Joshua Small

@alda@topspicy.social The user management was always interesting to me. That woocommerce users who made an account to buy something get "a wordpress account" on the same table with the same apparent config as a Wordpress Admin with just an ACL preventing them editing the site always rubbed me the wrong way. (information is old and I'm open to be updated)

I've published some tools relevant to the recent Netscaler vulnerability. https://github.com/technion/netscaler_scanner/

@wdormann@infosec.exchange I'm staring at a Citrix console after patching and that entire IOC Scanner section doesn't exist on my install.

Like seriously I will connect to any public network you want and open Outlook right now and challenge you to start reading my passwords the way you pretend is easy.

The update to Microsoft's certification credentials is basically just a big removal of everything not AI related. For example, they've replaced "Microsoft Certified: Azure Security Engineer Associate" with "Microsoft Certified: Cloud and AI Security Engineer Associate (Exam SC-500)" and "Microsoft 365 Certified: Administrator Expert" with "Microsoft 365 Certified: AI Services Administrator Associate (Exam AB-650)". There's a whole bunch of stuff they couldn't yet shoehorn AI into, so they just EOL'd the certification branch wholesale. I'm not anti AI, in fact I'm using it extensively, but declaring Microsoft certs have to be about AI surely makes them less valuable and I'd urge people putting these down as job requirements consider this. https://techcommunity.microsoft.com/blog/skills-hub-blog/microsoft-credentials-roundup-june-2026/4528350

@cR0w@infosec.exchange Yeah I've responded to three Clickfix incidents from hacked Wordpress sites just yesterday (for scale, my usual number is one a month) and somehow people are convinced this is a non event. I don't even know what's going on any more when the major intelligence agencies put out major alerts about "router hygiene" a few days ago are completely silent on this.

Synergy Wholesale's SSL purchase form sure is something else.

One of the ways the security landscape has changed - which I haven't seen discussed - is that URL blocklists seem a lot easier for attackers to evade. I had a Clickfix incident three days ago. I used a https://app.any.run/ sandbox to replicate that loading the site, which was full of hidden online casino SEO spam, delivered a password stealer. Reported to Google Safebrowse, Fortigate, Palo Alto, Microsoft. Today the URL has absolutely 0 flags on Virustotal.

What in hell is this Microsoft will the pilot group be included or exlcuded?

@Tarah@infosec.exchange somewhere, I have a security advisor not getting the joke, prepared to come in Monday and tell me thats an example of a good move.

@mubix@infosec.exchange had to double take after reading that as "900 lb hackers"

@filippo@abyssdomain.expert We've seen this for a while with Powershell scripts but I'm amazed someone wrote a bash version.

Telstra Custdata logon (business DNS management) calling themselves "Multifactor" on an email magic link logon.

Are there any Ruby people with views on [CVE-2026-66066] ? The official release uses wording like "In a default configuration" but as far as I can see the exploit is down to using a specific method storing and user uploaded images and then doing something specific with them? Image manipulation has always been a huge attack surface, it's the sort of thing I always would have put in its own backend or container.

Microsoft's latest advisory has a bunch of slop related typos. Really the part that worries me is the take away from these sort of write ups is "Buy Nord VPN" or some stupid shit when Device Code phishing and Clickfix 100% do not care.

Time for a hill to die on: it makes no logical sense to say "two unknown cves in citrix". The whole definition of a cve is as a constant public identifier of a specific vulnerability. If you cannot give me a cve number there is no new cve - just an exploit with no published information. Its like saying there are two new words in the official English dictionary, but no dictionary is allowed to document them.

@GossiTheDog@cyberplace.social All I see is an very typical phishing email and someone will say "good English, so must have had AI assistance writing" and suddenly it's an AI attack.

@rmondello@hachyderm.io while I agree, in the microsoft world entra wont let you setup a passkey unless you have either Ms authenticator push or totp setup first. I have no idea why.

@briankrebs@infosec.exchange Huge round of applause for this response.

@merill@infosec.exchange The custom CSS was valuable for logon canaries, and I've seen them detect phishing pages in the wild before. It's a loss to see them go.

@offseq@infosec.exchange How broken are these AI summaries that people are getting these "CRITICAL" alerts to "Patch ASAP" for Exchange Online, a SaaS you cannot patch yourself.

@alda@topspicy.social To an Australian the silent t in Costco is new to me and totally weird.