Identity Security Architect @ TrustedSec. Microsoft Certified Master #ActiveDirectory & former Microsoft MVP. Co-Host @ Enterprise Security Weekly. He/Him. #BLM

4°08'15.0N 162°03'42.0E
Joined August 2014
To my black family, friends, and people seeing this: I love you You matter I'm here for you #BlackLivesMatter
5
5
1
141
Sean Metcalf retweeted
Friendly reminder to IT admins about NTLM. You should: 1. Disable NTLMv1 2. Use RPC filtering on your Domain Controllers to protect against authentication coercion 3. Monitor the heck out of legacy authentication, so if something strange does happen you're more likely to know about it Easy? Not necessarily. But if you have weak NTLM in your environment and coercion paths still available, this is trivial to abuse and results in highly privileged access. What do you have to lose?
5
10
1
124
5,013
Sean Metcalf retweeted
Windows 11 26H2 ships 32 new GPO with AI & MCP controls but the big one for me is about NTLM. 👉🏻 "NTLM Enhanced Blocking" GPO (System\NTLM) block NTLM by account type, device role or app type, with a shared allow-list. 4 rules, each set to Audit / Enabled / Disabled. From the Oct 2026 security update, Windows 11 (26H2/25H2/24H2) + Server 2025 restrict NTLMv1-derived SSO credentials by default. Watch Event ID 4024 (audit) and 4025 (blocked) in Microsoft-Windows-NTLM/Operational. 📄 Microsoft ref: microsoft.com/en-us/download…
2
17
1
56
3,784
Mandatory meme of the day > cybersecuritynews.com/emudhr… > xkcd.com/221/
4
56
3
304
9,708
Sean Metcalf retweeted
It should be preached. Fundamentals matter
not that it should be preached, but... security hygiene > the semi-annual CVE apocalypse
1
3
27
1,584
Sean Metcalf retweeted
Friendly reminder with today’s PHP2Shell disclosure: pfSense is heavily PHP-based. Its entire WebGUI and much of its management logic run on PHP.
2
13
1
56
3,070
Sean Metcalf retweeted
If you're an IT admin, I can't think of a better thing to do in January then to go to @wpninjasus. I mean seriously. So much care and effort and love has been put into this event, you guys don't even know the half of it. Come support fellow IT/Security practitioners, trying to do good and make an impact. Would love to see you there!!!! Agenda: workplaceninjas.us/agenda/
1
1
8
922
Sean Metcalf retweeted
Let’s not forget about this certificate clusterfuck while everyone is busy with the PHP RCE news. Almost at the same time, another serious security incident became public. Eight intermediate CA certificates from eMudhra were found to use ridiculously weak private keys. We’re talking about P-384 keys where one private key was literally the number 4. FOUR! Six of these were TLS CAs, allowing anyone to recover their private keys and potentially issue trusted certificates for arbitrary domains. Major browsers have already blocked the affected CAs. But what about API clients, backend services, embedded devices, containers, and systems with outdated trust stores? Many don’t enforce Certificate Transparency or check revocation. Some could remain vulnerable for years. These weak keys have existed since April 2025. No confirmed malicious exploitation so far, but the implications are serious. Don’t overlook this one while focusing on PHP. Technical details and test endpoints: emudhra.we-have-a-problem.co…
12
92
8
489
29,832
Most decaf coffee is made with methylene chloride. It's the solvent that used to be in paint stripper. The green beans are steamed, then washed in methylene chloride, which pulls out the caffeine and not much else. The beans are steamed again to drive off the solvent and then roasted at over 400F. FDA allows up to 10 parts per million. When a lab tested 24 decaf brands in 2020 it found the solvent in 10 of them at about 0.05 to 0.1 ppm, around 100 times below the limit. The industry calls this the European method. There are 3 other ways to do it. Ethyl acetate, a solvent that can be made from sugarcane, which the trade calls the natural method. Carbon dioxide under pressure. And the Swiss Water process, which uses hot water and carbon filters and no solvent at all. Peet's says all of its decaf is water process. Starbucks has told reporters most of its decaf is the direct contact method, meaning solvent. EPA banned most uses of methylene chloride in 2024, but food is FDA's job, so decaf wasn't part of it. A petition to pull it from food has sat at FDA since December 2023. FDA reopened comments on it in May and hasn't decided. If the bag says Swiss Water or water process, no solvent touched it. If the bag says nothing, you don't know.
