Matthew Bowler 🏴󠁧󠁢󠁥󠁮󠁧󠁿

Every day is an opportunity to improve.

[Robert Jenrick @RobertJenrick]

Britain is broke. And to fix it, we need to start growing again.

That’s why Reform’s Economic Rescue Plan includes these 64 pro-growth measures I’d take if I were Chancellor:

𝗨𝗻𝗹𝗼𝗰𝗸𝗶𝗻𝗴 𝘁𝗵𝗲 𝗡𝗼𝗿𝘁𝗵 𝗦𝗲𝗮

1. Approve Rosebank
2. Restart oil and gas licensing
3. Legalise onshore exploration
4. Abolish the Energy Profits Levy
5. Restore maximum economic extraction as the North Sea regulator's objective

𝗥𝗲𝗶𝗻𝗱𝘂𝘀𝘁𝗿𝗶𝗮𝗹𝗶𝘀𝗶𝗻𝗴 𝗕𝗿𝗶𝘁𝗮𝗶𝗻

6. Abolish the Emissions Trading Scheme
7. Halt the Carbon Border Adjustment Mechanism
8. Repudiate AR7 contracts for difference and scrap AR8
9. Implement the Fingleton Review on nuclear in full
10. Automatically approve French and South Korean nuclear designs

𝗚𝗲𝘁𝘁𝗶𝗻𝗴 𝗛𝗼𝗺𝗲𝘀 𝗕𝘂𝗶𝗹𝘁 𝗶𝗻 𝗢𝘂𝗿 𝗖𝗶𝘁𝗶𝗲𝘀

11. Cut affordable housing requirements on brownfield sites
12. Permitted Development Right for brownfield housing
13. Repeal Biodiversity Net Gain
14. Exit the Aarhus Convention
15. Repeal and reform the Habitats Regulations, including Nutrient Neutrality
16. End the boiler ban
17. Legalise air conditioning to meet overheating rules
18. Remove mandatory EPC improvements
19. Revoke the Future Homes Standard
20. Repeal the Renters' Rights Act

𝗕𝘂𝗶𝗹𝗱𝗶𝗻𝗴 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗡𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲

21. Legislate approval for new runways at Heathrow and Gatwick
22. Auction airport landing slots
23. End 'target-consistent' carbon pricing in project evaluation
24. Ban carbon emissions considerations in planning applications
25. Fast-track all water reservoirs as nationally significant projects
26. Make Development Consent Orders a true one-stop shop
27. Restrict judicial review of ministerial planning decisions
28. Scrap Net Zero construction rules
29. Scrap the social value test in procurement
30. Lift launch limits at SaxaVord Spaceport
31. Open completed sections of East-West Rail

𝗝𝗼𝗶𝗻𝗶𝗻𝗴 𝘁𝗵𝗲 𝗔𝗜 𝗥𝗲𝘃𝗼𝗹𝘂𝘁𝗶𝗼𝗻

32. Review regulatory barriers to AI adoption
33. Permit on-site gas generation for data centres and industry

𝗥𝗲𝗱𝘂𝗰𝗶𝗻𝗴 𝘁𝗵𝗲 𝗖𝗼𝘀𝘁 𝗼𝗳 𝗛𝗶𝗿𝗶𝗻𝗴 𝗕𝗿𝗶𝘁𝗶𝘀𝗵 𝗪𝗼𝗿𝗸𝗲𝗿𝘀

34. Cut Employer NI back to 13.8%
35. Introduce a migrant worker levy
36. Repeal the Employment Rights Act
37. Clarify that workplace rights don't require mandatory training courses
38. Let experienced tradesmen work on government contracts without CSCS qualifications

𝗨𝗻𝗹𝗲𝗮𝘀𝗵𝗶𝗻𝗴 𝘁𝗵𝗲 𝗖𝗶𝘁𝘆 𝘁𝗼 𝗜𝗻𝘃𝗲𝘀𝘁 𝗶𝗻 𝘁𝗵𝗲 𝗥𝗲𝗮𝗹 𝗘𝗰𝗼𝗻𝗼𝗺𝘆

39. Review bank capital requirements to boost lending
40. Rule out Net Zero in financial regulators' remits
41. Repeal climate-related financial disclosure rules

