Peter C @itspeterc

Security Engineer Black Lives Matter peterc.ollins.me Washington, DC Joined November 2011

Tweets

801
Followers

1K
Following

601
Likes

44K

Florian Roth ⚡️ @cyb3rops

4 days ago

Cisco just confirmed that multiple zero-days against ASA/FTD VPN web services were exploited in the wild. CISA followed up with an Emergency Directive ordering federal agencies to inventory, patch, or disconnect affected devices. The last 3 Cisco advisories are directly tied to…

10 165 528 167K 229

Download Image

Phil Venables @philvenables

a week ago

Good CISO / Bad CISO. Explore the characteristics of each and see where your team can improve. Thanks to the collaboration on this post with @michaelaiello philvenables.com/post/good-ciso…

0 8 32 3K 10

Abi Raghuram @AbiCodeIntegrit

2 weeks ago

We got @NotionHQ to leak your private Notion pages 💀 On Thursday @NotionHQ announced Notion 3.0 with support for custom agents using MCP (built by @AnthropicAI) — powerful, but dangerous. @simonw calls these MCP related attacks the “lethal trifecta”: the combination of LLMs,…

27 104 634 386K 486

Download Image

Dirk-jan @_dirkjan

2 weeks ago

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-glob…

145 897 3K 436K 1K

Ivan Krstić @radian

3 weeks ago

🔺iPhone models announced today include Memory Integrity Enforcement, the culmination of an unprecedented design and engineering effort that we believe represents the most significant upgrade to memory safety in the history of consumer operating systems. security.apple.com/blog/memory-in…

54 502 3K 344K 966

Cloudflare @Cloudflare

4 weeks ago

A recent security issue announced by Salesloft has impacted many companies, including Cloudflare. This post provides a timeline of the attack, details our response, and offers security recommendations to help other organizations mitigate the effects of this attack.…

2 20 112 19K 29

Dino A. Dai Zovi @dinodaizovi

4 weeks ago

Over the years, I've made a conscious effort to always speak to the "why", even when not directly asked. If I'm providing a recommendation on what to do, I need to also say why I think it is right. If I'm explaining what something is, I need to also explain why it is significant.

2 3 25 4K 1

Zack Korman @ZackKorman

a month ago

Sorry cybersecurity mutuals, I really want to engage with your posts, but I have no idea what y’all are talking about half the time, and I just realized that’s because it’s about Windows. And sorry but I’m not learning that.

22 9 197 16K 17

Rami McCarthy @ramimacisabird

a month ago

* a thousand leaked Github tokens * dozens of npm tokens and cloud credentails * 20k files, identified by AI for exfiltration All spread publicly on Github by malware implanted in `nx` check out our blog for details: wiz.io/blog/s1ngulari…

1 9 28 2K 11

Matt Linton @0xMatt

2 months ago

If you are in a large org, The #1 most useful thing you can do in security when given a seemingly crazy task you have to accomplish, is go back down the chain and find the original requirement the task came from. Then read it carefully. 1/2

3 11 117 7K 17

Tim Willis @itswillis

2 months ago

That time when @tehjh was just reviewing a new Linux kernel feature, found a security vuln, then went on a journey to see if he could exploit it from inside the Chrome Linux Desktop renderer sandbox (spoiler: very yes) googleprojectzero.blogspot.com/2025/08/from-c…

0 50 135 22K 56

Michael Bargury @mbrg0

2 months ago

we hijacked microsoft's copilot studio agents and got them to spill out their private knowledge, reveal their tools and let us use them to dump full crm records these are autonomous agents.. no human in the loop #DEFCON #BHUSA @tamirishaysh

105 899 9K 1.2M 7K

Download Image

James Kettle @albinowax

2 months ago

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com

20 247 749 78K 338

Nir Ohfeld @nirohfeld

2 months ago

We (+@ronenshh) hacked NVIDIA's Triton AI server by abusing a single error message🚨 The result is unauthenticated RCE allowing attackers to compromise the server and steal proprietary AI models🤯 For more details & mitigations check out our blog @wiz_io wiz.io/blog/nvidia-tr…

4 61 232 21K 85

Download Image

neils @midwestneil

3 months ago

Turns out you can just hack any train in the USA and take control over the brakes. This is CVE-2025-1727 and it took me 12 years to get this published. This vulnerability is still not patched. Here's the story:

wetw0rk @wetw0rk7

3 months ago

5 45 410 276K 195

47 562 3K 318K 1K

Cloudflare @Cloudflare

3 months ago

Orange Meets, our open-source video calling web application, now supports end-to-end encryption using the MLS protocol with continuous group key agreement. cfl.re/45Cji79

2 10 79 25K 28

nullptrs @nullpt_rs

3 months ago

Breaking WebAuthn, FIDO2, and Forging Passkeys by @vmfunc nullpt.rs/forging-passke…

3 20 74 21K 32

Download Image

Chris Murphy 🟧 @ChrisMurphyCT

3 months ago

I was briefed on the intelligence last week. Iran posed no imminent threat of attack to the United States. Iran was not close to building a deliverable nuclear weapon. The negotiations Israel scuttled with their strikes held the potential for success.

5K 11K 43K 2.3M 2K

Luca Beurer-Kellner @lbeurerkellner

4 months ago

😈 BEWARE: Claude 4 + GitHub MCP will leak your private GitHub repositories, no questions asked. We discovered a new attack on agents using GitHub’s official MCP server, which can be exploited by attackers to access your private repositories. creds to @marco_milanta (1/n) 👇

46 493 2K 501K 2K

Download Image

Craig Gidney @CraigGidney

4 months ago

I'm often asked if I'll redo the 2019 quantum factoring estimate. Denser storage by yokes, smaller magic factories by cultivation, slimmer approx arithmetic by Chevignard et al… surely the cost is lower now? Yes, it's lower now. security.googleblog.com/2025/05/tracki… arxiv.org/abs/2505.15917