Kevin Beaumont

Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights. You may be surprised to know I am not representing my employer here and these are not their opinions.

I have Direct Messages disabled - you can send them, but I will never receive them.

My website: https://doublepulsar.com
Github: https://github.com/GossiTheDog
Signal: GossiTheDog.1337

Public Key

npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcye

NIP-05 Address

gossithedog_at_cyberplace.social@momostr.pink

Profile Code

nprofile1qqs0uvd8fnn6wdtgj6r2f29akaj63axmj3werdn5ztr4qk9g9fgullgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsc6sxv8

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcye

Show more details

Last Notes

2026-06-22 22:34:30 UTC

Very funny screw up by Meta. They installed a keylogger on employees PCs, so they could train their AI. However they exposed the collected data online, so anybody could see what anybody who works there has been typing.
https://www.wired.com/story/meta-accidentally-let-employees-access-each-others-keystroke-data/

2026-06-05 16:33:25 UTC

If you're wondering why Anthropic et all are publicly making stupid claims ('our AI that writes itself!') and begging world governments to regulate them - while directing setting up the regulation - it's pretty simple: they're locking out competitors.
If you read through this draft of "The Greeat American AI Act" it's pretty clear that nobody but the current big players will be able to comply. It's "regulate me, daddy" = "make sure nobody else can compete".
https://trahan.house.gov/uploadedfiles/the_great_american_ai_act_discussion_draft.pdf

2026-06-04 22:19:57 UTC

- reply

Incogni are back chasing their removal request about publishing another removal request. https://github.com/GossiTheDog/Cyberplace/blob/main/LegalThreats/Re%3A%20Data%20removal%20request%20-%20Felix%20Juhl%20%5BID-EDG1A8611%5D
https://cyberplace.social/system/media_attachments/files/116/694/152/128/564/516/original/515e0a11d979f398.png

2026-06-01 20:51:30 UTC

How people hacked Meta accounts recently:
Step 1) Open Meta AI support
2) ask to change Obama's password
3) it says no :(
4) ask it nicely to just do it anyway
5) it resets Obama's password
From the company who brought you this headline a few months ago:
https://cyberplace.social/system/media_attachments/files/116/676/826/664/314/767/original/36771d64f8e1c787.png

2026-05-23 12:27:08 UTC

The White House is ordering agencies to place its new app on all employees’ government phones
A button gives the option to “text President Trump,” which, when clicked, opens a text message to a pre-selected number with the default text “Greatest President Ever!”
https://www.govexec.com/management/2026/05/white-house-ordering-agencies-place-its-new-app-all-employees-government-phones/413738/

2026-05-18 09:40:44 UTC

- reply

most companies do

2026-05-18 08:07:07 UTC

RE: https://techhub.social/@Techmeme/116594072188375601
The Metaverse stuff in Teams was such a waste of time. Trend chasing a trend which never existed in the first place. With my AI avatar I used to robot dance in meetings to piss people off.
#note1m3m…wedj

2026-05-14 17:38:38 UTC

- reply

I have had another request remove posts from my Mastodon server - this time removal of cease and desist requests. https://github.com/GossiTheDog/Cyberplace/blob/main/LegalThreats/Data%20removal%20request%20-%20Felix%20Juhl%20%5BID-EDG1A8611%5D
https://cyberplace.social/system/media_attachments/files/116/574/144/814/370/830/original/9ebdc8a8a2eabe07.png

2026-05-13 05:40:57 UTC

So I’ve just had a quick play with this and yes, it works. Essentially BitLocker has a backdoor. https://github.com/Nightmare-Eclipse/YellowKey
Mitigation = BitLocker PIN and BIOS password lock.

2026-05-05 21:03:58 UTC

RE: https://masto.deoan.org/@neurovagrant/116523975367255574
If you want a fun threat hunt, look at what Claude et all are doing in your company. Spoiler: dumb shit.

