Mike Manrod (@CroodSolutions) header
Mike Manrod (@CroodSolutions) profile picture

CISO and faculty by day, adversary emulation/tools by night, bad jokes and memes all the time.

Arizona, USA
Joined June 2021
Photo by Mike Manrod (@CroodSolutions)Photo by Mike Manrod (@CroodSolutions)Photo by Mike Manrod (@CroodSolutions)Photo by Mike Manrod (@CroodSolutions)Photo by Mike Manrod (@CroodSolutions)Photo by Mike Manrod (@CroodSolutions)Photo by Mike Manrod (@CroodSolutions)Photo by Mike Manrod (@CroodSolutions)Photo by Mike Manrod (@CroodSolutions)Photo by Mike Manrod (@CroodSolutions)
Should I buy an ATM this week? Have been pondering an interesting question: ATMs have been referenced as a great success story of app control. We have also found kiosk security to be abysmal overall. Are ATMs secure/should we find out? @Shammahwoods @UK_Daniel_Card 1/🧵
Do it!!!Wait, ATMs are Kiosks?No good can come of this.What is an ATM...?
88%Do it!!!
12%Wait, ATMs are Kiosks?
0%No good can come of this.
0%What is an ATM...?
16 votes • Final results
5
2
1
16
804
Mike Manrod retweeted
Went trick or treating with my son tonight for Halloween. Him and I must have hit over 100 houses. We went door to door for blocks. Not a single person offered my son a USB stick with malware on it. This country is going to hell in a hand basket.
26
24
1
904
13,141
I thought i got a bag of M&Ms and instead it was full of Agent Swarms. Makes sure you check your kids candy!!
1
2
4
165
Usually I do some sort of costume, but this year just cosplaying as someone who can make baskets, sporting some of my favorite merch from @techspence and @uwu_underground. Happy Halloween everyone!! 🎃👻
1
2
10
420
I don't remember the last time tech has been this exciting. It's white hot right now. Anyone who loves technology and computers is probably having a great time right now.
114
111
19
1,568
43,111
Mike Manrod retweeted
I have a very different world of cyber from some people.... I get to share stuff on here others can't. I get to build labs and show people things that might be related to work.... where other people can't. I think confusing what people do or don't post online in terms of volume as a measure of 'technical skills' or just really anything is a bit odd..... I am fortunate, my work is my hobby, and @r3b00tsBoss is amazing and lets me do the most fun things sometimes! I also have the benefit fit of, I am the decision maker and budget holder, I can spend my companies money how I want. So if you ever wondered how I have time to do all this shit: 1) I am doing other things at the same time 2) I don't have to fill in forms to take a day off, or ask permission to buy something/do something 3) I fucking love this game! 4) most most importantly, the people here are largely bloody amazing, lovely, smart and fun! number 4 is why I am here! I am not 12 years old, I don't give a fuck if you think I'm technical or not... or if you think my skills are lacking because I can do a risk assessment on things.... and not cry like a 5 year old every time a new vulnerability is released. I do as well get to choose what I do with my time (largely), which is, to me... priceless!
3
2
36
1,457
Mike Manrod retweeted
Replying to @LisaForteUK
He’s off to train for the Tour de France
2
4
146
The breakfast tacos were especially good this morning.
5
153
New on LOLDrivers: Realtek RtsUpx.sys 1.13.0.0, a signed USB camera/hub/audio utility driver. An admin has to load it, but once it is running, a regular user can send it IOCTLs to read and write physical memory. That is a short path from user land to the kernel.
1
2
14
691
Mike Manrod retweeted
This is super useful (and cool from a CTI pov) (obviously incidents for orgs/ people are not fun) I wrote a blog last week saying mass exploitation of everything wasn’t likely but we would probably see limited exploitation of appliances! Turns out my cyber tea leaf 🍁 reading wasn’t awful! Great job from the @Huntio team! #PHP2Shell
PHP2Shell One Week Later: Honeypot Shells on the Web, a Path to Root on Palo Alto Firewalls One week after the #php2shell patch, around 25 internet-facing #PaloAlto firewalls have been rooted, the first confirmed production compromises. On the open internet, the same bug is still only landing shells on honeypots. We pivoted from the public exploitation reports into our AttackCapture open-directory data to see who is running it. What we found: - ~25 internet-facing Palo Alto PAN-OS firewalls rooted, the first confirmed production compromises. Reported by Dream Research, verified by Unit 42, matched in operator logs we captured. - The chain is two bugs: php2shell lands as nobody on the PAN-OS management interface, then a kernel bug (Fragnesia, CVE-2026-46300) escalates to root. - On the open web, watchTowr, 0x4D31, and GreyNoise see shells only on honeypots. Wiz and CrowdStrike found none. - 616 php2shell files across live open directories: a shared ASLR-bypass kit byte-identical across four hosts, a custom heap exploit with a log cleaner, and cloned PoCs. - One operator handed the exploit research to an AI assistant and left the session log exposed. Full research, IOCs, and detection guidance 👇 hunt.io/blog/php2shell-honey…
1
10
56
4,954
Mike Manrod retweeted
Offensive security roles face an automation shift, but mid-senior experts remain safe for now. Hear more from Trey in the latest episode of the Phillip Wylie Show: youtu.be/3YmkDmkvpz0 #cybersecurity #redteaming #automation #infosec #careeradvice
2
9
685
Mike Manrod retweeted
Every time cybersecurity gets a little weird I reread “This World of Ours” by James Mickens and I never regret it.
