A leading provider of #offensivesecurity solutions & contributor to the #infosec community. #pentesting #hackinghttps://bsky.app/profile/bishopfox.bsky.socialhttps://bsky.app/profile/bishopfox.bsky.social/post/3mzdoyytzcl2aWhen a vuln hits the news, start with logs. They help identify how the threat might affect your systems. 5 steps: - separate noise - map targets - read failed probes - track repeats - use the pattern to guide stack and vendor decisions. #php2shell #vulnerabilities #InitialAccess02 Nov 2026 16:00 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mzdoyytzcl2ahttps://bsky.app/profile/bishopfox.bsky.social/post/3myuwi6fzge2iAI is changing healthcare (and how attackers target it!) Join experts from Moderna, BlueCross BlueShield of Tennessee, Holland & Knight, and Bishop Fox for a discussion on ransomware, AI adversaries, and protecting patient care. Nov. 10 | 3 PM ET27 Oct 2026 19:04 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3myuwi6fzge2ihttps://bsky.app/profile/bishopfox.bsky.social/post/3myufje3ezk2zOur Continuous Security Testing portfolio is expanding. Attack Surface Discovery, Attack Surface Testing, and Emerging Threat Testing are now available as standalone managed services or together. https://okt.to/8OxkQJ27 Oct 2026 14:00 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3myufje3ezk2zhttps://bsky.app/profile/bishopfox.bsky.social/post/3mysemkfqlt23Not every proof-of-concept exploit is what it claims to be. After the recent PHP disclosure, unofficial PoCs appeared almost immediately. Some were broken. Others may have been malicious or misleading. Sergio Villegas discusses the fallout on Initial Access.26 Oct 2026 18:39 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mysemkfqlt23https://bsky.app/profile/bishopfox.bsky.social/post/3myl35ps4nc2sYour conference room door is closed. But is the conversation actually private? @Alethe explores how physical penetration testing reveals gaps in access controls, visitor verification, and the detection of unfamiliar devices.23 Oct 2026 21:01 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3myl35ps4nc2shttps://bsky.app/profile/bishopfox.bsky.social/post/3myky3g2elv25How much is too much to disclose before a patch is available? Kendrick Urbaniak used AI agents to investigate the recent PHP demonstration. Within an hour, they'd narrowed down the bug. What if someone else's agents went further?23 Oct 2026 20:06 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3myky3g2elv25https://bsky.app/profile/bishopfox.bsky.social/post/3myigrkwcxv2gA successful red team engagement isn't just about getting the shell or opening the door. What did you learn along the way? @Alethe is delivering the keynote at BSides Peoria this Saturday, exploring what success really looks like in offensive security.22 Oct 2026 19:51 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3myigrkwcxv2ghttps://bsky.app/profile/bishopfox.bsky.social/post/3mydk5itjqy24Our Continuous Security Testing portfolio is expanding. Attack Surface Discovery, Attack Surface Testing, and Emerging Threat Testing are now available as standalone managed services or together. Get the coverage your security program needs.20 Oct 2026 21:08 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mydk5itjqy24https://bsky.app/profile/bishopfox.bsky.social/post/3mydfmmwxkq2zAre your medical devices actually isolated, or are you assuming they are? Shad Malloy explores that question and medical device patching myths at the Health-ISAC workshop on Oct. 22. Insights from 160+ Bishop Fox healthcare assessments.20 Oct 2026 19:47 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mydfmmwxkq2zhttps://bsky.app/profile/bishopfox.bsky.social/post/3mxzbalk5j726AI swarm attacks can burn millions of tokens in minutes. So how do attackers afford them? On Initial Access, Kendrick Urbaniak explains the surprisingly cheap AI token resale market and why its sophistication resembles malware marketplaces.16 Oct 2026 19:02 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mxzbalk5j726https://bsky.app/profile/bishopfox.bsky.social/post/3mxz5sfc3cq2lAI is accelerating vulnerability discovery. But how many new CVEs pose a realistic threat? Nate Robb and Bishop Fox TEA investigated four widely publicized Nginx vulnerabilities and found that all required uncommon configurations. The findings challenge some alarming headlines.16 Oct 2026 18:00 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mxz5sfc3cq2lhttps://bsky.app/profile/bishopfox.bsky.social/post/3mxwwqtdyr42zHow do you contain a ransomware attack when taking systems offline could disrupt patient care? Join experts from Moderna, Holland & Knight, and Bishop Fox on Nov. 10 to discuss AI threats, ransomware readiness, and healthcare security.15 Oct 2026 20:49 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mxwwqtdyr42zhttps://bsky.app/profile/bishopfox.bsky.social/post/3mxr6xqry3v2sResearch, offensive security, open-source tools, and the occasional ridiculous war story. We're growing r/BishopFox as a place for security practitioners to talk shop.13 Oct 2026 14:00 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mxr6xqry3v2shttps://bsky.app/profile/bishopfox.bsky.social/post/3mxp5lpv6cf2cSeeing command injection in a log doesn't prove code execution. On the latest Initial Access, Dillon Sparks discusses inflated vulnerability claims, unrealistic configurations, and why demonstrated impact matters when evaluating severity.12 Oct 2026 18:30 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mxp5lpv6cf2chttps://bsky.app/profile/bishopfox.bsky.social/post/3mxhtfkg2s62aSolarWinds