Bishop Fox (@bishopfox) | teapawt

Bishop Fox retweeted

@HealthISACOct 12

Healthcare Security at Machine Speed: $17M Ransomware & AI Adversaries webinar with @bishopfox on Tuesday, November 10th at 3 PM ET! This session connects healthcare security strategy to these operational decisions: how to evaluate response assumptions, assign ownership across departments, and prioritize investments that support continuity of care. Register Here: bishopfox.com/resources/heal…

1

165

Research, offensive security, open-source tools, and the occasional ridiculous war story. We're growing r/BishopFox as a place for security practitioners to talk shop.

1

2

466

Come hang out: okt.to/n3EsxO

r/BishopFox

r/BishopFox is the official subreddit of Bishop Fox, a cybersecurity consulting and research firm focused on offensive security and real-world risk. This community is for practitioners to discuss red...

138

@bishopfoxOct 12

You found command injection in the logs. Did anything actually execute? On the latest Initial Access, Dillon Sparks discusses why vulnerability claims deserve scrutiny and how unrealistic configurations and unproven impacts can distort severity.

1

5

695

@bishopfoxOct 12

Full episode: okt.to/CU42Ho

Citrix NetScaler Zero-Day, Denmark CPR Breach, And Google Bug Bounty…

NetScaler zero-day vulnerability, Denmark CPR breach, Google OSS VRP pause, and tips to break into cybersecurity in 2026.

124

@bishopfoxOct 9

The master key came with the software. CVE-2026-28326: SolarWinds ARM shipped with a shared authentication secret that enabled unauthenticated RCE. Jon Williams & Bishop Fox TEA team confirmed SYSTEM access. CVSS: 8.8 or 9.8, depending on exposure.

1

10

988

@bishopfoxOct 9

Research & safe detector: okt.to/ItBdRv

Master Key Included: Detecting SolarWinds ARM CVE-2026-28326

CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.

2

201

@bishopfoxOct 8

¡Hoy: Weaponizing CloudFormation! ¿Puedes escalar privilegios en AWS empezando con permisos IAM limitados? Samanta Aranda nos mostrará cómo aprovechar roles de CloudFormation mal configurados en un taller práctico. En español Discord de Bishop Fox: okt.to/AThma4

1

443

@bishopfoxOct 8

Who has the AI advantage right now? Evan Wolff's answer: attackers. But he expects that gap to change as AI becomes embedded into the tools defenders already use.

2

2

500

@bishopfoxOct 8

More from our conversation on the cybersecurity priorities shaping 2027: okt.to/h0FL79

AI Security, Risk, and Cybersecurity Priorities for 2027

Vinnie Liu, Justin Greis, and Evan Wolff discuss AI security, risk, and which cybersecurity investments will actually matter heading into 2027.

132

@bishopfoxOct 6

Tomorrow at @ekoparty - iOS Game Hacking: From Zero to God Mode Luis De la Rosa & Steeven Rodríguez are going live with reverse engineering, hooking, Infinite Coins, Speed Hacks and, obviously, GOD MODE. Mobile Hacking Village 2 PM ART bfx.social/4rSsDRo

1

617

@bishopfoxOct 6

Happening today: Start with limited IAM permissions. Find a path to more. Samanta Aranda is going hands-on with abusing misconfigured CloudFormation execution roles today in the Bishop Fox Discord.

1

5

646

@bishopfoxOct 6

bfx.social/4hxypV4

Weaponizing CloudFormation

Learn to exploit misconfigured AWS CloudFormation roles in this hands-on workshop covering IAM abuse, persistence, and delegated execution attacks.

155

@bishopfoxOct 5

What happens when you give AI a firmware image and ask it to find a way in? At @ekoparty, Jon Williams is demoing a full unauthenticated UniFi OS takeoverand showing how an off-the-shelf AI research setup helped take it from raw firmware to a finished exploit.

1

5

633

@bishopfoxOct 5

bfx.social/3W7PoVo

Ekoparty 2026

Bishop Fox brings two talks to Ekoparty 2026 covering a UniFi OS RCE chain built with AI tooling and live iOS game hacking from reverse engineering to God…

161

@bishopfoxOct 5

“We have no evidence it was exploited” isn't very reassuring if you couldn't have detected exploitation in the first place. Thomas Wilson describes the problem with relying on an absence of evidence when legitimate and malicious access look the same.

1

4

831

@bishopfoxOct 5

From Initial Access: bfx.social/4j1JTkN

ShinyHunters PeopleSoft WAF Bypass, Arrests, And OpenAI Astra News

Read about ShinyHunters PeopleSoft WAF bypass, a key arrest, 400k Medicaid records exposed, and OpenAI pulling GPT-6.1 Astra.

1

139

@bishopfoxOct 5

One capital letter helped turn an Attu vulnerability into a path to the cloud. Berenice Flores found two flaws in Zilliz Attu 2.6.5 that could be chained to access internal services and, in a tested AWS EKS deployment, compromise the Kubernetes namespace. Upgrade to 3.0.0. bfx.social/3U8PdbS

8

769

@bishopfoxOct 2

Happening next week! Samanta Aranda is going hands-on with abusing misconfigured AWS CloudFormation execution roles, from limited IAM permissions to privilege escalation and persistence.

1

4

752

@bishopfoxOct 2

Oct. 6 — English: bfx.social/4zbYYoB Oct. 8 — Spanish: bfx.social/4djdLpb

Weaponizing CloudFormation

Learn to exploit misconfigured AWS CloudFormation roles in this hands-on workshop covering IAM abuse, persistence, and delegated execution attacks.

137