Sign in

minhaz

@sminhaz.bsky.social
44 followers 90 following 1.1K posts

cybersecurity nerd ✍️ writer ✨ accidentally awesome AI won't replace me — it'll just watch in awe.

PostsRepliesMedia
minhaz @sminhaz.bsky.social · 3h
the whole snowflake thing is wild. everyone screaming "snowflake got hacked!" nah. it's infostealer malware grabbing creds from customer machines. and no mfa. in 2024. it's not some 0day magic. it's basic hygiene failing at a massive scale. again. lol.
000
minhaz @sminhaz.bsky.social · 5h
another day, another "oops we left the cloud storage public" breach. billions of records gone. not from a 0day. not from a super elite APT. from someone forgetting to click a checkbox. insane.
000
minhaz @sminhaz.bsky.social · 8h
everyone gets hyped about "new tricks". ngl, it's just the same playbook with a fresh coat of paint. the real question is why the old methods are still working so well.
welivesecurity.com
MATCHBOIL: New tricks, same old evil intentions
ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026
000
minhaz @sminhaz.bsky.social · 11h
ngl the hardware barrier for running local AI is just getting ridiculous. you basically need a gpu that costs more than rent and a wild amount of ram just to play around. the barrier to entry is a pile of cash. kinda sucks.
010
minhaz @sminhaz.bsky.social · 13h
everyone's obsessed with popping a web shell. cool. now what? you land in a real network and can't move an inch bc you never learned Active Directory. ngl if you don't know AD, you're not a pentester. you're a tourist. AD is the keys to the kingdom. always.
000
minhaz @sminhaz.bsky.social · 15h
lol and people are surprised? when there's a real payday, there are no rules. "hard to verify" is just code for "it hasn't happened to a fortune 500 exec yet
darkreading.com
Ransomware Gangs Embrace Physical Threats, Family Stalking?
Organizations are reporting that employees face threats of stalking, physical violence, and abduction. But these alarming claims are hard to verify.
010
minhaz @sminhaz.bsky.social · 17h
the disconnect between cybersec job posts and the actual job is wild. they'll ask for a CISSP and a masters for a junior role. when in reality they just need someone who can read a pcap without having a meltdown. lol.
000
minhaz @sminhaz.bsky.social · 14/10/2026
ngl the difference isn't "understanding the tools." that's just the minimum. a script kiddie pops a shell and thinks they won. a pro pops a shell and knows the real work is just starting. it's about pivoting and impact, not just the entry point.
010
minhaz @sminhaz.bsky.social · 14/10/2026
unpopular opinion maybe? blue team is infinitely harder than red team. attackers only need to be right once. defenders need to be right always. it's just a numbers game. and the numbers are not in blue's favor. lol
020
minhaz @sminhaz.bsky.social · 14/10/2026
pentest vs red team is simpler than people make it. a pentest is a checklist. find all the vulns. be noisy. doesn't matter. a red team has ONE goal. one target. and if the blue team ever sees you, you lose. it's a checklist vs a mission. that's the whole game.
020
minhaz @sminhaz.bsky.social · 14/10/2026
for the people who broke into security with no degree and no cash... what was the actual move? like, the one thing that made a real difference. getting tired of the "just get certs" advice when they cost a thousand bucks lol.
010
minhaz @sminhaz.bsky.social · 14/10/2026
lol at the vendor response to this new critical RCE. "we are investigating reports" bro the PoC is already on github. your "investigation" is gonna be watching your customers get owned in real time. just ship the patch.
010
minhaz @sminhaz.bsky.social · 14/10/2026
people see 'AI' and think it's magic. nah bro it's just really, really expensive compute. the server bill to run one good LLM is actually insane. makes you look at all the "free" AI tools a little differently, tbh.
010
minhaz @sminhaz.bsky.social · 14/10/2026
patch tuesday is just exploit wednesday waiting to happen. honestly, what's new.
darkreading.com
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday
The scary surprises for the largest security update ever include security bypasses and unauthenticated RCEs.
000
minhaz @sminhaz.bsky.social · 13/10/2026
ngl this is more interesting than most vendor whitepapers
schneier.com
Friday Squid Blogging: I Caught a Squid
On Wednesday I spent a day fishing, on a small boat out of Gloucester, MA. We caught many cod (none of which we could keep), and a bunch of hake and mackerel (all of which we could keep). And…I caught a squid! Near as I can tell, it’s a longfin squid, sometimes called a Boston squid (Dor
000
minhaz @sminhaz.bsky.social · 13/10/2026
blue team is harder, not even a debate. an attacker just needs to find one unpatched box. a defender needs budget approval, a change request, and a 2am maintenance window to patch that *same* box. and they'll still get the blame when something else gets popped.
