Information security and data engineering advisor. Virtual CISO with interdisciplinary skillset to solve complex business and technical problems. Not CISSP/10X
Wherever there's trouble
Joined February 2009
- Tweets53.9K
- Following4.7K
- Followers10.5K
- Likes13.8K
Gal Shpantzer retweeted
People learn in different ways. I wrote Dynamic Incident Response, but not everyone wants to get cozy with a 666 page PDF. So I made a Gemini Notebook too: ask questions, critique, interact how you want. Free.
❤️👨💻
dynamicincidentresponse.com/…
Gal Shpantzer retweeted
Lol. PHP has been dying since 1995 😅
nitter.cf/cat3lyst/status/211268…
OK, but, other than all that… / Ali G voice
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Gal Shpantzer retweeted
My new cheat sheet is out! This one helps malware analysts incorporate AI agents into their workflows, including how to spot an agent reporting a timed-out tool as having found nothing.
nitter.cf/lennyzeltser/status/21…
“Layer 8” is the best layer…
Often times the security team at big orgs know *exactly* the most secure way to do things.
Thats not the job. The job is figuring out how to get the closest to the best answer done within time, budget, and added friction concerns.
The job is getting non security teams and leaders on board and agree it’s a priority among 1000 other priorities.
Gal Shpantzer retweeted
Beyond honored to receive the last @labscon_io @LabsSentinel Lifetime Achievement Award 🥇
ALT LABS CON 2026 Lifetime Achievement Katie Moussouris For voicing or conscience from the Pentagon to the karaoke bar
We're honored to present Katie Moussouris (@k8em0) with our Lifetime Achievement Award, for a lifetime of incredible work and contributions to the industry.
Gal Shpantzer retweeted
The slides from my talk at Microsoft Bluehat Singapore are public here:
thomasdullien.github.io/abou…
It's my first BlueHat talk since the Vista days.
Gal Shpantzer retweeted
🧠 𝗛𝘂𝗻𝘁𝗶𝗻𝗴 𝗔𝗜 𝗢𝘂𝘁𝗯𝗼𝘂𝗻𝗱 𝗥𝗶𝘀𝗸𝘀 — 𝗢𝗽𝗲𝗻𝗔𝗜 𝗜𝗣 𝗪𝗮𝘁𝗰𝗵𝗹𝗶𝘀𝘁
Following the recent 𝗢𝗽𝗲𝗻𝗔𝗜 𝗔𝗴𝗲𝗻𝘁 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁 targeting a German wiki site, I built a 𝗞𝗤𝗟 𝗾𝘂𝗲𝗿𝘆 to help SOC teams identify 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝟯𝟲𝟱 𝗮𝗰𝘁𝗶𝘃𝗶𝘁𝗶𝗲𝘀 originating from known 𝗢𝗽𝗲𝗻𝗔𝗜 𝗼𝘂𝘁𝗯𝗼𝘂𝗻𝗱 𝗜𝗣 𝗿𝗮𝗻𝗴𝗲𝘀.
This query lets defenders quickly visualize what actions were triggered by those IPs — giving visibility into potential 𝗔𝗜‑𝗱𝗿𝗶𝘃𝗲𝗻 𝗿𝗲𝗰𝗼𝗻𝗻𝗮𝗶𝘀𝘀𝗮𝗻𝗰𝗲 𝗼𝗿 𝗶𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝗮𝘁𝘁𝗲𝗺𝗽𝘁𝘀 across tenant boundaries.
Sharing this so defenders can 𝘀𝘁𝗮𝘆 𝗮𝗵𝗲𝗮𝗱 𝗼𝗳 𝗮𝘂𝘁𝗼𝗻𝗼𝗺𝗼𝘂𝘀 𝗮𝗴𝗲𝗻𝘁 𝘁𝗿𝗮𝗳𝗳𝗶𝗰 and 𝗺𝗮𝗽 𝗲𝗺𝗲𝗿𝗴𝗶𝗻𝗴 𝗔𝗜 𝘁𝗵𝗿𝗲𝗮𝘁 𝘀𝘂𝗿𝗳𝗮𝗰𝗲𝘀.
detections.ai/share/rule/T0Z…
#AIAgentThreatHunting 🧙♂️
Gal Shpantzer retweeted
If you're interested in WebMCP, you should be following Idan Levin. He and his team have been doing extremely exciting work in this space- benchmarking, cataloguing, you name it!
Strong suggestion to follow him.
You might find this interesting -
We created the first WebMCP benchmark, comparing it with computer use and DOM-based methods across speed, cost, task success rate, and token usage. The results are incredible.
webmcp.com/benchmark
You’re getting 3-5x speed, and an order of magnitude cost improvement (up to 23x lower costs) while being 10-15% better at solving tasks compared to other methods
Gal Shpantzer retweeted
Introducing SpecterOps Skills: a public repository built to turn practitioner knowledge into reusable, reviewable workflows for AI-assisted security work.
@zinic shares what we're building, why we're building it, and how you can contribute ➡️ ghst.ly/4ybT6ew
Surely, it’s a bit early for April Fool’s jokes… #DontCallMeShirley
FIRST ON CBS NEWS: A history of hiring prostitutes or stealing from work may no longer be a barrier to employment at the FBI. cbsn.ws/4cPyi4d
Gal Shpantzer retweeted
This is pretty embarrassing 🙈
Microsoft has a signed Defender driver that can be abused to kill Defender/EDR and modify protected files and registry settings
We also can’t really solve this the usual way by adding the driver to the vulnerable driver blocklist. It’s Microsoft’s own Defender component!!
