@VerSprite CEO & Founder | @OWASPAtl Leader | Author, Process for Attack Simulation & Threat Analysis #threatmodeling | AI Automation for Product Security. šŸ‡»šŸ‡¦

Dirty South
Joined July 2013
Big news on #threatmodeling: Scalable, cost-effective threat modeling is here with Fork šŸ“ Build PASTA šŸ threat models in < 2hrs. 18 different threat libraries (15 industry, 3 tech) and libraries are growing. Correlate ALL @MITREcorp & @owasp ASVS taxonomies to your threat models during a security sprint. Integrate AppSec tools automatically to contextualize and dynamically stay fresh. RBAC models to give teams what they need and nothing more. AI + leading human expertise in threat modeling for over 20 years built for providing one lens on product security across cloud, app, network, system, serverless, IoT, and other components of your stack. We just lowered the cost of operationalizing product security for all. Pick up a FORK here: forktm.com/
2
359
Joshua Michael found an access token on Flock's public website. No login required. No authentication. Just sitting there. He downloaded Flock's entire database. 300,000 device locations. 170,000 cameras. 130,000 other hardware units. 27,000 acoustic detectors. Made a map. Published it September 23. The Senate held a hearing on Flock the same day. Cited Michael's research. Flock panicked. Sent a cease-and-desist. Used a brand-protection vendor called Doppel to claim trademark infringement. The map said it wasn't affiliated with Flock. Doppel didn't care. Michael's site went dark. Then Proton moved it to Swiss servers. Now it lives on protonmcp.org. Untouchable. Uncensorable. Hosted by an encryption company in a country that doesn't care what Flock wants. The irony is crystalline. Flock left an access token on the internet. Michael used it to download their own data. Published it. Flock tried to suppress it. Proton said suppressing it is suppressing information. Which is true. The map shows Flock has 150,000 more cameras than they publicly claimed. Shows acoustic detection units mapping human speech across the country. Shows which police departments have access to the whole network. Flock doesn't want that visible. So they tried trademark infringement. Which only worked until Proton decided transparency matters more than Flock's feelings. Now everyone can see exactly how many cameras are watching their car. Where they are. Which cops can see them. Michael warned Flock about the exposed token in November 2025. Flock ignored him. Then got mad when he used it. The surveillance company that claims to protect privacy just tried to suppress the only map showing how much they actually surveille. And failed.
ā€¼ļø Proton is hosting a map of 300,000+ Flock surveillance device locations that Flock tried to get taken down. Researcher Joshua Michael says he pulled them from Flock's own systems via a token left open to anyone. Proton calls the takedown "an attempt to suppress information."
Readers added context they thought people might want to know
This is the correct link: proton.me/flock-camera-m…
224
6,889
278
25,990
487,165
We wrote up how to find every PHP service you run, including the ones on odd ports, under sub-paths, inside appliances and containers, and how to patch and verify them. Commands plus prompts for your coding agent. We also started SecureTheWeb.org It checks Chaos for services running an affected version and emails their security@ inbox for free, with the fix. We are enriching Chaos over the coming months so the next time a bug like this lands, the affected services are mapped fast and remediation starts sooner. Read: go.projectdiscovery.io/SIC1T…
5
53
6
210
25,776
Tony UV retweeted
50
364
33
3,082
75,650
Tony UV retweeted
Fascinating. Amazon says it has telemetry showing PHP2Shell was being exploited on Oct. 17—that is, four days prior to public disclosure. Not known who was doing it. "It remains unclear how the actor acquired exploit information prior to disclosure." aws.amazon.com/blogs/securit…
13
87
15
316
23,544
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines. If you run either stack in production, keep an eye on official advisories and apply patches promptly. Security maintenance doesn't stop at your application code. Your runtime matters too. Node.js advisory: nodejs.org/en/blog/vulnerabi…
188
4,082
1,162
11,877
2,304,758
PHP Patch, take it offline, or put it behind a WAF and hope it filters the exploit requests. I wouldn’t count on a configuration-only fix unless one is confirmed. For inventory, this Nmap command can reveal PHP versions exposed in HTTP headers: nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target> Only scan systems you’re authorized to test. This finds advertised versions, not every PHP server, and doesn’t confirm vulnerability.
Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.