221
823
105
10,009
1,082,576
The biggest SwiftOnSecurity-enabled tech announcement since sysmon-config is coming soon Swiftfender: An enterprise AV optimization engineer in your pocket
15
46
323
14,119
Sean Metcalf retweeted
If there was ever an event to NOT miss. This is it. I’ll be debating @merill about Active Directory and there’s an entire lineup of super awesome talks. If you’re an IT admin, IT director or do anything with Microsoft products, endpoint management or security, you will get value from this event.
Happy Wednesday Everyone!! A few key things we want to mention today: ⏳ Two weeks left on our Early Bird pricing of $650 for 3 action packed days at the gorgeous Scott Resort and Spa for #WPNinjasUS 2027 🏨 30 Hotel Packages/Rooms remain at the Scott!! Don't worry we rooms as well at the overflow across the street at Embassy Suites as well! ⏰ 82 Days left until things kickoff in Scottsdale!! 🚧 We continue working hard, building value, and creating experiences for all of you. Things are heating up and people are READY!! Come and join us! Register now: workplaceninjas.us @wpninjasus @Microsoft @MSIntune @IntuneSuppTeam #WPNinjasUS #WPNinjaS #MSIntune #ITPros #Community #MSEntra #MSSecurity #DefenderXDR #ConfigMGR #Copilot #AI #Automation #PowerShell #Microsoft #Azure #AzureVirtualDesktop #Windows365
2
2
17
1,342
Sean Metcalf retweeted
arstechnica.com/security/202… The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
31
215
51
1,672
268,544
Sean Metcalf retweeted
Another chance to catch our Founder and CEO @HackingDave on stage! He’s keynoting at @BSidesColumbus, Friday, November 6 at 9:00AM. Don't miss “This Talk Was Written by AI;” be sure to add it to your schedule! hubs.la/Q04BNqWf0
1
5
7
1,806
Sean Metcalf retweeted
Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.
35
320
113
1,424
468,642
Sean Metcalf retweeted
How I feel 1 week before DistrictCon CFP closes vs right after @DistrictCon CFP closes Oct 30 midnight pls submit I know y’all are procrastinators but submitting earlier saves my blood pressure 🥹 Sessionize.com/districtcon
2
6
10
1,626
Sean Metcalf retweeted
Building a B2B SaaS is hard. But waking up to new customer sign-ups that came in overnight? That’s the dream. 20 new customers in 4 weeks for Maester Cloud 🔥 Huge thanks to everyone who has supported, shared and championed Maester along the way. Grateful and honoured 🙏 maester.cloud #buildinpublic
6
2
1
51
4,491
We have reached the point where a former President of the United States has to remind the current president that criticizing him isn't grounds for deportation.
47
1,453
10
7,478
340,348
‘COYOTE VS ACME’ has passed ‘SUPERGIRL’ to become the highest-grossing movie produced by Warner Bros this Summer. The film was almost permanently deleted by Warner Bros for a tax write-off.
494
7,366
794
86,637
1,370,377
Sean Metcalf retweeted
The current MSSP incident reported by Huntress is a good reminder why you should enable app instance property lock for your applications to prevent malicious takeover in a compromised customer tenant. huntress.com/blog/vendor-cre… learn.microsoft.com/en-us/en…
5
37
1
225
24,066
Sean Metcalf retweeted
Regarding the connectwise supply chain, @ConnectWise just posted 2 new related ips!
2
14
2
54
4,822