Startups emerging from stealth: ❌ Startups emerging from cornfields: ✅ The GraphnAI Public Preview is live: Identity Security that shows which attack paths are real. 🧵👇

Ask Graphne which accounts can replicate the directory. Six can. Five should. One is a service account unused for 14 months. Every answer shows the query it ran, and the fix goes to Select Fire™, where you decide. graphnai.com/product/graphne…

Spending the day in the ER with debilitating pain due to a kidney stone was not on my to-do list. 😭

Thanks to OpenAI and Anthropic, everyone is rediscovering the lessons behind "Chicken Little" and "The boy who cried wolf" from first principles.

These things are necessary, but this is a very reactive mindset and misses a critical component of defense-in-depth. It is more crucial than ever to proactively implement mitigations and controls around your business-critical systems that limit the blast-radius of a compromise. Once you've done that, test your detection capabilities and practice your response procedures as a layer on top. New 0day announcements shouldn't induce panic. They should be a routine you're well prepared for. Keep calm and cyber on.

Thanks to Exchange 5.5 in NT4 domains using DNs years before AD existed, plus having to manage X.509 certificates (which also use DNs) running the Defense Messaging System on top of that... AD and LDAP were easy for me to learn when they first came out. I'm going to go take some ibuprofen now. 🤪

Opus 5.5: I won't write code to detect golden ticket attacks because cyber. I'm downgrading you to Opus 4.8. Opus 4.8: I finished writing the golden ticket detection rule, here's the exact mimikatz and Rubeus commands to run if you'd like to test it.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets an unauthenticated attacker run code on a server running PHP, and researchers have shown it can leak passwords and API keys from PHP's memory. Patch first: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both. Then ask the next question: if someone got onto that web server before you patched, where could they go from there? That part is an identity question, and GraphnAI answers it for every server in your directory. - Unconstrained delegation. If the server is trusted for it, whoever controls the server can collect reusable credentials from every user who authenticates to it. GraphnAI flags it, and Select Fire clears it with a change you can undo. graphnai.com/checks/unconstr… - Tier 0 credentials on the box. If a Domain Admin signed in to that server, and a lower-tier account holds rights there that can steal the credential, GraphnAI raises a Cross-tier credential exposure finding. graphnai.com/checks/cross-ti… - Where the site's accounts can go. If the service account the site runs as is an admin on your database or file servers, so is anyone who takes over the site, and an admin's credential left on that server could be one step away. GraphnAI maps every server and share those accounts can reach and shows which of that access has actually been used, so you can remove the rest with changes you can undo. Patching disarms the threat. GraphnAI reduces the blast radius.

I can't believe @techspence posted this without mentioning setting up canaries in AD to detect recon activities like directory enumeration. There are some great free tools out there for this like: github.com/AirbusProtect/AD-…

Kerberoasting targets a SQL service account someone gave replication rights. Minutes later, that account runs DCSync from the same address. Triage confirms the attack and escalates at once, because shutting off a Tier 0 account is a human's call. graphnai.com/product/detecti…

Seeing lots of people talking about having AI backport php2shell patches to PHP versions that went EOL 8 years ago. Cool, but are you also backporting patches for all the other CVEs that came out during that time? Or do you think threat actors only exploit the latest CVEs? 🤔

My daughter wanted to watch Alien tonight (she'd never seen it). I think the last time I watched this was on VHS on a little CRT TV. Streamed from Netflix and upscaled to 8K on a 160" screen with surround sound is quite the upgrade.

9 out of 10, would highly recommend. 😉

Nothing is safe this week.

I dream of the day when no one freaks out over the latest 0-day because everyone's security program has evolved beyond panic patching.

In GraphnAI's Identity Inventory, every number is a question. Click one, and the graph behind it opens above the table, with Tier 0 outlined in red. Intuitive workflows that empower informed decision making. graphnai.com/product

PHP was always a pain to update.

Every attack-path tool draws lines. GraphnAI shows how much proof stands behind each one: Theoretical, Constrained or Validated. A proven path outranks a theoretical one. Tiered Fidelity™ (patent-pending): graphnai.com/product/exposur…