
Identity Security Architect @ TrustedSec. Microsoft Certified Master #ActiveDirectory & former Microsoft MVP. Co-Host @ Enterprise Security Weekly. He/Him. #BLM
4°08'15.0N 162°03'42.0E
Joined August 2014
- Tweets23.4K
- Following720
- Followers37.1K
- Likes42.6K
Pinned Tweet
To my black family, friends, and people seeing this:
I love you
You matter
I'm here for you
#BlackLivesMatter
Sean Metcalf retweeted
Friendly reminder to IT admins about NTLM. You should:
1. Disable NTLMv1
2. Use RPC filtering on your Domain Controllers to protect against authentication coercion
3. Monitor the heck out of legacy authentication, so if something strange does happen you're more likely to know about it
Easy? Not necessarily. But if you have weak NTLM in your environment and coercion paths still available, this is trivial to abuse and results in highly privileged access.
What do you have to lose?
Sean Metcalf retweeted
Windows 11 26H2 ships 32 new GPO with AI & MCP controls but the big one for me is about NTLM.
👉🏻 "NTLM Enhanced Blocking" GPO (System\NTLM) block NTLM by account type, device role or app type, with a shared allow-list. 4 rules, each set to Audit / Enabled / Disabled.
From the Oct 2026 security update, Windows 11 (26H2/25H2/24H2) + Server 2025 restrict NTLMv1-derived SSO credentials by default. Watch Event ID 4024 (audit) and 4025 (blocked) in Microsoft-Windows-NTLM/Operational.
📄 Microsoft ref: microsoft.com/en-us/download…
Sean Metcalf retweeted
Mandatory meme of the day
> cybersecuritynews.com/emudhr…
> xkcd.com/221/
Sean Metcalf retweeted
Friendly reminder with today’s PHP2Shell disclosure: pfSense is heavily PHP-based. Its entire WebGUI and much of its management logic run on PHP.
Sean Metcalf retweeted
If you're an IT admin, I can't think of a better thing to do in January then to go to @wpninjasus. I mean seriously. So much care and effort and love has been put into this event, you guys don't even know the half of it.
Come support fellow IT/Security practitioners, trying to do good and make an impact.
Would love to see you there!!!!
Agenda: workplaceninjas.us/agenda/
Sean Metcalf retweeted
Let’s not forget about this certificate clusterfuck while everyone is busy with the PHP RCE news.
Almost at the same time, another serious security incident became public.
Eight intermediate CA certificates from eMudhra were found to use ridiculously weak private keys. We’re talking about P-384 keys where one private key was literally the number 4. FOUR!
Six of these were TLS CAs, allowing anyone to recover their private keys and potentially issue trusted certificates for arbitrary domains.
Major browsers have already blocked the affected CAs. But what about API clients, backend services, embedded devices, containers, and systems with outdated trust stores?
Many don’t enforce Certificate Transparency or check revocation. Some could remain vulnerable for years.
These weak keys have existed since April 2025. No confirmed malicious exploitation so far, but the implications are serious.
Don’t overlook this one while focusing on PHP.
Technical details and test endpoints:
emudhra.we-have-a-problem.co…
Sean Metcalf retweeted
Most decaf coffee is made with methylene chloride. It's the solvent that used to be in paint stripper.
The green beans are steamed, then washed in methylene chloride, which pulls out the caffeine and not much else. The beans are steamed again to drive off the solvent and then roasted at over 400F. FDA allows up to 10 parts per million. When a lab tested 24 decaf brands in 2020 it found the solvent in 10 of them at about 0.05 to 0.1 ppm, around 100 times below the limit. The industry calls this the European method.
There are 3 other ways to do it. Ethyl acetate, a solvent that can be made from sugarcane, which the trade calls the natural method. Carbon dioxide under pressure. And the Swiss Water process, which uses hot water and carbon filters and no solvent at all. Peet's says all of its decaf is water process. Starbucks has told reporters most of its decaf is the direct contact method, meaning solvent.
