Gemoh Mal.

a regυlar gυy ιnѕpιre тo lιve, laυgн, love, learn and grow

ⓣⓔⓒⓗⓝⓞⓛⓞⓖⓨ ⓔⓝⓣⓗⓤⓢⓘⓐⓢⓣ 💻🖥️🖱️

🎧podcast addict, ⚽🏀🏈🎮fan

[Formula 1 @F1]

FIRST LOOK! The plans for the purpose-built circuit in Bugesera, Rwanda 🇷🇼

Located 40 kilometres south of Kigali, the circuit will be designed to work in harmony with the natural landscape and use the area’s elevation changes to create a unique and challenging racing experience

#F1

[Thomas Roccia 🤘 @fr0gger_]

🧐 Our agent scanner allows you to scan SKILLs and MCP servers.

You can get a full verdict before installing the skill or MCP inside your agent

Check this out 👇
https://t.co/WU2j8mYH4x

[Florian Roth ⚡️ @cyb3rops]

One thing about this OpenAI / Hugging Face incident really bothers me. Hugging Face says the intrusion was driven “end to end” by an autonomous AI agent system.

But how do they actually know that?

Victim-side telemetry can show automation, speed, thousands of actions, short-lived sandboxes, changing infrastructure etc. It cannot show what happened upstream.

It cannot tell us whether humans changed prompts, restarted runs, selected successful paths, provided more context, redirected agents or manually helped at certain points. We also don’t know what was actually decided by a model and what was simply automated by the surrounding agent framework.

Maybe OpenAI has all those traces. Fine. Then publish them.

Show the prompts, tool calls, failed runs, model handoffs, restarts and human interventions. Without that, “end-to-end autonomous” is a claim, not a proven technical finding.

The forensic-refusal dataset Hugging Face published proves something much smaller: https://t.co/LemUxeaY4V

It shows that Claude refused to analyze one small Python backdoor while GLM 5.2 completed the analysis. That is a valid example of hosted-model guardrails getting in the way of incident response. But this is not evidence that the intrusion itself was carried out end to end by an autonomous agent.

And this claim matters because it pushes a very specific idea into people’s heads: AI agents can now independently find zero-days, escape sandboxes, move laterally, steal credentials and compromise companies.

Then comes the second part of the story: Hugging Face used local AI models to investigate the AI attacker “at machine speed”.

So the message basically becomes:

- AI attacked us
- AI helped save us
- Therefore, everyone needs more AI

Come on 🙄
Weak isolation, excessive privileges, poor credential boundaries, insufficient segmentation and far too much blast radius.

You don’t need an AI defender to fix those things.

Even fairly basic controls like rate limits and temporary blocks across source IPs, accounts, tokens and job volume could have throttled at least parts of this activity and created a very obvious signal for an analyst to review. Add proper egress restrictions, isolated workers and credentials that do not open the door to production clusters .. none of this requires an LLM

Using a local model to analyze 17,000 events may have helped during the investigation. Good - I’m not questioning that. But that happened after the compromise.

What I really hate is that something which would have been an embarrassment ten years ago is now repackaged as a capability demo, a heroic AI-vs-AI story and a marketing pitch.

Maybe the attack really was fully autonomous. Then show the evidence. Until then, I don’t think this claim should be repeated as if it had already been proven.

Sources
https://t.co/1yi9ck5xWD
https://t.co/TSlel0Cyfz
https://t.co/LemUxeaY4V

[Gemoh Mal. @Gemohmal]

CTI is vital to a modern security stack: Proactive vs. Reactive: We shift the team from chasing alerts to anticipating the next move.
Context is King: By tracking threat actor TTPs, we give our Center Backs(Network Sec) & Strikers(Vul Mgt) the exact intel they need to position

[Gemoh Mal. @Gemohmal]

With the 2026 FIFA World Cup underway, GIAC Certifications dropped a cybersecurity lineup analogy that hits the nail on the head. They mapped our role to the Defensive Midfielder (DM).
If you watch futbol, you know the DM is the unsung hero.

[Gemoh Mal. @Gemohmal]

We aren’t the Goalkeepers (Incident Response) making frantic, diving saves at the last second. Our job is to read the game early, intercept adversary playbooks, and shut down the attack before it ever reaches the box.

