🚨 We've released a 4th network room After all that enumeration, we are finally ready to start exploitation of the TryHackMe domain! Exploits in store: 🔴 ACL exploits 🔴 Kerberos Delegation 🔴 AD Certificates, Golden Tickets & many more! tryhackme.com/room/exploitin…

🖥️Monitoring Secure Boot Certificates with KQL Windows devices that rely on Secure Boot certificates issued in 2011 will reach their expiration in June 2026. The clock is ticking — defenders need to act now to avoid surprises when certificates lapse. With the KQL query below, you can quickly identify your fleet of Microsoft Defender for Endpoint (MDE) devices whose Secure Boot certificates are set to expire, giving you visibility and time to plan remediation before the deadline hits. DeviceTvmSecureConfigurationAssessmentKB | where ConfigurationName == @"Ensure devices are updated to Secure Boot 2023 certificates and boot manager" | join DeviceTvmSecureConfigurationAssessment on ConfigurationId | where IsCompliant == false #Cybersecurity #DefenderXDR #SecureBootCertificates

The first ever fully functional, supremely accurate, wearable 1:1 replica of the Pip-Boy 3000 as used in Fallout 3 and Fallout New Vegas. Preorder now on the IGN Store: bit.ly/3YHUMwx

Iets talk about ai data processing and vulnerability research. I understand this challenge quite well, it comes down to compliance, risk and data processing, but I find it exponentially harder to avoid any kind of third party processing in today’s age, let’s say one uses Google Docs to keep notes or write a report and use gemeni for spell checking, or use slack, windows, a modern ide, or even perform a search, etc. etc, they all have ai features and telemetrics enabled and built in. When it comes to data processing using ai the end user can in some cases control this by having an enterprise agreement with zero logging and zero data retention activated on ex Claude code. But it comes at a much higher price tier, and I highly doubt most will adapt to that setup. Then we have the fact that most foundation models live in the us. Which have its own complications. This it’s definitely a question I have pondered and not 100% sure on how to solve or even avoid. My approach is to guard the data as much as I can with the knowledge I have and use services where I can opt out from training and be selective with what I process and how and use local Models for some task. But tbh I think it’s a conversation of the past. If the thing you are processing have been in the internet (public facing) then it’s already in the datasets. And is code or vulns even IP these days? when more and more teams produce code on the fly. What are your opinions? can we solve this?