Ray M., MSc, CFE

Solving problems @cadmuscyber • Building solutions @brandefystudio • Teaching healthy living @raysfitnesske • Reposts ≠ Endorsements. 🇰🇪

[Ray M., MSc, CFE @ItsRayHere]

Can’t emphasize point 2 enough.

[Sahil Bloom @SahilBloom]

A 22-year-old follower recently messaged me asking for career advice.

Here are the 5 pieces of advice I shared:

1. Swallow the Frog: This is one of the greatest "hacks" to get ahead early in your career. Observe your boss, figure out what they hate doing, learn to do it, and take it off their plate. Easy win.

2. Do the "Old Fashioned" Things Well: There are simple things that still stand out. Look people in the eye, do what you say you'll do, be early, practice good posture, have a confident handshake. It sounds silly, but these things are all free and will never go out of style.

3. Work Hard First (& Smart Later): It's in vogue to say that working smart is all that matters. Wrong. If you want to accomplish anything meaningful, you have to start by working hard. Build a reputation for hard work—take pride in it. Then you can start to build leverage to work smart.

4. Build Storytelling Skills: World-changing CEOs aren't the smartest or most talented in their organizations. They are exceptional at: (1) Aggregating data and (2) Communicating it simply & effectively. Data in, story out. Build that skill and you'll always be valuable.

5. Build a Rep for Figuring It Out: Early on, you'll be given a lot of tasks you have no idea how to complete. There's nothing more valuable than someone who can just figure it out. Do some work, ask the key questions, get it done. People will fight over you.

Embrace those 5 pieces of advice and I guarantee you'll stand out and be on the right track.

If you enjoyed this or learned something, follow me @SahilBloom for more in the future.

[Piga Firimbi @pigafirimbi]

Dennis Itumbi, Head of Presidential Special Projects in Kenya's State House, shared a photo on X claiming to show world leaders at the 2026 G7 Summit. It contains at least four verifiable red flags.

A fact-check🧵

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: 320,000 Fortinet firewall devices have been targeted in a campaign that has been dubbed 'FortiBleed'. Attackers were able to confirm 75,000 working credentials against the admin and SSL VPN interfaces.

The victims include really big names like Samsung, Oracle, Spotify, Sony, and more.

The data was first surfaced by researcher Volodymyr "Bob" Diachenko and analyzed by Hudson Rock and SOCRadar. The operation runs as a self-feeding loop. Attackers scan the internet for exposed Fortinet devices, then test each one against a curated list of passwords leaked from earlier Fortinet breaches and infostealer logs. Every successful login gets recorded into a verified database. They then turn each compromised box into a listening post, sniffing the traffic passing through the firewall to harvest fresh credentials, which go straight back into the scanner.

The scale is large. The group ran an estimated 1.16 billion credential attempts against more than 320,000 FortiGate targets, plus 2.1 billion brute-force tries against 160,000 MSSQL servers. In the deeper intrusions they intercept SSL VPN authentication hashes, crack them on a dedicated 45-GPU cluster, and move into internal Active Directory.

Diachenko confirmed full network compromises in Japan, Taiwan, Vietnam, Iraq, and Turkey, including a Turkish NATO defense contractor that had classified defense documents stolen.

If you run Fortinet, act now: rotate every VPN and admin credential, enforce MFA on all external gateways, restrict management access to approved sources, segment internal networks, and audit gateway logs for unusual logins. Hudson Rock has a free domain lookup at https://t.co/KLv2YiMtpm.

Data surfaced via the Hunt Intelligence, Inc. feed.

[Ray M., MSc, CFE @ItsRayHere]

@designsentry @AikidoSecurity What are you saying? 😂

[Aikido Security @AikidoSecurity]

⚠️ New "IronWorm" supply-chain attack: 30+ npm packages from @ asteroiddao shipped a malicious Rust binary firing on preinstall.

It sweeps 86 env vars + 20 credential files (AWS, GCP, Vault, npm, plus AI keys like Anthropic & OpenAI), hits Exodus wallets, hides behind an eBPF rootkit, and beacons over Tor. Self-propagates via npm Trusted Publishing OIDC, with backdated commits faked as claude/dependabot/renovate.

[Ray M., MSc, CFE @ItsRayHere]

@ODPC_KE You say registration is a statutory obligation but the registration flow presents an optional path for businesses with turnover < KES 5m and that don’t process data in sensitive categories predetermined by ODPC. So is it actually mandatory? Messaging is unclear.

[Ray M., MSc, CFE @ItsRayHere]

@ODPC_KE You say registration is mandatory but the registration flow presents an optional path for businesses with turnover < KES 5m and that don’t process data in sensitive categories predetermined by ODPC. So is it actually mandatory? Messaging is unclear.

[Ray M., MSc, CFE @ItsRayHere]

Let me just laugh. 😂

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

[David Odes @chiefdavidsays]

Ikeja Electric was hacked through a profile photo upload form.

The threat actor exploited an Unrestricted File Upload vulnerability on their Smart Warehousing Inventory Management System, uploaded a webshell, and had remote access within minutes.

From there, he moved through their network, finding passwords stored in plain text, using them to access internal systems, and eventually cracking the domain admin password.

Gaining full control in four days.​​​​​​​​​​​​​​​​

He then exploited an unpatched VMware vCenter server—software from 2018, never updated—and according to him, deployed ransomware across 50+ hosts, taking down metering software across their systems.

