Information security and data engineering advisor. Virtual CISO with interdisciplinary skillset to solve complex business and technical problems. Not CISSP/10X
Wherever there's trouble
Joined February 2009
- Tweets53.9K
- Following4.7K
- Followers10.5K
- Likes13.8K
Gal Shpantzer retweeted
Lol. PHP has been dying since 1995 ๐
xitter.cf/cat3lyst/status/211268โฆ
OK, but, other than all thatโฆ / Ali G voice
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Gal Shpantzer retweeted
My new cheat sheet is out! This one helps malware analysts incorporate AI agents into their workflows, including how to spot an agent reporting a timed-out tool as having found nothing.
xitter.cf/lennyzeltser/status/21โฆ
โLayer 8โ is the best layerโฆ
Often times the security team at big orgs know *exactly* the most secure way to do things.
Thats not the job. The job is figuring out how to get the closest to the best answer done within time, budget, and added friction concerns.
The job is getting non security teams and leaders on board and agree itโs a priority among 1000 other priorities.
Gal Shpantzer retweeted
Beyond honored to receive the last @labscon_io @LabsSentinel Lifetime Achievement Award ๐ฅ
ALT LABS CON 2026 Lifetime Achievement Katie Moussouris For voicing or conscience from the Pentagon to the karaoke bar
We're honored to present Katie Moussouris (@k8em0) with our Lifetime Achievement Award, for a lifetime of incredible work and contributions to the industry.
Gal Shpantzer retweeted
The slides from my talk at Microsoft Bluehat Singapore are public here:
thomasdullien.github.io/abouโฆ
It's my first BlueHat talk since the Vista days.
Gal Shpantzer retweeted
๐ง ๐๐๐ป๐๐ถ๐ป๐ด ๐๐ ๐ข๐๐๐ฏ๐ผ๐๐ป๐ฑ ๐ฅ๐ถ๐๐ธ๐ โ ๐ข๐ฝ๐ฒ๐ป๐๐ ๐๐ฃ ๐ช๐ฎ๐๐ฐ๐ต๐น๐ถ๐๐
โ
Following the recent ๐ข๐ฝ๐ฒ๐ป๐๐ ๐๐ด๐ฒ๐ป๐ ๐ถ๐ป๐ฐ๐ถ๐ฑ๐ฒ๐ป๐ targeting a German wiki site, I built a ๐๐ค๐ ๐พ๐๐ฒ๐ฟ๐ to help SOC teams identify ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐โฏ๐ฏ๐ฒ๐ฑ ๐ฎ๐ฐ๐๐ถ๐๐ถ๐๐ถ๐ฒ๐ originating from known ๐ข๐ฝ๐ฒ๐ป๐๐ ๐ผ๐๐๐ฏ๐ผ๐๐ป๐ฑ ๐๐ฃ ๐ฟ๐ฎ๐ป๐ด๐ฒ๐.
โ
This query lets defenders quickly visualize what actions were triggered by those IPs โ giving visibility into potential ๐๐โ๐ฑ๐ฟ๐ถ๐๐ฒ๐ป ๐ฟ๐ฒ๐ฐ๐ผ๐ป๐ป๐ฎ๐ถ๐๐๐ฎ๐ป๐ฐ๐ฒ ๐ผ๐ฟ ๐ถ๐ป๐ท๐ฒ๐ฐ๐๐ถ๐ผ๐ป ๐ฎ๐๐๐ฒ๐บ๐ฝ๐๐ across tenant boundaries.
โ
Sharing this so defenders can ๐๐๐ฎ๐ ๐ฎ๐ต๐ฒ๐ฎ๐ฑ ๐ผ๐ณ ๐ฎ๐๐๐ผ๐ป๐ผ๐บ๐ผ๐๐ ๐ฎ๐ด๐ฒ๐ป๐ ๐๐ฟ๐ฎ๐ณ๐ณ๐ถ๐ฐ and ๐บ๐ฎ๐ฝ ๐ฒ๐บ๐ฒ๐ฟ๐ด๐ถ๐ป๐ด ๐๐ ๐๐ต๐ฟ๐ฒ๐ฎ๐ ๐๐๐ฟ๐ณ๐ฎ๐ฐ๐ฒ๐.
detections.ai/share/rule/T0Zโฆ
โ
#AIAgentThreatHunting ๐งโโ๏ธ
Gal Shpantzer retweeted
If you're interested in WebMCP, you should be following Idan Levin. He and his team have been doing extremely exciting work in this space- benchmarking, cataloguing, you name it!
Strong suggestion to follow him.
You might find this interesting -
We created the first WebMCP benchmark, comparing it with computer use and DOM-based methods across speed, cost, task success rate, and token usage. The results are incredible.
webmcp.com/benchmark
Youโre getting 3-5x speed, and an order of magnitude cost improvement (up to 23x lower costs) while being 10-15% better at solving tasks compared to other methods
Gal Shpantzer retweeted
Introducing SpecterOps Skills: a public repository built to turn practitioner knowledge into reusable, reviewable workflows for AI-assisted security work.
@zinic shares what we're building, why we're building it, and how you can contribute โก๏ธ ghst.ly/4ybT6ew
Surely, itโs a bit early for April Foolโs jokesโฆ #DontCallMeShirley
FIRST ON CBS NEWS: A history of hiring prostitutes or stealing from work may no longer be a barrier to employment at the FBI. cbsn.ws/4cPyi4d
Gal Shpantzer retweeted
This is pretty embarrassing ๐
Microsoft has a signed Defender driver that can be abused to kill Defender/EDR and modify protected files and registry settings
We also canโt really solve this the usual way by adding the driver to the vulnerable driver blocklist. Itโs Microsoftโs own Defender component!!
