mastodon 4.8.0-alpha.3+glitchElder Millennial | 💼 Security Research & AI for Intelligence | I ask 'why?' a lot | Pro Oxford Comma | Fix it! | He/Him | #BLM | Views are my own.
Bittersweet yet exciting transition ahead. This week marks my last at GreyNoise.
Lately I've spent a lot of time thinking about what I value most in this field: research and findings grounded in clarity, integrity, actionability, and truth that drives outcomes.
It seems that CISA is, in fact, shortening the time-to-fix for vulns added to the KEV of late.
(Casual reminder that the KEV should not be used as "what we should patch" but it is a signal worth watching for awareness).
Big day! Today I start at Censys leading Applied AI, Intelligence (A²I²?). Threat hunting is getting a major upgrade with what we’re scheming. Stay tuned…
RE: @greynoise@infosec.exchange
My latest pet project, an RSS feed to alert you to the silent KEV knownRansomwareCampaignUse flips!
(Did you know there were four CVEs flipped last week?) #threatintel
RE: @kev_Stalker@infosec.exchange
So, based on my work of digging into the KEV Ransomware flips, the RSS feed will now auto-toot here, if interested. There was a flip Tuesday (before the bot) and another just now.
🍩 & #threatintel - Since its disclosure 11 days ago, 95% of the exploitation attempts of CVE-2026-20045, a critical vulnerability in Cisco Unified Communications Manager, have used a distinctive user-agent: Mozilla/5.0 (compatible; CiscoExploit/1.0) and are heavily targeted against our Cisco Unified Communications Manager (UCM) sensors.
We're tracking it here: https://viz.greynoise.io/tags/cisco-unified-communications-manager-input-validation-cve-2026-20045-rce-attempt?days=10
Appears to be from https://github.com/Ashwesker/Ashwesker-CVE-2026-20045
Excited to share that I've been asked to speak at the Minorities in Cybersecurity Conference this March!
I’ll be on a panel “How Do You Define Cybersecurity Experience? A Change in Perspective” where we’ll dig into what really counts as cybersecurity experience beyond job titles, traditional career paths, and gatekeeping checklists.
If you’re passionate about broadening who gets seen, heard, and valued in this field, attend and lets continue the conversation in person. https://www.mincybsec.org/annual-conference
This gif from the “you got paid today” email is 100/10
CISA's KEV hit 1,500 yesterday. I'm working on a cool #threatintel blog (yes, I'm biased) about additional hidden intel in KEV that should be published soon, along with a helpful tool hosted by GreyNoise! :)
Fun how MSFT doesn't share any identifiable information about what their scanning looks like. (https://internetscans.microsoft.com/). While it appears to be just a user agent, since it's spoofable, we can't mark it benign.
If anyone there wants to confirm the list of 240+ IPs we're observing/suspecting, LMK.
“Why is everything political?”
Because it is.
“Secretary of State Marco Rubio is apparently a serif fan: He ordered diplomats this week to return to using Times New Roman size 14 in official documents, overhauling a Biden-era change to the more modern-looking Calibri. The shift to Calibiri was aimed at increasing accessibility for people with reading challenges and those who use screen readers, but Rubio characterized it as a “wasteful” diversity, equity, inclusion and accessibility program. He said switching back would “restore decorum and professionalism to the department’s written work.”
- @MorningBrew@flipboard.com
RE: @kev_Stalker@infosec.exchange
Got one today.
It’s almost 2026 and I still can’t seem to find:
- an iOS calendar app I fully like (and that includes fantastical)
- a digital way of taking notes that fits my needs in the moment and later. The closest is the Agenda app for iOS/Mac.
Rideshare drivers: check engine light
Claude code: update available!
☕ & #threatintel - Two campaigns (100x spike!) are hitting Ivanti Connect Secure; one loud (34K sessions from Romania/Moldova), one stealthy (~6K distributed IPs). Both target a pre-exploitation endpoint for CVE-2025-0282. https://www.labs.greynoise.io/grimoire/2026-01-29-inside-the-infrastructure-whos-scanning-for-ivanti-connect-secure/
When the signal gets lost in the noise, you learn to tune into a new frequency. Sometimes change doesn’t ask; it hums beneath the static.
#TheSignalShift