Vadim Gordas

Head of InfoSec Risk,
opinions are my own.

[Florian Roth ⚡️ @cyb3rops]

For most of 2025, I was skeptical that AI was already playing a major operational role in real intrusions. Most public examples seemed limited to phishing and supporting tasks.

This report by my friend Eyal Eyal lines up with what I have been hearing elsewhere, too - in recent publications and in private conversations with people seeing this stuff up close.

I think that phase is over.

AI is moving into the operational core of attacks. With stronger models, open models, and jailbroken variants circulating, the economics have changed. Tailored tooling, exploit adaptation, and large-scale analysis get cheaper and faster.

I expect AI to play a major role in future campaigns, and that means more variation, more fresh tooling, and less reliance by attackers on recycled code.

All the more reason to focus on controls and detections that do not depend only on known samples.

Worth reading.

[Vadim Gordas @VGordas]

Well, maybe this will force a serious discussion around encryption as privacy being a basic human right

[BBC Breaking News @BBCBreaking]

Apple removes high-level data protection for UK users after the government requested right to access https://t.co/JIMIlMBc37

[Matt Zorich @reprise_99]

One of our very smart Active Directory experts has been putting together a series of blog posts about hardening AD. Already into its 7th installment, it covers SMB hardening, disabling NTLMv1, least privilege and more. Check the series out - https://t.co/KkKfarAX9a

[Sam Stepanyan @securestep9]

CISA releases a Secure Software Development Attestation Form that will help ensure the software producers who partner with the US federal government leverage minimum secure development techniques and toolsets:

https://t.co/tyUp0tlU31

[Vadim Gordas @VGordas]

@quentynblog Hilti would make me really worried

[Sam Stepanyan @securestep9]

#Android: At BlackHat Europe researchers demonstrated that most #password managers for Android (1Password, LastPass, Dashlane, Keepass etc) are vulnerable to #AutoSpill attack allowing to steal account credentials on Android during the autofill operation:

https://t.co/dmUfu45JHU

[Mark Simos @MarkSimos]

The long-awaited Microsoft Cybersecurity Reference Architectures (MCRA) update is now live!

https://t.co/ZUd4ne90yD

In addition to the latest products & names, this is the first MCRA version integrated into the Microsoft Security Adoption Framework (SAF).

Share and Enjoy!

[Vadim Gordas @VGordas]

@securestep9 @elonmusk Looks like app mfa still remains free, for now

[InfoSecSherpa 🏔️ @InfoSecSherpa]

Check out ⁦@RobDuhart⁩ in this ⁦@SCMagazine⁩ article! https://t.co/6iXDkDhOG1

[Lesley Carhart @hacks4pancakes]

Tech people on Twitter be like, "just buy and install a pi hole to make your $2000 smart TV not play constant ads and narc on your viewing habits"

[Vadim Gordas @VGordas]

There is some truth in it:

[Sophos X-Ops @SophosXOps]

NEW: Conti affiliates use ProxyShell Exchange exploit in ransomware attacks ⚠️

In one of the ProxyShell-based attacks observed by Sophos, the Conti affiliates managed to gain access to the target’s network and set up a remote web shell in under a minute...

1/14

[rik van duijn @rikvduijn]

Wanted to do a quick blog on o365 audit logging and its quirks for a while now. Finally finished it. TLDR: enable it even if you dont monitor any of it. Atleast your incident responder will thank you.

https://t.co/azQ4Qb6oTY

[Nathan McNulty @NathanMcNulty]

Blue team trying to keep up with the latest Microsoft vulns

[Forrest Brazeal @forrestbrazeal]

The recent "All the ways to run containers on AWS" threads have left me super confused so I made this flowchart to help. It's probably also wrong.

[Chris Krebs @C_C_Krebs]

Ransomware shuts down one of the most critical regional pipelines. This has gotten out of control. https://t.co/xvRNQ0GAIO

[Chris Wysopal @WeldPond]

Syncing your phone to the car or having a built in GPS are privacy risks. Cars don’t have the data protection of a modern phone. https://t.co/yjep5pyPqA

[Alex Ionescu @aionescu]

What fresh hell is this?

[Troy Hunt @troyhunt]

Just to add to this, look at ParkMobile’s password requirements then look at the cracked passwords and ask yourself: do those requirements help people make good passwords? No, of course not, that’s why we ditched that craziness years ago: https://t.co/BYuK0brgg5

[Sam Stepanyan @securestep9]

If you are using #F5 @F5Networks kit - be aware of 4 CRITICAL CVEs just announced minutes ago with almost all versions of BIG-IP and BIG-IQ 7.x vulnerable.
Unauthenticated #RCE. Patches released - do check out the knowledgebase article:

https://t.co/RqUtD9vZ6I

@F5Security