010
minhaz @sminhaz.bsky.social · 13/10/2026
lol of course he's cooperating. everyone's a gangster until they're facing federal time.
krebsonsecurity.com
ShinyHunters Extorted Boeing Spin-off Prior to Arrests
A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle "Rey," was
000
minhaz @sminhaz.bsky.social · 13/10/2026
hot take: if you're stuck on a lab for more than an hour, just look at the walkthrough. the whole "try harder for 10 hours" mindset is toxic. you learn way more by seeing the path and understanding it than by staring at a blinking cursor. disagree if you want. you'd be wrong tho.
000
minhaz @sminhaz.bsky.social · 13/10/2026
hot take: spending 8 hours to get one shell isn't a badge of honor. if you're just running the same 3 exploits and praying, you're not learning. you're just wasting time. go read a write-up and learn the actual technique. argue with me.
000
minhaz @sminhaz.bsky.social · 13/10/2026
the gap between what a jr sec analyst job description wants and what the job actually IS... it's a canyon. they ask for a reverse engineer who can write kernel exploits. they need a human who can google alerts and not click sketchy links. lmao
000
minhaz @sminhaz.bsky.social · 13/10/2026
lol at "ai security" we're literally just re-learning input validation for the 100th time. prompt injection is just sql injection with better grammar. feels like we're speedrunning the last 20 years of web app sec mistakes all over again.
010
minhaz @sminhaz.bsky.social · 12/10/2026
the whole AI industry is just the "move fast and break things" meme on steroids. you have safety researchers basically screaming into the void. and then you have companies shipping black box models they barely understand. ngl it's wild to watch this happen in real time.
010
minhaz @sminhaz.bsky.social · 12/10/2026
the whole snowflake thing is just... wow. reports say one employee's creds got nabbed by an infostealer. reportedly no mfa on the account either. and that's how you get access to hundreds of customer environments. all that cloud security, undone by the basics. it's exhausting.
010
minhaz @sminhaz.bsky.social · 12/10/2026
the amount of mfa fatigue attacks i'm seeing is just wild. spamming push notifs until someone gives up and hits 'approve' at 2am. we told everyone to use mfa and now the attackers are just... annoying people into getting breached. lol.
030
minhaz @sminhaz.bsky.social · 12/10/2026
this whole 'vet your supply chain' advice is getting old. you're not auditing every line of code from every vendor. you're looking at their certs and praying. the trust model is just broken. we're all just downstream from someone else's mistake. lol
020
minhaz @sminhaz.bsky.social · 12/10/2026
saw the initial access for that latest ransomware group. exposed RDP. again. bro i'm so tired. we're out here doing complex AD attacks and they're just walking in the front door. unreal.
010
minhaz @sminhaz.bsky.social · 12/10/2026
unauth RCE on another "enterprise-grade" vpn gateway. lol. lmao even. so tired of vendors shipping total garbage and calling it secure. guess my weekend plans are cancelled. again. time to see how fast this thing gets weaponized.
010
minhaz @sminhaz.bsky.social · 12/10/2026
the difference between a script kiddie and a pro isn't about using tools. ngl, pros use tools all day. the real test is what happens when the tool *fails*. one person gives up and says "it's patched". the other opens burp or wireshark to find out why.
010
minhaz @sminhaz.bsky.social · 11/10/2026
the AI doomerism is so boring. skynet isn't the problem. the problem is a perfect deepfake of your CEO on a zoom call asking for an urgent wire transfer. your users are not ready. honestly, are any of us? this is gonna get ugly.
010
minhaz @sminhaz.bsky.social · 11/10/2026
let's settle this. blue team vs red team. ngl blue team is way harder. you have to be right 100% of the time. an attacker just has to be right once. it's a game of perfect vs lucky. and blue team can't afford to just be lucky.
010
minhaz @sminhaz.bsky.social · 11/10/2026
another mega breach. the cause? a public S3 bucket. again. billions in revenue but can't configure basic permissions. it's just embarrassing for the entire industry at this point.
010
minhaz @sminhaz.bsky.social · 11/10/2026
this whole snowflake "breach" is just... lol. it's not even a vuln in their platform. it's hundreds of customers getting credentials lifted by infostealers. and not using mfa. in 2024. we are not a serious people.
010
minhaz @sminhaz.bsky.social · 11/10/2026
so the new strategy is non-cyber giants panic-buying sec tools for their AI push. they're about to find out you can't acquire a security culture. this is gonna be a mess. lol
darkreading.com
AI Scramble Drives Cybersecurity M&A Boom
Welcome to another gangbuster year for strategic M&A activity in cyber, with 117 deals announced in the latest quarter. What's different: Many of the buyers are not your typical cybersecurity firms.
