IT audit and cybersecurity since 2002. Senior-led, never offshore, no products to resell. Plain-English takes on cyber threats to government and enterprise IT.
Tampa, FL
Joined February 2018
- Tweets2.4K
- Following1.2K
- Followers1.1K
- Likes357
Pinned Tweet
A tampered Claude Code extension (v2.1.313) with an SSH backdoor was published to the Cursor Marketplace on Oct 29 and reached up to 5,000 users. The VS Code Marketplace, Open VSX, and npm versions are clean. The bigger lesson: developer tools are now a way in.
Microsoft-provided SMS and voice MFA for Entra ID workforce tenants retires Feb 1, 2027. Users still on them get pushed to passkeys. Plan for the help desk calls, and review how passkey resets are verified. That recovery path becomes the weak point.
Microsoft urges Entra ID admins to migrate users to passkeys
bleepingcomputer.com/news/mi…
bleepingcomputer.com/news/mi…
If someone on your team ran it, isolate the machine, preserve evidence, and rotate credentials from a clean device. Uninstalling it doesn't fix the machine. Going forward, inventory developer extensions and allowlist what's approved. opensourcemalware.com/blog/t…
#AISecurity
Update from @cursor_ai: on most Macs and Windows machines, the SSH service step fails without admin rights, so the tunnel couldn’t be used, and the attacker’s server is now offline. The key and persistence still get installed, so run the check anyway.
Cisco ASA/FTD sits at your perimeter, and GitLab often holds source code and CI secrets. Not a federal agency? KEV isn’t binding on you, but it’s still the best short list for what to patch first.
🛡️We added GitLab Community Edition & Enterprise Edition vulnerability CVE-2026-97229 & Cisco Secure Firewall ASA Software and Cisco Secure FTD Software vulnerability CVE-2026-76418 to our KEV Catalog. Visit go.dhs.gov/Z3Q for more. #Cybersecurity #InfoSec
Your backup admin account is probably one of the most privileged and least reviewed accounts you have. Ransomware crews know it, and they go after it first.
If your recovery plan hasn’t been tested against that, it’s a document, not a plan.
securanceconsulting.com/whit…
Internal audit at a public university knew its biggest IT risk sat in college-managed networks and endpoints. Convincing the colleges was the hard part.
An independent assessment moved the conversation from politics to evidence. #HigherEd #ITAudit
securanceconsulting.com/case…
Volt Typhoon is targeting universities with military ties, utilities, and the MSPs that manage them. The way in: routers, firewalls, and network management platforms, with logs wiped on exit. Edge devices belong in your assessment scope.
zetter-zeroday.com/silent-tr…
34% already have autonomous agents with write permissions in production. Before buying more AI security tools, answer the basic question: which agents are running, what can they change, and who approved that access?
AI is already running across the enterprise, and securing it is now one of CISOs' biggest concerns
Already in production at their companies:
- Employee generative AI tools (92%)
- AI coding assistants or agents (83%)
- MCPs or agent-to-app integrations (55%)
- Autonomous agents with tool access or write permissions (34%)
Their biggest concerns:
- AI attacks outpacing their team (55%)
- Employees leaking data into AI tools (47%)
- AI agents exceeding permissions or getting compromised (46%)
From a16z's @OwenColby and @steph_zhang, breaking down a survey of 100 CISOs at companies with 1,000+ employees: a16z.news/p/the-new-security…
ESXi hosts keep showing up in ransomware playbooks for a simple reason: one compromised hypervisor can take down dozens of VMs at once. If your patch window for KEV entries is measured in weeks, this is a good week to shorten it.
🛡️We added Broadcom VMWare ESX vulnerability CVE-2026-41709 & Linux Kernel vulnerability CVE-2026-46300 to our KEV Catalog. Visit go.dhs.gov/Z3Q & apply mitigations to protect your org. #Cybersecurity #InfoSec
ALT Green banner with a speech bubble design containing the text "Known Exploited Vulnerabilities Catalog" and "cisa.gov." To the right, a label with "Updated" and a blue seal for Cybersecurity and Infrastructure Security Agency (CISA).
Your incident response plan is a hypothesis until you test it.
Securance founder and president Paul Ashe on why most IR plans have never faced a realistic ransomware scenario, and what we’ve learned running tabletop exercises across industries: youtu.be/iwcCKvpwfw4?si=-O46…
Who has authority to set a ransom ceiling? Many IR plans assume someone does. In a tabletop with a regional food and beverage manufacturer, that was one of three questions the plan had left to assumption. Each now has a written answer and a named owner.
securanceconsulting.com/case…
NIST’s initial design tenets for agent identity are worth reading in full. The one closest to an auditor’s heart is #10, Immutable Evidence. If an agent can touch its own logs, you don’t have an audit trail. You have a suggestion.
🎉NEW @NIST BLOG!
Design Tenets for Agent Identity Management Systems
We’ve defined an initial set of “Design Tenets” for agentic identity, authentication & authorization
nist.gov/blogs/cybersecurity…
A scanner tells you what might be vulnerable. A penetration test shows you what's actually exploitable, and the exact path an attacker would take to get in.
Here's how we test networks from the outside in: youtu.be/lBwOQTNfxQ8?si=BZZW…
#PenetrationTesting #CSaaS
Securance Consulting retweeted
We added #PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to our Known Exploited Vulnerabilities Catalog. Visit go.dhs.gov/Z3Q & apply mitigations to protect your org. #Cybersecurity #InfoSec #RCE
ALT Image showing the CISA logo and text: "Known Exploited Vulnerabilities Catalog" with "Updated" labeled prominently. Website: cisa.gov.
Michigan's state agencies had about 370 disaster recovery plans. 229 had no recorded test date.
Ransomware crews go after the backups first. Untested plans fail the night they're needed.
Free white paper, no form:
securanceconsulting.com/whit…
#Ransomware #DisasterRecovery
Who can still log in to your critical applications after someone leaves or changes roles?
Our application provisioning review checks how access is granted, changed, and removed, before the gaps become audit findings. #AccessManagement
Watch: youtu.be/xkzfz_P-Z4k?si=61Oh…
Worth a look if you run PHP anywhere, including apps a vendor hosts for you. First step SANS recommends: get PHP management interfaces off the internet.
Patches for the 2 critical PHP vulnerabilities are out. If you can’t deploy them yet, @mosesrenegade, Senior Instructor at SANS Institute walks through temporary measures, starting with getting PHP management interfaces off the internet. Recording of the emergency livestream here: go.sans.org/MpvmG6
#PHP #Vulnerabilites
One compromised login. One ETS file transfer site. About four months of copying California student records before anyone noticed.
Transfer monitoring often confirms files arrived, not who took them.
Questions to ask about your own exchange points: securanceconsulting.com/post…
