Christopher Peacock

#PurpleTeam | Ex @RaytheonTech MSSP, @SCYTHE_IO, & @GD_OTS | Taught at BlackHat & DEFCON | #100DaysofSigma | Keep exploring, keep learning, and stay curious

[Christopher Peacock @SecurePeacock]

My SANS Purple Team Series: Threat-Informed Detection Engineering Webinar with @jorgeorchilles is on YouTube!

Video: https://t.co/m856BQGemj

Blog post: https://t.co/knrcyYDAQk

[Christopher Peacock @SecurePeacock]

Make sure you run trufflehog on your stuff before someone else does…

[Justin Elze @HackingLZ]

The gift that keeps giving

[Cybersecurity and Infrastructure Security Agency @CISAgov]

Update to #PHP2Shell Alert: SIGMA rule helps identify potentially suspicious activity & incorporated partner resources. If your org can't update immediately or uses unsupported PHP 8.1 or earlier versions, take affected PHP-based systems offline until patched or updated.

[Burp Suite @Burp_Suite]

🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST.

Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using:

🟧 ActiveScan++ v2.0.13 (https://t.co/fkhECQ6wtD)
🟧 Bambda scan checks (https://t.co/PxPcj5uDYX)
🟧 BChecks (https://t.co/i8c8WiDnvb)

Start scanning for the vulnerability now → https://t.co/fkhECQ6wtD

[OpenAI @OpenAI]

If you are wondering whether your website is affected, we have packaged a Codex skill to help check.

Point your Codex at this repo to guide you through it: https://t.co/XUEbOwXuQC

[Christopher Peacock @SecurePeacock]

@anton_chuvakin First recorded DFIR was this:

[Christopher Peacock @SecurePeacock]

@DylanOwendylan

[Christopher Peacock @SecurePeacock]

Cyber espionage and military cyber operations should be an entire course in cybersecurity degree programs.

A lot of defenders don’t fully understand the game they’re playing or the adversaries they’re playing against.

[Christopher Peacock @SecurePeacock]

Generative AI will reduce patch diffing for 1 Day Exploits from hours to minutes.
Organizations must adopt rapid, high availability patching to endure this shift.

[Christopher Peacock @SecurePeacock]

"A responder noticed a GRE tunnel in network monitoring that didn't exist in the running config and left no trace in the logs." 👀

[Jake Williams @MalwareJake]

In today's Breach Please, me and Jess revisit the idea of detecting threat actors hiding in network devices to evade detection. This was inspired by a report from @sygnia_labs.

Real talk: how do YOU validate your network devices are free of malware?

[Jeff McJunkin @jeffmcjunkin]

There's unpatched pre-auth RCE in Log4j2. Latest version. There's no CVE and no patch.

But also, don't panic - this isn't Log4Shell all over again.

I tested 50+ products and couldn't find any exploitable ones.

More info, scanner, and rules here: https://t.co/MKtfkaAekx

[Christopher Peacock @SecurePeacock]

These are some very interesting posts by @cyb3rops and @fr0gger_ and what GenAI means for CTI.

LinkedIn Link:
https://t.co/bF2C9Re0NB

[Christopher Peacock @SecurePeacock]

@anton_chuvakin You’re leaving Google or there’s no way to actually fix the GUI in Chronicle?

[Christopher Peacock @SecurePeacock]

Jane Street Blog - Magic-trace: Diagnosing tricky performance issues easily with Intel Processor Trace https://t.co/TpWZft8Z1P

[Christopher Peacock @SecurePeacock]

"Malware Detection Using Electromagnetic Side-Channel Analysis" by Matthew A. Bergstedt https://t.co/0pVMwSdO4I

[Christopher Peacock @SecurePeacock]

SLAM Lab: Side-Channel Security https://t.co/e6h6h8L3mL

[Christopher Peacock @SecurePeacock]

Monitoring Side-Channel Signals Could Detect Malicious Software on IoT Devices https://t.co/adFOOV49Fu

[Christopher Peacock @SecurePeacock]

What do you call a technique that’s documented in the popular CTI framework?

[Christopher Peacock @SecurePeacock]

👀
https://t.co/VGBO1XnCi8

[Christopher Peacock @SecurePeacock]

Pretty interesting: retrieves the command-and-control (C2) domain from a blockchain smart contract. Instead of hardcoding the server address... queries multiple Polygon RPC endpoints defined in CONTRACT_CONFIG.RPC_HOSTS
https://t.co/rELa0eKtI0

[Christopher Peacock @SecurePeacock]

This is very interesting for those working in DFIR:
https://t.co/UwezpH9irT