Joe Garcia

Started in Enterprise InfoSec. Now Automation & DevOps Security for @CyberArk. Gopher. (All views & opinions are my own.)

[Joe Garcia @InfamousJoeG]

In flight to Boston for @CyberArk IMPACT. I’ll be posting all week from the event! There’s still time to register for the virtual event at https://t.co/7DLdwuxAhL.

[Brendan Falk @BrendanFalk]

To check if your Google Workspace has been compromised by the same tool that compromised Vercel:

1. Go to https://t.co/TpuIOW5Fwg
- This is Google Admin Console > Security > Access and Data Control > API Controls > Manage app access > Accessed Apps
2. Filter by ID = https://t.co/uqJnCqp5Ah
- This is the ID of the compromised OAuth app

If you see an app after filtering, you have potentially been compromised

[Vercel @vercel]

We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin:
https://t.co/0S939n3qHC

[Damian Player @damianplayer]

this is the MOST important 4 minutes you’ll watch on AI this year.

anthropic built a model so good at finding vulnerabilities they didn’t release it to the public.

>CLAUDE MYTHOS PREVIEW

it’s unreleased to the public and here’s what it did in a few weeks:

>found a 27-year-old vulnerability in OpenBSD

>caught a 16-year-old flaw in FFmpeg that automated tools missed after 5 million tests

>chained together multiple linux kernel exploits autonomously. no human steering.

AWS, google, microsoft, apple, nvidia, crowdstrike, JPMorgan. all got access.

Anthropic committed $100M in credits to let these companies hunt vulnerabilities in their own systems before attackers do.

>93.9% on SWE-bench verified. >77.8% on SWE-bench pro.

nothing else is comes remotely close. Anthropic just pulled away in this AI race…

[Dave LaGreca @davidlagreca1]

I think @Skyebyee is my new favorite wrestler #AEWDynamite

[Joe Garcia @InfamousJoeG]

@ewarren Don’t let your weak leader cave

[CyberArk Labs @CyberarkLabs]

“This attack methodology, which abuses legitimate tools, sites, and services, is becoming increasingly common in supply chain attacks aimed at poisoning development environments or stealing credentials for malicious purposes,”

https://t.co/HrS3pvIfcA

[Joe Garcia @InfamousJoeG]

@atrupar BUT WHAT DO THE BAILEYS THINK?! /s

[Redd Legend @ReddLegend]

: The brilliance of Chris Hedges...

[Zohran Kwame Mamdani @ZohranKMamdani]

WU-TANG FOREVER 👐🏽

[Gavin Newsom @GavinNewsom]

If they can handcuff a U.S. Senator for asking a question, imagine what they will do to you.

[Tom Morello @tmorello]

Hope that helps.

[CyberArk @CyberArk]

From CyberArk’s @InfamousJoeG's session on Ansible’s single machine credential problem to meeting with customers and prospects, this year’s @RedHatSecurity Summit was amazing! Here are some highlights of our team at the show!

#IdentitySecurity #RedHatSummit #cybersecurity

[Joe Garcia @InfamousJoeG]

In the Expo Hall at the AnsibleFest Theater!

[CyberArk @CyberArk]

Heading to @RedHat Summit tomorrow? Don’t miss CyberArk’s @InfamousJoeG as he tackles Ansible’s single machine credential problem—live in session.

#IdentitySecurity #RedHatSummit #cybersecurity

[CyberArk @CyberArk]

Headed to #RedHatSummit on May 20th? Make sure to stop @InfamousJoeG's session and he'll show you how to solve Ansible's single machine credential problem.

[Tampa International Airport ✈️ @FlyTPA]

A very good morning to everyone except the Florida Panthers

[Alexandria Ocasio-Cortez @AOC]

Tell me we’re in his head without telling me we’re in his head

[Joe Garcia @InfamousJoeG]

They ARE hacking trust relationships, identities, and APIs…

[Florian Roth ⚡️ @cyb3rops]

We’re seeing a clear trend: attackers are bypassing the endpoint entirely. Not just avoiding traditional EDR-monitored systems by pivoting to embedded and edge devices, but now also operating purely in the cloud. No shell, no malware, no persistence on the endpoint. Just an OAuth token and full access to whatever’s in the victim’s Microsoft 365, Google Workspace, or AWS console.

It’s a complete inversion of how things used to be. The endpoint, once the weakest link, is now usually the most monitored, most policy-enforced part of the infrastructure. You’ve got EDRs, SIEM integration, automation, threat hunting - the full stack. But attackers don’t need to touch it anymore.

Instead, they go after the new soft spots:

- Cloud platforms, where logging is limited, expensive, or off by default
- Network devices and appliances, which are practically blind spots - obscure OSes, no EDRs, hard to monitor, hard to forensicate.
- Embedded systems and IoT junk that no one really knows how to secure, but that sit in critical network paths.

Cloud especially is a mess:

- Logging tiers cost extra and the good stuff is behind paywalls.
- Detection content is lacking, both from vendors and the community.
- You don’t get memory dumps or full control like you do on endpoints.
- You’re at the mercy of the provider when it comes to visibility and response.

And that’s the shift: attackers aren’t hacking computers anymore. They’re hacking trust relationships, identities, and APIs. The whole idea of detection and response needs to evolve with that. Otherwise, we’re securing the hell out of endpoints while attackers happily fish through mailboxes and cloud shares from halfway across the planet.

[CyberArk @CyberArk]

"If AI is going to defend instead of endanger, identity must be the strongest link.” Former CISA Director Jen Easterly underscores the urgent need for robust identity security amid the rapid acceleration of AI at CyberArk IMPACT25.

#IdentitySecurity #CYBRIMPACT #cybersecurity

[Alexandria Ocasio-Cortez @AOC]

Any member of Congress who purchased stocks in the last 48 hours should probably disclose that now.

I’ve been hearing some interesting chatter on the floor.

Disclosure deadline is May 15th. We’re about to learn a few things.

It’s time to ban insider trading in Congress.

[Joe Garcia @InfamousJoeG]

It’s Machine Identity Security day at #CYBRImpact - waiting for the keynote by Kurt Sand while preparing to tackle the day!