𝗚𝗲𝘁𝘁𝗶𝗻𝗴 𝗠𝗼𝘁𝗼𝗿𝗶𝘀𝘁𝘀 𝗠𝗼𝘃𝗶𝗻𝗴

42. Scrap airport 'surface access strategies'
43. Abolish the electric vehicle mandates
44. Apply domestic GB hours to all UK HGV trips
45. Ban Low-Traffic Neighbourhoods
46. Back the M4 Relief Road
47. Move a new car's first MOT to four years
48. Abolish the Renewable Transport Fuel Obligation

𝗨𝘀𝗶𝗻𝗴 𝗕𝗿𝗲𝘅𝗶𝘁 𝗙𝗿𝗲𝗲𝗱𝗼𝗺𝘀

49. Replace GDPR with a New Zealand-style Privacy Act
50. Fully re-legalise Imperial units
51. Review all unchanged EU law
52. Automatically repeal remaining EU law in 5 years unless retained

𝗚𝗲𝗻𝗲𝗿𝗮𝗹 𝗗𝗲𝗿𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗠𝗲𝗮𝘀𝘂𝗿𝗲𝘀

53. Make quarterly Making Tax Digital reporting voluntary
54. Reduce legal obligations on SME Non-Executive Directors
55. Double permission-free event days from 28 to 56
56. Make pavement dining licences automatic and permanent
57. Let shops open until 10pm, except Sundays
58. Repeal board diversity and inclusion rules
59. Remove the Sustainable Aviation Fuel mandate
60. Abolish the packaging tax
61. Scrap BBC and Channel 4 priority on streaming platforms
62. Remove the Public Sector Equality Duty
63. Five-year sunset on all QUANGOs
64. Five-year sunset clause on all new regulations

And there are more to come!

Britain’s full potential is waiting to be unleashed 🚀

[BleepingComputer @BleepinComputer]

Citrix patches NetScaler SAML zero-day exploited in attacks
https://t.co/p5xbEu0M7v

https://t.co/p5xbEu0M7v

[BleepingComputer @BleepinComputer]

Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers
https://t.co/9eeUwD1XbI

https://t.co/9eeUwD1XbI

[BleepingComputer @BleepinComputer]

September Windows Server updates break Remote Desktop Services
https://t.co/BwvQ2fggJd

https://t.co/BwvQ2fggJd

[sapir federovsky @sapirxfed]

We know attackers are registering devices. They know we know🙃
So they’re getting smarter, and we need to stay one step ahead. @shahardorf & I wrote a new post on how to outsmart them, and it's pretty good! https://t.co/AuPeqBeego

[spencer @techspence]

Lateral movement isn’t detected nearly as much as it should be.

If I ever get admin creds during a pentest I almost always use PSRemoting to access servers.

PSRemoting to a DC from Suzie’s computer should light up like a Christmas tree.

More on this topic here👇

https://t.co/NI9lwxHIE3

[Rob T. Lee @robtlee]

[NEW] @SANSInstitute just released something I've been wanting to exist since the Hugging Face incident: a Readiness Check with the nine things every security team should be able to answer before an AI-run attack hits their environment.

These came straight out of the Hugging Face incident debrief where they walked 700 security leaders through the response. Roughly 90 questions came up. Those questions became the post-mortem we wrote with the @cloudsa CISO community, and now they're a diagnostic your team can take to figure out your IR gaps.

My favorite: if a slow, automated attack starts at 2 a.m. on a Saturday and blends into the automation already running in your environment, does anyone get paged within the hour?

You answer all nine on the page (nothing to download) and see where you are relative to the six factors that defined the incident:

Whether your SOC would see the attack
Whether you could investigate 20,000 commands
Whose model you'd use when frontier models refuse your attack data
Whether your credentials and rebuild process hold
Whether you know your AI surface
What you ask the board to fund

That second one is the honest test. For an IR consultant, 20,000 commands is a Tuesday. For teams that don't do this daily, it's daunting, and finding that out mid-incident is the expensive way.

Over the last 20 years, defenders have dealt with many of the same core attack techniques used in the Hugging Face attack. AI changed how many could be attempted, combined, and executed autonomously at the same time... and which controls fail first. You will have gaps, and this diagnostic can inform what you address first.

