Hopefully you listened when I said get your resumes ready. @GreyNoiseIO is hiring Threat Researchers who will develop and exploit first, second, and third-party access and sources to produce cyber threat intelligence that practitioners will use to detect, disrupt, and impose cost /t.co/bh6V84K6SN

On Watch

invadergirlart.com/products/on-wa…

This is the "model." AI-Enabled Experts.

It should be expected that on a longer timeline more potent exploits emerge, but that's not the point, and if you got multiple days to patch before that, you're counting your blessings in 2026++

This "cohort" term is the hottest garbage in AI generated threat intelligence outputs. Absolutely not. 😂

Accurately depicting ground truth about threats is the majority of the show for threat intelligence.

Is 70% of the world hacked? The only entity I've seen say they have confirmed successful exploitation in the wild said they found it at one victim, and then within hours revised the report to say zero.

Blessed on this flight leg; definitely not blessed on the second 😂. Had a great time with the company in Miami. Great place to work, great people, tech, and data.

I have been asked a few times recently if pulling down internet facing resources is an acceptable immediate action following nasty bug disclosures. The answer is it depends. Only downstream organizations can assess the risk. The value that my function provides is giving you the most accurate ground truth about the threat so that you can make an informed decision about what is and isn't acceptable risk given the trade offs you're facing.

Years ago I challenged our community to do a better job at characterizing exploitation "in the wild." There's lots of reasons for why, but the primary reason at the time is security researchers were using "in the wild" as the signal that it was low to no risk to publish offensive capability. "In the wild exploitation" at one victim in one country is not anywhere near the same "mass exploitation."

PHP2SHELL is a good example of where there are private exploits that are not publicly available, and there are less potent exploits that are, and there's mass exploitation *attempts* using these less potent exploits and they aren't really working in real scenarios relative to the volume of attempts. Does that matter? It does. It's bought a lot of time for down stream would be victims to put durable mitigations in place.

Accurately depicting ground truth about threats is the majority of the show for threat intelligence.

"The previous update (October 22 16:18 UTC) reported that Sophos observed successful exploitation of PHP2Shell in customer environments. Upon further analysis, we are correcting that assessment as Sophos customer telemetry shows scanning and a small number of failed exploitation attempts. As of this update, there is no evidence of a successful compromise due to these vulnerabilities." sophos.com/en-us/blog/pro…

An actor is attempting to exploit PHP2SHELL vulnerabilities in order to install patches. Interesting.

There are no bad bugs or leaked exploits; I'm at an offsite. Thank you for your attention in this matter.

So funny though.

Project Swarm from @GreyNoiseIO let's you get ground truth on exploitation in the wild. You can deploy your own honeypots to collect reconnaissance, exploitation, and post-exploitation artifacts. It's a dollar.

greynoise.io/project-swarm

The operative word is "attempt." There's a lot of observed attempts.

Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours. Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.

microsoft.com/en-us/security…

CISO talking to the CEO today:

"Nothing significant to report" (NSTR).

"We don't need your team to write rules anymore" (ha ha we can finally replace you with a machine, FINALLY)

"Hey so can we get you guys to start writing rules again please lol."