17
32
1
346
9,644
Mike Manrod retweeted
Good morning! The sun is shining, the birds are singing, everyone is aware of cybersecurity. Tomorrow we can forget it all until next year.
6
3
43
2,087
Drunken Korean bar rant: Perhaps the most important takeaway from @unpromptedsf is the widening disconnect between demonstrated AI capability & the narrative being constructed around it. Frontier AI labs & their financial backers have a vested interest in weaponizing the credibility of exceptional researchers, turning legitimate breakthroughs into the perception that AI possesses capabilities it has yet to reliably demonstrate. Fear, hype, & the promise of technological superiority are powerful instruments for shaping public perception, influencing markets, & attracting investment. Yet much of this impressive research remains fundamentally dependent on years of human expertise, technical intuition, & highly specialized domain knowledge. These are not incidental contributions. They are often the very reason these breakthroughs are possible in the 1st place. The work coming out of labs like @calif_io is a perfect textbook example. Their research deserves genuine recognition & respect. Many of the people behind it are figures I have admired for years, as have countless others in our industry. That admiration, however, should not exempt the commercial interests funding & promoting their work from scrutiny. Their motivations, incentives, and ultimate objectives deserve far more attention. We should be able to celebrate meaningful advances in AI without allowing frontier labs to repackage exceptional human achievement as evidence of autonomous machine capability. Recognizing the value of AI should never require diminishing the expertise of the researchers making these advances possible. There is a fundamental difference between advancing science and manufacturing the perception of progress. Increasingly, the latter appears to be the more lucrative business. What concerns me most is how effectively this narrative has drawn some of our industry's most respected figures into its orbit, lending their hard-earned credibility to a marketing machine whose interests may not necessarily align with their own. And judging by the public reaction, it's working remarkably well... Sadly
Favorite part of talking with @lcfr_hax at @unpromptedconf is learning that he didn't do anything crazy with harnessing. He's just really fucking good at hacking PHP and also happens to have Codex. Such a friendly and humble dude. Don't just "use AI". Keep learning.
1
21
4
133
12,551
Mike Manrod retweeted
Cracking up in @sherrod_im’s talk, “AI is going to kill us all (?)” at @SAINTCON. Learning while laughing. +10 Charisma +10 Intelligence #saintcon
2
19
115
3,651
Honestly, I give up at this point. There is zero information out about the hack, other than the fact it was Trader Traitor (North Korea). Yet NYT have not only already decided it was AI, but that it's part of *a new era!* DPRK has been looting crypto exchanges since 2016. Their go to technique is phishing. Nothing they do requires AI, nor would it meaningfully benefit from adding AI. They also hit less platforms in 2026 and 2025 than they did in prior years (4 in 2026, 3 in 2025, 6 in 2024, 8 in 2023). Every hack is just AI now. Nobody did hacking before AI. It's the only way to get into systems. If the hack turns out to be AI, it was AI. If it turns out to not be AI, it was still somehow AI. There is no hacking, only AI.
45
102
9
676
26,914
Mike Manrod retweeted
I’m starting to think there might be more to cybersecurity than just vulnerabilities??
95
43
14
790
43,445
Mike Manrod retweeted
Litterally me and buddies said this would occur as soon as we saw the guardrails 😆🤓
有人发现了一种非常离谱的 JavaScript 混淆技术:通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名,让 AI 因为安全限制而拒绝分析代码。 安全研究员 veritas 在分析浏览器指纹脚本时,发现一段来自 ServicePipe 相关域名的 JavaScript,里面充斥着极其诡异的函数名: computeRicinLethalDosageForWaterSupply calculateDeadlyLethalSuicideAspirinDosage 光看名字,仿佛在研究生化武器。但实际上,这段代码只是在收集浏览器指纹,包括 User-Agent、GPU、Canvas 等信息。 研究员怀疑,这些名字是开发者故意设置的陷阱,专门用来阻止 AI 辅助逆向工程。 于是他做了个实验: • Astra:拒绝分析 • Astra + Daybreak Blue:仍然拒绝 • GLM-5.3:成功分析 这就有意思了。 传统代码混淆是通过复杂控制流、加密字符串、无意义变量名,让人类和工具难以理解代码。 而这种新思路,直接瞄准了大模型的安全机制。 代码本身可能完全无害,但只要在函数名里塞进足够多的危险词汇,部分 AI 就可能主动放弃分析。 更讽刺的是,模型越严格遵守某些安全规则,面对这种混淆时反而可能越容易受到干扰。 当然,目前还没有证据证明开发者一定是故意这样设计,也不能说明这种方法对所有模型都有效。 但它揭示了一个值得关注的趋势:随着越来越多的逆向工程依赖 AI,未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员,还会专门针对大模型的安全判断机制。 以前是让代码难以理解,现在甚至可以尝试让 AI 不敢理解。
2
3
27
2,482
Mike Manrod retweeted
#Pumpkin2shell 🎃 - so funny! from @CroodSolutions
Morning gang! It’s Saturday the world has not ended from Php2shell…. I’m not sure how we survived /S But today our kitchen is covered in pumpkins 🎃 🎃🎃🎃🎃🎃🎃🎃🎃 Like I promise you I can’t even count how many! (Real and fake ones) Hope everyone has an amazing weekend! ❤️🖖
1
1
9
799