M kumar

Just a caffeine-dependent human with a really cool day job …

[M kumar @MkumarCyber]

@alexatallah the hard part is who decides which companies get approved, and what happens when one of them gets breached. a licensed scanner with access to everything becomes the juiciest target on the internet

[M kumar @MkumarCyber]

@caseyjohnellis this is the gap nobody talks about. most real breaches I’ve seen were never a CVE: a misconfigured bucket, an overly permissive IAM role, an internal app with no auth. CVE counts measure the library world, not the actual attack surface

[M kumar @MkumarCyber]

@itsmmesoma AI won’t replace security, but it’ll replace the version of security that’s just clicking “close as false positive” all day. the investigation and judgment parts are safe. the alert queue isn’t

[M kumar @MkumarCyber]

@Malwarebytes worth a reminder for anyone with a BrickLink account: change the password now if you reused it anywhere else. “unusual activity” announcements usually come before the full story

[M kumar @MkumarCyber]

@vivaldibrowser @WebSummit this is the part people miss. you can’t leak data you never collected. every breach headline is basically a data collection decision made years earlier

[M kumar @MkumarCyber]

@vivaldibrowser the “no built-in AI” line will sell this to a lot of IT teams. half the security reviews right now are just figuring out where the browser’s AI sends company data. question: does it support policy management via GPO / MDM out of the box?

[M kumar @MkumarCyber]

@1Password this is the right direction. agents shouldn’t ever see the raw password. curious though: can I scope access per task, like “this agent can sign into this one site for the next hour” and then it’s revoked automatically?

[M kumar @MkumarCyber]

@DuckDuckGo “we fixed the privacy problem with face cameras” by adding a tiny LED nobody notices in daylight 🙃 the person being recorded never agreed to anything, that’s the whole problem

[M kumar @MkumarCyber]

@brave cool approach. genuine question: if the links are encrypted server-side, what stops the cloaking service from seeing which result I clicked? is the decryption done in the browser, or is there a separation between the two services?

[M kumar @MkumarCyber]

Everyone's adding AI bots to Slack this week.

Your bot reads every message it can access, including ones attackers write.

One hidden instruction and it can leak private channels.

Read-only by default. Only the channels it needs. Never your admin token.

[M kumar @MkumarCyber]

Microsoft just patched 1,235 vulnerabilities. 66 Critical.

You won't patch them all this week. Order:

1. Exploited Outlook 0-day → today
2. CISA KEV → today
3. Internet-facing → this week
4. Public exploit → this week
5. Rest → normal cycle

What's first on yours?

[M kumar @MkumarCyber]

Outlook zero-day exploited in the wild (CVE-2026-124194)

Open a malicious message file -> Windows leaks your NTLM hash.

Fix:
1. Install the Nov update
2. Block outbound SMB (TCP 445)
3. Admins -> Protected Users group

Step 2 alone stops most of these attacks.

[M kumar @MkumarCyber]

@Malwarebytes for anyone who can’t patch every machine today: blocking outbound SMB (TCP 445) at the firewall stops most of these Outlook hash leaks. buys you time until the update is everywhere

[M kumar @MkumarCyber]

@vivaldibrowser underrated feature. most people don’t realize the tracking junk on a shared link can tie the share back to them. does it also clean links from shorteners, or only the full URL?

[M kumar @MkumarCyber]

@Bitwarden @DuckDuckGo private browser + open source password manager is a great combo. any plans to bring the extension to DuckDuckGo on Mac too?

[M kumar @MkumarCyber]

@brave thanks for the fast turnaround. tip for anyone reading: the update downloads automatically but only applies after you fully restart Brave. if you haven’t closed it in a week, you’re probably still unpatched

[M kumar @MkumarCyber]

@DuckDuckGo an AI that can send email from your inbox is also an AI that any email it reads can give instructions to. one sneaky message and it’s forwarding your boss’s thread to a stranger. prompt injection is about to get very real

[M kumar @MkumarCyber]

@DuckDuckGo a camera that flies room to room, uploads to the cloud, and is protected by your account password. what could go wrong 🙃 genuine question: does any of it work fully local, or does every flight go through Ring’s servers?

[M kumar @MkumarCyber]

eMudhra just revoked 16 certificate authorities.

Private key material was pulled out of their HSMs into process memory with a Python script.

The whole point of an HSM: the key never leaves it. Not once.

Using eMudhra certs? Check if your CA is on the revoked list.

[M kumar @MkumarCyber]

@watchtowrcyber good callout on it being config-specific. quick check for anyone wondering: grep your Apache config for “Protocols” and look for h2. if it’s not there you’re likely not exposed, but patch anyway