[Manchester City @ManCity]

Pep's Taxi: 10 years later! 🚖

Pep finally gets the chance to show Braydon where he kept all of those trophies... 🏆

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Defender was able to confirm a small but noticeable uptick in installations of OpenClaw initiated by Cline CLI installation script during the supply chain compromise of their NPM package that lasted approximately eight hours on February 17, 2026 between 11:26 and 19:30 UTC. Organizations using Cline CLI should urgently check environments for unexpected OpenClaw installations.

Cline is an open-source AI coding agent. On February 17, 2026, Cline published an advisory that an unauthorized party had used a compromised npm publish token to publish an update to Cline CLI on the npm registry: https://t.co/1WcoXCIWIf.

The altered npm package ([email protected]) was modified to perform the installation of OpenClaw as post-install script, as initially discovered and demonstrated by a security researcher: https://t.co/9dIGuju7dj. A corrected version has since been released.

For more information on the risk arising from self-hosted agent runtimes like OpenClaw, including monitoring and hunting guidance, read this blog: https://t.co/P4JpYK25Za

[Jon Hencinski @jhencinski]

How Ransomware Groups Got In: @rapid7 MDR’s Top Initial Access Vectors from Q1 2025.

Top Initial Access Vectors
- Account Compromise (No MFA)
- Vuln Exploitation (all known, patchable)
- Brute Forcing
- Exposed RDP
- SEO Poisoning

What our #MDR team saw in real-world ransomware intrusions in Q1—and what you can do to reduce risk 🧵

[Microsoft Threat Intelligence @MsftSecIntel]

Selecting "See the logic behind the query" shows an explanation of the KQL query & a breakdown of what each line in the query means. Seeing the logic behind the generated query offers an opportunity for hunters who are not experts yet to better understand KQL.

[Microsoft Threat Intelligence @MsftSecIntel]

Quick response (QR) code phishing attacks continue to be an impactful threat to end users and organizations alike, as threat actors continue to explore how to use QR codes to evade detection. https://t.co/AviCtbO7VT

[Gemoh Mal. @Gemohmal]

View my verified achievement from @CertifyGIAC. https://t.co/QC7HQ70iZm via @credly

[SANS Institute @SANSInstitute]

Our Top SANS Summit Talks of 2024 blog is out 🏔️

This year, SANS Summits hosted 13 events, featuring over 300 talks from top cybersecurity practitioners all over the world. Ranging from CTI, ICS, hacking, ransomware, and everything in between, enjoy these top Summit talks by @RachelTobac @yarden_shafir @fr0gger_ @Cyb3rWard0g @johullrich @it_audit @cyvatar @baileybercik @JefTek and more!

View Blog https://t.co/0cd1V9Ax6u

[Microsoft Threat Intelligence @MsftSecIntel]

We've also introduced a new use case detailing how SOC analysts can use Security Copilot to assess and manage incidents. https://t.co/ebCTx6JTov

[Microsoft Threat Intelligence @MsftSecIntel]

The new Microsoft Security Copilot Adoption hub, launched during #MSIgnite, provides resources that can help users enhance their Security Copilot skills and knowledge.
https://t.co/fbOnHOYOEo

[Gemoh Mal. @Gemohmal]

🔍 Microsoft Purview Updates: Enhanced AI data governance for better compliance and security. 🔐 AI Infrastructure Enhancements: Improved security and performance with Azure innovations.
#MSIgnite #CyberSecurity #AI #TechInnovation

[Gemoh Mal. @Gemohmal]

🌐 Microsoft Ignite 2024 Highlights 🌐

🚀 Security Copilot: AI-powered assistant enhancing security operations with actionable insights. 🛡 Security Exposure Management: New service for comprehensive risk management.

[Gemoh Mal. @Gemohmal]

💻 Windows 365 Link: Secure virtual PCs with seamless integration and passwordless login. 💥 $4M Zero-Day Hacking Challenge: Encouraging ethical hacking to secure AI and cloud services.

[delivr.to @delivr_to]

Zip Concatenation 📦⚠️

A recent blog from @AttackTrends (https://t.co/Yc8IGwaF8G) shows how actors are concatenating zip files to evade mail filters and deliver malicious content

🛡️ Test deliverability: https://t.co/hikAhtMfkc
🔍 Detect with YARA: https://t.co/7KAgUgbzdu
🧵1/3

[Florian Roth ⚡️ @cyb3rops]

Cisco‘s security products use static accounts with static passwords
https://t.co/12ofOxVDpu