Blue Teamer and ex college professor | Photographer & Gamer | Living with Fibromyalgia, Scoliosis & Bipolar Disorder | Views are my own
Mumbai, India
Joined May 2009
- Tweets197K
- Following366
- Followers3.5K
- Likes9.7K
Lionel F retweeted
Folks,
I left Microsoft three months ago to start my own company. Two weeks after I left, my whole team in Australia was let go.
I see the hurt it’s causing my ex-colleagues, their families and their kids. Layoffs, forced relocations, PIPs. It’s brutal and I don’t want to brush past that.
But here’s my honest take.
Microsoft needs fewer people.
I’ve been on the inside. I’ve seen how things get built. Lots of small orgs. Layers on layers. Silos everywhere.
Here’s a real example.
The Entra team shipped managed identities back in 2017. No more secrets in code. A clear security win.
Then they tried to get the rest of Microsoft to adopt it. Very few teams did, and the ones that did moved at a snail’s pace. Every org had its own priorities and its own decision makers.
It took Microsoft getting hacked, and the Secure Future Initiative that followed, before things really moved.
Today almost every Microsoft app and service supports managed identity.
Six years, and a major breach, to get there.
In a world with agents and fewer people, that rollout would be possible across Microsoft in months, not years.
Microsoft already has everything else. The customers. The infrastructure. The scale.
What it needs is fewer people, leaning hard into agentic work.
Right now OpenAI and Anthropic are shipping at a pace Microsoft can’t match.
Microsoft has to change to survive.
BREAKING: Microsoft, $MSFT, is offering buyouts to 60,000 workers as part of the company’s efforts to cut costs amid AI adoption, per Bloomberg.
Personnel on select teams in the US, Canada, India, and the UK at a vice president level and below will be eligible.
This reflects ~27% of Microsoft's total workforce.
Lionel F retweeted
BREAKING: Microsoft, $MSFT, is offering buyouts to 60,000 workers as part of the company’s efforts to cut costs amid AI adoption, per Bloomberg.
Personnel on select teams in the US, Canada, India, and the UK at a vice president level and below will be eligible.
This reflects ~27% of Microsoft's total workforce.
Lionel F retweeted
1/2 Unit 42 reported earlier that we had observed post-compromise activity that we initially thought was related to the PHP2Shell vulnerabilities. What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application.
Lionel F retweeted
❗️ A tourist lost their Apple Watch charger in China, bought another at an Apple Store, and the US watch refused it as a "country-specific charger".
Apple says Chinese wireless chargers sold there only charge local models.
They cost CN¥279, ~$42, and can't fast charge.
Readers added context they thought people might want to know
Chinese WPT regulations limit wireless charging frequencies to 100-148.5 kHz (and two other bands), excluding the 360 kHz of standard Qi2/MagSafe fast charging, so Apple sells slower country-specific compliant chargers in China that only work with local models.
support.apple.com/en-us/120920
scmp.com/tech/policy/ar…
gov.cn/gongbao/2023/i…
Lionel F retweeted
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
Lionel F retweeted
Gabriel Iglesias was on Ozempic for about five months. His description is the most honest one I’ve heard.
It worked almost too well. He’d look at food and feel nothing, not disgust, just “I’m good.”
The weight came off. But he watched his shoulders disappear with it. A strong guy, losing the strength he was proud of. Add the constant nausea, and he quit.
The moment he stopped, 20 pounds came back almost immediately.
And here’s the twist: years earlier, he says Ozempic offered him a million-dollar deal to be the face of the brand. He turned it down.
That’s the part nobody puts in the commercial. The drug turns off your hunger. It doesn’t protect your muscle, and it doesn’t fix whatever was driving the eating in the first place.
Lionel F retweeted
I think this is more serious than many people realize.
Not every Node.js server is vulnerable, of course. The application needs to process untrusted Brotli-compressed data.
But how common is that? Well, common middleware configurations in Express 5 can already expose the vulnerable decoder, without developers explicitly using Brotli anywhere in their code.
So we’re potentially looking at a pretty large attack surface, although nobody really knows how many deployments are exploitable yet.
I wouldn’t be surprised to see automated scanning and exploitation attempts targeting this very soon.
Patch your Node.js runtimes.
🤖 Made with AI
Liked PHP2Shell? You’re gonna love Node2Shell.
We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!
imperva.com/blog/node2shell-…
Lionel F retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
Lionel F retweeted
Today we're launching cve.now 🚨
Yesterday was a rough day for security. php2shell, LiteLLM, Railway... How are we supposed to stay on top of all of this?
cve.now aggregates 4 vulnerability sources into one free feed and uses AI to explain each one in plain English. No login.
cve.now
Lionel F retweeted
This might be the BEST iPhone Duo review I’ve seen yet. 🍿
Grab some popcorn. This one is worth watching from start to finish.
Lionel F retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Lionel F retweeted
The complaints about iPhone Duo app optimization are really overblown. In the one week I've had the phone, a ton of the apps I use every day have been updated.
Also, the phone isn't even out yet. The app situation is only going to get better, and I think that's going to happen quickly.