Mike Kearn

Senior Infosec Leader within Financial Services. My 1st computer was an Apple IIe & I remember 300 baud modems. Been doing this awhile.

[Bill Ackman @BillAckman]

A must watch from Jamie Dimon.

[Michael Mauboussin @mjmauboussin]

This is the time of year when a lot of investment firms welcome interns. While our work is geared toward institutional investors, a lot of it can be useful for learning about markets and the investment process. Here are a handful of reports and how they can guide interns:

[Mike Kearn @michaelkearn]

@HackingDave

[adam_cyber @Adam_Cyber]

On May 26, 2026, at 14:00 UTC, the CrowdStrike Counter Adversary Operations team executed a coordinated takedown of the Glassworm botnet, a global threat targeting software developers through the open-source supply chain. In collaboration with Google and the Shadowserver Foundation, we struck all four of Glassworm's command-and-control (C2) channels simultaneously, severing the operators from their infected machines and their ability to deliver new malicious payloads.

This takedown matters beyond the botnet. Glassworm marked a significant shift in the threat landscape that should serve as a wake-up call for every organization that ships or consumes software. Adversaries are no longer just targeting products, they're targeting the developers who build them.

https://t.co/rl9EVrA371

[John Hultquist @JohnHultquist]

If you've been laid off from a cyber threat intel position and would like to come to @SLEUTHCON this year, please reach out.

[Ben Carlson @awealthofcs]

It's publication day for my new book!

Risk & Reward is now available

Tons of my favorite charts, stories and anecdotes

I read the audio version of the book myself

I had a lot of fun writing this

I think it's the best thing I've ever written

[John Hultquist @JohnHultquist]

Google Threat Intelligence Group is dropping our latest AI Threat Tracker report today, which covers several threats we are watching through a variety of means. The report includes some details of the first 0day exploit we've found developed with AI. 1/x https://t.co/klvOrX31xv

[Mike Kearn @michaelkearn]

@HackingDave Well done my friend. Well done.

[Florian Roth ⚡️ @cyb3rops]

We released first detection rules for Copy Fail / CVE-2026-31431.

YARA rules by me:
https://t.co/PrkIOIihA6

It covers public PoC artifacts, including known payloads, exploit code fragments and URLs seen in shared material.

More generic rules for customer environments are still in testing.

Sigma rules by @_swachchhanda_:
https://t.co/UTZgDhtsqg

They cover suspicious Copy Fail-related exploitation patterns, including setuid binary execution behavior and NULL argv shell execution.

More updates soon.

[Dave Kennedy @HackingDave]

This is a completely new course for us, run but some of the best of the best at #TrustedSec.

Hope to see you there!

[cow @cowincrisis]

thank you @googlemaps

[Boring_Business @BoringBiz_]

Spoke with a former colleague of mine who is currently at a hedge fund and involved in new analyst recruiting for his firm

He has been interviewing candidates from banking and private equity backgrounds for the past month or so

Apparently there has been a massive surge in kids who simply cannot figure out what the business model or revenue recognition of a business is with just the 10K in front of them

One of them completely botched the case study, and when asked, simply answered that he uses ChatGPT and Claude at his current job to figure out the details

Clearly an early sign of cognitive decline in analyst capacity coming because of AI

[Wiz @wiz_io]

🚨 BREAKING: Wiz Research discovered Remote Code Execution on https://t.co/SvN2lGsnbO with a single git push

The flaw in @github allowed unauthorized access to millions of repositories belonging to other users and organizations 🤯

[Bryson 🦄 @brysonbort]

Remote Desktop, Windows quietly saves fragments of what was on screen. Attackers can grab those fragments and reassemble them into readable screenshots using two free tools and about ten minutes. No special privileges required.

https://t.co/h56E4HVvoJ

[Mike Kearn @michaelkearn]

@pdouglasweather Some of the storm chasing channels on YouTube will be great watching this week from the looks of things.

[Thomas Massie @RepThomasMassie]

Would you believe 57 Republicans and 211 Democrats recently voted in favor of this Orwellian automobile kill-switch? Here’s the roll call for the vote I forced to defund the mandate: https://t.co/dnPxPHFYie

[Lamborghini Squadra Corse @LamborghiniSC]

The wait is over.
Super Trofeo Asia returns to Sepang - ready for the first race of the season.
April 24–26 🏁

[JFrog Security @JFrogSecurity]

TeamPCP is back.
The xinference PyPI package (680K downloads, 9.3K stars) was hijacked. Import it and your cloud credentials, SSH keys, and .env secrets are instantly harvested and exfiltrated.
Versions 2.6.0–2.6.2 are malicious. If you installed them, assume compromise and rotate everything now.
Full technical breakdown 👇

[Mike Kearn @michaelkearn]

@HackingDave The least you can do is click the link & see if the files are really yours. ;)

[Dave Kennedy @HackingDave]

For the enterprises using Claude, if you are using it for heavy enterprise type stuff - be extremely careful. It's introducing massive bugs, security issues, and code quality is way worse than Opus 4.5, substantially worse on both 4.6 and 4.7.

Our entire development team is shifting off of it. It's unusable at the moment aside from beautiful UI stuff, it's code quality is not something you can trust.

Still no word from Claude on why they mangled their models and didn't tell anyone - which is particularly alarming on every front.

I would recommend switching teams over to something like Cursor, Perplexity, or AWS Bedrock - as the frontier models continue to innovate (or regress) - having the ability for flexible model selection that doesn't disrupt development workflow will be insanely important for enterprise.