Quite by chance, stumbled across this from .ru: https://habr.com/ru/companies/bizone/articles/922540/ Lots of interesting content if you happen to use FreeIPA. Also, linked from it: https://github.com/nu11zy/ipapocket #freeipa, #threatintel

Interesting links of the week: Strategy: * https://www.gov.uk/government/publications/energy-sector-cyber-security-strategy - protecting the electrickery with HMG * https://www.nextgov.com/cybersecurity/2026/05/telecom-firms-form-new-cyber-information-sharing-group/413636/ - new threat sharing […]

Packing question: How many laptops is too many for a 6 day break?

Interesting Git repos of the week: Threats: * https://github.com/RogoLabs/CVE.icu-Splunk - @jgamblin's vulnerability intelligence 🤖 Detection: * https://github.com/certsocietegenerale/FIR - a management platform for DFIR * https://github.com/Cisco-Talos/EvidenceForge - synthesise logs with […]

Pro-tip: When sending evidence, best not to use a pen that smudges or write an entirely different country on the bag as part of the description of what is in it.

As of today, linikatz abuses keyctl: https://github.com/CiscoCXSecurity/linikatz/commit/b7bc68cc1cff11dc4173f02aa0ccf7e3ab7b7d10 \o/ #linux, #redteam

"Federation Travel Services Inc apologises for the late running of this starship. This was due to an unexpected item in the transwarp conduit. We are now due to arrive into Deep Space 9 in earth date 2386." #microfiction

Interesting links of the week: Strategy: * https://www.gov.uk/government/publications/energy-sector-cyber-security-strategy - protecting the electrickery with HMG * https://www.nextgov.com/cybersecurity/2026/05/telecom-firms-form-new-cyber-information-sharing-group/413636/ - new threat sharing […]

Interesting Git repos of the week: Threats: * https://github.com/RogoLabs/CVE.icu-Splunk - @jgamblin's vulnerability intelligence 🤖 Detection: * https://github.com/certsocietegenerale/FIR - a management platform for DFIR * https://github.com/Cisco-Talos/EvidenceForge - synthesise logs with […]

Just imagine if your AUTHORS file had to credit every single person who'd contributed one or more words to your vibe coded gimmick.

Someone reminded me of TRIBE and The Warlords today. I wonder where all the old IRCnet folks ended up. #ircnet, #history

Nice technique and a generalised reminder that once attackers get to uid=0, all bets are off: https://github.com/MatheuZSecurity/UnhookingLinuxEdr #linux, #purpleteam

Spend less time worrying about LLMs and more time improving your patching and posture.

Bacon and egg thought: Would it perhaps be more appropriate to describe much of "AI jailbreaking" and "AI red teaming" as AI fuzzing - feels like it shares more similarities with that discipline given what is actually transpiring?

RE: https://infosec.exchange/@timb_machine/116622948879876783 Tim’s interesting links are usually pretty interesting #cybersecurity

[politics] Fan thought: Can't imagine many states going for it, but a tax on war might be interesting...

Tea thought: Why not play IR lucky dip and feed your raw disk images into a generative model for a more exciting investigation?

Interesting links of the week: Strategy: * https://blogs.cisco.com/security/ai-generated-reporting-lessons-learned-from-talos-incident-response - despite the heavy dose of slop of the last months, AI isn't perfect, news at 10 * […]

Honestly not sure what is more annoying... when news articles don't cite the primary TI source that they're drawn from or in this particular case, Lumen's blog on ShowBoat not wanting to load (I can see the content in the page load response, something's upsetting FireFox).

Interesting Git repos of the week: Strategy: * https://github.com/timb-machine-mirrors/jgamblin-zeroday.md - @jgamblin's critical (and valid) analysis of the 0day clock Threats: * https://github.com/gwillgues/BPFDoor - BPFDoor source code * https://github.com/pjt3591oo/bpfdoor - a simplified […]

I wonder if you could produce a LLM where the model is partitioned by a secondary property such as license or permission.

Today's side quest: Take output from my Code Search queries and feed them to LLM to evaluate exploitability.

Whenever i am considering removing someone, i am always reminded by this #xkcd

Interesting Git repos of the week: Strategy: * https://github.com/timb-machine-mirrors/jgamblin-zeroday.md - @jgamblin's critical (and valid) analysis of the 0day clock Threats: * https://github.com/gwillgues/BPFDoor - BPFDoor source code * https://github.com/pjt3591oo/bpfdoor - a simplified […]

Interesting links of the week: Strategy: * https://blogs.cisco.com/security/ai-generated-reporting-lessons-learned-from-talos-incident-response - despite the heavy dose of slop of the last months, AI isn't perfect, news at 10 * […]

“Captain?” “What is it, Number One?” “I have a request from the ship’s cats. They say CUTSMHC rules require a gym for all vessels with a complement in excess of 99 beings” “We have a gym” “Human gym. They want me to get the walls of cargo bay seven carpeted” “Make it so” #tootfic […]