3
67
4
280
34,395
The first ten HIPAA settlements of 2025 all traced back to one thing: the risk analysis. Finding vulnerabilities is half the job. Explaining what they mean for patient data is the other half šŸ‘‡
1
3
3
53
Good thread to unpack, analyze and evaluate in your own MS environment
The potential impact of the ConnectWise supply chain attack is massive. One compromised OAuth application with elevated permissions could give attackers access to emails, files, and directory data across hundreds of Microsoft 365 tenants. Even worse, attackers could establish persistent access by adding credentials to other applications, surviving the revocation of the original compromised credentials. And with MSPs involved, the potential blast radius could extend even further to downstream customers. We don't know the full extent of the compromise yet, but this could affect far more organizations than those directly using ConnectWise Cloud Backup. linkedin.com/posts/microsoft…
1
55
Tony UV retweeted
Christ or Collapse? Which way western man?
French ā€œhigh schoolersā€ posing for a photo on the fiery but mostly peaceful streets of Paris. šŸ‡«šŸ‡·
8
120
2
770
17,422
ā€œI betrayed the One who loves meā€ → so did Saint Peter, and he became chief of the apostles. ā€œI persecuted believersā€ → so did Saint Paul, and he became the greatest missionary of the Church. ā€œI hurt othersā€ → so did Saint Moses the Black, and he became a gentle father to monks. ā€œI fell into lustā€ → so did Saint Mary of Egypt, and she became radiant with holiness. They sinned… but they repented. And God raised them up as saints. So no matter how far you’ve fallen the path back is open for you too. Repent, get up, and follow Christ. Holiness is not for the sinless, it’s for the repentant.
6
209
13
1,202
12,626
Day 2 in the books. So many great conversations with old and new friends. We've got one more day left. Come find us tomorrow! #ekoparty
2
2
85
Patched ≠ clean. Web shells are surviving firmware updates on 1,200+ patched Citrix NetScaler devices. If you patched, hunt for persistence and rotate creds. #Citrix #infosec
2
2
65
I spent 48 hours in SF hanging out with billionaires, data labs and AI founders and execs running $1B to $100B companies. My observations: 1. Sooo MANY stories of data brokers making like $2M a WEEK selling company data to labs. I can't tell if it's the beginning or a bubble, and I kept wondering which niches are left. Digging into it actively. 2. At dinner, someone asked the table, "If a new model drops next month, does your company get better or worse?" HALF the table went quiet! I think that's the best question to ask about any AI startup right now. 3. The bar people talk about now is hitting $1B in revenue in 12 months (I guess that's the new unicorn?). What I didn't hear much about is retention. AI revenue can come in fast and leave fast, and I think we're going to see a lot of stories of AI companies with huge revenue and terrible retention. 4. It's pretty clear we're living through the reinvention of the computer. The model is the CPU, the harness is the operating system, and skills and plugins are the apps. Thinking about it that way makes it easier to see where the whitespace is. 5. We're maybe 12 months from an agent that can watch you work for a week and then do your job without any instructions. The screen recording plus agent memory plus local model combination makes this possible right now. 6. Agent harnesses feel like the new GPT wrappers, in a good way, especially vertical ones. The best teams I talked to treat the model as swappable. One founder walked me through routing different models to different jobs: one for taste and visuals, a cheaper one for the everyday stuff, another for text. They use prompts they can move across models over fine-tuning, and A/B test the output on what users actually do with it: do they edit it, export it, share it? A vertical harness is basically four things: the connectors for that industry's data, evals written by people who know the work, rules for what the agent can and can't touch, and a clean screen for a human to review. The model is maybe 20% of it. 7. There's a lot of reverse engineering going on/cloning going on more than I've ever seen. People are decompiling software and rebuilding it with agents, and someone showed a suite of like 10 apps that are worth $5B+ each all that he cloned open source. Me and everyone are still thinking through what it means when software gets this easy to copy. 8. My guess is the value moves to data. If the software can be rebuilt quickly, what's worth paying for in a legacy SaaS company is the years of customer data and workflows inside it. Some SaaS companies are secretly data companies. Gets me thinking about how do you truly value data for this saas companies? Like if we were buying these dying saas companies at 2x ARR before (as example), maybe there is a better metric. Idk, just thinking out loud here. 9. It feels like a good chunk of legacy software won't make it to the agentic era, especially anything built around people clicking through a lot of screens. 10. Every company I talked to wants to pipe its internal data into one place and expose it to agents through MCP. Then they look at the data and realize it's a mess: five versions of the same customer, old Slack channels, PDFs nobody can search. Cleaning that up feels like a big consulting opportunity! 