Sean Metcalf

Identity Security Architect @ TrustedSec. Microsoft Certified Master #ActiveDirectory & former Microsoft MVP. Co-Host @ Enterprise Security Weekly. He/Him. #BLM

[Sean Metcalf @PyroTek3]

To my black family, friends, and people seeing this:

I love you
You matter
I'm here for you

#BlackLivesMatter

[Sean Metcalf @PyroTek3]

@techspence @m0bilej0n @planedrop @merill Let me see if I can get approval 😃

[Nathan McNulty @NathanMcNulty]

Ahhh, here we go again

[jungman @notajungman]

If you've ever lost a brilliant friend or family member to this disease, this is exciting

[Merill Fernando @merill]

For those running apps on @Railway and affected by their breach (you should have an email)

Use your agent to do a quick review of all the keys that need to be rotated.

[Florian Roth ⚡️ @cyb3rops]

I think this is more serious than many people realize.

Not every Node.js server is vulnerable, of course. The application needs to process untrusted Brotli-compressed data.

But how common is that? Well, common middleware configurations in Express 5 can already expose the vulnerable decoder, without developers explicitly using Brotli anywhere in their code.

So we’re potentially looking at a pretty large attack surface, although nobody really knows how many deployments are exploitable yet.

I wouldn’t be surprised to see automated scanning and exploitation attempts targeting this very soon.

Patch your Node.js runtimes.

[Nathan McNulty @NathanMcNulty]

SMS/Voice deprecation --> Passkey registration campaign has caused a lot of confusion

This is as consice of a statement as you'll get

If the user is eligible for SMS or Voice in Entra Authentication methods, they can enroll whatever passkeys they want

[Sam Erde @SamErde]

PowerShell 7.6.8 is released on GitHub and will be available via WinGet soon.

It's a maintenance release that moves the .NET SDK to 10.0.402 and somewhat ironically removes the update notification feature from PowerShell, per customer feedback. 🗣️

💾 https://t.co/lgF9hrw5hH

[TrustedSec @TrustedSec]

Desktop #AI is moving fast—a secure rollout for your organization starts here. Join @paulsems, @PyroTek3, and Scott Blake on November 4 for our next #webinar, “Leash Your LLM: Rolling Out Claude and Copilot Securely.” Secure your spot now! https://t.co/m1qAbdJWmk

[‏ً @omgsidewalks]

I saw someone say they miss when the internet was a library and not a store and I’ll be damned if that’s not the realest thing I’ve seen all year.

[BlackRoomSec @blackroomsec]

Greg created the Linux OS CentOS, has healthy views on artificial intelligence, is letting his people do their jobs and is looking for more people instead of firing them. Go work for Greg and tell him BRS sent you but behave yourselves. We are the swarm but we are not animals. 😉

[Massimo @Rainmaker1973]

Guy shows how nothing is real now on social media.

[Md Ismail Šojal 🕷️ @0x0SojalSec]

WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners.

Bro Rooted a brand-new 2025 Samsung TV after noticing absurdly targeted ads.

Firmware was locked down, so zero-days it was.
Got a root shell.

then found: always-on voice service, ACR, geo, full telemetry pipeline, and four separate DRM systems.

This isn’t a bug, It’s the product bro.

[Sean Metcalf @PyroTek3]

Don't connect "smart TVs" to the internet.
Use a device like Apple TV or Roku.

[International Cyber Digest @IntCyberDigest]

❗️ Samsung and Vizio smart TVs kept contacting the servers that track what you watch after users opted out, Northeastern University researchers found.

On Vizio the opt-out had no visible effect, even with the TV idle.

[RedTeam Pentesting @RedTeamPT]

🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!

Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀

[Nathan McNulty @NathanMcNulty]

A great reminder that Entra App Proxy, Cloudflare Tunnels/Access, or some sort of ZTNA is a great way to remove stuff you don't want hacked from the Internet

[spencer @techspence]

Please don’t tell Merill

[jungman @notajungman]

Forewarned...

[Justin Elze @HackingLZ]

👀 "We have not confirmed any successful exploitation."

https://t.co/x9lNX92EZ4