Pinned Tweet
In case you've missed it, we have a blog!
Every week, a Hunter Strategy expert shares their tips, opinions, and advice in an article.
These blog posts can help expand your knowledge and give you tools for success!
Read more here: medium.com/hunter-strategy
#blog #hunterstrategy #IT
Every week, a Hunter Strategy expert shares their tips, opinions, and advice in an article.
These blog posts can help expand your knowledge and give you tools for success!
Read more here: medium.com/hunter-strategy
#blog #hunterstrategy #IT
0
2
5
HunterStrategy retweeted
FBI, CISA warn of cyberattacks targeting refrigeration systems
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
11
17
57
12,218
Node2Shell KEV deadline is Tuesday.
"We updated the package" and "the running container uses the updated package" are two different sentences.
Somewhere, a ticket got closed on the first one.
"We updated the package" and "the running container uses the updated package" are two different sentences.
Somewhere, a ticket got closed on the first one.
0
0
0
20
HunterStrategy retweeted
Changing one letter bypassed an entire admin API in @huggingface chat.
One request could trigger bulk internal exports of every user’s private chats, completely unauthenticated.
Here’s how. 🧵
One request could trigger bulk internal exports of every user’s private chats, completely unauthenticated.
Here’s how. 🧵
29
126
1,439
141,159
A good culture won’t stop insider threats.
It just means someone notices the coworker with the new car, the loud grudge, and the sports gambling debt.
New This Is Fine on insider threat for SMBs: f.mtr.cool/zx4fxgvkgs
It just means someone notices the coworker with the new car, the loud grudge, and the sports gambling debt.
New This Is Fine on insider threat for SMBs: f.mtr.cool/zx4fxgvkgs
0
0
0
18
HunterStrategy retweeted
Cyberattack disrupts blood storage refrigeration systems in France www.bleepingcomputer.com/news/security/cyberattack-disrupts-blood-storage-refrigeration-systems-in-france/ #Security
1
5
13
1,658
HunterStrategy retweeted
Phishing-Resistant Isn't Enough; Yubico Takes Aim at Identity-Verification Gap www.darkreading.com/identity-access-management-security/beyond-phishing-resistant-yubico-identity-verification-gap
2
4
8
1,806
HunterStrategy retweeted
Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk securityweek.com/florida-studen…
2
2
3
1,843
Most-reported finding in LMG's 2026 internal pen tests: unpatched software (78% of tests).
How often it was on the path to domain takeover: 5%.
Meanwhile, Fall2026! is out here doing most of the work.
How often it was on the path to domain takeover: 5%.
Meanwhile, Fall2026! is out here doing most of the work.
0
0
0
17
HunterStrategy retweeted
In lieu of flowers, memorial contributions may be made to:
Johns Hopkins Alzheimer’s Disease Research Center Fund
alzresearch.org/giving/
Alzheimer’s Foundation of America Caregiver Resources
alzfdn.org/donate/
Photo Credit: Tommy Garcia
Johns Hopkins Alzheimer’s Disease Research Center Fund
alzresearch.org/giving/
Alzheimer’s Foundation of America Caregiver Resources
alzfdn.org/donate/
Photo Credit: Tommy Garcia
6,674
79,732
345,471
11,860,630
Adobe Campaign Classic
Vulnerable: 7.4.4
Fixed: 7.4.4
Check the build number. 9402 bad, 9403 good.
That's 1 of 5 ways remediation looks done before it is: f.mtr.cool/ieij72ilnr
Vulnerable: 7.4.4
Fixed: 7.4.4
Check the build number. 9402 bad, 9403 good.
That's 1 of 5 ways remediation looks done before it is: f.mtr.cool/ieij72ilnr
0
0
0
34
This week’s patch list is just the tools that manage, authenticate, and monitor everything else. Cool. Love that for us.
- HPE ArubaOS: 8 max-severity flaws, no credentials required
- Okta Access Gateway: CVE-2026-115547, fixed in 2026.10.2
- Splunk Enterprise + SOAR: critical SolarWinds Observability: CVE-2026-28328
If you patched Okta in September and feel good about it, that was a different bug.
- HPE ArubaOS: 8 max-severity flaws, no credentials required
- Okta Access Gateway: CVE-2026-115547, fixed in 2026.10.2
- Splunk Enterprise + SOAR: critical SolarWinds Observability: CVE-2026-28328
If you patched Okta in September and feel good about it, that was a different bug.
0
0
0
81
The internet spent last week on fire. So naturally, this week’s episode is about federal contracting.
It has its own fires: a product acquired out from under an agency mid-contract, fixed-price SOWs that turn a report tweak into a modification, and a HUBZone sole-source authority @trinertech has never once seen used.
Full disclosure: a small business podcast making the case for small businesses. We’re aware.
🎧 f.mtr.cool/xofaoi5v5j
It has its own fires: a product acquired out from under an agency mid-contract, fixed-price SOWs that turn a report tweak into a modification, and a HUBZone sole-source authority @trinertech has never once seen used.
Full disclosure: a small business podcast making the case for small businesses. We’re aware.
🎧 f.mtr.cool/xofaoi5v5j
2
0
1
35
HunterStrategy retweeted
Prompt of the day:
Split this "one-way door" PR into two:
1. A PR that implements everything, except it can be easily reverted (a two-way door)
2. A followup PR (stacked on top) that actually goes through the one-way door
AKA expand/contract. Use feature flags as needed.
---
Lets you de-risk a huge PR by testing large chunks of it in production first.
Split this "one-way door" PR into two:
1. A PR that implements everything, except it can be easily reverted (a two-way door)
2. A followup PR (stacked on top) that actually goes through the one-way door
AKA expand/contract. Use feature flags as needed.
---
Lets you de-risk a huge PR by testing large chunks of it in production first.
102
24
919
74,942
Railway’s advice to customers: rotate every key you’ve ever trusted us with.
Quest Diagnostics: someone got into the lab results portal. How many records, which ones, and how? ...TBD :)
“It’s hosted, so it’s their problem” is a great plan, right up until it’s YOUR keys.
Quest Diagnostics: someone got into the lab results portal. How many records, which ones, and how? ...TBD :)
“It’s hosted, so it’s their problem” is a great plan, right up until it’s YOUR keys.
0
0
0
32
A brief history of the #PHP2Shell embargo:
Tuesday afternoon: CVE IDs leak, with the wrong CVSS score for flavor.
Tuesday night: an exploit demo video gets posted by accident.
Wednesday morning: patched images ship 6+ hours before the coordinated release.
Somewhere a disclosure ce down on the floor.
Plan for patch windows the length of a lunch break.
Tuesday afternoon: CVE IDs leak, with the wrong CVSS score for flavor.
Tuesday night: an exploit demo video gets posted by accident.
Wednesday morning: patched images ship 6+ hours before the coordinated release.
Somewhere a disclosure ce down on the floor.
Plan for patch windows the length of a lunch break.
0
0
0
90