11. A lot of founders are building the basic building blocks for agents: APIs, data layers and tools. Some of the companies I saw barely have a UI because the main user is an agent. I really believe the startups that build primitives to this agentic era will do extremely well. Building blocks is the best way to think about it. 12. Labs can get plenty of training data, but it's harder to get real examples of agents failing inside companies. Whoever has those logs has something valuable. 13. Someone running a big consumer company told me the next fight is over memory. The model that remembers the most about you wins, and the smartest model matters less than people think. 14. Physical AI came up a lot. Astra I think was the first model that got people into AI can actually do CAD, and I think a lot of people are thinking what does vibe manufacturing really look like. The line I keep thinking about came from a robotics founder: the hardest problems in AI are deployment problems now, not research problems. Their robots work on their own, call a human when they get stuck, and every one of those calls becomes training data. 15. Cybersecurity companies are having a moment and are actually cool companies to build now, especially the ones that clean up after a breach. Every agent with access to your systems is a new door into your company, and a lot of those doors were left open. 16. Some startups are worth more dead than alive now. A shutdown company with 5 years of Slack, email and code can get paid for licensing all of it. I wouldn't be surprised if founders start factoring that into when they shut down. 17. People are starting to talk about monetizing the agent web. It feels really early, but when the most popular user of the internet is an agent, what startups should you be building? 18. I think agent insurance is coming. Once an agent makes an expensive mistake, insurers will want audits before they cover anyone. 19. Several people said the hire they want most is someone with taste who can write evals. The models are getting good at generating ideas, so the hard part is judging which ones are good. 20. New trend I observed: startup raises VC, uses venture dollars to become a creator, startup fails, founder falls back on being a full-time creator and incubates other products bootstrapped. 21. Getting SIGNIFICANT distribution is HARD right now. Founders are sponsoring buses, buying billboards like crazy and throwing parties with famous DJs to get noticed. Kinda feels dotcom era in that sense. Attention is what's scarce! The growth guy going viral sharing his UGC strategy from Wispr Flow is a good example. It's the sauce everyone wants, and I truly believe there are probably only 50 people on the planet who know how to scale these types of businesses efficiently in this era. Always good to get that dose of SF. I felt sooo lucky to have such an incredible trip during such an incredible time in building businesses. Surreal in so many ways. Happy to be home and locked in. Until next time!
934
1,984
581
21,214
2,516,039
Cisco SD-WAN, Citrix, Atlassian: attackers keep hitting the infrastructure everything else trusts. Map your trust boundaries before they do. #infosec #zerotrust
4
5
94
The Danger of Stopping Prayer: Lessons from St. Teresa of Avila If you’re ever tempted to stop praying, remember the powerful story of St. Teresa of Avila. Convinced she was bad and unworthy of God, she stopped praying for 15 years. The devil had convinced her that she was acting out of humility. Instead, this decision led her to become more sinful and less worthy of God. She later admitted that it nearly brought about her ruin. You will never be worthy of God if you stop praying. This is the powerful lesson that St. Teresa of Avila learned. She thought she was being holy and humble by giving up on prayer, but in fact she was playing right into the devil’s hands. When we pray, we don’t pray because we’re worthy of communing with God. We could never be worthy of speaking to Him, let alone receiving His very body in the Eucharist! And yet, this is a beautiful reminder of how deeply Jesus loves you and the profound humility we are called to imitate. He does not only associate with those who are ā€œworthyā€ of Him. In the Gospels, we see Jesus freely associating with sinners of all kinds, while strongly condemning the ā€œholier-than-thouā€ Pharisees. He wishes to speak to us even though we are not worthy. So never stop praying. Come to God exactly as you are, broken, imperfect, and in need of His grace. That is where His mercy meets us most powerfully. Keep praying, dear friends. Your consistency in prayer matters more than you know. ..... Inspired by the life and testimony of St. Teresa of Avila
9
274
4
1,384
18,301
ā€¼ļø BREAKING: A ransomware negotiator who wrote a book on cyber extortion has been charged with conspiring to commit it. Edward Dubrovsky, 54, co-founder of Canadian firm CYPFER, was arrested in Pennsylvania on 8 October. Krebs ties the arrest to the FBI's ShinyHunters probe.
14
80
6
449
31,132
ā€¼ļøšŸ‡¬šŸ‡§ Deloitte has been named by The Gentlemen ransomware. šŸ‡¬šŸ‡§ Deloitte - A global professional services organization providing audit and assurance, consulting, financial advisory, risk advisory, tax, legal, technology, and cybersecurity services.
18
116
21
551
69,674