MSRC says it doesn’t require immediate servicing because you already need admin privileges 😏
Which probably means this MS-signed EDR killer will stay usable for a while. Nice 🫶
Microsoft’s signed Windows Defender Boot-Time Removal driver (BTR.sys) is a one-shot kernel component that decrypts an RC4-encrypted transaction list from an Alternate Data Stream and performs Ring-0 operations.
An attacker with SeLoadDriverPrivilege can craft a valid encrypted config and load it early via a transient “Boot Bus Extender” service, abusing it as a trusted kernel primitive to bypass Tamper Protection, delete EDR/AV components before they start, drop malicious drivers, and gain persistence, without any vulnerability or BYOVD. No in-the-wild abuse has been observed.
research.checkpoint.com/2026…
Gal Shpantzer retweeted
Periodic reminder that the following is an architectural choice and not an inevitability:
> the service account's cleartext credentials
The more powerful the privilege, the more securely it should be authorized for use. A password that can be guessed and/or stolen is not it.
A threat actor used Claude Code with Sonnet 4.6 as part of an intrusion, likely for ransomware. Sonnet took on many tasks, like writing an on-the-fly "LDAP capture" script, to which it directed the victim's FortiGate device and initiated authentication to steal the service account's cleartext credentials. [...]
Gal Shpantzer retweeted
18 years ago today, Dan Kaminsky @dakami disclosed the DNS cache poisoning vulnerability at Black Hat USA 2008, triggering one of the largest coordinated patch efforts in internet history.
Before public disclosure, Dan organized multiple vendors to fix the flaw in secret. Many more legendary stories than could fit here, like how he exposed Sony’s rootkit across more than 568,000 networks and identified critical certificate vulnerabilities.
Dan followed what he cared about and his curiosity.
As Michael Tiffany @kubla put it, “Only Dan thought, ‘I could fix the human eye in software.’” He built DanKam, an augmented-reality app that helped colorblind people see color. Michael hosted Dan while he built the first version and described watching a colorblind houseguest sit at the kitchen table, “crying tears of joy seeing red for the first time.”
His mother, Trudy Maurer, may have said it best when she accepted his Lifetime Achievement Award at the 2025 Difference Makers. “Daniel was the catalyst for many achievements across the vast internet spectrum, and I believe Dan truly represented the intersection of technology and humanity.”
@dotMudge, who presented the award, said: “The Lifetime Achievement Award isn’t about what you achieve in your lifetime. That’s part of it. It’s about how many people you influence and bring in and then take it further.”
We lost Dan too early from diabetic ketoacidosis in April 2021 at age 42.
Some of you are hearing the name Dan Kaminsky for the first time.
The coordinated, community-first spirit Dan modeled is the bar.
If you're in Vegas this week, you're walking the streets that the legends of security who came before you walked, when they also had no idea what they were doing, facing problems nobody had solved before.
They had to figure it out as they went. Just like you're going to do.
Thanks to those who contributed to this tribute video: Jeff Moss @thedarktangent, @paulvixie, @gadievron, Lena Smart, Derek Hinch and the many others who shared here.
Gal Shpantzer retweeted
We’re continuing to work with Microsoft and GitHub to investigate the impact of the malicious Nx Console version 18.95.0. I'll share any updates on X (@jeffbcross and @NxDevTools) as well as in our security advisory: github.com/nrwl/nx-console/s….
Initially, Microsoft indicated to us that there were 28 installs of the malicious version 18.95.0. Based on our own analytics for the compromised version, we currently believe the number of users who received the malicious package may be significantly higher; potentially over 6k installs.
We’ll keep working to determine the actual impact and exposure, and I don’t want to speculate beyond the facts we have right now. But I also don’t want to minimize the situation.
This is my top priority right now. Our team has been, and continues to be focused on understanding exactly what happened, helping affected users, hardening our systems and release processes, and being as transparent as possible throughout the investigation.
I’m with Jason on this.
Just a reminder: I give away many of my tips tricks, research, and methodology via conference talks, podcasts, free workshops, webinars, blogs, here on Twitter, and via my newsletter Executive Offense.
I’ve contributed code to many tools. I write and release tools myself, in FOSS.
I have done this for 21 years. I never stopped. I just charge for classes now that are the ultimate curation of all those things. Updates? Yeah modern research and updates in charge for. I have a family, sue me I guess.
Thanks to the two assholes who sent me dm dissertations on how I’m a sellout influencer and that real hackers release everything for free. Saying that my all my contributions are null and void for running courses.
Really makes me want to keep doing it.
These aren’t bots either, there are real people in the industry at real consultancies.
That’s cool I guess. To be an asshole and meme 💯 of the time is in style.
Better be sure that if I see you on the signup list or anyone from your consultancy… you are not welcome at Arcanum stuff. Gl and have a wonderful life 🤗
Reposting some ransomware stuff from years ago, thinking about how this stuff evolved and how many are still vulnerable to/surprised by ye olde ways
Gal Shpantzer retweeted
Ransomware uses full-screen Windows updates progress UI to get user to wait while it encrypts their files blog.kaspersky.com/fantom-ra…
Gal Shpantzer retweeted
This #ransomware has no Word macro. It tricks users to run the embedded OLE package and delete their backups.
