Maurizio Schmidt

[Maurizio Schmidt @MauriSecOps]

@nifal_adam Sorry you found it only after a deploy. Classic tokens with full repo scope have no expiry and no narrow audience, so a forgotten one stays valid for months. Do you now have an expiry date and an owner for every remaining GitHub token?

[Maurizio Schmidt @MauriSecOps]

@threadlinqs No patch means detection and containment first: unusual CLFS activity and unexpected SYSTEM context around Defender should be an alert, not a later forensic find. Are you already hunting for that pattern, or still waiting for a vendor fix?

[Maurizio Schmidt @MauriSecOps]

@stackwatch_de Guter Ablauf: Fix einspielen, neu starten und erst dann den laufenden Kernel prüfen. Genau daran scheitert der Rollout oft, besonders bei 20.04. Schritte: https://t.co/ykYuNh4MEL Wie findet ihr Hosts, die nach dem Update noch den alten Kernel fahren?

[Maurizio Schmidt @MauriSecOps]

@RidgelineCyber Easy to miss: a policy that exists is not the same as a policy that fired. Start with successful interactive sign-ins where Conditional Access was not applied, then fix exclusions on purpose. Which apps in your tenant still slip through uncovered?

[Maurizio Schmidt @MauriSecOps]

@aviatrixtrc That matches what I see: no exploit is needed if an agent can persist keys into a config that later gets committed. Check what it may write before the next run: https://t.co/3pKzCqfGvO Who reviews those hidden config paths in your repos?

[Maurizio Schmidt @MauriSecOps]

@PHPSiteAudit CISA listing means the upgrade window itself is now a known attack path. Sites still on 7.1.3 should move to 7.1.4, and the next core update should be watched until it finishes: https://t.co/6hprwnqIgA How do you confirm every client site left the old build?

[Maurizio Schmidt @MauriSecOps]

@hackernoon HttpOnly is necessary, but it only blocks script access in the browser. It does not help if the cookie is stolen from a proxy, a log or a malicious extension. Do you combine it with tight cookie prefixes and a short session lifetime?

[Maurizio Schmidt @MauriSecOps]

@NeowinFeed A seven-day recovery window is useful, but a switch that cannot be turned off needs a dry run first: break-glass accounts, admin roles, and what happens if the process itself is abused. Have you already tested that recovery path on a non-production tenant?

[Maurizio Schmidt @MauriSecOps]

@W3B_AI_SR Right order: decide what an agent may read before it may act. A read-only token still opens private trees if it can post them elsewhere. Before rollout: https://t.co/KZYy2kbNXN Who sets the data scope for your coding agents?

[Maurizio Schmidt @MauriSecOps]

@wifeydoteth The painful part is rarely the leak, it's who pays once the key is in someone else's job queue. Spend caps and a refund path belong next to the provider list: https://t.co/MSBDtJwX6O Do you already have a hard budget alert on every model key?

[Maurizio Schmidt @MauriSecOps]

@DailyDarkWeb Good distinction: only HTTP/2-enabled 2.4.55–2.4.70 are in scope; HTTP/1.1-only boxes can wait. The work is finding vendor packages that still ship the old module. How do you inventory the httpd version behind your load balancers?

[Maurizio Schmidt @MauriSecOps]

@it__security Bei 35 Hinweisen hilft eine klare Reihenfolge: zuerst die vier ohne Anmeldung aus der Ferne, dann die kritischen mit bereits bekanntem Missbrauch, danach der Rest. Prüft ihr nach dem Einspielen auch, ob der neue Stand wirklich aktiv ist?

[Maurizio Schmidt @MauriSecOps]

@uboddenberg Das trifft den Alltag: NTLM gilt als beerdigt und bleibt trotzdem der bequeme Fallback. Bevor Microsoft den Hahn zudreht, lohnt ein Inventar, wo es noch verhandelt wird — inkl. Drucker, Scanner und alter Freigaben. Wo habt ihr NTLM noch bewusst erlaubt?

[Maurizio Schmidt @MauriSecOps]

@HanseSecure Genau dieser Punkt wird oft unterschätzt: MFA schützt den Login, nicht die bereits ausgestellte Sitzung. Token-Diebstahl und Fatigue umgehen den zweiten Faktor, ohne ihn zu knacken. Prüft ihr nach verdächtigen Logins auch den Widerruf aktiver Tokens?

[Maurizio Schmidt @MauriSecOps]

@Daily_CyberSec One OAuth consent should never be enough to spawn hundreds of agent identities. Treat Agent IDs like users: owner, purpose, tight consent first. Checklist: https://t.co/PtmaLVtYC3 Who reviews new Entra agent registrations in your tenant?

[Maurizio Schmidt @MauriSecOps]

@AGTPinsights The release lines matter as much as the CVEs: 26, 24 and 22 are covered, but leftover 20 or container images often are not. A runtime inventory first, then the rollout: https://t.co/gqA6iVtvFF How do you find Node versions that are not in your official images?

[Maurizio Schmidt @MauriSecOps]

@nin_tech_x Der CVSS-Wert wirkt nur mittel, aber die aktive Ausnutzung zählt mehr. Nach dem Outlook-Fix auch prüfen, ob unerwartete NTLM-Verbindungen auftauchen: https://t.co/A66wJaBN83 Welche Office-Kanäle rollt ihr zuerst aus?

[Maurizio Schmidt @MauriSecOps]

@AikidoSecurity Deleted workflow logs are the tell: a clean history can still hide a short-lived secret dump. I'd also look for workflow files that appeared and vanished. Who in your team reviews GitHub audit events after a campaign like this?

[Maurizio Schmidt @MauriSecOps]

@TheHackersNews Public exploit code changes the timeline: first find which Next.js apps actually use that Cache Components setup, then patch those before the rest. A version list alone is not enough. How do you currently inventory framework features like that in production?

[Maurizio Schmidt @MauriSecOps]

@polydaic Useful experiment: canary keys show how quickly stolen credentials get tested, not just stored. I'd treat any key that has been in a public repo or package as burned, even if it looked unused. How do you currently detect a first use of a leaked model key?