VP, Google Threat Intelligence @ Google. Board Member. Mom/Wife. Veteran. PhD Student
Joined February 2022
- Tweets100
- Following197
- Followers2.5K
- Likes466
Sandra Joyce retweeted
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
Sandra Joyce retweeted
GTIG has just released our latest quarterly AI threat tracker, a collection of case studies based on our unique visibility into this rapidly evolving threat. Criminals and state actors are making strong headway in speed, scale, and sophistication. 1/2 cloud.google.com/blog/topics…
We are thrilled to announce that our flagship Google for Startups program, Gemini Startup Forum: Cybersecurity, has selected its first 33 trailblazing startups. This exclusive forum is designed to address critical domains and foster deep dialogue on AI integration in cybersecurity. Congratulations to the new cohort!
@googlecloud cloud.google.com/blog/produc…
Standing on the Acropolis in Athens, this is the exact rocky hillside where the democratic assembly of Athens (Ekklesia) met to debate and vote on laws. The literal birthplace of democracy. It would take roughly 2000 years but here we are. The idea that true sovereignty comes bottom up, not top down. What a great idea. Have a wonderful Day of Independence!
Sandra Joyce retweeted
Google AI Threat Defense fuses the reasoning power of Gemini and other frontier models, the contextual risk prioritization of @wiz_io, the code remediation capabilities of Gemini and CodeMender, and the frontline expertise of @Mandiant.
Check out the Wiz details and demo ⬇️
🧠 NEW ERA: #AI Threat Defense. AI is changing vuln discovery & exploitation speed.
Wiz AI Threat Readiness: reduce exposure, remediate faster, secure code, detect threats. Partnering with @googlecloud + @Mandiant.
Learn more: wiz.io/blog/wiz-ai-threat-re…
A touching tribute to the missing, fallen, and imprisoned at our Google Reston office cafeteria for Memorial Day. @GoogleCloudSec
Our quarterly AI Threat Tracker is out today. We found a threat actor using a zero day exploit developed with AI. Read about our recent findings here @googlecloud cloud.google.com/blog/topics…
Sandra Joyce retweeted
An update from NIST. Due to volume they’re only going to enrich CVEs that are meaningful to USG federal systems and critical software (some more nuance in the blog post). This means if you’re relying on the NVD data for your enterprise security program and use other software, your tools may not flag software you use as at risk. nist.gov/news-events/news/20…
Sandra Joyce retweeted
Huge props to Mandiant Threat Defense who were instrumental in unravelling this thing. More details in our blog: 2/x cloud.google.com/blog/topics…
Sandra Joyce retweeted
Google Threat Intelligence Group took down a massive, longterm intrusion campaign into global telcos and government. This PRC-nexus actor built a vast surveillance tool across 42 confirmed countries and another 20 suspected countries. 1/x
Google disrupts Chinese-linked hackers that attacked 53 groups globally reut.rs/4rxn4Xn reut.rs/4rxn4Xn
Sandra Joyce retweeted
🦞🛡️ OpenClaw × VirusTotal: every ClawHub skill now auto-scanned for malware
🔍 AI Code Insight catches reverse shells, crypto miners & exfiltration
⚡ ~30s verdicts
🚦 Benign/Suspicious/Malicious tiers
🔄 Daily re-scans
This is not a silver bullet, but it is another layer to the shell 🦞openclaw.ai/blog/virustotal-…
Sandra Joyce retweeted
Outstanding how VirusTotal is leaning into the future here to help wrap security around the bleeding edge of AI.
🦞🛡️ OpenClaw × VirusTotal: every ClawHub skill now auto-scanned for malware
🔍 AI Code Insight catches reverse shells, crypto miners & exfiltration
⚡ ~30s verdicts
🚦 Benign/Suspicious/Malicious tiers
🔄 Daily re-scans
This is not a silver bullet, but it is another layer to the shell 🦞openclaw.ai/blog/virustotal-…
Sandra Joyce retweeted
Google took out a MASSIVE pool of residential proxies.
Threat actors have been having a hard time ever since, whining in hacking forums, attempting to seek out new providers that don’t have KYC (Know Your Customer/Identity Verification)
This is a huge win for cybersecurity world-wide 👏 well done Google Threat Intelligence Group
cloud.google.com/blog/topics…
Sharing intelligence is a necessary but insufficient response to the threats we face in 2026. It’s time to operationalize intelligence through active defense and disruption. Really appreciate all the incredible teams at Google and external partners who worked on this. On to the next one.
@googlecloud @mandiant cloud.google.com/blog/topics…
Google Threat Intel is tracking widespread exploitation of on-prem SharePoint vulns: CVE-2025-53770 & CVE-2025-53771.
This is a severe threat. We recommend patching, threat hunting and rotating keys.
Learn more, incl. how to detect this threat in Google SecOps: security.googlecloudcommunit… @GoogleCloudSec @Mandiant
Sandra Joyce retweeted
New from our security teams: Our AI agent Big Sleep helped us detect and foil an imminent exploit. We believe this is a first for an AI agent - definitely not the last - giving cybersecurity defenders new tools to stop threats before they’re widespread.
Sandra Joyce retweeted
It’s that time of the year when the Joyce Clan converges on Aspen to think big thoughts about cybersecurity. Happy to join Sandra Joyce and Sean Joyce and all the Aspen Digital team!
@JumpforJoyce @Sean_M_Joyce @AspenDigital
Sandra Joyce retweeted
This afternoon @Google's @jmmanfra spoke to the US House Committee on Homeland Security on the need for harmonized regulation with strong cybersecurity standards that are agile enough to keep pace with evolving tech and threats: homeland.house.gov/hearing/c…