs. Patching does. But next time an app gets popped, it's a bad day for that app, not for your whole domain. The video includes clips from Tarek Dawoud (Microsoft Security) and @richardhicks from past Entra.Chat episodes.

This is true 👇 There's a lot of opportunity in the coming years to finally fix all those legacy apps with the use of AI. Migrating legacy code was almost impossible before, now with AI and coding agents its achievable.

For those running apps on @Railway and affected by their breach (you should have an email) Use your agent to do a quick review of all the keys that need to be rotated.

One-click mitigation for php2shell vulnerability: If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected. dash.cloudflare.com/?to=/:ac… This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.

Entra ID is on the internet anyone can hack it. AD is safe because we're behind a firewall, so its okay if we open all our ports to all the internal servers... Zero Trust boys. You are just one zero day away from all the internet facing endpoints that connect to your AD. If you think there aren't PHP servers connecting with line of sight to your DC I have a bridge to sell. Fact is Entra ID is on the internet 24x7 and its still standing. Because that is how modern identity works.

Reposting this from my own comment so you all see it. Re: PHP patch today. Context (Cloudflare built in protection) from staff. You can get cloudflare for your WordPress or regular site for free. cloudflare.com/plans/free/ Not sure if the free plans offer deanonymized IPs in logs but they are one of the only providers which has it, organically, meaning you don't have to toggle something on to see it and that helps with IR. The user interface is very easy to use and on each page under the title of each page is a white button which has the help article for that section and all help documentation is written beautifully and simply. No nonsense. Just as an aside. I am adding this but if you have WordPress you do need a WAF. The .htaccess page isn't going to cut it. The plugins and themes are exploited constantly. I just wrote a report a couple weeks ago about a website I found which had its Elementor plugin compromised with poisoned SEO links. CF would've caught it. Just when reading the analytics in certain places like with the bot score the lower the score the higher the probability the agent was a bot whereas if you're not familiar with this format you're going to think if you see 100% that it is a bot when that just means it's likely human. Ok Enough of that. Get on the PHP thing today. DEPLOY COUNTERMEASURES! Sorry not to be dramatic but I always just wanted to say that. 😎

💣 Did you opt-out of Entra ID's SMS retirement rollout in Sept? Your time is running out. The good news is @NathanMcNulty has the fix to help you get ready for the Feb 2027 deadline. Link to Nathan's GitHub script below.

I think I have a good analogy for what's about to happen in cyber. It's pitch dark. Always has been. And the world is dilapidated buildings and rats and maggots and other creepy-crawlies. The whole world. And we just invented flashlights.