Take the AI-Run Attack Readiness Check into your next staff meeting and send me your score. (I don't expect to see a nine-for-nine. Prove me wrong.)
https://t.co/yEgkAFeh8M

[BleepingComputer @BleepinComputer]

Ernst & Young data breach claimed by ShinyHunters extortion gang
https://t.co/JOsPwBVwyY

https://t.co/JOsPwBVwyY

[Horizon Secured @horizon_secured]

⏱️ 60-Second Bits 🔒
𝗗𝗼 𝘆𝗼𝘂 𝗥𝗗𝗣 𝘁𝗼 𝘆𝗼𝘂𝗿 𝗗𝗼𝗺𝗮𝗶𝗻 𝗖𝗼𝗻𝘁𝗿𝗼𝗹𝗹𝗲𝗿𝘀 𝗳𝗿𝗼𝗺 𝘆𝗼𝘂𝗿 𝘄𝗼𝗿𝗸𝘀𝘁𝗮𝘁𝗶𝗼𝗻?

Even with 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗚𝘂𝗮𝗿𝗱 enabled, your 𝗗𝗼𝗺𝗮𝗶𝗻 𝗔𝗱𝗺𝗶𝗻 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝘀 can still end up in the 𝗠𝗦𝗧𝗦𝗖 process memory on your workstation.

Credential Guard protects 𝗟𝗦𝗔𝗦𝗦.
It does 𝗻𝗼𝘁 protect credentials handled by the 𝗥𝗗𝗣 client.

If your workstation is compromised, an attacker may be able to recover those credentials from 𝗺𝘀𝘁𝘀𝗰.𝗲𝘅𝗲.

The solution isn’t another Windows security feature.

It’s proper privileged administration:
✅ 𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝗱 𝗔𝗰𝗰𝗲𝘀𝘀 𝗪𝗼𝗿𝗸𝘀𝘁𝗮𝘁𝗶𝗼𝗻 (𝗣𝗔𝗪)
✅ A properly implemented 𝗧𝗶𝗲𝗿𝗶𝗻𝗴 𝗠𝗼𝗱𝗲𝗹

Credential Guard is important.
It just doesn’t solve this problem.

#ActiveDirectory #WindowsSecurity #CredentialGuard #RDP #PAW #TieringModel #CyberSecurity #BlueTeam

[Steven Lim @0x534c]

👻Certighost (CVE-2026-54121) Detection

A newly disclosed Active Directory Certificate Services (AD CS) vulnerability, dubbed Certighost, allowed a low-privilege domain user to impersonate a Domain Controller and take over an entire Active Directory domain.

https://t.co/y8yZbZgsSZ

👇 A Sentinel KQL to help detect AD CS abuse.

https://t.co/bGrHkbHEK4

#Cybersecurity #Certighost #ThreatHunting

[Simon Willison @simonw]

I wrote about the completely wild incident where OpenAI were testing a new model and it broke out of its sandbox and broke INTO Hugging Face to steal the answers to the benchmark https://t.co/HGr5lFuAZA

[Merill Fernando @merill]

If you haven't patched yet.

Your Active Directory is currently indefensible.

https://t.co/sbhYArMTNh

🤷‍♂️

Join @techspence and I @ @wpninjasus in Jan as we dig into what this means and what you can do...

[TrustedSec @TrustedSec]

Device code phishing is quietly becoming one of the more effective techniques targeting #M365 environments. In our latest #blog, Lumi Taiwo and Danny Dubree detail how it works and the #ConditionalAccess controls that shut it down. Read it now! https://t.co/eMk45P56cQ

[Horizon Secured @horizon_secured]

🔒 Secure Bits 💡
𝗡𝗲𝘄 𝗼𝗳𝗳𝗶𝗰𝗶𝗮𝗹 𝗧𝗶𝗲𝗿𝗶𝗻𝗴 𝗠𝗼𝗱𝗲𝗹 𝗴𝘂𝗶𝗱𝗲 𝗳𝗿𝗼𝗺 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁!

Really, not a joke! I was not expecting to live long enough to see something like this.

Jokes aside, a few months ago Microsoft published not only new 𝗱𝗼𝗰𝘂𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 called “Tier model for Active Directory Domain Services”, but earlier this year also a 𝗚𝗶𝘁𝗛𝘂𝗯 𝗽𝗿𝗼𝗷𝗲𝗰𝘁 called ActiveDirectoryTierModel.