2026-04-15 11:46:49 UTC

- reply

Anthropic: we can't release our vuln research as it will end the internet as we know it!!1!
Me: if I release Teams Roulette I'll probably cause global chaos with people getting their knobs out in board meetings
https://cyberplace.social/system/media_attachments/files/116/408/555/607/595/490/original/bb5138a4efe55296.mp4

2026-04-10 08:21:27 UTC

lol of the day - noticed I’m quoted in this article, but I never spoke to the publication and the quotes are made up. They use GenAI during article creation and just made up what I thought 🤣 https://www.techbuzz.ai/articles/hacker-siphons-700k-from-u-k-energy-firm-in-payment-redirect
https://cyberplace.social/system/media_attachments/files/116/379/433/857/702/050/original/a29d34dc566d9297.jpeg

2026-03-18 19:08:38 UTC

- reply

the word create isn't in the thread anywhere

2026-03-18 18:40:41 UTC

Free copy of Battlefield 6 (PC I'm presuming) for anybody with an EA account -- 3F5T-NDK4-WN93-VEBH
https://www.ea.com/redeem

2026-03-18 18:11:57 UTC

- reply

don't worry, all these orgs are also hyping GenAI as the next big thing.
https://cyberplace.social/system/media_attachments/files/116/251/510/836/803/012/original/fdc1725cd4cbb52c.png
https://cyberplace.social/system/media_attachments/files/116/251/514/609/970/328/original/2eac8fb36b2b3bbc.png
https://cyberplace.social/system/media_attachments/files/116/251/519/073/424/378/original/386f8f5b11ae2a58.png
https://cyberplace.social/system/media_attachments/files/116/251/523/822/865/124/original/b47c42a7d5a6320f.png

2026-03-18 18:06:36 UTC

Meta, having renamed itself Meta and spending billions on it, is shutting down it's metaverse VR platform. https://www.theshortcut.com/p/meta-is-shutting-down-horizon-worlds-vr-despite-investing-billions-into-the-metaverse
https://cyberplace.social/system/media_attachments/files/116/251/502/489/240/665/original/d1f9af6fb14e849b.png

2026-03-18 15:15:24 UTC

We winning. https://www.bbc.co.uk/news/articles/cvg1gr5v333o

2026-03-16 23:35:08 UTC

RE: https://mastodon.social/@404mediaco/116241338503387167
Add this to the long list of execs fucking up their entire company using GenAI - CEO decides he doesn’t want to pay $250m bonus to staff, asks ChatGPT how to avoid it, his legal team tell him ‘are u fuckin dumb’, he does it anyway, gets sued, and loses in court.
#note1c24…x5y2

2026-03-16 17:13:30 UTC

- reply

Stryker have a liveblog of their security incident, linked from the front page of their website:
https://www.stryker.com/gb/en/about/news/a-message-to-our-customers-03-2026.html
tl;dr is most customer systems aren't impacted as they run on Linux, but their corporate Windows systems are toast so please hold the line.

2026-03-16 13:33:05 UTC

- reply

I still don't understand the US war on Iran. They declared war, then said it wasn't a war, then it was, then it wasn't, then it was, then declared victory, said Iran's military was totally disabled.. and now they're begging for help from the rest of the world as things keep getting blown up?
Like - what is the plan here?
There's not point asking the UK for help, we probably sold all our boats to Lidl.

2026-03-15 19:46:48 UTC

In other news, Hulu passed on the Buffy reboot, they didn't like the pilot. It's easy to be cynical about that one but from what I'd heard it was actually good, and weird, and got death'd by a thousand exec cuts of clueless people going "we made Buffy The Vampire What?!"

