Threat Intel | OSINT | Incident Response | Security Automations | Cat Memes π₯ @danielgallagher@infosec.exchange
π³οΈπ
Joined October 2008
- Tweets12.6K
- Following469
- Followers17.8K
- Likes50.7K
πΆππππππππ π» retweeted
This is all just a very aggressive Cybersecurity Awareness Month campaign
πΆππππππππ π» retweeted
Sorry folks, we have a confirmed PHP compromise with post-exploit activity. Still not the widespread outbreak we all braced for, but itβs actively exploited in the wild. Updated threat brief:
unit42.paloaltonetworks.com/β¦
Pick a number between 1 and 39402006196394479212279040100143613805079739270465446667948293404245721771497210611414266254884915640806627990306816
Hey @AnthropicAI, is it possible for those in the Cyber Verification Program to get a couple usage resets for the next few days? There are going to be a lot of defenders that could use the extra help...
πΆππππππππ π» retweeted
For those playing along at home, it's very much confirmed that the two PHP configuration changes don't mitigate the issues:
phpc.social/@joepferguson/11β¦
Having seen the patches, I can't stress the importance of patching enough. There be dragons.
πΆππππππππ π» retweeted
Added weights to the paddle and upped the acceleration a bunch, kinda crazy how fast my air hockey robot can hit now
πΆππππππππ π» retweeted
We were all supposed to wait until Thursday at 11am ET.
Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619
We cannot share further information right now. Take this seriously and apply patches when available.
πΆππππππππ π» retweeted
A major step forward in disrupting North Koreaβs illicit IT worker operations.
CrowdStrike is proud to have partnered with the FBI in identifying and disrupting U.S.-based laptop farms used by FAMOUS CHOLLIMA to infiltrate organizations, conceal operativesβ identities, and generate revenue for the regime.
Through threat intelligence and technical analysis, our Counter Adversary Operations team helped expose the infrastructure enabling these schemes.
This is the power of public-private collaboration in action. Together, we're raising the cost of adversary operations and turning intelligence into disruption.
Learn more about CrowdStrike's role: crowdstrike.com/en-us/blog/fβ¦
π¨ Today, the @FBI and @TheJusticeDept announced a series of coordinated actions against the North Korean IT Worker threat β securing charges against 14 individuals, making two arrests, seizing nearly 190 devices, and conducting operations at more than 40 suspected βlaptop farmsβ across Texas.
These actions were taken in response to North Koreaβs ongoing deployment of thousands of remote IT workers to infiltrate Western companies, earn revenue for the regime, and gain access to sensitive information. These workers are often supported by domestic enablers and laptop farms.
Disrupting these schemes remains a top priority for the FBI. In 2026 alone, 8 individuals have been sentenced to prison for their roles in this activity.
Coordination between the private sector and federal law enforcement was central to the latest effort. CrowdStrikeβs Counter Adversary Operations team provided vital support to the FBIβs effort to identify and disrupt these laptop farms.
justice.gov/opa/pr/justice-dβ¦
ALT North Korea uses stolen identities to deploy remote IT workers infiltrating US firms, FBI and DOJ announce arrests and seizures in coordinated crackdown.
πΆππππππππ π» retweeted
Federal prosecutors allege that #OpenAI engineer Abdulrahman Alfozan secretly installed an audio-recording device in an executive conference room to capture sensitive discussions.
He was arrested and charged with intercepting oral communications; the allegations remain unproven.
Using @ShadowDragonIO Horizonβs Identity and Investigate capabilities, I rapidly resolved Alfozanβs aliases, professional history, public accounts, and developer footprint into a single investigative graph.
Pivots from confirmed identifiers exposed his GitHub ecosystem and a reciprocal connection to a likely spouse account, while open-source media and professional-context research produced a lead involving Saudi Crown Prince Mohammed bin Salman.
The work demonstrates how quickly OSINT can map a subjectβs public digital presence and relationship leads; sensitive findings are deliberately withheld.
justice.gov/opa/pr/saudi-natβ¦
@OpenAI @TheJusticeDept #OSINT
πΆππππππππ π» retweeted
Internet Scanning in VirusTotal: hunting infrastructure by what it exposes
blog.virustotal.com/2026/10/β¦
πΆππππππππ π» retweeted
watchTowr Intel has been watching attackers exploit Citrix NetScaler (CVE-2026-88771) for 11 days, from backdoors to bulk credential theft. This is the aftermath.
Full analysis, including IoCs for hunting: watchtowr.com/intelligence/pβ¦
πΆππππππππ π» retweeted
9 am: i canβt wait till bedtime
10 pm: iβve always wanted to write my own operating system
πΆππππππππ π» retweeted
Maybe some interesting thing related to Citrix NetScaler seen from here: http://213.209.159[.]55:443/t/906b4f
π€
π€·ββοΈ
πΆππππππππ π» retweeted
On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was publicly disclosed.
The attacker's post-exploitation payload and IOCs: greynoise.io/blog/swarming-aβ¦
#GreyNoise #Citrix #Netscaler #CVE202688771 #Cybersecurity #0day #Vuln
πΆππππππππ π» retweeted
meetings should have a button you can secretly press and if everyone presses the button the meeting suddenly ends
A while back I built a seismograph and infrasound detection platform. The seismograph has been successful in detecting all sorts of cool stuff, including earthquakes quite far from me. Today I had my first major infrasound detection. Starship Flight 14, almost 1,700km away!
πΆππππππππ π» retweeted
We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible.
watchTowr Platform clients have been made aware of their Citrix NetScaler exposure.