𝗧𝗵𝗲 𝗽𝗿𝗼𝗷𝗲𝗰𝘁 𝗰𝗼𝗻𝘁𝗮𝗶𝗻𝘀 𝘁𝘄𝗼 𝗺𝗮𝗶𝗻 𝗣𝗼𝘄𝗲𝗿𝗦𝗵𝗲𝗹𝗹 𝘀𝗰𝗿𝗶𝗽𝘁𝘀:

1️⃣ 𝗗𝗲𝗽𝗹𝗼𝘆-𝗧𝗶𝗲𝗿𝗠𝗼𝗱𝗲𝗹.𝗽𝘀𝟭
This script helps you build the Tiering Model and prepares much more than just a basic OU structure. It can deploy:
▪️ Organizational Units
▪️ Security groups
▪️ Administrative and service accounts
▪️ OU ACL delegations
▪️ Group Policy Objects and links
▪️ Security Baselines
▪️ ADMX templates
▪️ MSA, gMSA, and dMSA ACL delegations
▪️ Windows LAPS ACL delegations and optional LAPS deployment
▪️ Kerberos Armoring support

The deployment can be performed component by component or as a full deployment. Each component follows the same useful process:
Plan → Deploy → Audit

The important part is that the invasive configurations and settings are not simply enabled without your control. You can review the plan, deploy individual components, test the result, and continue gradually.

2️⃣ 𝗔𝘂𝗱𝗶𝘁-𝗧𝗶𝗲𝗿𝗠𝗼𝗱𝗲𝗹.𝗽𝘀𝟭
This script audits the deployment and checks whether the environment still matches the Tiering Model configuration. It can audit individual components or the full deployment, including OU structure, groups, users, ACLs, GPOs, ADMX templates, managed service account delegations, and Windows LAPS configuration.

So far, I have only played with both scripts a little, but I am genuinely 𝗵𝗮𝗽𝗽𝘆 𝘁𝗼 𝘀𝗲𝗲 𝘁𝗵𝗶𝘀 🎉

After all these years of Active Directory, this is quite an advancement, especially when many of the older Microsoft Tiering Model resources and links are no longer available. There is 𝗻𝗼𝘄 𝗮𝗻 𝗼𝗳𝗳𝗶𝗰𝗶𝗮𝗹, documented, and testable starting point for implementing the Tiering Model.
(𝘢𝘮 𝘐 𝘤𝘰𝘮𝘪𝘯𝘨 𝘭𝘢𝘵𝘦 𝘵𝘰 𝘵𝘩𝘦 𝘱𝘢𝘳𝘵𝘺, 𝘩𝘰𝘸 𝘭𝘰𝘯𝘨 𝘩𝘢𝘴 𝘵𝘩𝘪𝘴 𝘣𝘦𝘦𝘯 𝘢𝘳𝘰𝘶𝘯𝘥?)

Have you already tested the project?

#ActiveDirectory #WindowsSecurity #TieringModel #PowerShell #MicrosoftSecurity #BlueTeam #HorizonSecured

[BleepingComputer @BleepinComputer]

🚨 BREAKING: Progress has warned ShareFile customers to immediately power down Storage Zone Controller servers due to a "credible external security threat."

The company has disabled affected ShareFile accounts and says customers must manually shut down the on-premises servers while it investigates.

It is unclear at this time if the threat involves a zero-day vulnerability or whether any Storage Zone Controllers have been compromised.

[The CyberSec Guru @thecybersecguru]

ServiceNow customers are being notified after unauthorized access hit multiple tenants.

The messy part?

A Scripted REST endpoint reportedly shipped with authentication disabled.

No token.
No valid session.
No real user account.
Just requests landing as “Guest” in logs.
The IOC: 51.159.98.241

Security teams should be checking /api/now/related_list_edit transaction logs immediately.

[Lenny Zeltser @lennyzeltser]

I published a 4-point approach for succeeding as a CISO, based on my experiences building and leading a security program at a high-growth company.

It shows how to focus on the defender's advantage and escape the unending cycle of reacting to vulnerabilities, investigating incidents, and responding to attackers' advances: https://t.co/zrASlvv3Se

[The DFIR Report @TheDFIRReport]

🐱 Cat’s Got Your Files: Lynx Ransomware

Attackers abused valid credentials to access RDP, created high-privilege accounts for persistence, mapped the environment, and exfiltrated data before deploying Lynx ransomware.

Report 👇
https://t.co/NvMbsfdJyL

[Matthew Bowler 🏴󠁧󠁢󠁥󠁮󠁧󠁿 @matthew_bowler]

@HaakonWibe Looks awesome but am i the only one uncomfortable approving that unverified app prompt 😱

[Haakon Wibe @HaakonWibe]

Look.. it's a Conditional Access policy simulator built by an infra architect guy who got tired of squinting at What If results 🫠 Shiny graphs yay! 🔗https://t.co/hqKKVDnBFV No sign-in needed, click Sample Data and play around. Or connect to your own data - all's in browser.