2026-03-15 19:38:42 UTC

The Firefly cast have secured the rights to Firefly, and plan to turn it into an animated series with the original cast voicing. https://deadline.com/2026/03/nathan-fillion-firefly-animated-series-development-1236754122/

2026-03-14 17:23:23 UTC

Buzzfeed journey:
- Successful
- Pivoted to GenAI for content
- Laid everybody off
- Now admits it probably can't stay in business
https://futurism.com/artificial-intelligence/buzzfeed-disastrous-earnings-ai

2025-11-20 18:39:26 UTC

If you use Sourcescrub by Datasite, they're dumping all the things people export into a public Azure Storage Blob - prodscrubstorage.blob.core.windows.net
http://prodscrubstorage.blob.core.windows.net/export?restype=container

2025-11-18 12:41:20 UTC

- reply

frame this modern art
https://cyberplace.social/system/media_attachments/files/115/570/748/829/164/087/original/c085208e7f83cd33.png

2025-09-18 13:24:01 UTC

- reply

I believe this is the fourth time Thalha Jubair has been arrested btw.
https://cyberplace.social/system/media_attachments/files/115/225/515/685/588/640/original/bfa1ae038d897ece.mp4

2025-09-18 13:22:10 UTC

- reply

Suspect arrested for M&S hack have been rearrested (again), this time for Transport for London hack last year: https://therecord.media/scattered-spider-teenage-suspects-arrested-britain-nca

2025-09-15 17:30:14 UTC

- reply

Marks and Spencer CTO leaves, CISO still in role.
It’s difficult to see what happened as her fault - eg the decision to outsource the frontline IT helpdesk that did the password resets dates 5 years before she joined.
https://www.computerweekly.com/news/366630565/MS-parts-ways-with-CTO-after-cyber-attack

2025-09-12 17:21:45 UTC

- reply

Unite are calling on the government to urgently intervene over the Jaguar Land Rover cyber incident, to introduce a furlough scheme for their suppliers.
https://www.unitetheunion.org/news-events/news/2025/september/jlr-supply-chain-workers-impacted-by-cyberattack-must-receive-government-support-says-unite

2025-09-09 11:04:12 UTC

Apparently Microsoft don’t understand how the Fediverse works, and want me to delete the parody account [@microsoft](https://lea.pet/@microsoft ) 🤣🫡
https://cyberplace.social/system/media_attachments/files/115/174/005/051/548/545/original/87419541f6ed4bf2.png

2025-09-02 11:16:36 UTC

- reply

This isn't a dig at MS btw, as they're actually really good with high profile vulns in their own on prem products nowadays overall - they'll frequently give extensive details to hunt on.
Other vendors should learn from that.

2025-08-21 12:06:28 UTC

- reply

The status updates on Colt's website describing a "technical issue" have been removed, replacing it with always being a cyber incident.
Left - internet archive - https://web.archive.org/web/20250814102113/https://www.colt.net/status/
Right - now https://www.colt.net/status/#updates
https://cyberplace.social/system/media_attachments/files/115/066/657/646/160/919/original/8e15ee68209339f2.png
https://cyberplace.social/system/media_attachments/files/115/066/661/955/280/114/original/8320bddd46e86316.png

2025-08-11 09:03:53 UTC

- reply

M&S still working on system recovery. https://www.bbc.com/news/articles/cewyyjdzql4o

2025-08-11 09:03:08 UTC

- reply

I understand the people released have not been charged.

2025-07-17 13:07:57 UTC

- reply

The people arrested as part of the Co-op and M&S hack investigation have been released on bail.
https://nation.cymru/news/four-people-bailed-after-arrests-over-cyber-attacks-on-ms-co-op-and-harrods/
Previously when this happened with LAPSUS$, they just continued hacking stuff.

2025-07-16 08:58:23 UTC

- reply

Personally I think Co-op did a really good job getting out of that situation and minimising impact.
I definitely think if you have a LAPSUS$ style advanced persistent teenagers situation, tilt towards open and honest comms as those kids will use secrecy against ya. It’s 2025, it’s okay to say you got hacked, people largely understand. Also, in IR, lawyers are usually stuck in 1980 advice - it’s just advice, they ain’t yo boss.