ARM shipped with a shared authentication secret. An attacker who could reach TCP 55555 could bypass authentication and achieve SYSTEM-level RCE. @Jon Williams & the Bishop Fox TEA team reproduced CVE-2026-28326 and built a safe detector. The 8.8 score? It depends on your firewall.09 Oct 2026 20:39 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mxhtfkg2s62ahttps://bsky.app/profile/bishopfox.bsky.social/post/3mxetmmtvxh22¡Hoy tenemos taller en español! Samanta Aranda nos enseñará cómo aprovechar configuraciones incorrectas de CloudFormation para escalar privilegios en AWS. Un taller práctico sobre IAM, roles de servicio y rutas de ataque.08 Oct 2026 16:05 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mxetmmtvxh22https://bsky.app/profile/bishopfox.bsky.social/post/3mxepuu4wfy2aWho has the AI advantage right now? Evan Wolff says attackers. But as AI becomes embedded into everyday security tools, he expects defenders to start closing the gap.08 Oct 2026 14:58 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mxepuu4wfy2ahttps://bsky.app/profile/bishopfox.bsky.social/post/3mxa7k3u34x24Tomorrow at Ekoparty: iOS Game Hacking: From Zero to God Mode Luis De la Rosa & Steeven Rodríguez are taking over the Mobile Hacking Village with live reverse engineering, hooking, Infinite Coins, Speed Hacks and God Mode. Sala C2 2 PM ART https://bfx.social/4rR0oT606 Oct 2026 19:55 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mxa7k3u34x24https://bsky.app/profile/bishopfox.bsky.social/post/3mx7mwkqmgk24Happening today: Weaponizing CloudFormation Samanta Aranda is going hands-on with how attackers can turn limited IAM permissions and misconfigured CloudFormation roles into paths to more access.06 Oct 2026 14:22 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mx7mwkqmgk24https://bsky.app/profile/bishopfox.bsky.social/post/3mx5tlvyxj62p@Jon Williams gave an AI-powered vulnerability research lab raw UniFi firmware. It helped take the research all the way to a working unauthenticated exploit. This week at Ekoparty, Jon is demoing the takeover live and sharing where the AI worked and where it fell flat.05 Oct 2026 21:16 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mx5tlvyxj62phttps://bsky.app/profile/bishopfox.bsky.social/post/3mx5rllzx4t2rWhat does “no evidence of exploitation” mean when your telemetry couldn't distinguish legitimate access from abuse? Thomas Wilson breaks down the bigger lesson from the DC healthcare data exposure in the latest Initial Access.05 Oct 2026 20:40 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mx5rllzx4t2rhttps://bsky.app/profile/bishopfox.bsky.social/post/3mx5n6c2dko22http:// → blocked hTtp:// → private IP access Berenice Flores found two vulnerabilities in Zilliz Attu 2.6.5 that could be chained to reach internal services and, in a tested AWS EKS deployment, compromise the Kubernetes namespace. Upgrade to 3.0.0. https://bfx.social/4y26gdu05 Oct 2026 19:21 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mx5n6c2dko22https://bsky.app/profile/bishopfox.bsky.social/post/3mwvml4g7lt2uHappening next week: Weaponizing CloudFormation Samanta Aranda is going hands-on with how misconfigured CloudFormation execution roles can create paths to privilege escalation and persistence in AWS. Available on our site or in the Bishop Fox Discord server!02 Oct 2026 14:49 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mwvml4g7lt2uhttps://bsky.app/profile/bishopfox.bsky.social/post/3mwtrtt5kuy23Finding more vulnerabilities doesn't help much if you can't really tell what matters. Ori Zigindere explains CTEM and how continuous scoping, prioritization, validation, and remediation can turn an endless backlog into actual risk reduction.01 Oct 2026 21:18 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mwtrtt5kuy23https://bsky.app/profile/bishopfox.bsky.social/post/3mwofu6wfr42u🔴 And we’re live! Vinnie Liu, Justin Greis, and Evan Wolff are talking AI security, identity risk, and the cybersecurity priorities shaping 2027. Join the conversation: https://bfx.social/4hlCdbT29 Sep 2026 18:00 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mwofu6wfr42uhttps://bsky.app/profile/bishopfox.bsky.social/post/3mwm7rmgquz25Happening tomorrow at 2 PM ET. Vinnie Liu, Justin Greis, and Evan Wolff are getting together to talk AI security, identity risk, and the cybersecurity decisions organizations should be thinking about now as 2027 approaches.28 Sep 2026 21:06 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mwm7rmgquz25https://bsky.app/profile/bishopfox.bsky.social/post/3mwm75yyzgy2zAttackers can now build an AI team. Kendrick Urbaniak breaks down a campaign where different models were chosen for different jobs, using one for orchestration and others with looser restrictions for exploitation.28 Sep 2026 20:55 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mwm75yyzgy2zhttps://bsky.app/profile/bishopfox.bsky.social/post/3mweihjruaf2rThe questions that matter most in cybersecurity aren't always technical. Daniel Wallace of McKinsey explains why AI's shift to a non-deterministic world is changing how leaders think about risk, governance, and what actually deserves attention.25 Sep 2026 19:20 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mweihjruaf2rhttps://bsky.app/profile/bishopfox.bsky.social/post/3mwc2fbdxvx2eMost AWS attack paths begin with IAM permissions. At BSides Cleveland this Saturday, David Garlak explores what happens when you look beyond IAM and map attack paths across identity, network, and resource boundaries.24 Sep 2026 20:03 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mwc2fbdxvx2e