Intelligence, Resilience, Risk, Security, Geopolitics. All views my own, not my employer / handler / AI, because no one else would be daft enough to have them.
Roaming...
Joined October 2019
- Tweets1.9K
- Following394
- Followers175
- Likes1.3K
Mike Evans retweeted
997 days
Healey vows cheaper marmalade and gherkins in pre-Budget package of 'everyday fixes' bbc.in/4zTnQ4K
Who said working in intelligence / security / risk wasn’t all fun and games?
Jokes aside, this is an incredible read @AnnieJacobsen
Organizations are geopolitical actors whether they realise it or not.
The Jaguar Land Rover (JLR) cyber-attack was state-sponsored, according to a former defence minisiter.
telegraph.co.uk/news/2026/10…
UK Defence Secretary warns the country has 1,000 days to prepare for war by 2030, emphasising the importance of national resilience in addition to national defense.
telegraph.co.uk/news/2026/10…
U.S. intelligence finds Iran has "substantially increased" its efforts to target American diplomats and officials in the Middle East and beyond, with lethal plots reaching "advanced stages.”
thetimes.com/world/middle-ea…
Mike Evans retweeted
Intelligence and Security Committee has launched what looks like a fairly wide-ranging inquiry into the production & use of intelligence assessments and security advice, including by Ministers, as well as reviewing the effectiveness of coordination across the intel community 😳
Mike Evans retweeted
The Department of State updated the Travel Advisory for mainland China to add the “D” risk indicator due to the serious risk of wrongful detention of Americans in China. travel.state.gov/en/internat…
Mike Evans retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Mike Evans retweeted
they’re calling it “Black October” and i don’t think people realize how serious this is
in the last 48 hours there have been over 27 major cybersecurity incidents. not in a month. not in a week. in 48 hours
any ONE of these would normally be the biggest story of the year
PHP: critical vulnerability in the software running 80% of the web. severity 9.2 out of 10
Node.js: high-severity flaw letting attackers take over servers remotely. affects versions 22, 24, and 26
Java: also compromised. three of the most used programming languages on earth hit at the same time
GitLab: a perfect 10 out of 10 severity hole in every version since 2014
Railway: hosting platform compromised. API keys for OpenAI, Claude, Stripe potentially exposed
Signal: a bug that could leave your mic and camera on after you hang up
WordPress: hackers stole a plugin maker’s keys and planted backdoors on websites
LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
and that’s not even half the list
thousands of AI agent swarms are reportedly scanning and attacking vulnerable servers right now. automated. around the clock
security researchers are saying this might be the early stages of a global cyber incident that nobody fully understands yet
if you run a website, use cloud services, store API keys on hosting platforms, or use any software built on PHP, Node.js, or Java you are potentially affected
update everything. rotate your API keys. change your passwords on critical services. enable 2FA everywhere you haven’t already
this is not a normal week on the internet. this is something different
Mike Evans retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Mike Evans retweeted
A Kremlin official told Germany through a backchannel after the failed Leipzig attack that this "wouldn’t be the last attack." -WSJ
wsj.com/world/europe/airfiel…
Mike Evans retweeted
🚨🇩🇰🇷🇺 Six weeks ago, Danish intelligence warned about a Russian espionage tactic.
Today, prosecutors revealed a case that appears to follow the same playbook.
On 5 September, Denmark's intelligence service (PET) warned that Russian intelligence was recruiting individuals through platforms such as Telegram to photograph defence companies, buildings and access points.
Such reconnaissance could potentially be used to prepare sabotage operations.
Now, on 20 October, two men aged 18 and 21 have been charged in an alleged Russian intelligence operation targeting MyDefence - a Danish company producing counter-drone technology supplied to Ukraine, NATO and allied militaries.
According to prosecutors:
• The suspects allegedly photographed MyDefence's facilities on 19 October.
• They allegedly operated alongside several unidentified accomplices.
• The photographs were reportedly forwarded to a user on Telegram.
• A third individual reportedly remains at large.
The similarities to PET's warning are striking.
But one crucial question remains: What were the photographs intended for?
There is currently no public confirmation that sabotage was being planned.
Both suspects deny the charges.
🚨🇩🇰 🇷🇺 BREAKING: RUSSIAN INTELLIGENCE IMPLICATED IN ESPIONAGE CASE TARGETING DANISH DEFENCE COMPANY
Two young men, aged 18 and 21, have been arrested in Denmark and charged in an espionage investigation involving a Russian intelligence service.
According to DR and TV 2, the case concerns alleged espionage targeting a Danish defence company.
• Both suspects were arrested on 19 October and appeared before Aalborg District Court today.
• Prosecutors have charged both under Section 108 of Denmark's Criminal Code, concerning assistance to foreign intelligence services.
• Denmark's domestic intelligence service (PET) is participating in the investigation.
• A third individual reportedly remains at large.
• The involvement of a Russian intelligence service was disclosed during today's court hearing, according to both DR and TV2 Nord.
Both suspects deny the charges.
The identity of the defence company, the nature of the alleged intelligence operation and the role of the Russian service have not yet been publicly disclosed.
Mike Evans retweeted
🪫 A power outage at a Google Cloud data centre near London caused serious failures to services on Tuesday, leading to widespread disruptions for several UK banks.
➡️ u.afp.com/SCz7
In Intelligence - particularly in fast moving security environments - Structured Analytical Techniques (SATs) are sometimes treated as academic tools. Their real value becomes clear when reporting is uncertain, time is limited & consequences of getting it wrong are significant.
This is what good intelligence should do.
It should provide alarm when the evidence requires action and assurance when speculation is running ahead of the facts.