Identity Security Architect @ TrustedSec. Microsoft Certified Master #ActiveDirectory & former Microsoft MVP. Co-Host @ Enterprise Security Weekly. He/Him. #BLM
4°08'15.0N 162°03'42.0E
Joined August 2014
- Tweets23.5K
- Following721
- Followers37.1K
- Likes42.6K
Pinned Tweet
To my black family, friends, and people seeing this:
I love you
You matter
I'm here for you
#BlackLivesMatter
Sean Metcalf retweeted
If you've ever lost a brilliant friend or family member to this disease, this is exciting
Scientists found a way to flush Alzheimer’s plaque out of the brain in minutes.
Without any surgery and drugs.
Your brain has a waste-clearance network called the glymphatic system. It flushes out toxic proteins and dead cells.
But it only really activates during deep, slow-wave sleep.
If you don't sleep, the trash piles up. Over time, that buildup leads to cognitive decline and Alzheimer's.
Until today.
Researchers just published a paper proving they can manually trigger this cleaning cycle.
Without you ever going to sleep.
They used 40.68 MHz ultrashort waves (USW) beamed non-invasively into the brain.
Within 10 minutes, the brain's fluid flow rapidly accelerated.
The waves artificially synchronized the neurons into a Delta state, the exact frequency of deep sleep. This forced the brain's water channels to open and start flushing out the system.
They tested it on mice with traumatic brain injuries and Alzheimer's pathology.
The brain swelling dropped. The toxic proteins were cleared out. Cognitive deficits actually improved.
No surgery. No massive chemical interventions. Just a frequency.
Sean Metcalf retweeted
For those running apps on @Railway and affected by their breach (you should have an email)
Use your agent to do a quick review of all the keys that need to be rotated.
Sean Metcalf retweeted
I think this is more serious than many people realize.
Not every Node.js server is vulnerable, of course. The application needs to process untrusted Brotli-compressed data.
But how common is that? Well, common middleware configurations in Express 5 can already expose the vulnerable decoder, without developers explicitly using Brotli anywhere in their code.
So we’re potentially looking at a pretty large attack surface, although nobody really knows how many deployments are exploitable yet.
I wouldn’t be surprised to see automated scanning and exploitation attempts targeting this very soon.
Patch your Node.js runtimes.
🤖 Made with AI
Liked PHP2Shell? You’re gonna love Node2Shell.
We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!
imperva.com/blog/node2shell-…
Sean Metcalf retweeted
SMS/Voice deprecation --> Passkey registration campaign has caused a lot of confusion
This is as consice of a statement as you'll get
If the user is eligible for SMS or Voice in Entra Authentication methods, they can enroll whatever passkeys they want
Sean Metcalf retweeted
PowerShell 7.6.8 is released on GitHub and will be available via WinGet soon.
It's a maintenance release that moves the .NET SDK to 10.0.402 and somewhat ironically removes the update notification feature from PowerShell, per customer feedback. 🗣️
💾 github.com/PowerShell/PowerS…
Sean Metcalf retweeted
Desktop #AI is moving fast—a secure rollout for your organization starts here. Join @paulsems, @PyroTek3, and Scott Blake on November 4 for our next #webinar, “Leash Your LLM: Rolling Out Claude and Copilot Securely.” Secure your spot now! hubs.la/Q04C4L3n0
Sean Metcalf retweeted
Greg created the Linux OS CentOS, has healthy views on artificial intelligence, is letting his people do their jobs and is looking for more people instead of firing them. Go work for Greg and tell him BRS sent you but behave yourselves. We are the swarm but we are not animals. 😉
Sean Metcalf retweeted
WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners.
Bro Rooted a brand-new 2025 Samsung TV after noticing absurdly targeted ads.
Firmware was locked down, so zero-days it was.
Got a root shell.
then found: always-on voice service, ACR, geo, full telemetry pipeline, and four separate DRM systems.
This isn’t a bug, It’s the product bro.
Sean Metcalf retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
Sean Metcalf retweeted
A great reminder that Entra App Proxy, Cloudflare Tunnels/Access, or some sort of ZTNA is a great way to remove stuff you don't want hacked from the Internet
Sean Metcalf retweeted
Please don’t tell Merill
Crazy cool blog I saw on linkedin about an SMB signing bypass technique
TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included.
blackfield.ch/blog/defeating…
Sean Metcalf retweeted
Forewarned...
Starting on November 4th, Entra ID users will be able to create agent identity blueprints unless this capability is disabled. I strongly recommend you disable this capability so you don't have users creating agent identity blueprints.
There's a setting to turn this off in Entra ID under User Settings: "Users can register agent blueprints".
Switch it to "No" to prevent users from being able to do this.
Agent identity blueprints are templates that define identity configuration and credentials for AI agents. This is similar in capability to app registrations but for agent identities.
Allowing all users to create blueprints has similar risk to allowing all users to register applications (default is enabled as well). When a user creates an agent identity blueprint, they become the owner of it until removed. This provides full control access to the blueprint.
Agent ID Developer and Agent ID Administrator will still have the ability to create them.
More details here (including searching for existing blueprints):
lazyadmin.nl/office-365/micr…
Sean Metcalf retweeted
👀 "We have not confirmed any successful exploitation."
xitter.cf/Huntio/status/21132838…
🚨 #PHP2Shell (CVE-2026-109618, CVE-2026-109619): everyone is staging the leaked PHP RCE, no one has landed it 🫠
We mapped the exposed PHP footprint and went into the attacker open directories after the Oct 21 leak.
What we found:
→ 683,922 IPs leaking a PHP version in one day of scans, mostly end-of-life builds
→ ~a dozen open-dir workspaces staging php2shell tooling, zero victims or shells in any of them
→ one mass operator sprayed up to 123 servers via a ~97-proxy farm, zero shells
→ scanning started ~20 min after the patch, driven by an existing Mirai-style botnet
→ no public PoC lands code exec on x86-64 yet (OOM corruption vs ASLR)
Patch now: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.
Full research + network observables: hunt.io/blog/php2shell-cve-2…