2025-07-16 08:47:29 UTC

- reply

Co-op finally admitted the entire membership database was stolen
I had this in the thread months ago, they originally tried to deny it entirely then tried to say ‘some’ data was accessed when they knew it was the whole thing.
https://www.bbc.co.uk/news/articles/cql0ple066po

2025-07-10 21:07:55 UTC

- reply

. @npub1vc3…axsh has broken the story that the key member (and teenager) of LAPSUS$ runs Scattered Spider
https://krebsonsecurity.com/2025/07/uk-charges-four-in-scattered-spider-ransom-group/
https://cyberplace.social/system/media_attachments/files/114/830/978/034/667/877/original/b5253b031d93741e.jpeg

2025-07-10 17:10:53 UTC

- reply

After almost 3 months, Marks and Spencer recruitment system came back online just now. First 4 jobs posted.
https://cyberplace.social/system/media_attachments/files/114/830/043/138/465/663/original/0999651b7bfea908.png

2025-07-10 16:58:28 UTC

- reply

If you ever doubted the link between Scattered Spider(tm) and LAPSUS$ - one of the people arrested today was a key part of the LAPSUS$ attacks a few years ago.

2025-07-10 11:17:17 UTC

- reply

17 and two 19 year old teens picked up over Co-op and M&S hacks, and a 20 year old woman.
Pretend to be surprised.
https://www.bbc.com/news/articles/cwykgrv374eo

2025-07-01 12:56:48 UTC

- reply

Marks and Spencer’s CEO says half of their online ordering is still offline after their ransomware incident, they hope to get open in next 4 weeks.
They are also rebuilding internal systems and hope a majority of that will be done by August.
Lesson: mass contain early. M&S didn’t. Co-op did.
https://www.reuters.com/business/retail-consumer/ms-ceo-most-cyberattack-impact-will-be-behind-us-by-august-2025-07-01/

2025-05-13 08:02:04 UTC

- reply

M&S confirm my toot from 3 days ago that a significant amount of customer and staff data was stolen. They’ve known for weeks but opted not to tell anybody. https://www.bbc.com/news/articles/c62v34zv828o

2025-05-07 11:55:01 UTC

- reply

One thing for media covering the Co-op thing - attackers are not impersonating IT help desks to gain access. They’re impersonating *staff* calling in to the IT help desks - they’re different things.
https://cyberplace.social/system/media_attachments/files/114/466/416/024/433/698/original/f030bca626f42b41.jpeg

2025-05-06 14:52:01 UTC

- reply

Contactless payment has been fixed at all Co-op Group stores.

2025-05-06 10:21:14 UTC

- reply

It sounds like the situation at Co-op has got worse. They’ve stopped taking card payments, it’s cash only. https://www.telegraph.co.uk/business/2025/05/06/co-op-shops-stop-taking-card-payments-amid-cyber-attack/

2025-05-05 16:21:58 UTC

- reply

Co-op Group appear to be trying to course correct with their cyber incident comms.
They’re calling it a cyber incident now, and have put a statement on the front page of their website, along with an FAQ. They haven’t yet emailed members (they should).
https://www.coop.co.uk/cyber-incident

2025-05-05 14:32:41 UTC

- reply

One of the points of exploitation of large orgs is they usually outsource their Service Desk to somewhere cheap offshore who don’t know the org staff, and when you call and say your name, they normally put big all caps bold red warning if the person is a VIP, eg C suite, so they get VIP service - ie anything goes.

2025-05-05 14:18:45 UTC

- reply

BBC News has a look at teenagers phoning helpdesks and pretending to be the CISO. https://www.bbc.com/news/articles/c4grn878712o

2025-05-05 12:23:15 UTC

- reply

The SignalNotSignal hack of US government is really big. Some examples for those who haven’t seen it. The USG managed to take an encrypted platform, backdoor it, and got owned.
https://cyberplace.social/system/media_attachments/files/114/455/202/237/947/143/original/52ac669d4ca17b82.jpeg
https://cyberplace.social/system/media_attachments/files/114/455/202/488/201/917/original/5f18f46f66b82595.jpeg

2025-05-05 10:42:28 UTC

- reply

I’ve been using Recall for a few weeks now on my daily driver.
It scooped up my credit card statements after I logged into online banking - both screenshots (text indexed) of the PDFs, transaction history from the website, and my name, date of birth and security question reminders.
Sensitive filtering mode only kicked in when I viewed my cards CVV number.
Worth excluding bank websites from Recall’s options, if you see it enabled.

