Smart people who get IT. Contact us: https://teapaw.org/t.co/sydYuXPcGN NOW HIRING: https://teapaw.org/t.co/GuohqldmDI
Washington, DC
Joined December 2015
- Tweets1.6K
- Following180
- Followers716
- Likes930
Pinned Tweet
In case you've missed it, we have a blog!
Every week, a Hunter Strategy expert shares their tips, opinions, and advice in an article.
These blog posts can help expand your knowledge and give you tools for success!
Read more here: medium.com/hunter-strategy
#blog #hunterstrategy #IT
HunterStrategy retweeted
Phishing-Resistant Isn't Enough; Yubico Takes Aim at Identity-Verification Gap www.darkreading.com/identity-access-management-security/beyond-phishing-resistant-yubico-identity-verification-gap
HunterStrategy retweeted
Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk securityweek.com/florida-stu…
Most-reported finding in LMG's 2026 internal pen tests: unpatched software (78% of tests).
How often it was on the path to domain takeover: 5%.
Meanwhile, Fall2026! is out here doing most of the work.
HunterStrategy retweeted
In lieu of flowers, memorial contributions may be made to:
Johns Hopkins Alzheimer’s Disease Research Center Fund
alzresearch.org/giving/
Alzheimer’s Foundation of America Caregiver Resources
alzfdn.org/donate/
Photo Credit: Tommy Garcia
Adobe Campaign Classic
Vulnerable: 7.4.4
Fixed: 7.4.4
Check the build number. 9402 bad, 9403 good.
That's 1 of 5 ways remediation looks done before it is: f.mtr.cool/ieij72ilnr
This week’s patch list is just the tools that manage, authenticate, and monitor everything else. Cool. Love that for us.
- HPE ArubaOS: 8 max-severity flaws, no credentials required
- Okta Access Gateway: CVE-2026-115547, fixed in 2026.10.2
- Splunk Enterprise + SOAR: critical access control fixes
- SolarWinds Observability: CVE-2026-28328
If you patched Okta in September and feel good about it, that was a different bug.
The internet spent last week on fire. So naturally, this week’s episode is about federal contracting.
It has its own fires: a product acquired out from under an agency mid-contract, fixed-price SOWs that turn a report tweak into a modification, and a HUBZone sole-source authority @trinertech has never once seen used.
Full disclosure: a small business podcast making the case for small businesses. We’re aware.
🎧 f.mtr.cool/xofaoi5v5j
HunterStrategy retweeted
Prompt of the day:
Split this "one-way door" PR into two:
1. A PR that implements everything, except it can be easily reverted (a two-way door)
2. A followup PR (stacked on top) that actually goes through the one-way door
AKA expand/contract. Use feature flags as needed.
---
Lets you de-risk a huge PR by testing large chunks of it in production first.
Railway’s advice to customers: rotate every key you’ve ever trusted us with.
Quest Diagnostics: someone got into the lab results portal. How many records, which ones, and how? ...TBD :)
“It’s hosted, so it’s their problem” is a great plan, right up until it’s YOUR keys.
A brief history of the #PHP2Shell embargo:
Tuesday afternoon: CVE IDs leak, with the wrong CVSS score for flavor.
Tuesday night: an exploit demo video gets posted by accident.
Wednesday morning: patched images ship 6+ hours before the coordinated release.
Somewhere a disclosure coordinator is lying face down on the floor.
Plan for patch windows the length of a lunch break.
Who watches the watchmen?
Apparently anyone who can reach the Patroni API. Splunk CVE-2026-76268, CVSS 9.8, no auth.
Patch every search head cluster member, not just one.
HunterStrategy retweeted
Today's Breach Please is out. We talk about how Chainguard unilaterally broke the embargo on the PHP vulnerability and what that likely means for coordinated disclosure going forward.
It is BY FAR the spiciest episode we've recorded to date. 1/3
Moving 500 MB across NIPR/SIPR: an hour or more.
Getting 5 GB of extra disk: a stack of forms.
Running Terraform after someone made manual portal changes: everything snaps back.
This week on This Is Fine, @trinertech talks about what DevSecOps actually looks like inside DoD.
Catch the full episode here: f.mtr.cool/6bwwabwh9g
HunterStrategy retweeted
PHP2Shell (CVSS 9.2) disclosed, and eight eMudhra certs could let anyone mint trusted certs for any site.
Thursday, Oct. 22, 11 a.m. ET: @MalwareJake, IANS Faculty, on what your security team should do now.
Register now: bit.ly/4dLHUh6
TIL: Rotating every credential on your BeyondTrust appliance before evicting the attackers actually gives them a fresh set too. Remote Support CVE-2026-102764 has been exploited since August.
Rebuild first, then rotate.
HunterStrategy retweeted
🚨 BREAKING: PHP is warning admins to prepare for emergency security updates tomorrow to fix two critical vulnerabilities rated CVSS 9.2.
However, security researchers at @watchtowrcyber rate the flaws CVSS 10.0 and say they are RCE vulnerabilities affecting PHP 5 through 8.
Information about the vulnerabilities has reportedly leaked ahead of disclosure.
No known exploitation in the wild.
🔗 bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
