Regarding the PHP vulnerability, I have seen some security researchers recommending people limit web browsing for a few days (due to the potential for common websites to be compromised via this vuln). There is exploit code available for this vuln, though it is not known to exist “in the wild.” But with the weaponization of AI, it’s possible that the discovery and broad distribution of exploit code could happen fast - possibly reverse engineered after the patches are released. I expect cyber security providers of web application firewalls and exploit prevention services will have protections deployed quickly today, and IT teams will be busy patching and upgrading. And I think it may be wise to lay low on the Internet today. Do what you need to, but probably skip frivolous browsing. Also: Make sure you are running full service anti-virus / anti-malware on every device (including phones). I recommend BitDefender for home/personal use. Update your browser apps and only use Safari, FireFox, or DuckDuckGo. No opinion about Brave (people keep asking). Make sure ad blocking is turned on and auto play of active content is turned off. Be very cautious of links you receive in SMS messages, message apps, and email. Check and verify the source first and check the URL to make sure the website domain is as expected. Keep your operating system and all applications up to date, and watch for new updates over the coming days. Regarding iOS, I do not recommend upgrading to 27. Stay on 26 and update as possible. Make sure you have MFA turned on for all websites or online accounts. True MFA. Passkey has a major design weakness so I do not recommend it. This is all to protect your devices and your accounts in case a website you visit is explored and does attempt to steal your credentials, information, or deliver exploit code to your device. @PractiveSec will be following this today. Advisory coming for customers.

Have you read any of my work and thought, “hmm…he needs an editor.” Well, you aren’t alone. Besides, my inventory of commas runs low. But I have a solution: @PractiveSec now has a part-time Content Editor! Rachel is hard at work already and has helped me improve 7 significant pieces in her first 2 weeks on the job. Practive Security Essentials customers will see the revised versions of the articles first as we post updates on our website. Substack versions will follow. She’s working through our 101 section first and will move on from there, polishing all published content by year end (I hope). And soon she will be part of the pre-publication process so I will hopefully embarrass myself less often. No major changes in what I say, but some excellent editing to help me say it without distracting the reader. practivesecurity.com/about

Hey my fellow parents, As the school year approaches, most of us will be back in the mode of education routines. Many of our kids will be using computers and online resources and engaging each other via the digital spaces. But who is training them, preparing them, guiding them, and protecting them online? And what about you? Are you aware of the dangers and how to counter them? Arm yourself and your family with strategies, mindset, practical tips, and tools to do so safely, securely, and while managing digital health. 346 pages packed full of the essentials. amazon.com/dp/B0H4LK1Y93

Choosing a secure browser is a stronger move toward digital privacy than paying for an app and service that prevents your device from leaking your physical location. @PractiveSec on Digital Privacy: practivesecurity.substack.co…

I may have been a little unfair in my comments on this interview yesterday. Seeing Kevin and thinking about the Mandiant journey along with some of the milestones they discussed in this interview brings back so many memories. Some good, some bad. Successes and failures. Peaks and valleys. There simply aren’t very many of us who have careers in this stuff that goes back so far and for those who do, our history is shared…even the working the same incidents and investigations. I’m glad the story is getting some attention. As I mentioned yesterday, we did some crazy stuff over the years and most of it was intentionally buried or hidden from view. The Cyber Security industry is like many others a massive world within our world that operates in the shadows and the effects are taken for granted. Cheers to my fellow practitioners. Cheers to the proverbial plank owners of our industry. Cheers to Kevin and the Mandiant crew. Cheers to the APT Working Group (APTWG), the DIB, DSIE…and the others. And hello to the intel analysts and spies reading this because it was flagged by the ever diligent analytics platforms of your respective nation state. Maybe we should do a war stories podcast and share our reflections on the silent battles that we fought in the cyber space over the years. It might blow your mind and change the way you think about the Internet. I bet many of us have surprises yet to the told. #CyberSecurity #InfoSec

“Attend to your story.” - Jonathan Pageau, Rapunzel. Part of protecting our hearts, minds, souls, and property online includes controlling what we are aware of and what we are thinking about: attending to our story and not pursuing others. Online ads, algorithms, feeds, reals, pop-ups, influencer posts, AI slop etc. are all clamoring for your attention. They want to make you aware of something, hoping that awareness will catch your attention, and your time, and your participation. And when that happens, you have been changed. Your behavior and thoughts and focus have been influenced by that attention grabber, and you will have given it life. And if we are attending to that thing, then we are not attending to others that may be more important or worthy of our attention. As Iain McGilchrist has revealed to us, attention is a moral action because it makes reality. Some simple steps to guard your attention: Use a secure browser like FireFox that blocks ads and pop ups and active content on websites, and blocks unnecessary trackers and cookies. In social media apps, disable auto-play of videos and live content. Keep your speakers muted until needed. Carve out dedicated time for scrolling or reading the news etc. Make that a space in the day and avoid doing it outside of that space. Manage your email - don’t give your address away easily, and unsubscribe to all the spam or unneeded email you get. Use web content filtering (Wi-Fi router, local app, or browser safe settings) to prevent accidental access to categories of content that are distracting or harmful. During times with people - especially family - leave the device in your pocket, in storage, or somewhere out of reach.

