ISC2 CC | Building toward Tier 1 SOC and Detection Engineering | Hands-on investigations with Splunk, Wazuh and Sigma | Documenting what I learn
Johannesburg, South Africa
Joined March 2020
- Tweets25.5K
- Following1.5K
- Followers2.7K
- Likes30.5K
Pinned Tweet
I can’t wait to start my 90 Day SOC journey completely from scratch!
90 days of building, investigating, making mistakes, and learning to think like a SOC analyst.
I’ll be documenting the wins, challenges, and lessons along the way.
Curious to see how far I can grow!
William | SOC and Detection Engineering retweeted
High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
github.com/assetnote/php2she…
A suspicious file arrived. What happened next?
Was it saved? Opened? Did it launch a process or make a network connection?
As an analyst, I follow that trail to assess the impact. A download alone does not prove compromise.
Day 22: Disable Automatic File Downloads in Messaging Apps
“Don’t let unknown files land on your plate automatically 👀”
Every day, we receive pictures, videos, documents, and other files through messaging applications. While many of these files are harmless, some may contain malicious content or come from untrusted sources. When automatic downloads are enabled, certain files may be saved to your device without you deliberately choosing to download them
Imagine receiving an unexpected attachment in a messaging group, labelled as an important document. Although you don't recognise the sender, the file downloads automatically because of your app settings. While downloading a file does not necessarily mean your device is infected, opening malicious attachments can create security risks.
Quick Tip: Disable automatic file downloads where supported, verify unfamiliar senders, and avoid opening unexpected files.
What other steps can help reduce the risks of automatic file downloads in messaging apps?
William | SOC and Detection Engineering retweeted
Made the similar tweet a few mins ago😭😭😭
At least the gospel of cybersecurity will reach everywhere this week without a serious campaign!!!😭😭😭
Five failed SSH logins. Five usernames. One source IP.
Coincidence or an attacker testing accounts?
The lastb command reveals recorded failed logins.
SOC tip: Compare with last to check for successful access.
Failed attempts tell part of the story. Find out what happened next
William | SOC and Detection Engineering retweeted
Surprise surprise!!!
Public PoC claims ASLR-bypass RCE on unpatched PHP
A public proof-of-concept exploit has been released on GitHub targeting the PHP session flaws behind "PHP2Shell". The author says it achieves one-shot, fully remote code execution on an unpatched PHP 8.4.26 + Apache stack (mod_php, prefork), bypassing ASLR over plain HTTP with no code added to the target page.
* The PoC runs against the official php:8.4.26-apache image; the author reports a 3/3 success rate yielding www-data command execution.
* It leaks heap and PHP library addresses to defeat ASLR; the current version needs display_errors=on.
* This targets unpatched 8.4.26 - fixed builds already exist.
Patch now: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's fixed package.
github.com/9bie/php2shell-by…
#PHP #CyberSecurity
William | SOC and Detection Engineering retweeted
Shaping up to be hottest cyber October!!
Cybersecurity Awareness month with the highest level of cyber vulnerabilities, cyber attacks!!
‼️𝗟𝗶𝘁𝗲𝗟𝗟𝗠 𝗦𝘂𝗽𝗽𝗹𝘆 𝗖𝗵𝗮𝗶𝗻 𝗔𝘁𝘁𝗮𝗰𝗸: 𝗛𝗮𝗰𝗸𝗲𝗿𝘀 𝗛𝗶𝗷𝗮𝗰𝗸 𝗥𝗲𝗹𝗲𝗮𝘀𝗲 𝗣𝗶𝗽𝗲𝗹𝗶𝗻𝗲 𝘁𝗼 𝗗𝗶𝘀𝘁𝗿𝗶𝗯𝘂𝘁𝗲 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹-𝗦𝘁𝗲𝗮𝗹𝗶𝗻𝗴 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 𝘃𝗶𝗮 𝗣𝘆𝗣𝗜 𝗮𝗻𝗱 𝗗𝗼𝗰𝗸𝗲𝗿
LiteLLM disclosed a supply chain attack in which attackers compromised its release pipeline using stolen developer credentials and distributed malicious v1.107.0 packages via PyPI and Docker Hub. The malware could steal cloud credentials, API keys, database passwords, and other secrets.
Full details and impact assessment on HackRisk.io
William | SOC and Detection Engineering retweeted
AI Security can get overwhelming very quickly if you start by trying to memorize every risk list you see.
I would start with the patterns instead.
Manipulation. Can someone influence how the AI behaves?
Data. Can the system expose information it should not?
Access. What can the AI actually reach or do?
Trust. Can someone manipulate the information the AI relies on?
Dependencies. What models, APIs, libraries or services are you trusting?
Once you understand those five patterns, frameworks like OWASP start making a lot more sense.
Understand the security problem first. Learn the terminology later .
Day 21/31 of Cloud + AI Security.
#AISecurity #OWASP #GenAI #CybersecurityAwarenessMonth
William | SOC and Detection Engineering retweeted
The more I learn about cybersecurity, the more I realize that detecting threats is only part of the job.
Recently, I spent time learning about Business Impact Analysis.
And it made me think differently about people saying AI will replace SOC analysts.
William | SOC and Detection Engineering retweeted
How do you plan to harvest these IPs?? How do you separate legitimate traffic from the bad ones?what made you think these people aren’t on IP rotation running on VPNs?
William | SOC and Detection Engineering retweeted
‼️ A single HTTP/3 connection can crash vulnerable web servers. No login required.
Newly disclosed QPACK flaws trigger up to 4,000× memory amplification in tests, exhausting server resources.
→ PoC is public
→ 7 implementations affected
→ Still unpatched: Bun, aioquic, h3
Full details ↓ thehackernews.com/2026/10/ne…
William | SOC and Detection Engineering retweeted
Interesting read…
@commando_skiipz what do you think?
‼️ A single HTTP/3 connection can crash vulnerable web servers. No login required.
Newly disclosed QPACK flaws trigger up to 4,000× memory amplification in tests, exhausting server resources.
→ PoC is public
→ 7 implementations affected
→ Still unpatched: Bun, aioquic, h3
Full details ↓ thehackernews.com/2026/10/ne…
William | SOC and Detection Engineering retweeted
I really want to log off and run away from these news… but how will I know how to create new detection rules if I don’t keep up??🙆🏾♂️🙆🏾♂️😭😭😭
We just need purpose that’s it. That’s the one thing that changes everything when you don’t know why you drift you hesitate you start things and never finish.
William | SOC and Detection Engineering retweeted
I am asking again. What will it take for the Nigerian government to mandate that its agencies have dedicated, in-house Cybersecurity professionals? And is there a way to ensure that these positions are openly advertised and accessible to qualified, competent professionals through a transparent, merit-based recruitment process?
William | SOC and Detection Engineering retweeted
PhP, a language that quietly runs a huge portion of the internet suddenly became front-page news because of severe, widely exploitable security flaws and the scramble to patch (or take offline) affected systems.💔
William | SOC and Detection Engineering retweeted
Knowing where to click doesn’t mean I understand what I’m seeing.
Tonight, it’s the Windows Registry.
No hacking. No investigation. Just studying and paying attention to the details I might otherwise rush past.
William | SOC and Detection Engineering retweeted
This year, I decided to do something different. I chose to mentor a young person in Cybersecurity. Having noticed her interest in the field, I took it upon myself to support her learning, growth, and development.
Ten months into this journey, I can confidently say it has been worth it. This is just the beginning. I look forward to the next five years of learning and growth.
Meet Michelle, a future Cybersecurity professional and a superstar. She is unstoppable ❤️✨🥂