2025-05-05 06:25:55 UTC

#NoName are back targeting UK councils. Same config as prior UK runs. #threatintel
https://cyberplace.social/system/media_attachments/files/114/453/797/399/811/939/original/a2ea6e643c9913e9.jpeg

2025-05-05 05:33:55 UTC

- reply

Sky News quote a source in M&S head office saying Marks and Spencer have no ransomware incident plan so they are making it up as they go along apparently, with staff sleeping in the office and communicating via WhatsApp.
M&S dispute this, saying they have robust business continuity plans.
https://news.sky.com/story/amp/mands-had-no-plan-for-cyber-attacks-insider-reveals-with-staff-left-sleeping-in-the-office-amid-paranoia-and-chaos-13361359

2025-05-04 23:33:20 UTC

The third party version of Signal the White House has been using has been hacked, and Signal messages from devices stolen (as they were being sent to the supplier)
https://www.404media.co/the-signal-clone-the-trump-admin-uses-was-hacked/

2025-05-04 18:40:10 UTC

- reply

Great NCSC piece by [@ollie_whitehouse](https://infosec.exchange/@ollie_whitehouse )
I’d add - block by Entra policy specifically High risk logins (below is too FP prone), and SOC monitor them. SOC playbook = account probably compromised. How?
https://www.ncsc.gov.uk/blog-post/incidents-impacting-retailers

2025-05-04 11:16:59 UTC

- reply

A wrote a piece about paying ransoms does not equal quick restoration - in fact, quite often it makes things worse. https://doublepulsar.com/big-game-ransomware-the-myths-experts-tell-board-members-03d5e1d1c4b7

2025-05-03 20:56:03 UTC

- reply

Sunday Times has a piece looking into ransomware incident at Marks and Spencer. It's pretty good, goes into their contain and eradicate focus.
"By shutting down parts of the IT estate, Higham’s team had worked to prevent the attack from spreading, but had also stopped parts of its digital operations from functioning. This was considered a worthy trade-off."
One error in the article - lack of recovery doesn't mean no ransomware paid. Paying is not quick restoration.
https://www.thetimes.com/business-money/companies/article/m-and-s-cyber-attack-ms-klrnxvwq6
https://cyberplace.social/system/media_attachments/files/114/445/873/790/799/993/original/366d4e68b247f7c3.png

2025-05-03 16:52:07 UTC

- reply

Here's the ITV News report anyhoo, logline: "ITV News understands the the ongoing cyberattack faced by the supermarket has worsened since Friday, impacting the ordering system, drivers and warehouse staff."
https://www.itv.com/news/2025-05-03/worsening-cyberattack-shuts-down-co-op-orders-itv-news-understands

2025-05-03 16:27:51 UTC

- reply

There's a report on ITV News that Co-op member data is available on the Dark Web(tm), but as far as I know this isn't accurate. DragonForce's portal hasn't been available for over a week.
https://cyberplace.social/system/media_attachments/files/114/444/827/549/010/837/original/40d434fbac7c69bf.png

2025-05-02 23:26:54 UTC

- reply

By the way, this is absolutely terrible advice for dealing with a major and high visibility ransomware incident.
https://cyberplace.social/system/media_attachments/files/114/440/825/134/064/907/original/a4b8dbace31247be.jpeg

2025-05-02 23:24:45 UTC

- reply

One of M&S’ biggest suppliers have said they have reverted to pen and paper for orders due to M&S lacking IT.
Additionally, M&S staff are raising concern about how they will be paid due to lack of IT systems.
M&S are over a week into a ransomware incident and still don’t have their online store working.
https://www.bbc.com/news/articles/cvgnyplvdv8o
#threatintel #ransomware

