Br*an

☁️ security, general technology fan • opinions = mine

[Mololuwa | Cybersecurity - (The God Complex) @cyber_rekk]

A Linux server can be patched, restarted and still remain under an attacker's control

Microsoft found threat actors installing GSocket on compromised servers to preserve remote access after the original web application vulnerabilities had been fixed

GSocket is an open-source remote access tool that uses a shared public relay network

Here's what makes it difficult to track

The compromised server and the attacker both establish outbound connections to the Global Socket Relay Network

A shared secret lets the attacker reconnect to the server through that relay without knowing its IP address or hostname

There is no dedicated attacker-controlled C2 server to identify and block

The deployment can also disguise its process, hide files in memory-backed directories and establish persistence through cron jobs, systemd services and shell profiles

Microsoft observed GSocket-related detections increasing 356.2% between March and August 2026

Web applications and hosting environments accounted for 87.1% of attributable incidents, with PHP applications, cPanel hosting and Apache heavily represented

In a few incidents, attackers also attempted to exploit the Linux kernel's Dirty Frag (CVE-2026-43284) to escalate from the web server's account to root

This is why patching an exploited application is not the same as recovering a compromised server

You still need to investigate what ran after the initial breach, remove persistence, hunt for unauthorized remote access and verify that the attacker can no longer reconnect

[Dave McCollough @davemccollough]

I'm revisiting Microsoft Sentinel and documenting the process in a new blog series.

Part 1 covers deploying Sentinel through the Microsoft Defender portal and getting started with sample data.

#MicrosoftSentinel #Azure

https://t.co/9gOMi6WypD

[Br*an @SecurityCollins]

@89bravesteam @CinemarxismBret Just move to Texas

Oh wait 💀

[Br*an @SecurityCollins]

@nickshirleyy Your reading skills have improved. Nice job

[Br*an @SecurityCollins]

@GunloverClub1 Here’s that engagement you’re thirsty for

[spencer @techspence]

Buying tools is the biggest trap in cybersecurity. Vendors know it and they prey on the uninformed to pad their wallets.

If you’re a IT Manager, Director, CISO or similar, this is what I recommend instead. (Bookmark/save this to refer back to it later)

1) Identify & document the problem you’re trying to solve.

If you can’t describe it without using tool names in your answer you don’t fully understand the problem.

This is literally the MOST important part. Yes it takes more than 5 minutes to flush this out.

Don’t do this alone either. That brings me to the next step.

2) involve stakeholders

I know some IT/security people want to think they’re the most important person in the room but chances are your business is not cybersecurity.

That means something else keeps the company going. Customers, clients, agents, insurers, patients, etc.

If you buy a tool that impacts stakeholders outside IT and it’s the first time they are hearing or seeing it, there will be frustrations as a result.

The best time to involve stakeholders is at the beginning, during the planning stages.

Continue reading steps 3-6 here 👇
https://t.co/hLQiNzYWUy

[Br*an @SecurityCollins]

@ALosersLament @EYakoby You should look at what they’ve got in the bank friend. RU’s economy is much more cooked and fragile

[Br*an @SecurityCollins]

@sentdefender Good girl

[Br*an @SecurityCollins]

@TeahCartel @BaldVolf Doesn’t make it less true, I fear

[Br*an @SecurityCollins]

@Calmindownfr Glad to have you

[Br*an @SecurityCollins]

@UK_Daniel_Card @techspence

[Russell Adams @ruadams]

Stumbled across this today. Probably been there forever.

In Entra / External Identities under Lifecycle Management

Although it's presented as a Terms of Use for access to Admin portals, I'm leveraging it to force acceptance of our orgs IT Acceptable Use Policy every 180 days by targeting all Cloud Apps and excluding mobile devices.

Don't forget to exclude your glass break. Your users will also see it on their My Account page under Settings & Privacy.

https://t.co/0yczSBWYO5

@NathanMcNulty @ITguySoCal

[The Redline @theredlinehq]

TRACKED CHANGES: Law firm innovation chiefs left a private meeting with Anthropic unimpressed, per Bloomberg Law. “They need to wake up,” one said, citing two major dealbreakers: no hands-on training support and a minimum spend requirement just to negotiate custom privacy terms.

[Muqsit 𝕏 @mqst_]

🪢 AWS Security Team's Writeup On Building your AI Vulnerability Harness

Part 1: https://t.co/nKk1AP6AXi
Part 2: https://t.co/NOUEKzdjax

Author: Nidhi Ramakant, Ievgeniia Ieromenko, and Justin Kontny

[Jacob Rintamaki @jacobrintamaki]

This post about Chick-fil-A's K8s team always brings me joy.

[Br*an @SecurityCollins]

@anton_chuvakin Good read!

[Br*an @SecurityCollins]

@marklevinshow Time to take this guy’s guns away

[Br*an @SecurityCollins]

@mkraju He was born to “lead from behind”

[Br*an @SecurityCollins]

@officiallyramc @ahttba ❤️

[Br*an @SecurityCollins]

@KissHysilens @packers Incredible