Adam John

IT security, privacy, and mostly lots of random thoughts.. a little for everyone and disclaimer.. My thoughts are not of my employer, and agencies

[International Cyber Digest @IntCyberDigest]

❗️ Over 30 official Red Hat npm packages were compromised. How they got in:

- A Red Hat employee's GitHub account was compromised.
- Attackers pushed "orphan commits" (detached from branch history) straight in, bypassing code review with no pull request.
- Payload "Miasma" (Mini Shai-Hulud variant) steals GitHub/cloud/Vault/SSH/npm secrets. Rotate everything since June 1.
- The commits added a workflow (ci.yaml) + script (_index.js) that abused npm trusted publishing, requesting a real OIDC token to publish backdoored versions.

[BSides Harrisburg @BsidesHbg]

This year we have upped our swag game! Not only will there be shirts, but we will also have trucker hats and pull over hoodies for sale! Stop by our merch table on Friday May 29th https://t.co/LNIxIgG0zY

[Brian in Pittsburgh @arekfurt]

This is just...
I barely even know what to say.

This has to be one of the absolute worst (meaning: most incredibly ridiculous) vulnerabilities in a major vendor product in the last decade.

Cisco's devs literally just forgot to invoke the authentication check.

[Brian in Pittsburgh @arekfurt]

Huh.
Am I the only one who didn't know that Microsoft makes a tool called EventLogExpert that is supposed to be an improved version of event viewer for IT/helpdesk people?

https://t.co/HzSzG1zSO0

[The Hacker News @TheHackersNews]

🔥 A U.S. federal agency was hacked via Cisco firewall.

Attackers used ASA flaws to install FIRESTARTER, a backdoor that stays even after patches and normal reboots.

Fix requires full reimage or hard power cycle, not just updating software.

🔗 Read → https://t.co/sbjyK90Fuy

[Justin Berk @JustinWeather]

Good Morning it’s TUESDAY April 21
🧵 1 of 3
🧊 🚗 You may want to warm up your car a few minutes early
🥶 ⚠️ DEEP FREEZE THIS MORNING
☀️ Sun will warm us up in a hurry
👇

[Adam John @ajohn76]

@SharkHomeUS. I found a classic. Do you need one for a museum?

[BuBBliK @k1rallik]

VERCEL GOT HACKED

ShinyHunters - the group behind the Ticketmaster breach - is selling Vercel's internal database for $2M on BreachForums

here's why every developer should care:

- they have NPM tokens and GitHub tokens
- Vercel owns Next.js - 6 million weekly downloads
- one malicious push = global supply chain attack
- Vercel confirmed the breach today, April 19
- they literally DMed the hackers on Telegram asking them to stop

rotate your env variables RIGHT NOW

[BSides Harrisburg @BsidesHbg]

🚨 Early bird ticket sales and CFP close on March 15th, in a couple of days!

Get your discounted tickets here: https://t.co/ImMpEM7umV

Submit your CFP here: https://t.co/siLc03Zlp4

[BSidesCharm @BSidesCharm]

In case you missed it, #BSidesCharm 2026 tickets are now on sale!! Go to https://t.co/ncEyYLMTxi

[BSides Harrisburg @BsidesHbg]

🚨 Reminder: Early bird tickets for BSidesHBG 2026 are still available until the 15th of March.

Get your tickets now before the deadline!

https://t.co/ImMpEM7umV

[Adam John @ajohn76]

@PoojaUjagare That’s ai.

[Adam John @ajohn76]

@SelahaddinZengi This.. is AI

[Cobra Commander @CobraCommander]

Alright, boys. Only a few hours left to wrap this war up before the opening bell on Monday. We’ve got stocks to juice.

[Colin Dunlap @colin_dunlap]

Our daughter — a cancer survivor — is raising money for other kids with cancer. She’s doing it with Hampton High School’s Thon event.
Please help if you can.

https://t.co/UpGEpSgOR2

[Adam John @ajohn76]

@GadgetMaker235 @Osint613 They also have new skylights in all the hangers

[Adam John @ajohn76]

@mamunxy That’s not a reaper there’s no lower rear stabilizer. Also, there’s multiple reports on Internet that looks like it’s coming from a video game.

[Adam John @ajohn76]

@chrismartenson Add some context, at least according to @grok the ship that was hit was part of the Iranian shadow fleet. So they are either fairly incompetent or they hit their own ship to potentially scare others. If you look at the ship traffic maps in the strait, it’s reduced not closed

[Adam John @ajohn76]

@krassenstein For context, It looks like this ship is part of an Iran’s own shadow fleet that’s under sanction as reference by @grok which is slightly ironic. The strait still has traffic going through it at this time is you look at the ship traffic monitoring sites.

[SwiftOnSecurity @SwiftOnSecurity]

The most important strategic strike on Iran was denying them access to seamless remote work with Microsoft Teams