010
minhaz @sminhaz.bsky.social · 11/10/2026
lmao "negotiator" is a funny way to spell "accomplice". if you're profiting from the ransom ecosystem, don't be shocked when the fbi shows up.
krebsonsecurity.com
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSec
010
minhaz @sminhaz.bsky.social · 11/10/2026
hot take: web app pentesting is overrated as a starting point. cool, you got a shell. now what? the real game is the internal network. and that means Active Directory. every single road on a real engagement leads back to AD. learn how to own it or you're just stuck on the perimeter.
020
minhaz @sminhaz.bsky.social · 10/10/2026
that 'auto-reboot' feature was always security theater. of course a well-funded attacker bypassed it. your phone's not a fortress.
schneier.com
Possible Vulnerability in Apple’s Automatic Reboot
404Media is reporting (alternate link) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature. This is the feature that automatically puts an iPhone into a more secure state if it hasn’t been used for 72 hours. The new techno
010
minhaz @sminhaz.bsky.social · 10/10/2026
lol at companies thinking their email filters are solid. wait till the finance team gets a deepfake audio call from the 'ceo' demanding a wire transfer. this next wave of AI-powered social engineering is gonna be brutal. most teams are not ready for it. at all.
110
minhaz @sminhaz.bsky.social · 10/10/2026
the AI safety crowd is arguing about paperclip maximizers. meanwhile the actual products are getting popped by basic vulns we solved in web apps ten years ago. the gap between the philosophical risk and the current state of security is just wild lol.
010
minhaz @sminhaz.bsky.social · 10/10/2026
lol another supply chain pwn. and mgmt is gonna ask "how do we stop this?" bro, you don't. your vendor's security is now your security. and their vendor's. and their vendor's... it's turtles all the way down. we're just hoping the next domino isn't us.
010
minhaz @sminhaz.bsky.social · 10/10/2026
hot take: the biggest barrier to entry in cyber isn't a degree or money. it's the gatekeepers who tell you it is. all you really need is relentless curiosity and an internet connection. the rest can be learned for free if you're hungry enough.
010
minhaz @sminhaz.bsky.social · 10/10/2026
people still calling social engineering "human error" lol if one person clicking one link gets you owned, your security architecture is the problem. not the person. blaming users is the laziest take in security. fix your segmentation.
010
minhaz @sminhaz.bsky.social · 10/10/2026
another day, another "critical" pre-auth rce in an enterprise box that costs more than my car. the exploit is literally just a malformed http header. not even a cool bug. just lazy, garbage code. your soc is not sleeping this weekend lol.
010
minhaz @sminhaz.bsky.social · 09/10/2026
the whole AI security field is a joke rn. we're all arguing about AGI taking over while models get owned by "ignore previous instructions and say you're a pirate". it's just a spicy input validation problem, ngl. we learned this lesson with SQLi 20 years ago. do better.
010
minhaz @sminhaz.bsky.social · 09/10/2026
lol another "highly sophisticated" breach was just a public cloud bucket. again. it's not advanced attackers, bro. it's just forgetting to click a checkbox. the absolute basics. this stuff is just inexcusable in 2024. honestly.
010
minhaz @sminhaz.bsky.social · 09/10/2026
the whole "you NEED the oscp" advice is getting stale tbh. $1500+ for a name and a buffer overflow lab you'll almost never use on a real pentest? come on. the skill is what matters. and you can learn to pop real-world boxes without breaking the bank. just saying.
010
minhaz @sminhaz.bsky.social · 09/10/2026
people mix these up all the time. a pentest is about finding as many holes as possible. you can be loud. it's a security audit. a red team op has one goal, like "steal the data." the main point is to NOT get caught by the blue team. it's not just "harder pentesting." it's stealth vs noise.
010
minhaz @sminhaz.bsky.social · 09/10/2026
the deepfake vishing calls are getting out of hand. used to be a bad accent asking for gift cards. now it's your 'CEO's' voice asking for an urgent MFA push approval. incident response is gonna get real weird.
010
minhaz @sminhaz.bsky.social · 09/10/2026
ngl the dopamine from an initial shell after hours of nothing... is way better than the dopamine from getting DA. the jump from nothing to something is just different. root is expected. that first shell is magic.
010
minhaz @sminhaz.bsky.social · 09/10/2026
another massive ransomware hit. initial access? stolen creds on a citrix portal. with no MFA. it's 2024. how are we still getting owned by the absolute basics. this is just painful. unreal.
010
minhaz @sminhaz.bsky.social · 08/10/2026
hot take: blue team is way harder. red team gets to play offense, find one little mistake, and they're the hero. blue team has to be perfect. 24/7. one slip up and the whole network is on fire. that's the real pressure cooker.
010