Securance Consulting

IT audit and cybersecurity since 2002. Senior-led, never offshore, no products to resell. Plain-English takes on cyber threats to government and enterprise IT.

[Securance Consulting @SCsecurance]

Your backup admin account is probably one of the most privileged and least reviewed accounts you have. Ransomware crews know it, and they go after it first.

If your recovery plan hasn’t been tested against that, it’s a document, not a plan.

https://t.co/deeCrpTeqD

[Securance Consulting @SCsecurance]

A ransomware tabletop is 3–4 hours in one room, not a multi-day outage drill. Where plans stall: a call tree naming someone who left, no one sure which backups are isolated, insurer notice rules missing, legal and comms unsure when to join. https://t.co/jcO4okixZV

[Securance Consulting @SCsecurance]

Practical takeaway from Arctic Wolf’s AntiFox findings: look for the successful AWS API calls hiding inside bursts of denials. Most attempts failed. The few that worked exposed production secrets, all through valid credentials.

[BleepingComputer @BleepinComputer]

Hackers use AntiFox AI agents in AWS credential-theft attacks
https://t.co/7h9H0jNcv4

https://t.co/7h9H0jNcv4

[Securance Consulting @SCsecurance]

Affected versions and details via @SecurityWeek: https://t.co/TVYwDkAVKi

[Securance Consulting @SCsecurance]

Microsoft patched an exploited Outlook zero-day yesterday. One opened message file makes Outlook reach an attacker’s server without warning and leak the user’s NTLMv2 hash.

Hospitals, schools, local gov: push the Office update today. Then ask if staff would open that file.

[Securance Consulting @SCsecurance]

Paul's full article, with three things worth doing before mid-December: https://t.co/7N9aAKzokU

[Securance Consulting @SCsecurance]

1/ Most security gaps don't appear in December. They've been there all year. The holidays are just when they get expensive: change freezes, thin coverage, distracted employees, and executives who are hard to reach.

[Securance Consulting @SCsecurance]

3/ Securance president Paul Ashe argues that the real holiday risk is complexity, and the answer is simplifying the program before mid-December. Which part of your security program would you least want to rely on during a holiday week?

[Securance Consulting @SCsecurance]

Details from @BleepinComputer: https://t.co/js4UiMH1jT

[Securance Consulting @SCsecurance]

SSHole (CVE-2026-123158) was under attack within two days of its fix, and CISA added it to KEV yesterday. If you run Alpine or other musl-based Linux, update OpenSSH to 10.6p2 and restart sshd. Can’t patch yet? Turn off SSH password authentication. #OpenSSH

[Securance Consulting @SCsecurance]

@BleepinComputer Eight exploited Chrome zero-days this year, and none of the fixes count until the browser relaunches. Worth checking today how many endpoints haven’t restarted since yesterday’s update.

[Securance Consulting @SCsecurance]

Patch Tuesday drops at 1 p.m. ET. Don’t wait for it to start: Google fixed an exploited @googlechrome zero-day yesterday (CVE-2026-125350). For a county IT team the order holds every month. Exploited first, internet-facing next, the rest on schedule. #PatchTuesday

[Securance Consulting @SCsecurance]

A food and beverage manufacturer’s executives had never tested their IR plan. One tabletop exercise exposed three open questions: who sets the ransom ceiling, how evidence is preserved, and when customers hear. Each now has an owner. #RansomwareReadiness

https://t.co/yXN283l6pb

[Securance Consulting @SCsecurance]

Via @nodejs: https://t.co/rZdALTq0pt

[Securance Consulting @SCsecurance]

Two patch drops to plan around this week. Microsoft's Patch Tuesday lands tomorrow. Node.js ships fixes for its 22, 24 and 26 lines on or shortly after Wednesday, top severity High. Anything still on Node 20 or older gets no fix at all. Find those installs before Wednesday.

[Securance Consulting @SCsecurance]

@MauriSecOps @kultekin Then confirm the brake engaged. sshd keeps the first value it reads, so an earlier line or a drop-in in sshd_config.d can override a PasswordAuthentication no added at the bottom. Restart sshd, run sshd -T | grep -i passwordauth, and check Match blocks too.

[Securance Consulting @SCsecurance]

Since 2016, OpenSSH on Alpine Linux without PAM has let key-only accounts accept any password over 256 characters. Found by @kultekin. Fix: update to 10.6p2 or turn off password logins.

[Securance Consulting @SCsecurance]

@Eugenesuofx @HIPAAJournal The report doesn’t say what training Marathon’s staff had. Training helps, but a rule helps more: if anyone claiming to be IT asks for your password, stop and contact IT yourself through a number or channel you already know. Then test whether people actually follow it.

[Securance Consulting @SCsecurance]

Marathon Health is reportedly notifying 5.7M people after someone posing as IT tricked one employee into sharing credentials. Would your staff verify that request first?

via @HIPAAJournal #HIPAA

https://t.co/R77qI9i3rW

[Securance Consulting @SCsecurance]

https://t.co/3MW0fUuk1H

[Securance Consulting @SCsecurance]

@PVynckier Nearly everything on this list is tooling that speeds up detection and containment. What decides the outcome is the plan around it: who declares the incident, who approves the spend, and whether anyone has rehearsed it. Tools speed up a response. They don’t replace one.