Microsoft 365
M365 is the most common cloud based business identity platform (be that native or hybrid mode) and so defending this is a key element to business digital security (it’s clearly not the only thing though…. security is a very broad domain!), so I thought I would take a look at incident commonality and controls.
Read more “Identity Incidents and how to prevent them!”
Forensics
Scope: Where each component writes logs, what it records, what it doesn’t, defaults, and the forensic/detection implications for the lab. Basis: Verified against the running lab (Ollama 0.32.1 on the Windows host + remote 3090; Agent Zero container, Kali-based image). Paths/behaviors confirmed live where noted.
Read more “Logging Reference — Ollama & Agent Zero”
AI
Imagine building what you describe as the most powerful AI enabled cyber tool…. and then showing the world that you put it in a lab where a single box compromise led to it having unrestricted and unmonitored internet access… that would be awkward would it not? Here’s an LLMs take on this…
Read more “If it’s so powerful, it’s a shame you didn’t use it for defense design”
Research
What better way to test than to eat ones own dogfood right! This site runs WordPress, it is fronted by Cloudflare, has wordfence and has automatic patching enabled (the default) in WordPress. So what better example to show that we can use an LLM + LLM created scripts to conduct assurance activities. This is mixing deterministic and non deterministic technologies to test and then assess.
Read more “Using an LLM for assurance (WP2SHELL)”
Strategy
TL;DR: wp2shell (CVE-2026-63030 chained with CVE-2026-60137) matters because it is a core, pre-authentication RCE reachable on a stock, plugin-free install. That is the rare category. In 25 years, unauthenticated code execution against a bare WordPress install has happened only a handful of times. The overwhelming majority of WordPress mass compromise has ridden the plugin and theme supply chain and infrastructure abuse, not core. This post maps the history so you can see where wp2shell actually sits.
Read more “From TimThumb to wp2shell: 25 Years of WordPress Mass Exploitation”
Vulnerabilities
This morning I’ve started to see exploitation attempts on pwndefend.com (they all failed because like about 80% of sites (based on sampling) this site automatically patched, but also, this site has word fence, is fronted by Cloudflare.
On the 18th (AM) I did sampling of about 3.5K hosts and found ~20% were not patched. The cyber apocalypse is not seemingly here today! (let alone the fact that if every WordPress site was popped, the world would probably not end)
Read more “WP2SHELL Update”
Threat Intel
Yesterday afternoon/early evening a patch for WordPress was released (7.0.2) which address two vulnerabilities which are named: WP2SHELL. This is a fast post (largely generated by Claude Opus) to provide some detail. For reference in our research we have found ~20% of WordPress sites still vulnerable as of a few hours ago (based on a sample), so this is a live scenario and it would be strongly advisable for organisations to take appropriate steps. This morning I’ve built a docker lab of a vulnerable WordPress site and demonstrated hash theft and web shell deployment to a vulnerable lab instance.
I’ve put some resources for people (use at own risk) into a repo: https://github.com/mr-r3b00t/wp2shell/
that includes a scanner, some info on the vulns and a PoC tool!
Leadership
We should block the RMM! We should block that IP! We should block that port! The trouble is; there’s 65535 ports per protocol (TCP/UDP), there’s billions of IPs (dynamic and rotating infra are a thing), and well that’s a lot of work, neve ending, in fact!!
This topic has come up a number of times recently so I thought I’d put it into a blog, so I had Claude generate this based on my quick fire views:
Read more “You Cannot Block Infinity”
Cybercrime
Every ransomware incident runs on one uncomfortable assumption: that the people you bring in to help are actually on your side. A case that concluded in a Florida federal court this month blew a hole straight through that assumption. Three cyber professionals — two of them ransomware negotiators whose day job was to defend victims — have been sentenced for working as an affiliate crew of the ALPHV/BlackCat operation. One of them didn’t just moonlight as an attacker; he sold out the very clients who were paying him to protect them.
This is not another “big scary ransomware gang” story. It’s an insider-threat story, and it lands right in the middle of the incident-response industry itself. If you run an IR practice, negotiate on behalf of victims, broker cyber insurance, or you’re a CISO who will one day have to trust one of these firms on the worst day of your career — this one is worth your time.
Read more “When the negotiators go bad!”
AI
We are already watching the fear, uncertainty and doubt industry spin up around AI. It follows a pattern anyone who has sat through a vendor pitch will recognise: take a real, narrow signal, strip out the caveats, and inflate it until it fills a keynote slide or a board paper. The problem is not that AI carries no risk. It carries plenty. The problem is that the loudest claims are almost always the least accurate, and the people making them usually have something to sell — a model, a defence against one, or a regulatory moat.
So let’s take the three narratives I keep hearing, put them next to the evidence, and separate the kernel of truth from the theatre.
Read more “AI: Fear it, so I can sell you the cure!”