I’ve published a full analysis of what I’m now calling cyber-terrorism against Nigerian critical infrastructure, along with a practical advisory for affected individuals, organisations, and regulators.

https://t.co/0rzvhVcLNf

[International Cyber Digest @IntCyberDigest]

🚨 UPDATE on the cPanel/WHM authentication bypass (CVE-2026-41940): Shadowserver now reports at least 44,000 unique IPs compromised and actively scanning their honeypot network on April 30, 2026.

What this means in practice. Within roughly 24 hours of public disclosure, attackers have already taken over enough vulnerable cPanel/WHM servers to use them as a global scanning swarm, hunting for the next batch of victims. Each of those 44,000 IPs is itself a compromised host, mostly shared-hosting servers running customer websites, email, and databases.

Shadowserver also reports approximately 650,000 cPanel/WHM instances exposed to the internet in total. Anything not patched today is sitting in the targeting pool.

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: cPanel and WHM, the control panels behind an estimated 70+ million websites, have a critical security flaw that lets anyone become root admin without a password. CVE-2026-41940 affects every supported version. It’s already being exploited in the wild.

watchTowr Labs published the full attack today, after the hosting company KnownHost confirmed the bug was already being used to break into a significant chunk of the internet.

If you've never heard of cPanel: it's the dashboard that hosting providers and millions of website owners use to manage their servers, domains, email accounts, databases, and SSL certificates. WHM is the admin version that controls the entire server. If someone gets root access to WHM, they get the keys to the kingdom and to every apartment inside it.

How the attack works, in plain English:

🔴 Step 1: The attacker sends a deliberately wrong login. cPanel still creates a temporary "you tried to log in" record on disk and gives the attacker a cookie tied to it.
🔴 Step 2: The attacker tweaks the cookie to disable cPanel's password encryption. Normally cPanel encrypts the password field on disk. With one small change to the cookie, cPanel just stores it as plain text instead.
🔴 Step 3: The attacker sends a fake login attempt where the password field secretly contains hidden line breaks. cPanel does not strip these line breaks out, so they get written straight to the session file. Each line break creates a brand new fake record. The attacker uses this to inject lines that say "this user is root" and "this user already authenticated successfully."
🔴 Step 4: The attacker visits one more random page on the site to nudge cPanel into re-reading the file. cPanel then promotes the injected fake lines into its main session memory.
🔴 Step 5: On the next request, cPanel sees a flag that says "this user already passed the password check." cPanel trusts that flag, skips checking the actual password, and lets the attacker in as root.

From start to finish, the attack takes a handful of HTTP requests.

If you run cPanel or WHM, the patched versions are:

🔴 cPanel/WHM 110.0.x → 11.110.0.97
🔴 cPanel/WHM 118.0.x → 11.118.0.63
🔴 cPanel/WHM 126.0.x → 11.126.0.54
🔴 cPanel/WHM 132.0.x → 11.132.0.29
🔴 cPanel/WHM 134.0.x → 11.134.0.20
🔴 cPanel/WHM 136.0.x → 11.136.0.5

If your version is older than these, assume someone has already broken in and act accordingly. Patch right now, then rotate every password and key the server touched: root passwords, API tokens, SSL private keys, SSH keys, mail passwords, and database passwords.

[JER @lifeof_jer]

https://t.co/ofucbVgkLV

[Vercel @vercel]

We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin:
https://t.co/0S939n3qHC

[Ray M., MSc, CFE @ItsRayHere]

@kcsfa Good idea, though I foresee adoption challenges. For instance, how does this work where publishers use pseudonyms and other anonymization techniques for legitimate reasons?

[Ray M., MSc, CFE @ItsRayHere]

@ill_will_0 @BRIGHTZEED I’d be so happy to subscribe to your highly technical content. Let’s go!

[Ray M., MSc, CFE @ItsRayHere]

@outsydlookinin @BRIGHTZEED And?

[harry @Harrris0n]

In my previous post, I demonstrated how Waze user data can be scraped from the public web map to track individuals.

But I glossed over something important: what does Waze's own privacy policy say about your data?

I went through the full policy. Here's what stood out.

[harry @Harrris0n]

UPDATE: Waze has removed the username field from reports shown on their live map. I would still heavily encourage users to turn on invisible mode

[harry @Harrris0n]

https://t.co/7zsdN8sgoH

[Bright Mawudor,PhD @BRIGHTZEED]

AI coding or Vibe coding as they call it these days helps to write code faster has been helping to produce applications really fast. It is great for prototyping but without careful consideration, you might be in for a disaster.
There are extra measures to take into consideration to avoid security vulnerabilities which needs going back to basics. Too many applications vibe coded these days are producing vulnerable applications and spilling out sensitive data. We need to avoid them as much as possible by going back to basics

[Mwango Capital @MwangoCapital]

After months of speculation, NCBA Group PLC has confirmed that it has received an offer to be acquired by Nedbank Group Limited:

— Nedbank Group Limited is one of South Africa’s largest banking groups and is listed on the Johannesburg Stock Exchange (JSE).
— Nedbank is seeking to acquire up to 66% of NCBA through a tender offer valuing the bank at 1.4x book value, with the remaining 34% of shares continuing to trade on the Nairobi Securities Exchange.
— Under the proposed structure, participating NCBA shareholders will receive 20% of the consideration in cash, with the remaining 80% settled through the issuance of Nedbank ordinary shares listed on the JSE.