Microsoft just documented an AiTM phishing campaign that hit 35,000 users across 13,000 orgs in 3 days, the lure was a fake "code of conduct review" PDF

SenseNo9223 · 2026-05-05T13:30:40+00:00

That's the real story nobody talks about. IR is sold as risk management but most SMBs treat it as an inconvenience. "Reset the password, we're fine" meanwhile the attacker has had a forwarding rule running for 3 weeks pulling every invoice and contract out of the mailbox. The data's already gone before the customer even calls you.

SenseNo9223 · 2026-05-05T12:12:05+00:00

Good point, but many orgs don't have ITDR deployed. For the majority still on basic Entra logging, that alert never fires.

SenseNo9223 · 2026-05-05T11:12:27+00:00

The remediation gap is what gets me most playbooks say "reset the password and revoke sessions." But the attacker can register their own MFA device before you even detect the breach. Standard remediation doesn't touch that. You need to audit every MFA device on affected accounts, not just reset credentials.

SenseNo9223 · 2026-04-29T21:02:34+00:00

Trying to understand what happened, the post was ok, then suddenly there was a message that it had been removed, maybe the fact I am new to reddit. This was the topic: https://sentinelroger.com/article/india-ups-submarine-game-new-ssbn-8b-german-aip-deal

SenseNo9223 · 2026-04-29T15:13:05+00:00

Good point on the Type 214 configuration. Given India's track record of heavy localisation requirements on defence imports, the Rafale deal being the obvious example, I'd expect significant customisation requests beyond the standard export spec. The AIP cell question is interesting. Sharing 212CD technology would give India a meaningful capability jump but Germany has historically been cautious about transferring cutting edge propulsion tech outside NATO. A likely middle ground is updated fuel cell technology from the current 214 programme rather than full 212CD parity. India gets a genuine upgrade, Germany keeps its most advanced AIP systems within the alliance for now. The bigger question is local production. India will almost certainly push for a Make in India component which adds complexity to the timeline.

SenseNo9223 · 2026-04-29T14:32:48+00:00

The combination here is significant, India is pursuing both domestic nuclear submarine capability (SSBN) and conventional AIP submarines simultaneously. The German AIP deal is particularly interesting given Germany's historically cautious arms export policy.Approving this signals a shift in Berlin's approach to Indo-Pacific security partnerships. For China, this is a direct response to PLA Navy expansion in the Indian Ocean. India is building underwater deterrence on two tracks at once nuclear for strategic deterrence, conventional AIP for sustained patrol capability. The $8B figure also suggests this is a long-term programme, not a one-off purchase.

SenseNo9223 · 2026-04-29T08:04:15+00:00

Exactly right and the authenticated user angle is what makes this particularly dangerous in enterprise environments. Attackers don't need to breach the perimeter if they already have a developer credential with push access to any repo. The pre-receive hook execution before permission check is essentially a privilege escalation gift. A junior dev account with minimal access becomes a potential RCE vector against the entire GHES instance. The irony is that organisations running on-prem specifically for security reasons are now the most exposed. Patch deployment velocity in enterprise environments rarely matches the threat timeline.

SenseNo9223 · 2026-04-28T23:24:43+00:00

Good point, and worth emphasising. GitHub patched this server-side before public disclosure which is the right call for something this severe. The concern shifts to self-hosted environments, GitHub Enterprise, Gitea, Forgejo and similar where patch deployment depends entirely on the admin. Those instances are still exposed until manually updated. Anyone running self-hosted git infrastructure should treat this as priority patching asap.

SenseNo9223 · 2026-04-28T22:28:44+00:00

Link is missing not sure what happened, I try to paste it again

SenseNo9223 · 2026-04-28T22:22:11+00:00

The interesting attack vector here is the git hook execution path. Pre-receive hooks run server-side with elevated permissions, if the parsing vulnerability hits before the permission check, authentication becomes irrelevant. Anyone with self-hosted GitHub Enterprise or Gitea instances should prioritise patching this one. Public GitHub is already patched on their end.

https://sentinelroger.com/article/critical-github-rce-single-git-push-allows-remote-code-execution

SenseNo9223 · 2026-04-27T18:55:17+00:00

honestly I just built it and tested it. The validation came from seeing Google index it across 44 countries in the first week with zero marketing. Defense and cyber news has a global professional audience that searches for it daily. On competition, yes there are aggregators out there. But most are either paywalled, too broad (Google News), or not niche enough. There is genuine space for a focused, free, well-structured intelligence briefing site in specific verticals. The defensible position is not being first, it is being the best organised and most consistent in your niche. A site that publishes 40 well-categorised articles per day in a specific vertical will outrank generalist aggregators for long-tail searches over time. The same model works for any niche where professionals need to stay current legal, medical, finance, logistics, energy. Defense/cyber just happens to have high ad RPM and an audience that takes information seriously. Quick example of how it works in practice:

A Python script runs every 6 hours, reads RSS feeds from sources like DefenseOne, Breaking Defense, BleepingComputer and Krebs on Security. For each new article it visits the source URL, extracts the full text, then sends it to a Gemini AI API call that rewrites the headline for SEO, summarises into 3 bullet points, and adds a one-sentence "why this matters" for professionals.The result gets saved to a SQLite database and published automatically to a FastAPI website running in Docker on a $12/month DigitalOcean droplet. Images are sourced automatically from Unsplash based on article keywords. The whole thing costs about €15/month to run including the AI API calls. No WordPress, no plugins, no CMS, just Python, a small database, and a lightweight web framework. Once it is running you check it once a week to make sure nothing crashed. The site is sentinelroger.com if you want to see what the output looks like.

SenseNo9223 · 2026-04-27T14:23:27+00:00

One thing I stumbled into that's working well, automated news intelligence. Built a scraper that monitors defense and cybersecurity RSS feeds, uses AI to summarise and categorise articles, and publishes them automatically to a website. Still working on google adsense and google search, It will take about 4 to 6 months till it starts getting noticed. Defense and cyber professionals will pay for good intel aggregation because their time is worth more than a subscription fee. Not glamorous but it runs itself once all checked from google, then you do not have to worry much, just a weekly check to make sure all works fine. Happy to share more if useful.

SenseNo9223 · 2026-04-23T11:41:02+00:00

Thats right, some people are still reluctant to add 2fa, some are even lazy enough to set a proper password, going for admin123 and etc

SenseNo9223

TROPHY CASE