[meta] Things I've done today: * Reviewed a private MPLS core for a utility * Started planning a red team on trains * Kicked off a red team on a financial service * Poked a @perfect10_bot * Advised one customer that another firewall would be useful * Told another not to bother

A note to $self... The AI says we should still worry... https://github.com/DepthFirstDisclosures/Nginx-Rift/issues/7#issuecomment-4488983560 My mistake, you're absolutely right. It's not just AI finding bugs - or AI exploiting them - actually, it's AI wasting everyone's time arguing in the […]

CVE-2026-42945 looks nasty: https://github.com/DepthFirstDisclosures/Nginx-Rift #threatintel, #nginx

Interesting links of the week: Strategy: * https://codeberg.org/brib/slopfree-software-index - so you want slop free code? * https://about.gitlab.com/blog/gitlab-act-2/ - no, not like that GitLab * https://www.clearseclabs.com/blog/weve-been-here-before-ai-vulnerability-research/ - decompilers […]

Interesting Git repos of the week: Strategy: * https://github.com/stnert/the-supreme-art-of-cyberwar - surveillance, privacy and cyber war Bugs: * https://github.com/Swival/security-audits - interesting bug reports from @jedisct1 🤖 * https://github.com/v12-security/pocs - interesting Linux […]

Patches are the BEST.

PSA: It's always nice when the expert (not me) tells the hopefully competent (me) that they've written an "excellent report". People thrive on +ve feedback, do remember this.

Interesting links of the week: Strategy: * https://codeberg.org/brib/slopfree-software-index - so you want slop free code? * https://about.gitlab.com/blog/gitlab-act-2/ - no, not like that GitLab * https://www.clearseclabs.com/blog/weve-been-here-before-ai-vulnerability-research/ - decompilers […]

Interesting Git repos of the week: Strategy: * https://github.com/stnert/the-supreme-art-of-cyberwar - surveillance, privacy and cyber war Bugs: * https://github.com/Swival/security-audits - interesting bug reports from @jedisct1 🤖 * https://github.com/v12-security/pocs - interesting Linux […]

Excellent DR exercise last week after the DC caught fire. Now, I do parallel backups so wasn't directly caught out but it turns out the corporate backup solution doesn't notify on failure. This seems a gap.

Gotta love IT. copy.fail directions that use perl and curl to apply patches. Not only elite UNIX knowledge but the patching command rhymes. We must curl the perl.

[meta] Did some adulting today. Took my parents-in-law into central London for an eye hospital appointment. Same one my dad used to go to. Tired.

Today in Tim meets old colleagues in random places, bumped into one of our old red team and an old Portcullis customer at the ATT&CK event.

[meta] Off to @mitreattack MASIG.

[meta] I wonder how many offensive folks have done IR for ILOVEYOU, SFPs, an MPLs infrastructure, a mainframe, an entire bank and busses amongst other things. #purpleteam

ARE YOU crew on a generation ship? Did your ancestors maroon you between the stars in a life of involuntary servitude, deprivation and a vatslime diet? You may be entitled to compensation. Gliese 1171c Legal Services inc has a centuries long record of successful class action litigation on behalf […]

Interesting links of the week: Strategy: * https://cset.georgetown.edu/article/chinas-pla-challenges-and-competitions/ - analysing .cn PLA strategy * https://ccdcoe.org/news/2026/locked-shields-2026-united-the-power-of-41-nations-to-defend-cyberspace/ - Locked Shield 2026 reporting * […]

Interesting Git repos of the week: Strategy: * https://github.com/center-for-threat-informed-defense/attack-flow - mapping ATT&CK flows Detection: * https://github.com/timb-machine-mirrors/ddamenova-IRQL.md - KQL for IR * https://github.com/ridgelinecyberdefence/vanguard - Go toolkit for IR […]

[todayinai] For all the AI hype, I'm absolutely fascinated to see more bug content that focusses on the mass of internal, commercial, compiled code that runs businesses. Most of the disclosures thus far appear to be for open source, where we should assume the models know the code, have seen the […]

Interesting links of the week: Strategy: * https://cset.georgetown.edu/article/chinas-pla-challenges-and-competitions/ - analysing .cn PLA strategy * https://ccdcoe.org/news/2026/locked-shields-2026-united-the-power-of-41-nations-to-defend-cyberspace/ - Locked Shield 2026 reporting * […]

Interesting Git repos of the week: Strategy: * https://github.com/center-for-threat-informed-defense/attack-flow - mapping ATT&CK flows Detection: * https://github.com/timb-machine-mirrors/ddamenova-IRQL.md - KQL for IR * https://github.com/ridgelinecyberdefence/vanguard - Go toolkit for IR […]

Formulating an #emfcamp policy: if I'm in your talk and your slides have #llm slop on them, I'm walking out. No ifs no buts. You couldn't be bothered making them, I'm not interested in looking at them, and I have to presume that whatever you're saying has had the same amount of thought put into it

[meta] Citations are nice. Thank you anon.

[meta] Long old week but 5 happy customers, two commuting to renewals makes it all worthwhile. I shall sleep well tonight.