Smart people who get IT. Contact us: https://nitter.cf/t.co/sydYuXPcGN NOW HIRING: https://nitter.cf/t.co/GuohqldmDI
Washington, DC
Joined December 2015
- Tweets1.6K
- Following180
- Followers714
- Likes915
Pinned Tweet
In case you've missed it, we have a blog!
Every week, a Hunter Strategy expert shares their tips, opinions, and advice in an article.
These blog posts can help expand your knowledge and give you tools for success!
Read more here: medium.com/hunter-strategy
#blog #hunterstrategy #IT
This week’s patch list is just the tools that manage, authenticate, and monitor everything else. Cool. Love that for us.
- HPE ArubaOS: 8 max-severity flaws, no credentials required
- Okta Access Gateway: CVE-2026-115547, fixed in 2026.10.2
- Splunk Enterprise + SOAR: critical access control fixes
- SolarWinds Observability: CVE-2026-28328
If you patched Okta in September and feel good about it, that was a different bug.
The internet spent last week on fire. So naturally, this week’s episode is about federal contracting.
It has its own fires: a product acquired out from under an agency mid-contract, fixed-price SOWs that turn a report tweak into a modification, and a HUBZone sole-source authority @trinertech has never once seen used.
Full disclosure: a small business podcast making the case for small businesses. We’re aware.
🎧 f.mtr.cool/xofaoi5v5j
HunterStrategy retweeted
Prompt of the day:
Split this "one-way door" PR into two:
1. A PR that implements everything, except it can be easily reverted (a two-way door)
2. A followup PR (stacked on top) that actually goes through the one-way door
AKA expand/contract. Use feature flags as needed.
---
Lets you de-risk a huge PR by testing large chunks of it in production first.
Railway’s advice to customers: rotate every key you’ve ever trusted us with.
Quest Diagnostics: someone got into the lab results portal. How many records, which ones, and how? ...TBD :)
“It’s hosted, so it’s their problem” is a great plan, right up until it’s YOUR keys.
A brief history of the #PHP2Shell embargo:
Tuesday afternoon: CVE IDs leak, with the wrong CVSS score for flavor.
Tuesday night: an exploit demo video gets posted by accident.
Wednesday morning: patched images ship 6+ hours before the coordinated release.
Somewhere a disclosure coordinator is lying face down on the floor.
Plan for patch windows the length of a lunch break.
Who watches the watchmen?
Apparently anyone who can reach the Patroni API. Splunk CVE-2026-76268, CVSS 9.8, no auth.
Patch every search head cluster member, not just one.
HunterStrategy retweeted
Today's Breach Please is out. We talk about how Chainguard unilaterally broke the embargo on the PHP vulnerability and what that likely means for coordinated disclosure going forward.
It is BY FAR the spiciest episode we've recorded to date. 1/3
Moving 500 MB across NIPR/SIPR: an hour or more.
Getting 5 GB of extra disk: a stack of forms.
Running Terraform after someone made manual portal changes: everything snaps back.
This week on This Is Fine, @trinertech talks about what DevSecOps actually looks like inside DoD.
Catch the full episode here: f.mtr.cool/6bwwabwh9g
HunterStrategy retweeted
PHP2Shell (CVSS 9.2) disclosed, and eight eMudhra certs could let anyone mint trusted certs for any site.
Thursday, Oct. 22, 11 a.m. ET: @MalwareJake, IANS Faculty, on what your security team should do now.
Register now: bit.ly/4dLHUh6
TIL: Rotating every credential on your BeyondTrust appliance before evicting the attackers actually gives them a fresh set too. Remote Support CVE-2026-102764 has been exploited since August.
Rebuild first, then rotate.
HunterStrategy retweeted
🚨 BREAKING: PHP is warning admins to prepare for emergency security updates tomorrow to fix two critical vulnerabilities rated CVSS 9.2.
However, security researchers at @watchtowrcyber rate the flaws CVSS 10.0 and say they are RCE vulnerabilities affecting PHP 5 through 8.
Information about the vulnerabilities has reportedly leaked ahead of disclosure.
No known exploitation in the wild.
🔗 bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
HunterStrategy retweeted
The number of times I've clicked Restart Now thinking updates were finished while updates were still installing...
I don't understand why we can't grey that option out while updates are in progress. Why is it like this? :(
Metabase’s "reset password" feature turned out to double as "become admin." It even worked on Metabase’s own cloud. CVE-2026-72898 is on KEV and the PoC is public, so maybe patch before lunch.
HunterStrategy retweeted
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
HunterStrategy retweeted
ConnectWise has an incident with compromise this weekend where they disabled backups in customer M365 environments.
Even if you're not a ConnectWise customer, you likely have third party risk management concerns here for those you do business with who are.
Funny how the tools we trust to manage everything else keep turning out to be the easiest way in. This time around, it’s pfSense, Metabase, Splunk, BeyondTrust, and FortiGate.
Details here: f.mtr.cool/h5x047yhq0