Kevin Beaumont

Payton lives on in the Lake District 🐕

God damn it

Strange reply - just pointing out it’s for a different vuln, it’s mentioned in the link.

It does include threat intel btw - namely, that vuln is being used to drop webshells (including .xhtml ones, which is also new info).

‘tis a different vuln - CVE-2025-6543

Tomorrow you will have no legs

It’s not weird to me, since it’s just something you’ve made up in your head 🤣

My take is MAPP should be protected btw, it’s a net win regardless.

MSTIC had a running joke that MAPP’s acronym stood for Microsoft Arming People’s rePublic of china. 🤣

citrix-2025/TLPCLEAR_check_script_cve-2025-6543-v1.6.sh at main · NCSC-NL/citrix-2025 Contribute to NCSC-NL/citrix-2025 development by creating an account on GitHub.

Emerging situation to be aware of - some of the #CitrixBleed2 session hijacking victims are also victims of webshell implants via a different vuln, CVE-2025-6543.

Script to check for Netscaler implants: https://github.com/NCSC-NL/citrix-2025/blob/main/TLPCLEAR_check_script_cve-2025-6543-v1.6.sh

dear satya,

i have a new product idea

mustafa suleyman xoxo

Microsoft Bob - Wikipedia

Shush you, he's inventing Microsoft Bob en.wikipedia.org/wiki/Microso...

Clean on OPSEC

Nobody tell the US Government representatives about Jen Easterly existing.

yeah it's nonsense.

this is bollocks, FYI. It's a minor outage, stop using Downdetector graphs as the primary source.

I am debating about updating my CitrixBleed2 vulnerability tracking on Github to include which boxes were exploited, and by which IPs and when.

It's a real mess.

I think CISA, UK NCSC and authorities in Germany likely need to get more proactive on #CitrixBleed2. Left is unpatched CitrixBleed 2, right is that SharePoint vuln.

One is a much, much bigger problem leading to nation state actors sat in inside remote access to networks - and it's the Citrix one.

At Least 750 US Hospitals Faced Disruptions During Last Year’s CrowdStrike Outage, Study Finds Of those, more than 200 appear to have had outages of services related to patient care following CrowdStrike’s disastrous crash, researchers have revealed.

When, one year ago, a buggy update to software sold by the cybersecurity firm CrowdStrike took down millions of computers around the world and sent them into a death spiral of repeated reboots, the global cost of all those crashed machines was equivalent to one of the worst cyberattacks in history.

At Least 750 US Hospitals Faced Disruptions During Last Year’s CrowdStrike Outage, Study Finds Of those, more than 200 appear to have had outages of services related to patient care following CrowdStrike’s disastrous crash, researchers have revealed.

At Least 750 US Hospitals Faced Disruptions During Last Year’s CrowdStrike Outage

Wired piece: www.wired.com/story/at-lea...

Study: jamanetwork.com/journals/jam...

vim how do I quit vim

VIM: hello dave

the enron book 'the smartest guys in the room' is good btw, it's about people who invented things and then booked profits on those things without checking if anybody actually wanted them

a cat sitting on a counter next to a roll of green tape ALT: a cat sitting on a counter next to a roll of green tape

As a companion to this skeet please know I've had a Microsoft exec tell me that with generative AI, they've invented electricity, and it was quite possibly the best moment of my life.

The Hague’s Public Prosecution Service has a cybersecurity incident running and have shut down services, the NCSC are directing people to my blog with headers such as “China goes brrr” and “Russia goes bleep boop”

I have this image saved on my phone camera reel as I get so much use out of it

🤣 last time I checked The UN still hadn’t patched.

A photo of a TV where a woman dressed as a ghost for the Eras Tour is interviewed by local news. The caption reads “Woman hides identity because she called in sick to work.”

Unlike CEOs and other executives, individual contributors understand concert OPSEC

They essentially didn't investigate it properly, their statement: www.linkedin.com/posts/inform...

and my view:

I'm not a fan of how the ICO investigated this, for the record.

lol at the image they use

Exploitation of CitrixBleed 2 (CVE-2025-5777) Began Before PoC Was Public GreyNoise has observed active exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler. Exploitation began on June 23 — nearly two weeks before a public proof-of-concept was released on July 4.

GreyNoise observed exploitation of CitrixBleed 2 (CVE-2025-5777) nearly two weeks before a public PoC was released. Full breakdown ⬇️
#GreyNoise #ThreatIntel #CitrixBleed #Citrix #NetScaler