I accidentally became the CISO. I didn't want this job, but the job chose me. I'm scared, and I want to go home.
United States
Joined January 2019
- Tweets36.7K
- Following2.1K
- Followers59.6K
- Likes67.8K
I met an enterprising young hacker at a conference last week. Our conversation produced a business idea. I don’t need another project, but suggested he run with it. He expects to have a prototype for me to play with next week. 🔥
Ideas are cheap, execution is what matters.
I thought October was going to be a relaxing month to enjoy the fall weather. Instead it turned into my biggest month ever as an independent consultant. I’m not complaining, I’m just very tired.
Accidental CISO retweeted
Make sure that while in persuit of moving the needle you don't stick it into your eye.
Focusing on optimization in environments that have a significant amount of uncertainty creates brittle systems. Fix the uncertainty first.
PSA: Emailing customers invoices called "invoice.pdf" is not helpful. Please put your company/product in the file name. Bonus points for a date, too.
Accidental CISO retweeted
Unless I'm working in an ER, working as a paramedic, or working as a firefighter, there's no reason I should be expected to "thrive in a fast-paced, high-pressure environment." Just fix the terrible management and stop running your office like a circus.
Accidental CISO retweeted
Part four of our special series on AI Implementation is available on the podcast feed! This time, we're discussing where business leaders should look to integrate AI into their processes, workflows, and systems to achieve results. mindfulsmbshow.com/e/special…
What (or who) are your favorite sources of Cybersecurity news?
Bonus points for news that is primarily relevant to small businesses leaders.
Accidental CISO retweeted
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:
php.net/index.php#2026-10-20…
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow
The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
⠀
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.
PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
⠀
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
⠀
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
Any sufficiently large vendor risk questionnaire will inevitably ask some of the same questions more than once. 🤬
I'm working on reinventing the format of my podcast and shifting the focus from teaching business leaders about cyber to teaching cyber practitioners about business. If you listen already, would this make you stop? If you don't already listen, would this be interesting to you?
You know that SOC 2 emergency you are having right now? If you had taken this advice and done during the summer, it wouldn’t be an emergency now, would it?