2025-05-02 19:58:23 UTC

- reply

Bleeping Computer have more on the Co-op breach https://www.bleepingcomputer.com/news/security/co-op-confirms-data-theft-after-dragonforce-ransomware-claims-attack/
#threatintel #ransomware
https://cyberplace.social/system/media_attachments/files/114/440/005/208/877/125/original/0c84e4558d7e9dc4.jpeg

2025-05-02 19:53:27 UTC

- reply

Pass the bong
https://cyberplace.social/system/media_attachments/files/114/439/985/794/564/818/original/f7ebe7e360547636.jpeg

2025-05-02 19:49:46 UTC

- reply

Regarding IOCs around the UK retailer activity - there’s loads doing the rounds, and they’re almost all not useful.
Eg hundreds of dynamic VPN IPs from 2022. If you google them you’ll find them on vendor blogs from years ago for Scattered Spider - people are recycling in panic and passing around in panic.
Don’t hunt on random IOCs. IP addresses change. Strengthen foundational controls. Review sign in logs for abnormal activity etc.

2025-05-02 18:33:10 UTC

- reply

New by me - breaking down the attacks on UK highstreet retailers
https://doublepulsar.com/dragonforce-ransomware-cartel-attacks-on-uk-high-street-retailers-walking-in-the-front-door-52ed8ba68534

2025-05-02 17:51:34 UTC

- reply

Co-op Group have now admitted a significant amount of member (customer) information has been stolen by DragonForce Ransomware Cartel, saying they "accessed data relating to a significant number of our current and past members" - around 20 million people. The Member database, basically.
Up until now Co-op hadn't even used the words cyber or threat actor, referring to an "IT issue" and "third party" in comms.
https://www.bbc.co.uk/news/articles/crkx3vy54nzo

2025-05-02 17:17:15 UTC

- reply

The individuals operating under the DragonForce banner are using social engineering for entry.
Defenders should urgently make sure they have read the CISA briefs on Scattered Spider and LAPSUS$ as it's a repeat of the 2022-2023 activity.
Links: https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf
https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider_0.pdf
I would also suggest these NCSC guides on incident management: https://www.ncsc.gov.uk/collection/incident-management
and effective cyber crisis comms: https://www.ncsc.gov.uk/guidance/effective-communications-in-a-cyber-incident
https://cyberplace.social/system/media_attachments/files/114/439/364/451/611/425/original/88443a28e91c4812.png

2025-05-02 17:13:18 UTC

- reply

I'm going to make this the new ongoing megathread for DragonForce Ransomware Cartel's attack on UK retailers as they're all connected.
Why it matters: these are some of the UK's largest retailers, think Target or some such in a US sense.
Prior threads
M&S: https://cyberplace.social/@GossiTheDog/114381946765071799
Co-op: https://cyberplace.social/@GossiTheDog/114426688834113446
Harrods:
https://cyberplace.social/@GossiTheDog/114433519351165250

2025-05-02 16:56:56 UTC

DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks
https://cyberplace.social/system/media_attachments/files/114/439/291/680/282/586/original/e2f2cb46a87536b1.jpeg

2025-05-01 14:36:36 UTC

- reply

in account.microsoft.com you can turn on passwordless, so your hotmail account has no password at all, MFA is used for access.
But if you enable it, can you still RDP with the old password?

2025-05-01 12:31:43 UTC

- reply

what happens if you turn passwordless on with the account, does it still accept the old password?

2025-04-30 12:44:23 UTC

- reply

US economy shrinks 0.3% https://www.bbc.co.uk/news/live/c3wx0797d37t?post=asset%3A444e1826-46b9-4f10-a9bf-f696e7e486fd#post
https://cyberplace.social/system/media_attachments/files/114/426/973/865/032/332/original/5216d36617619ccc.jpeg

2025-04-29 21:38:23 UTC

Lord, feel sorry for the M&S CISO. He only arrived just over a year ago.
It looks like they outsourced lots of their IT systems to TCS many years ago. He's spend years warning about ransomware and now he's on the hook for a barn fire likely caused by years of prior decisions.

