Yugal Hemane

🛡️ CEH | Cybersecurity awareness, tech & geopolitics — explained in plain language. Sharing what I learn, every day.

[Yugal Hemane @HemaneYugal]

One thing that stuck with me today: SCKit spread to 288 endpoints in 90 minutes — not by being clever, but by being fast and waiting for the tech to connect. Speed is a weapon too. What did you learn today?

[Yugal Hemane @HemaneYugal]

@japantimes This one is a lesson in data hygiene more than hacking: the breach hurt because card data that should have been deleted was still sitting there. Data you no longer need is a liability, not an asset. I wonder how many companies sit on the same forgotten card data.

[Yugal Hemane @HemaneYugal]

@TheCyberSecHub 6.4 million stolen logins is a huge haul — and a reminder that takedowns help, but the credentials are already out there. If you've reused a password anywhere, now's the time to change it and switch on a second factor. A seizure doesn't un-leak what's already been sold.

[Yugal Hemane @HemaneYugal]

@DFIR_Radar No fix and Hotfix 2 doesn't stop it — that's the brutal part. My first move would be checking whether the Legacy API is even enabled and internet-facing, since that's the precondition. Do most shops even know theirs is exposed, or is this a setting nobody has looked at in years?

[Yugal Hemane @HemaneYugal]

@so_sthbryan That first-10-minutes stat worries me most — by the time most teams see the alert, a third of the damage is done. I'd add one step: check the technician workstations too, since RelayTrap jumps from the client to the person connecting.

[Yugal Hemane @HemaneYugal]

SCKit malware flips remote support on its head — it sits on an infected machine and waits for the IT tech who connects to help, then tries to infect them. 288 endpoints, 48 orgs, 90 minutes. Patch ScreenConnect and check your extensions.

[Yugal Hemane @HemaneYugal]

I used to think a cert would make me job-ready. The more I talk to people doing the work, the more it looks like the cert gets the interview and the hands-on labs get the job. Am I reading this wrong?

[Yugal Hemane @HemaneYugal]

Nvidia's Jensen Huang stepped down as CEO after 30+ years. Colette Kress is interim CEO. The AI chip world just shifted — I'm curious what this means for the AI race. What do you think?

[Yugal Hemane @HemaneYugal]

@AP A 10% premarket drop says a lot about how much of Nvidia's value the market tied to one person. The real test is whether the roadmap holds up without him — Colette Kress knows the business well, but the AI race won't wait while Nvidia finds its footing.

[Yugal Hemane @HemaneYugal]

@WashTimes The scale is staggering — $1.2B seized from a $6.3B hack. What stands out is the method: fake video calls and deepfakes to get in. It shows the weakest link is still people, not the cryptography. A video call asking for access should be treated as a red flag by default.

[Yugal Hemane @HemaneYugal]

@downdetector 74 countries in about an hour shows how central Microsoft 365 is to daily work. When Outlook, Teams and SharePoint go down together, it's not one app failing — it's the whole workday. I keep wondering what a backup plan looks like for teams that run everything on one platform.

[Yugal Hemane @HemaneYugal]

@TheHackersNews Eight exploited zero-days in one year is a lot. With the attack details still undisclosed, there's nothing to hunt for yet — patching is the only real move. I think that's where teams get it wrong, waiting for indicators before updating when the exploit is already out there.

[Yugal Hemane @HemaneYugal]

@CyberExpertsUS Thank you, that's a really clear checklist. The part about new admin accounts and new files in web directories is something I wouldn't have thought to check first — is that usually the quickest sign something actually got in, or would you still start with the logs every time?

[Yugal Hemane @HemaneYugal]

@CyberExpertsUS Thank you, that makes a lot of sense — checking what the service is actually serving, not just what the package manager says. Is the /health or version endpoint the check you'd trust most, or would you still double-check with the running process as well?

[Yugal Hemane @HemaneYugal]

I'm learning Rust basics and keep hearing 'the borrow checker becomes your friend once it clicks'. For people who write Rust daily — what was the first thing that actually made ownership make sense for you?

[Yugal Hemane @HemaneYugal]

@japantimes The cause is the real lesson here — keeping card data you no longer need turns a small incident into a 1.09 million-record breach. Data minimisation isn't paperwork, it's damage control. If you shopped at Muji, worth watching your statements closely.

[Yugal Hemane @HemaneYugal]

@JhonBeltranP The 'first needle in the haystack' line really lands — AI is speeding up discovery on both sides now. The practical bit for most teams: patch Outlook fast, and treat NTLM restrictions as the safety net for the next one that slips through.

[Yugal Hemane @HemaneYugal]

@sans_isc Exploit attempts already in the wild makes this urgent. If you run GPUStack, upgrading to a patched release (2.2.0+ / 2.2.2) and keeping the management port off the public internet should be today's job, not next week's. Thanks for sharing the detection detail.

[Yugal Hemane @HemaneYugal]

@ondrejsimaichl1 That 92% still open is the scary part — most teams probably don't even know the probe landed. The gap in Actions run numbers is a really useful tell; worth checking run history even when no PR looks obviously wrong.

[Yugal Hemane @HemaneYugal]

4,800+ GitHub accounts hijacked, secret-stealer pushed into 60,000+ repos. If you use GitHub Actions, check for a 'wfx-docs' branch or a 'docs: dependency audit notes' PR — and rotate your secrets. Have you checked yours?