Ex-Microsoft PM | Tweets my own Built → https://xitter.cf/t.co/QbUp63ffXf • https://xitter.cf/t.co/8W7yvQi3jb • https://xitter.cf/t.co/NFLDqDIY8h • https://xitter.cf/t.co/tSWrIw8Ajh 📰 Newsletter→ https://xitter.cf/t.co/tPzAEl0Zuq & https://xitter.cf/t.co/894nfObWuU 🎙️ Podcast→ https://xitter.cf/t.co/TBlNKTzn8t
Melbourne, Australia
Joined March 2007
- Tweets16.5K
- Following4.1K
- Followers21.3K
- Likes33.9K
Pinned Tweet
Why did I leave Microsoft?
To work full time on 🔥 Maester.
Over 40,000+ tenants today rely on Maester to monitor their tenants daily.
I wanted to make sure that the tests they are running continue to be relevant and evolve as Microsoft 365 and the security landscape evolves.
So today I'm announcing the launch of Maester.Cloud
Maester Cloud is the portal companion to Maester that lets you track your results over time. It is multi tenant, runs in your cloud (or ours) and more → check out the site for all the features.
More importantly Maester Cloud is a way for me to fund the continued development of the open source Maester core and the tests in Maester.
That is our mission. In fact I worked with the core team @fabian_bader , @Thomas_Live , @MySnozzberries and @SamErde to create the Maester Manifesto (maester.cloud/manifesto). It is our promise to the community.
If you value Maester and would like to support and ensure that Maester continues to grow and be healthy, I would be beyond thrilled if your organisation can sponsor this effort.
I would also appreciate it very much if you can share this post with your network to spread awareness.
Thanks!
ALT Screenshot of Maester Cloud
Merill Fernando retweeted
Two critical remote code execution bugs this week: PHP2Shell, GitLab (CVSS 10). Patch them first.
But patch night isn't the end of it. When an app server gets popped, attackers often drop a webshell and look around. There's a high chance they're looking for Active Directory, because once they own AD they own pretty much everything else.
There's more than one way an app server can hand AD to an attacker:
1. LDAP sign-in. The app usually keeps a bind account in its config, and every password a user types passes through the app in clear text before it's checked.
2. AD service accounts, with the password in a config file or connection string.
3. Domain-joined servers, which can hold the credentials of admins who sign in interactively.
4. Unconstrained Kerberos delegation, which captures the tickets of users who connect.
5. And most of them need a network path to your domain controllers.
The long-term fix is to take these apps off AD and modernise how they authenticate, wherever you can:
- Move sign-in to Entra ID with OpenID Connect or SAML. The app gets a signed token, never a password, and Entra handles MFA, passkeys and Conditional Access. GitLab supports this today.
- Use managed identities or workload identity federation instead of passwords in config.
- Publish legacy Kerberos apps through Entra Private Access with Kerberos SSO.
- Remove the bind accounts you no longer need and firewall these servers off from your DCs.
The hard part is finding them. PHP hides inside intranet portals, help desks, wikis and appliances, often as an embedded runtime nobody owns. Defender for Identity flags services sending LDAP credentials in clear text, and Private Access application discovery shows which private apps people actually use.
None of this fixes the bugs. Patching does. But next time an app gets popped, it's a bad day for that app, not for your whole domain.
The video includes clips from Tarek Dawoud (Microsoft Security) and @richardhicks from past Entra.Chat episodes.
This is true 👇
There's a lot of opportunity in the coming years to finally fix all those legacy apps with the use of AI.
Migrating legacy code was almost impossible before, now with AI and coding agents its achievable.
xitter.cf/levie/status/211313703…
Two critical remote code execution bugs this week: PHP2Shell, GitLab (CVSS 10). Patch them first.
But patch night isn't the end of it. When an app server gets popped, attackers often drop a webshell and look around. There's a high chance they're looking for Active Directory, because once they own AD they own pretty much everything else.
There's more than one way an app server can hand AD to an attacker:
1. LDAP sign-in. The app usually keeps a bind account in its config, and every password a user types passes through the app in clear text before it's checked.