2025-04-16 20:14:55 UTC

- reply

I’m very tempted to take next week off work 😅
https://cyberplace.social/system/media_attachments/files/114/349/473/220/930/641/original/f79c99058d414276.jpeg

2025-04-16 20:08:18 UTC

- reply

Oblivion Remastered vs vanilla comparison https://youtu.be/BppeLAz37rc

2025-04-16 14:31:21 UTC

- reply

CVE extension to March 16th 2026
See y’all March 15th 2026 for the last minute renewal 🫡😅
https://www.usaspending.gov/award/CONT_AWD_70RCSJ24FR0000018_7001_70RSAT20D00000001_7001
https://cyberplace.social/system/media_attachments/files/114/348/122/205/370/434/original/574ab8fc6e0c1081.jpeg

2025-04-16 14:14:22 UTC

- reply

CVE extension by CISA = 11 months. https://infosec.exchange/@metacurity/114348047105534455

2025-04-16 12:44:06 UTC

- reply

Now all we need is for Breachforums to get back online and the threat intelligence industry is alive again!
https://cyberplace.social/system/media_attachments/files/114/347/700/587/719/753/original/2ff378f6a90ded78.jpeg

2025-04-16 12:14:24 UTC

- reply

CISA have, at the last minute, extended the MITRE CVE contract. “The CVE Program is invaluable to cyber community and a priority of CISA. Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We appreciate our partners’ and stakeholders’ patience.” HT @npub102x…wzj6

2025-04-16 09:14:43 UTC

- reply

Another effort - https://gcve.eu/ Global CVE Allocation System

2025-04-16 08:22:44 UTC

- reply

Looks like the US Government are going to lose control of CVE. https://www.thecvefoundation.org/

2025-04-16 08:08:09 UTC

- reply

If you want to know how stupid the CVE situation is - CISA are trying to source last minute funding or look at taking CVE management in house, but they themselves have had a massive budget cut where the staff trying to fix it are also at risk of being cut.
https://cyberplace.social/system/media_attachments/files/114/346/615/524/679/501/original/421385df81c38d4e.png

2025-04-16 07:54:47 UTC

- reply

DOGE have terminated MITREs contracts, they say they will be laying off nearly 500 people. This will have impacts beyond CVE - think MITRE ATT&CK etc. https://virginiabusiness.com/nova-govcon-firm-mitre-to-lay-off-442-employees-after-doge-cuts-contracts/

2025-04-15 22:52:38 UTC

- reply

NextGov piece on the CVE mess. https://www.nextgov.com/cybersecurity/2025/04/mitre-backed-cyber-vulnerability-program-lose-funding-wednesday/404585/

2025-04-15 22:27:34 UTC

- reply

CISA comment on CVE situation: https://infosec.exchange/@metacurity/114344326544856491

2025-04-15 22:13:45 UTC

- reply

There's an argument that MITRE should try to keep everything alive and run things without funding and contracts etc.. but, honestly? My take - stop doing everything that isn't in the contract. Force the issue.

2025-04-15 21:45:36 UTC

- reply

To widen it out - CVE is the globally recognised system orgs use for vulnerability management.
Every vulnerability management product uses CVEs. Vulnerability management is a core part of cybersecurity - often, the most important part.
Additionally, CVE is written into several US government standards that orgs have to follow.
So the US Government not funding it is a major and historic own goal.

2025-04-15 21:38:37 UTC

- reply

Just as an update to this - @npub1vc3…axsh has confirmed with MITRE the letter is real, and as it stands the CVE database is likely to offline tomorrow.

2025-04-15 18:58:37 UTC

- reply

My take on the CVE contract issue for businesses: don’t overreact, wait and see what impacts are.
The NVD backlog was already pretty crazy.. the US gov has gotta put real funding into this area if it wants to retain control of cyber standards.

