Steven Harris | OSINT & Cyber Security Specialist | Investigator | Teach OSINT @SANSInstitute | @OSINTCurious | https://nitter.cf/t.co/EGO8CWyA6H
UK
Joined February 2019
- Tweets7.3K
- Following1.5K
- Followers24.1K
- Likes15.1K
The modern day panopticon.
Permanent and invasive surveillance of every citizen's device just case a handful of them might do wrong.
Law enforcement agencies already have wide ranging and extremely powerful capabilities to detect and disrupt online child abuse. I know this because it used to be my job.
This measure is completely unnecessary and has no place in a democratic society. On-device surveillance combined with ID-gating the internet under the guise of "child safety" makes routine the kind of intrusive surveillance that used to appall us when the old communist regimes did it.
That's why I'm backing @ijm and @jessphillips in urging the Government to extend device-level safeguards to detect and block child sexual abuse material – including live-streamed exploitation – on all devices.
Nixintel retweeted
It's so obviously right that Æthelstan should go on the 4th plinth, it barely needs saying. nitter.cf/NeilDotObrien/status/2…
Nixintel retweeted
Millions of private AI conversations have leaked through share links, browser extensions, and misconfigured integrations.
Shahar Bahat shows what OSINT practitioners can learn from them, plus how to defend against your own exposure.
Watch: youtu.be/76iQJMgrXco
#OSINT
Nixintel retweeted
The government’s under-16s social media ban won’t just mean Instagram, it’s going to include Lego Play, YouTube Kids and Spotify.
This is mad — it’s the parents who are using these services for education and entertainment for their children.
Nixintel retweeted
One registration. Two co-located Summits. More perspectives on the intelligence challenges shaping cybersecurity.
New for 2027, SANS #OSINTSummit and #CTISummit are coming together in Alexandria, VA, February 1–2!
Join practitioners sharing real-world research, investigative techniques, tools, and lessons learned across two closely connected disciplines: open-source intelligence and cyber threat intelligence.
With one registration, you can:
🔘 Explore how OSINT and CTI help uncover threats, understand adversaries, and inform security decisions.
🔘 Learn from different investigative approaches, real-world case studies, and emerging research.
🔘 Connect with practitioners across both communities to compare notes and share perspectives.
🗓️ Feb. 1–2
📍 Alexandria, VA
➡️ Explore OSINT Summit: go.sans.org/g59cmF
➡️ Explore CTI Summit: go.sans.org/xSO4ke
#OSINT #ThreatIntel #CyberSecurity
Nixintel retweeted
Two days to compare approaches. Six more to build OSINT skills.
Join us at #OSINTSummit Feb. 1–2, then train Feb. 3–8 with @nixintel (SEC497) or @matt0177 (SEC587).
🎟️ Get a complimentary Summit pass with either course!
➡️ go.sans.org/g59cmF
Nixintel retweeted
Sometimes the best insights come from seeing how someone else approached the same problem.
Join us at #OSINTSummit for real-world investigations, tools & techniques you can put to work.
🗓️ Feb. 1–2 | Alexandria, VA
🎟️ Space is limited
➡️ go.sans.org/g59cmF
Nixintel retweeted
BREAKING: Revolut moved ~2,000 engineers onto self-hosted GLM for coding and pushed Claude Code and Codex to the exception list.
Per David Abitbol, who leads AI ops there: 56 Nvidia B200s, a blended 30 cents per million tokens, roughly a tenth of what they paid Anthropic and OpenAI. Engineering lead time improved 70%.
Here's the part that matters: the gains showed up when tokens stopped being rationed. Engineers quit saving AI for the hard tickets and pointed it at everything.
Frontier models become the exception, open weights become the default. That's a pricing problem for every lab heading to IPO.
h/t @OliverMolander
Would you move your team off frontier APIs if the bill dropped 90%?
Nixintel retweeted
The information is out there. Can you find what matters and verify what you find?
Join us at #OSINTSummit for real-world investigations, emerging research, tools & techniques you can put to work.
🗓️ Feb. 1–2
📍 Alexandria, VA
🎟️ Space is limited
➡️ go.sans.org/g59cmF
Nixintel retweeted
📵 A ‘social media ban’ isn't a policy for children's online safety - it's a national ID scheme by the back door.
Here are five things the government will not tell you about a social media ban ⤵️
Nixintel retweeted
Cohorts are back 🙌 Bring your team to the ice for SANS Holiday Hack Challenge 2026. Subscribe for free: go.sans.org/Wh3RYD
#HolidayHack #Cybersecurity #CyberRange #SANSInstitute
Nixintel retweeted
Didn't take long for Burnham's pledge to scrap digital ID (@NoToDigitalID) to be revealed as entirely hollow. Showing your passport as a prerequisite to engage with the online world is still remains state policy.
The solution was never digital ID requirements (doxxing of every user) as mandatory for every internet user in the UK and her territories. In reality, the solution was not this – it was having the family computer in the living room or the kitchen, and giving your child a nokia, rather than an Android.
Standing on the graves of children and reaching for the tools of censorship will always be seen for what it is. The only antidote to the multi-faceted censorship state in Britain is low-tech approaches to parenting, and passing the @ASI Freedom of Speech Bill: adamsmith.org/research/the-f…
Nixintel retweeted
What I found Pre Announcement yesterday I see alot of people finding. This has been a known PHP thing, that i can remember from at least 10 years ago becuase it was in a class I wrote.
1. PHP allows you to upload a file even if there is no file upload area.
2. It then realizes that you do not have a file upload area and cleans things up
3. The bug announced recently allowed for one interesting thing: session fixation through setting the PHPSESSIONID (at least this is what I'm verifying now).
4. Given you know the name of the session ID, you can then predict the session ID file name in /tmp because many implementations will do this by default.
5. Recalling the session_id through an LFI (stock configuration) will cause the file to be read.
6. Reading the file, given that it's a serialized object, will deserialize it, giving you potential RCE.
I tried this on stock WordPress in a container, and it appeared to work. I'm unsure how widespread this is, or whether it is really a problem.
Nixintel retweeted
Missed the PHP briefing? Replay is up. CVE-2026-109618 / CVE-2026-109619, the Oct 21 fix, and what to do if you are on a version that will not get one. go.sans.org/MpvmG6
#PHP
ALT The image is a promotional banner for a livestream titled "PHP Vulnerabilities: What You Need to Know Today and Do Right Now," featuring Rich Greene and Moses Frost as instructors from SANS Institute and Neuvik, respectively. There is a button labeled "Watch the Replay" and the SANS logo is displayed in the bottom right corner.
Nixintel retweeted
📣 Deadline Extended! The SANS #OSINTSummit 2027 Call for Presentations is open for another week!
Have an OSINT case study, research project, tool, technique, or lesson learned to share? We want to hear from you!
⏰ New Deadline: Oct. 26, 5 p.m. EDT
📩 go.sans.org/dPm8qI
Nixintel retweeted
Zu dem analytischen Elend kommt noch das hier. Die RUS Dienste kommen doch aus dem Lachen gar nicht mehr heraus, angesichts tausender Zuschreibungen, die ihnen jeden Tag übermenschliche Einflussmöglichkeiten überall auf dem Kontinent attestieren: nitter.cf/AlexanderDinger/status…