2. AD service accounts, with the password in a config file or connection string.
3. Domain-joined servers, which can hold the credentials of admins who sign in interactively.
4. Unconstrained Kerberos delegation, which captures the tickets of users who connect.
5. And most of them need a network path to your domain controllers.
The long-term fix is to take these apps off AD and modernise how they authenticate, wherever you can:
- Move sign-in to Entra ID with OpenID Connect or SAML. The app gets a signed token, never a password, and Entra handles MFA, passkeys and Conditional Access. GitLab supports this today.
- Use managed identities or workload identity federation instead of passwords in config.
- Publish legacy Kerberos apps through Entra Private Access with Kerberos SSO.
- Remove the bind accounts you no longer need and firewall these servers off from your DCs.
The hard part is finding them. PHP hides inside intranet portals, help desks, wikis and appliances, often as an embedded runtime nobody owns. Defender for Identity flags services sending LDAP credentials in clear text, and Private Access application discovery shows which private apps people actually use.
None of this fixes the bugs. Patching does. But next time an app gets popped, it's a bad day for that app, not for your whole domain.
The video includes clips from Tarek Dawoud (Microsoft Security) and @richardhicks from past Entra.Chat episodes.
Remember when we used to say Mythos was a marketing stunt by Anthropic, Microsoft and crew.....?
Good times
Two critical remote code execution bugs this week: PHP2Shell, GitLab (CVSS 10). Patch them first.
But patch night isn't the end of it. When an app server gets popped, attackers often drop a webshell and look around. There's a high chance they're looking for Active Directory, because once they own AD they own pretty much everything else.
There's more than one way an app server can hand AD to an attacker:
1. LDAP sign-in. The app usually keeps a bind account in its config, and every password a user types passes through the app in clear text before it's checked.
2. AD service accounts, with the password in a config file or connection string.
3. Domain-joined servers, which can hold the credentials of admins who sign in interactively.
4. Unconstrained Kerberos delegation, which captures the tickets of users who connect.
5. And most of them need a network path to your domain controllers.
The long-term fix is to take these apps off AD and modernise how they authenticate, wherever you can:
- Move sign-in to Entra ID with OpenID Connect or SAML. The app gets a signed token, never a password, and Entra handles MFA, passkeys and Conditional Access. GitLab supports this today.
- Use managed identities or workload identity federation instead of passwords in config.
- Publish legacy Kerberos apps through Entra Private Access with Kerberos SSO.
- Remove the bind accounts you no longer need and firewall these servers off from your DCs.
The hard part is finding them. PHP hides inside intranet portals, help desks, wikis and appliances, often as an embedded runtime nobody owns. Defender for Identity flags services sending LDAP credentials in clear text, and Private Access application discovery shows which private apps people actually use.
None of this fixes the bugs. Patching does. But next time an app gets popped, it's a bad day for that app, not for your whole domain.
The video includes clips from Tarek Dawoud (Microsoft Security) and @richardhicks from past Entra.Chat episodes.
For those running apps on @Railway and affected by their breach (you should have an email)
Use your agent to do a quick review of all the keys that need to be rotated.
Merill Fernando retweeted
One-click mitigation for php2shell vulnerability:
If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected.
dash.cloudflare.com/?to=/:ac…
This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.
Entra ID is on the internet anyone can hack it.
AD is safe because we're behind a firewall, so its okay if we open all our ports to all the internal servers...
Zero Trust boys.
You are just one zero day away from all the internet facing endpoints that connect to your AD.
If you think there aren't PHP servers connecting with line of sight to your DC I have a bridge to sell.
Fact is Entra ID is on the internet 24x7 and its still standing. Because that is how modern identity works.
Merill Fernando retweeted
Reposting this from my own comment so you all see it. Re: PHP patch today.
Context (Cloudflare built in protection) from staff.
You can get cloudflare for your WordPress or regular site for free.
cloudflare.com/plans/free/
Not sure if the free plans offer deanonymized IPs in logs but they are one of the only providers which has it, organically, meaning you don't have to toggle something on to see it and that helps with IR.
