exss

HackerOne UK VDP Leaderboard 2024 - #2 | security nerd

[exss @ex_s_s]

@ZackKorman More work for everyone 😊

[International Cyber Digest @IntCyberDigest]

🚨 BrEaKiNg: Splunk, a security product, has zero authentication in its built-in database service and accepts any credentials, according to the security researchers who just dropped a full pre-auth RCE chain for Splunk Enterprise (CVE-2026-20253, CVSS 9.8).

Splunk Enterprise on AWS is vulnerable out of the box.

[exss @ex_s_s]

@UK_Daniel_Card Scotland would be so good

[exss @ex_s_s]

@ZackKorman Did give me a free Pistachio hoodie so you’re certified nerd as far as I’m concerned

[exss @ex_s_s]

@UK_Daniel_Card Have magnesium! You’ve probs been sweating so need to rebalance electrolytes

[exss @ex_s_s]

@banthisguy9349 I was getting this as well. Constant push notifications from Germany even though I’ve not got passwords enabled… no telemetry for standard users either 😡

[Anshu @anshuc]

@github holy shit, how did the attackers find a large enough uptime window to get in?

[exss @ex_s_s]

@NathanMcNulty the man for the job, looking to see if there’s a way to enumerate and gather ASR rules and Sentinel log sources and data (like a gap analysis) in an automated way, can imagine theirs some scripts but I’m thinking one of these agent things

[exss @ex_s_s]

@NathanMcNulty Submissions is more for community wide threat intelligence implementation for MDE no? It also has some backend intelligence to identify similar campaigns and detect similar TTPs/IoCs etc, not even sure what the review stuff is for, reckon it’s just a gimmick to save themselves

[exss @ex_s_s]

@UK_Daniel_Card I’ve seen some environments that take zero trust so insanely that it start becoming inconvenient and unmanageable

But yes, agree, most “zero trust” is just basic segmentation and proxying, but they get breached from pipeline and supply chain compromises or provider accounts

[Florian Roth ⚡️ @cyb3rops]

the official OpenSearch client for Node.js has also been compromised

[exss @ex_s_s]

@wbmmfq I’ve reached out to IT Teams on LinkedIn before and ended up having Zoom calls with CEOs, responsible disclosure is always the way, some companies don’t reply, but that’s also okay. You’re not authorised to be responsible and are not Mr Robot. Don’t publicly expose unless auth

[exss @ex_s_s]

@techspence Or search password in SharePoint - it’s very scary

[rekdt @rekdt]

Mad at your favorite software for requiring you to upload a photo of your ID??

Get revenge by uploading a photo of your credit card instead

Welcome to PCI DSS, bitch

[exss @ex_s_s]

@Telefonia_MX Or you can go to the router IP in the WiFi network settings I.e. 192.168.1.254

[exss @ex_s_s]

@UK_Daniel_Card I do think there’s such a big skill gap and manual work gap in detection and coverage, some SIEMs have basic features that highlight it, but really need something to fully show the full life cycle and the potential risks to missing events, log verbosity and sources. Claude time

[exss @ex_s_s]

@JanPantel I hope you’re ensuring that your security architects be involved in this, don’t let these pressures let your security standards slip, ensure full auditing and I hope this was all logged under ECABs 😳

[exss @ex_s_s]

@UK_Daniel_Card Claude on my Mac don’t even open

[exss @ex_s_s]

@weezerOSINT Just have to highlight this is the built in Defender, most enterprises will have EDRs which will detect and stop this exploit, so if a TA is in your environment and they do happen to find a host with no EDR, I doubt they’ll abuse this vector, nonetheless still a very cool vuln

[exss @ex_s_s]

@UK_Daniel_Card this is absolutely ridiculous…