Wayne Markovich

Desktop Architect | AVD, Nerdio, FSLogix, Intune | Solving EUC problems and writing about it

[Wayne Markovich @markovichio]

Uber burned through its entire annual AI tooling budget in 4 months after encouraging staff to use AI freely. If you are forecasting Copilot or AI assistant costs in an AVD deployment, this is a real governance data point. https://t.co/9wu9e5JYcv

[Wayne Markovich @markovichio]

Researchers built a self-propagating AI worm that spreads with zero human involvement. In a shared AVD host pool environment, lateral movement assumptions change significantly if the attacker has no operator latency. https://t.co/V6I8AbxG4l

[Wayne Markovich @markovichio]

Anthropic mapped 12 months of AI-assisted attacks to MITRE ATT&CK. The AD discovery and credential access TTPs showing up in AI-built toolkits are already in this dataset. Worth reading before your next threat model review. https://t.co/ZeBTEEA7UY

[Wayne Markovich @markovichio]

Microsoft threatened legal action against a researcher for disclosing a zero-day without coordinated notification, then walked it back. The CVD trust problem this creates is real and affects how fast defenders get actionable intel. https://t.co/ogbGweukWa

[Wayne Markovich @markovichio]

Microsoft Build 2026: native Linux coreutils on Windows without WSL. For architects writing cross-platform scripts against AVD or Azure infra, this quietly matters more than most of the AI announcements. https://t.co/cU1CEJxQ6r

[Wayne Markovich @markovichio]

5,000 typosquat domains registered ahead of US midterms. Phishing and impersonation are the real election security threat. Worth reviewing your org's Defender anti-phishing policies before campaign season peaks. https://t.co/L4jxhRu564

[Wayne Markovich @markovichio]

GitHub Copilot metered billing is generating real anger. One user reports 16% of their monthly Pro+ allowance gone for basically nothing. The era of unlimited AI-assisted coding is over. https://t.co/F9E77ASslB

[Wayne Markovich @markovichio]

Dashlane got brute-forced and some encrypted vaults were downloaded. If your org uses Dashlane for shared service account credentials, assume those vaults are in someone's decryption queue. https://t.co/3zksMs4m2e

[Wayne Markovich @markovichio]

32 Red Hat npm packages backdoored with a credential-stealing worm, downloaded 80K times a week. If your CI/CD pipeline pulls from @redhat-cloud-services, audit your lockfiles now. https://t.co/Hxmdl3xsDi

[Wayne Markovich @markovichio]

Dutch authorities took down a 17 million device botnet running as a residential proxy network. The infrastructure behind credential stuffing and phishing campaigns just got smaller. https://t.co/IrJTuJyH13

[Wayne Markovich @markovichio]

Project Headroom is an open-source tool built to cut AI inference costs, now available to everyone. If you are running AI workloads or Copilot-adjacent tooling in Azure, worth a look before your next billing cycle. https://t.co/m7LHnwVwJH

[Wayne Markovich @markovichio]

Notebooks up 11%, desktops up 10% as memory supply tightens for AI server demand. Physical endpoint refresh budgets are taking a hit. This is another data point for Cloud PC and AVD thin-client conversations with your finance team. https://t.co/Qo6wc71cBd

[Wayne Markovich @markovichio]

CIFSwitch LPE in the Linux kernel abuses CIFS auth key handling to get root. If you run Linux session hosts, Linux-based jump boxes, or ANF-connected workloads, check your kernel version and distro patch status. https://t.co/mCSC25XCfB

[Wayne Markovich @markovichio]

GitHub Copilot is moving to token-based billing. If you use it for AVD IaC, Bicep, or Terraform work, your costs just got unpredictable. Time to baseline your actual token consumption before the bill surprises you. https://t.co/MsRAIdm1VA

[Wayne Markovich @markovichio]

CVE-2026-0257 is now being actively exploited. If GlobalProtect is in your network path to AVD or any Azure workload, patch or compensate now. Auth bypass on your VPN edge is a bad day. https://t.co/DmNMekBkGc

[Wayne Markovich @markovichio]

DDoS-as-a-Service has matured into polished subscription platforms with pricing tiers and reseller channels. AVD control plane endpoints and RDP gateways are reachable targets. Azure DDoS Protection Basic vs. Standard is worth revisiting for production deployments. https://t.co/KgCDYOdwCI

[Wayne Markovich @markovichio]

Critical RCE in Gogs, the self-hosted Git service, has an active exploit module and no patch. Maintainers went quiet after the researcher reported it in March. If you self-host Gogs for IaC repos, migrate to Gitea or move to Azure DevOps now. https://t.co/Ep0SWfOnp8

[Wayne Markovich @markovichio]

MokN deploys fake access points to lure attackers into using stolen creds, then surfaces them before abuse. Interesting defensive signal for environments where MFA bypass via token theft is the main AVD attack vector right now. https://t.co/8km7zGz9bA

[Wayne Markovich @markovichio]

CISA dropped supply chain attack guidance this week. If your AVD imaging pipeline or Nerdio scripted actions pull from external repos, this is worth 15 minutes of your time. The npm typosquatting story the same day is not a coincidence. https://t.co/fO69Nq16nv

[Wayne Markovich @markovichio]

Dutch authorities seized 200+ servers and took down a 17-million-device botnet used as a residential proxy network. Scale like that means some of those devices were endpoints in managed environments. Patch your unmanaged devices. https://t.co/rY23rKtwtp