Philippe Tremblay 🇨🇦🇫🇷 🇺🇦

Husband, father, teammate. IT Product Owner and Solution Architect with a passion for cloud, code and empowering teams.

[Matthew Keys @MatthewKeysLive]

Just one day after ending "The Late Show" on CBS, Stephen Colbert returned to TV — to host a public access show with rocker Jack White in Monroe, Michigan.

Appearances by Jeff Daniels, Eminem and Steve Buscemi.

[Philippe Tremblay 🇨🇦🇫🇷 🇺🇦 @philtrem2000]

@cyb3rops @ElijahWoodward9 @bunsofwrath12 Nice callout for you @cyb3rops

[Florian Roth ⚡️ @cyb3rops]

Really enjoyed this interview by @elijahwoodward9 with @bunsofwrath12 on Team Cymru’s “Future of Threat Intelligence”

A lot of good DFIR points in there that often get ignored in enterprise envs:

- why default Win event log sizes are a forensic disaster
- why Sysmon deployments are often stale or incomplete
- the forensic value of Volume Shadow Copies and the $J USN Journal
- why EDR alone is not enough
- how true positives get buried in alert fatigue
- using AI as a force multiplier for parsing logs and writing one-off tooling, while still not treating it as forensic ground truth

Also liked the practical angle throughout the whole discussion. Felt very experience-driven, not theoretical.

Worth watching
https://t.co/SfgqjbR9Eu

[International Cyber Digest @IntCyberDigest]

‼️🚨 Microsoft calls this "intended behaviour," so here we go.

How to dump the credentials of every user stored in Microsoft Edge:

1. Open Edge. Don't browse anywhere, just open it.
2. Flip to Task Manager, find Edge, expand the task.
3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump."
4. Open the dump file and look for credentials.

The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking.

Thanks to Rob VandenBrink at SANS: https://t.co/ebtVZxne4L

[Kimberly @StopMalvertisin]

Unit 42 | The npm Threat Landscape: Attack Surface and Mitigations https://t.co/j1dwIvJdot

[Vercel @vercel]

Our investigation has revealed that the incident originated from a third-party AI tool with hundreds of users whose Google Workspace OAuth app was compromised.

We recommend that Google Workspace Administrators check for usage of this app immediately. https://t.co/MNxfGOcch9

[Feross @feross]

We dug into this more: The blast radius is larger than it looks. Axios only needed to be resolved somewhere in the dependency graph during the window (e.g. via CLI tools, npx installs, CI jobs, etc). In some cases, you can check now and see nothing, even if it ran. 🫥

https://t.co/5qHxUgHRJp

[Florian Roth ⚡️ @cyb3rops]

More relevant than ever …

[Steven Lim @0x534c]

Best practices for securing Microsoft Intune

In view of the March 11, 2026 cyberattack against U.S.-based medical technology firm Stryker Corporation, which affected their Microsoft environment. Microsoft has newly released the following guidance:

https://t.co/g1ZNgS4Bfm

#Cybersecurity #MicrosoftIntune #Hardening

[Philippe Tremblay 🇨🇦🇫🇷 🇺🇦 @philtrem2000]

@HackingDave @HackingDave Nice cut with a Jamie Diamon intro.

[Scott Hanselman 🌮 @shanselman]

daylight savings sucks

Now I’m jet lagged and I haven’t even gone anywhere

[Philippe Tremblay 🇨🇦🇫🇷 🇺🇦 @philtrem2000]

@cyb3rops @rapid7 @pseudonyme_ovb Subtle😆

[Philippe Tremblay 🇨🇦🇫🇷 🇺🇦 @philtrem2000]

RT @cyb3rops: Here’s how I currently see software development.

Imagine a farmer who grows cabbage.

He has one large field and several sma…

[Florian Roth ⚡️ @cyb3rops]

Rapid7 dropped a write-up on the Notepad++ update-chain abuse and - finally - it comes with real IOCs

- update.exe downloaded from 95.179.213[.]0 after notepad++.exe -> GUP.exe
- file hashes for update.exe / log.dll / BluetoothService.exe / conf.c / libtcc.dll
- network IOCs incl. api[.]skycloudcenter[.]com (-> 61.4.102[.]97), api[.]wiresguard[.]com, 59.110.7[.]32, 124.222.137[.]114

by @rapid7
https://t.co/rrespJ9Ju0

[Florian Roth ⚡️ @cyb3rops]

For convenience: I wrote a small collector that pulls all SHA-256, SHA-1 and MD5 hashes from Notepad++ releases and compiles them into big CSV + JSON files

Use it to check if any Notepad++ installs in your org match known-good release hashes - and spot weird/malicious outliers

https://t.co/W2pYbfYemz

[Philippe Tremblay 🇨🇦🇫🇷 🇺🇦 @philtrem2000]

@cyb3rops …and learned from it

[ian bremmer @ianbremmer]

the brand new sensation
that’s sweeping your nation

it’s our special military operation
https://t.co/6cLKX8HsZo

[BleepingComputer @BleepinComputer]

Google now lets you change your @gmail.com address, rolling out - @mayank_jee
https://t.co/BYNfppoLRs

https://t.co/BYNfppoLRs

[tobi lutke @tobi]

My annual MRI scan gives me a USB stick with the data, but you need this commercial windows software to open it.

Ran Claude on the stick and asked it to make me a html based viewer tool. This looks... way better.