The user interface is very easy to use and on each page under the title of each page is a white button which has the help article for that section and all help documentation is written beautifully and simply. No nonsense.
Just as an aside.
I am adding this but if you have WordPress you do need a WAF.
The .htaccess page isn't going to cut it.
The plugins and themes are exploited constantly. I just wrote a report a couple weeks ago about a website I found which had its Elementor plugin compromised with poisoned SEO links.
CF would've caught it.
Just when reading the analytics in certain places like with the bot score the lower the score the higher the probability the agent was a bot whereas if you're not familiar with this format you're going to think if you see 100% that it is a bot when that just means it's likely human.
Ok
Enough of that.
Get on the PHP thing today.
DEPLOY COUNTERMEASURES!
Sorry not to be dramatic but I always just wanted to say that. 😎
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Merill Fernando retweeted
💣 Did you opt-out of Entra ID's SMS retirement rollout in Sept?
Your time is running out. The good news is @NathanMcNulty has the fix to help you get ready for the Feb 2027 deadline.
Link to Nathan's GitHub script below.
Merill Fernando retweeted
I think I have a good analogy for what's about to happen in cyber.
It's pitch dark. Always has been. And the world is dilapidated buildings and rats and maggots and other creepy-crawlies. The whole world.
And we just invented flashlights.
Merill Fernando retweeted
Hello My Friends,
I wanted to remind everyone, that hasn't signed up yet for our event, @wpninjasus 2027 in Scottsdale, that you have 2 weeks left on Early Bird.
Also, only about 30 rooms left on the main hotel (we have an overflow hotel so don't worry there).
This event is going to be huge, and even bigger than Dallas was.
If you've been looking for an event that understands #ITPros and actually caters to what you want, this is your event.
We balance mental health, inclusion, mentoring, technology, and just having fun. It's going to be special and we have so many things we haven't even announced yet.
If you need help convincing your boss, connect and message me, I CAN HELP!
If you want to discuss things you haven't liked with other events, and things you want to see, connect with me. We pledge to addressing 100% of feedback EVERY. SINGLE. YEAR. No one else can make that claim, because you are our family and we GOT you.
Register now and check out the best collection of speakers that Microsoft community has to offer:
web.cvent.com/event/a9994d6b…
#Community #Microsoft #Mentoring #MSIntune
Happy Wednesday Everyone!!
A few key things we want to mention today:
⏳ Two weeks left on our Early Bird pricing of $650 for 3 action packed days at the gorgeous Scott Resort and Spa for #WPNinjasUS 2027
🏨 30 Hotel Packages/Rooms remain at the Scott!! Don't worry we rooms as well at the overflow across the street at Embassy Suites as well!
⏰ 82 Days left until things kickoff in Scottsdale!!
🚧 We continue working hard, building value, and creating experiences for all of you. Things are heating up and people are READY!! Come and join us!
Register now: workplaceninjas.us
@wpninjasus @Microsoft @MSIntune @IntuneSuppTeam
#WPNinjasUS #WPNinjaS #MSIntune #ITPros #Community #MSEntra #MSSecurity #DefenderXDR #ConfigMGR #Copilot #AI #Automation #PowerShell #Microsoft #Azure #AzureVirtualDesktop #Windows365
💣 Did you opt-out of Entra ID's SMS retirement rollout in Sept?
Your time is running out. The good news is @NathanMcNulty has the fix to help you get ready for the Feb 2027 deadline.
Link to Nathan's GitHub script below.
Watch the full podcast at → entra.news/p/operational-gro…
Repo → github.com/nathanmcnulty/nat…
If you want a short 7 edu-tainment minute walk through of this and other awesome tips from Nathan check out → youtu.be/kA-DsNR7pEc
Merill Fernando retweeted
Digital sovereignty ≠ putting everything back on-premises.
And data location ≠ data security.
With #AI and agents, #sovereignty becomes a workload decision
Sovereignty is becoming architecture.
Architecture is becoming governance. blogs.microsoft.com/blog/202…