MSRC says it doesnโt require immediate servicing because you already need admin privileges ๐
Which probably means this MS-signed EDR killer will stay usable for a while. Nice ๐ซถ
Microsoftโs signed Windows Defender Boot-Time Removal driver (BTR.sys) is a one-shot kernel component that decrypts an RC4-encrypted transaction list from an Alternate Data Stream and performs Ring-0 operations.
An attacker with SeLoadDriverPrivilege can craft a valid encrypted config and load it early via a transient โBoot Bus Extenderโ service, abusing it as a trusted kernel primitive to bypass Tamper Protection, delete EDR/AV components before they start, drop malicious drivers, and gain persistence, without any vulnerability or BYOVD. No in-the-wild abuse has been observed.
research.checkpoint.com/2026โฆ
Gal Shpantzer retweeted
Periodic reminder that the following is an architectural choice and not an inevitability:
> the service account's cleartext credentials
The more powerful the privilege, the more securely it should be authorized for use. A password that can be guessed and/or stolen is not it.
A threat actor used Claude Code with Sonnet 4.6 as part of an intrusion, likely for ransomware. Sonnet took on many tasks, like writing an on-the-fly "LDAP capture" script, to which it directed the victim's FortiGate device and initiated authentication to steal the service account's cleartext credentials. [...]
Gal Shpantzer retweeted
18 years ago today, Dan Kaminsky @dakami disclosed the DNS cache poisoning vulnerability at Black Hat USA 2008, triggering one of the largest coordinated patch efforts in internet history.
Before public disclosure, Dan organized multiple vendors to fix the flaw in secret. Many more legendary stories than could fit here, like how he exposed Sonyโs rootkit across more than 568,000 networks and identified critical certificate vulnerabilities.
Dan followed what he cared about and his curiosity.
As Michael Tiffany @kubla put it, โOnly Dan thought, โI could fix the human eye in software.โโ He built DanKam, an augmented-reality app that helped colorblind people see color. Michael hosted Dan while he built the first version and described watching a colorblind houseguest sit at the kitchen table, โcrying tears of joy seeing red for the first time.โ
His mother, Trudy Maurer, may have said it best when she accepted his Lifetime Achievement Award at the 2025 Difference Makers. โDaniel was the catalyst for many achievements across the vast internet spectrum, and I believe Dan truly represented the intersection of technology and humanity.โ
@dotMudge, who presented the award, said: โThe Lifetime Achievement Award isnโt about what you achieve in your lifetime. Thatโs part of it. Itโs about how many people you influence and bring in and then take it further.โ
We lost Dan too early from diabetic ketoacidosis in April 2021 at age 42.
Some of you are hearing the name Dan Kaminsky for the first time.ย
The coordinated, community-first spirit Dan modeled is the bar.
If you're in Vegas this week, you're walking the streets that the legends of security who came before you walked, when they also had no idea what they were doing, facing problems nobody had solved before.
They had to figure it out as they went. Just like you're going to do.
Thanks to those who contributed to this tribute video: Jeff Moss @thedarktangent, @paulvixie, @gadievron, Lena Smart, Derek Hinch and the many others who shared here.
Gal Shpantzer retweeted
Weโre continuing to work with Microsoft and GitHub to investigate the impact of the malicious Nx Console version 18.95.0. I'll share any updates on X (@jeffbcross and @NxDevTools) as well as in our security advisory: github.com/nrwl/nx-console/sโฆ.
Initially, Microsoft indicated to us that there were 28 installs of the malicious version 18.95.0. Based on our own analytics for the compromised version, we currently believe the number of users who received the malicious package may be significantly higher; potentially over 6k installs.
Weโll keep working to determine the actual impact and exposure, and I donโt want to speculate beyond the facts we have right now. But I also donโt want to minimize the situation.
This is my top priority right now. Our team has been, and continues to be focused on understanding exactly what happened, helping affected users, hardening our systems and release processes, and being as transparent as possible throughout the investigation.
Iโm with Jason on this.
Just a reminder: I give away many of my tips tricks, research, and methodology via conference talks, podcasts, free workshops, webinars, blogs, here on Twitter, and via my newsletter Executive Offense.
Iโve contributed code to many tools. I write and release tools myself, in FOSS.
I have done this for 21 years. I never stopped. I just charge for classes now that are the ultimate curation of all those things. Updates? Yeah modern research and updates in charge for. I have a family, sue me I guess.
Thanks to the two assholes who sent me dm dissertations on how Iโm a sellout influencer and that real hackers release everything for free. Saying that my all my contributions are null and void for running courses.
Really makes me want to keep doing it.
These arenโt bots either, there are real people in the industry at real consultancies.
Thatโs cool I guess. To be an asshole and meme ๐ฏ of the time is in style.
Better be sure that if I see you on the signup list or anyone from your consultancyโฆ you are not welcome at Arcanum stuff. Gl and have a wonderful life ๐ค
Reposting some ransomware stuff from years ago, thinking about how this stuff evolved and how many are still vulnerable to/surprised by ye olde ways
Gal Shpantzer retweeted
Ransomware uses full-screen Windows updates progress UI to get user to wait while it encrypts their files blog.kaspersky.com/fantom-raโฆ
Gal Shpantzer retweeted
This #ransomware has no Word macro. It tricks users to run the embedded OLE package and delete their backups.
Gal Shpantzer retweeted
โ ๏ธ Update: It has now been 24 hours since #Iran implemented a nationwide internet shutdown, with connectivity flatlining at 1% of ordinary levels. The ongoing digital blackout violates the fundamental rights and liberties of Iranians while masking regime violence โฑ