EPA banned most uses of methylene chloride in 2024, but food is FDA's job, so decaf wasn't part of it. A petition to pull it from food has sat at FDA since December 2023. FDA reopened comments on it in May and hasn't decided. If the bag says Swiss Water or water process, no solvent touched it. If the bag says nothing, you don't know.
Sean Metcalf retweeted
The biggest SwiftOnSecurity-enabled tech announcement since sysmon-config is coming soon
Swiftfender: An enterprise AV optimization engineer in your pocket
Sean Metcalf retweeted
If there was ever an event to NOT miss. This is it. I’ll be debating @merill about Active Directory and there’s an entire lineup of super awesome talks.
If you’re an IT admin, IT director or do anything with Microsoft products, endpoint management or security, you will get value from this event.
Happy Wednesday Everyone!!
A few key things we want to mention today:
⏳ Two weeks left on our Early Bird pricing of $650 for 3 action packed days at the gorgeous Scott Resort and Spa for #WPNinjasUS 2027
🏨 30 Hotel Packages/Rooms remain at the Scott!! Don't worry we rooms as well at the overflow across the street at Embassy Suites as well!
⏰ 82 Days left until things kickoff in Scottsdale!!
🚧 We continue working hard, building value, and creating experiences for all of you. Things are heating up and people are READY!! Come and join us!
Register now: workplaceninjas.us
@wpninjasus @Microsoft @MSIntune @IntuneSuppTeam
#WPNinjasUS #WPNinjaS #MSIntune #ITPros #Community #MSEntra #MSSecurity #DefenderXDR #ConfigMGR #Copilot #AI #Automation #PowerShell #Microsoft #Azure #AzureVirtualDesktop #Windows365
arstechnica.com/security/202…
The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
Sean Metcalf retweeted
@BSides_NoVA OCT 31st Keynote: @mubix
Stories from the Red Side
Creating tools, wielding donuts, walking on water, etc.
With 25 years of experience, Rob's been though crazy situations.
And we're gonna hear about it!
Info: bsidesnova-2026.sessionize.c…
Tickets: eventbrite.com/e/bsidesnova-…
Sean Metcalf retweeted
Another chance to catch our Founder and CEO @HackingDave on stage! He’s keynoting at @BSidesColumbus, Friday, November 6 at 9:00AM. Don't miss “This Talk Was Written by AI;” be sure to add it to your schedule! hubs.la/Q04BNqWf0
Sean Metcalf retweeted
Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.
How I feel 1 week before DistrictCon CFP closes vs right after
@DistrictCon CFP closes Oct 30 midnight pls submit
I know y’all are procrastinators but submitting earlier saves my blood pressure 🥹
Sessionize.com/districtcon
Sean Metcalf retweeted
Building a B2B SaaS is hard. But waking up to new customer sign-ups that came in overnight? That’s the dream.
20 new customers in 4 weeks for Maester Cloud 🔥
Huge thanks to everyone who has supported, shared and championed Maester along the way. Grateful and honoured 🙏
maester.cloud
#buildinpublic
Sean Metcalf retweeted
We have reached the point where a former President of the United States has to remind the current president that criticizing him isn't grounds for deportation.
Sean Metcalf retweeted
‘COYOTE VS ACME’ has passed ‘SUPERGIRL’ to become the highest-grossing movie produced by Warner Bros this Summer.
The film was almost permanently deleted by Warner Bros for a tax write-off.
Sean Metcalf retweeted
The current MSSP incident reported by Huntress is a good reminder why you should enable app instance property lock for your applications to prevent malicious takeover in a compromised customer tenant.
huntress.com/blog/vendor-cre…
learn.microsoft.com/en-us/en…
Sean Metcalf retweeted
Regarding the connectwise supply chain, @ConnectWise just posted 2 new related ips!