I receive this question often and the answer is, yes most of the content I write or podcasts I post are behind a paywall. @PractiveSec is my full-time job and has been since early 2025. But I do view this work as missional in nature (which is why my faith is expressed in all of it) and so I have attempted to price access accordingly. What I write is also backed by 2.5 decades of very deep research practiced in cutting edge contexts. I say this plainly: you won’t find someone else with my background and experience doing this. I don’t mean to boast, it’s just the reality of the path God has placed me on—perhaps for this very final outlet. But I am open to feedback. Here’s a breakdown of the price / service structure: practivesecurity.com/signup What is not listed there are custom advisory, research, speaking, and consulting which I also offer in a “pay what you can” model. Substack and Spotify are secondary outlets that I also use. Substack has a lot of content (written and audio) but the website has more and it is organized by interest/topic. Substack gives me a way to preview the work and for you all to unlock one free article to help you decide if you want to support my work. And we also have a supporter tier for $5 / month for those who wants to see this work continue and get enough value from what I do. And we have also started publishing work in book format which you can read about here: practivesecurity.com/books Lots of ways to participate and I hope above all that what I know can be of help to you in meaningful ways. If you would like me to continue, please consider supporting in any way you can.

Going live with @juliecbarrett in just over an hour. Join us!

I wrote about this in Countering the AI Revolution. Part of Larry Ellison’s dream of the AI world, is cameras everywhere watching everything we do all the time so that “citizens will be on their best behavior.” Search for that and you’ll find him excitedly describing his police state of cameras constantly watching us in a live interview he gave. It’s already taking shape. I give examples in the book. Kids are being jailed because AI thinks they were planning a crime. In San Diego County, local police are inviting citizens to grant them access to personal home security cameras so the police can perform real-time monitoring and investigations. We really need to wake up and pay attention. Before you dismiss Larry Ellison’s dreams as unimportant, he was invited to the Trump White House the first week back in office to announce Trump’s first AI initiative: Stargate. westbowpress.com/en/bookstor…

Listen to her words: the AI race is about global dominance. It is the new vehicle for globalism. Calling it a national security issue makes winning this race an existential necessity. But what does that mean? What are we afraid of? The implication is that if we lose, we become servants to the winner, China, and if we win, then the world comes under our dominion. And what will that new world look like? According to those facilitating this race, it will be some form of techno-socialism. Something like a perpetual Burning Man festival. Elon Musk even uses the terms of socialism: universal income, universal prosperity. Larry Ellison speaks of a total police state: “everyone will be on their best behavior because we will be watching everything.” Elon and Dario tell us our economy will be completely changed because none of us will have jobs and everyone will be capable of doing anything via the machines. They even promise to do away with our religions as Elon has spoken of Grok being the final source of truth that will answer all the philosophical and religious questions of mankind. The AI Revolution is in every way the abandonment of our history, traditions, and faith as humans. Saying that opposition is a phenomenon of social media foreign influence operations is ridiculous. I’m sure that is happening, but let’s not pretend that there is no objection to the anti-human force that is behind this. @Heritage should be leading the opposition along with the church. westbowpress.com/en/bookstor…

Most parents start their children’s online participation by giving them a smartphone for 3 primary reasons: 1. To be able to communicate with them on-demand. 2. To know where they are at all times. 3. For participation with friends and the greater world. This begins a transformative journey and if our kids are not properly shepherded and prepared for the dangers ahead, exposure can rapidly lead to harm in many forms. I created a 1 day in-depth seminar to walk parents through the issues facing our kids online, and strategies to address them. We cover overt and covert threats as well as the transformative nature of using tech in the ways we are invited and tempted to. The seminar is available online in recorded format, as I describe in the open Substack below. And it is 50% off for the month of July. It is packed full of information. But I also offer these seminars in shorter lengths and tailored to communities and audiences. I will be delivering this in a very condensed workshop later this week. But check out this Substack article and if you are interested, take advantage of the 50% off code. I would be honored if I may be a help for you to defend yourself and your family. practivesecurity.substack.co…

A quick intro into the first book and some teasers about a bigger one to come. Available now: Practive Security 101 Coming soon: Countering the AI Revolution youtu.be/bYsUt74T2cw?is=Y8rU…

Hey. Pssst. You. Yeah, you. Listen up. Why are you here reading this when you could be reading in-depth analysis and learning strategically important things about online safety & security over at PractiveSecurity.com or on our Substack page? Don’t like reading? Well that’s ok, we have most presentations in audio or video format. Ok, now off you go. Go sign up. Just $5 a month to support our work, $10 to unlock all our Substacks, and $15 for our Essentials membership on our website. Oh, and if you really want to geek out, we have a pro subscription too. Boom. I know, I know…it’s so incredibly cheap, you’re probably wondering, “can it really be any good?” Well, it’s such a great deal you can sign up today and check us out for a month for just $15. Just $15 for a whole month!! But alas, I know what you are going to say: “I don’t need that stuff, I know what I’m doing.” Ok. Cool. Well, just to be sure I haven’t missed anything, why don’t you take our Personal Security Assessment and then you’ll know if I know all the stuff that you know. Then come tell me what I got wrong. Mkay? Mkay. Off with ya now - head on over to PractiveSecurity and hit the sign-up link to pick your cup of tea. One more thing. If you’ve got some extra time, our Digital Health seminar for parents is more loaded than a California style carne asada burrito. Oh, and tell your friends. All. Of. Them. Then tell your boss about our professional services. Thanks. You rock.