2025-04-03 16:10:55 UTC

- reply

Bleeping Computer report that although Oracle are telling clients the login data is "old", they've received login details from the threat actor current to this year (2025). Oracle haven't returned requests for comment. https://www.bleepingcomputer.com/news/security/oracle-privately-confirms-cloud-breach-to-customers/

2025-04-03 13:05:12 UTC

- reply

Also in both cases Oracle hasn’t filed an 8-K or told regulators or provided an IR report to customers or a written technical statement of what happened or put anything on their website or commented to press.

2025-04-03 12:55:16 UTC

- reply

To answer my own question up thread - from talking to people, the Oracle Health breach appears to be unrelated to the Oracle SaaS incident this thread describes.
In both cases they’re being extorted, and in both cases they’re working with the FBI and external incident response.

2025-04-03 12:09:26 UTC

- reply

Oracle were still trying to get SaaS solutions *they* manage off Oracle Classic aka Gen1 as of 2023. They made a mess of it.
https://cyberplace.social/system/media_attachments/files/114/273/954/152/805/333/original/9462e09daeffbb8b.jpeg

2025-04-03 12:05:46 UTC

- reply

Yeah, by legacy system Oracle mean ‘a system we manage housing active customer data’. They’ve also been telling people it isn’t Oracle Cloud.. but it is, and they know it is, they’re just doing customer talking points to wordsmith around it.
https://infosec.exchange/@Fringedcrow/114273919390396133

2025-04-03 08:54:12 UTC

- reply

The Bloomberg article is paywall so here’s screenshots.
https://cyberplace.social/system/media_attachments/files/114/273/186/220/506/506/original/f8f2490848206049.jpeg
https://cyberplace.social/system/media_attachments/files/114/273/186/529/949/197/original/42a2ca8df53b03fb.jpeg

2025-04-03 08:25:37 UTC

- reply

“The company informed customers that the system has not been in use for eight years and that the stolen client credentials therefore pose little risk, the report added. The stolen data included Oracle customer log-in credentials from as recently as 2024, the report said.”
This would be Oracle Classic, aka Gen1. I’ve been told the systems were left online after migration.. unpatched.
Oracle are trying to play legacy angle - but what else was stolen? What else did the attacker do? Why cover up?

2025-04-03 08:22:25 UTC

- reply

We have an update. Reuters and Bloomberg confirm my blog, that’s there’s a security incident going on at Oracle cloud. Oracle declined to comment, after lying to @npub1pkr…6763 and other outlets on the record.
CrowdStrike is the IR company.
“Oracle staff acknowledged to some clients this week that an attacker had gotten into a legacy environment, Bloomberg News report said.”
https://www.reuters.com/technology/cybersecurity/oracle-tells-clients-second-recent-hack-log-in-data-stolen-bloomberg-news-2025-04-02/

2025-04-03 04:35:58 UTC

It’s 5am and I just watched that Trump “Liberation Day” press conference and it’s the dumbest thing to happen since the last dumbest thing to happen (there’s a lot of completion).
All that will cause is inflation in the US.

2025-04-02 17:21:23 UTC

- reply

100% on this one, seen all the time on real world incidents.
Problem: somebody got a password for an account and nobody knows how.
How: the business user signed into their personal Google account in Chrome at work, which synced all their bookmarks and saved passwords to Google. Then they switched on their home PC, Chrime synced, and infostealer took all the details
Solution: Google Chrome ADMX, and set Group Policy to turn off personal account sign in with Chrome.
https://infosec.exchange/@Walker/114268652560517693

2025-04-02 16:20:00 UTC

- reply

I should also point out there's a lot of infosec people at trillion dollar tech companies sat thinking quantum and AI is going to be the next big problem...
...when in reality SMBs make up a vast majority of the global economy - and are getting owned by people running this as they can't work out nmap parameters, while playing Call of Duty on their second monitor (this isn't even a joke, this was a ransomware deployment):
https://cyberplace.social/system/media_attachments/files/114/269/268/098/136/656/original/1f351dc552d9a58a.png