Green throughout, dad, runner. Tweets are my own.
London, UK
Joined February 2009
- Tweets5.5K
- Following556
- Followers550
- Likes14.8K
Meanbean retweeted
World-leading cardiac surgeon Asif Hasan was surrounded by the children who received the gift of life thanks to his unerring skills at the emotional climax of another memorable Pride of Britain ceremony. 🥹
Now 70 years old, Mr Hasan has just retired after 35 years of service at the Freeman Hospital in Newcastle upon Tyne, but just after receiving his Lifetime Achievement Award, he had an extra special surprise: a cast of patients who would not be alive without him. ❤️
Meanbean retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Meanbean retweeted
A firm I'm acquainted with accidentally deployed Defender EDR to the ENTIRE COMPANY (thousands of endpoints) in full enforcement and they DIDN'T NOTICE. They didn't even uninstall their old antivirus. It was fine. Not how I'd exactly do it, but stuff works way different now.
Meanbean retweeted
Whatever you think of Burnham's new pension policy (and it is pretty confusing) it in no way would "cut your pension".
It will still go up by either the rate of inflation or 2.5% a year, and sometimes by more.
Meanbean retweeted
I've seen a lot of Active Directory environments in the last 5+ years. These are some of the most dangerous issues I recommend reviewing and addressing in your environment.
Treat it like a check list.
If you have 0 of these, you're doing a great job.
Meanbean retweeted
If you thought the OpenAI Hugging Face incident would be a “warning shot” that convinces people of the risks of AI, you should know that it didn’t even convince most companies to monitor their AI agents.
Welcome to security.
Meanbean retweeted
Stop scrolling and watch this. (This is important.)
Zack Korman Just published one of the best opinion pieces I've seen on the OpenAI incident, and it reframes the whole thing as cybersecurity versus AI safety. [11/12] minutes. Worth every one of them.
No. Really - watch it. Give it a think. It's important. I need a bunch of people debating this. I have to think about this as well, but it needs to be debated.
My admission: I'd been meaning to figure out who METR actually is for over a week. It kept bugging me. Then I forgot and slid straight into assumption land. Nobody else was questioning them, so they must be qualified. (My internal skeptic apparently took the week off.)
Then this video. The number of questions it opened up for me felt like a punch in the face. I was so excited that a public incident report existed at all (credit where due; publishing one is still rare and still commendable) that I skipped the part where I interrogate whether the folks who wrote it took a single SANS class (or any class in cybersecurity)
If you work in incident response, if you work anywhere in cybersecurity, this should be required listening today. Watch it, then repost it and get it in front of your team.
We need some discourse on this. The cybersecurity insurance industry especially - are you ok with this too? Regulatory? The impacts cascade - and this is the only piece that does a wonderful job on the pitfalls that METR did on this. (And if there is a ton of discourse on this already - I'll admit that I must be focused on Openclaw 2.0 a bit that I've been distracted.)
Meanbean retweeted
Today, the @FBI and @TheJusticeDept announced the disruption of a global botnet used by Chinese state-sponsored group known as QTFY to target U.S. critical infrastructure.
Our investigation attributes QTFY to the Nanjing Xinjiuwei Network Technology Company, which sells stolen data and hacking services to Chinese military and intelligence agencies. Their services include a scanning platform that scours the internet for vulnerable smart devices—like home routers and security cameras—infects thousands of them, and feeds them into a botnet, or a network of machines secretly controlled by the adversary.
These platforms hide the origin of PRC-linked cyberattacks. Thanks to the work of @FBISanDiego, FBI Cyber Division, and partners at DOJ—we shut those platforms down 🔗justice.gov/opa/pr/justice-d…
Meanbean retweeted
If you have E5/Defender you're probably underutilizing Defender for Cloud Apps(MDA). Highly recommend Checking out Jays Repo for ideas, Use cases, short explanations. github.com/jkerai1/SoftwareC…
Meanbean retweeted
🚨New @BCG Centre for Growth/Centre for Energy Impact report out today🚨To Cut Electricity Bills, Britain Needs to Use More, Not Less.
Most of the energy bills debate is about what the system looks like in 2040. Important, but for the most part it doesn't solve the immediate cost challenge, nor the difficult path to our future system.
We've modelled every component of bills & system cost out to 2035. On current demand trends the typical household bill rises £264, to £1,145. The gap between that & what's achievable is £324 per household per year.
No single lever can achieve this. The key is getting more demand into the system over the medium term. But this requires bills to come down in the short term. We propose a mechanism to defer some costs off bills to help break the negative price/demand spiral Britain is in.
Thread 1/🧵
Meanbean retweeted
🟠 An Amber Heat-Health Alert is now in place until 9am on Friday 14 August.
Drink plenty of water, avoid the hottest part of the day where possible and check in on those who might struggle to keep cool - those with health conditions, older people, young children and babies.
ukhsa.blog.gov.uk/2026/06/23…
Meanbean retweeted
Well a whole business got accidentally onboarded to Defender MDE and they didn't even notice for weeks, so nice job to the Defender compat engineers...
Meanbean retweeted
There now follows a party election broadcast by the Count Binface Party, And if I do say so myself, it's a banger. #VoteBinface #Clacton
Listening to Lord Kinnock try to explain why borrowing money for defence isnt just borrowing more money and adding to the national debt for the young to pay back. No challenge from @SophyRidgeSky or @WilfredFrost #skybews