A leading provider of #offensivesecurity solutions & contributor to the #infosec community. #pentesting #hackinghttps://bsky.app/profile/bishopfox.bsky.socialhttps://bsky.app/profile/bishopfox.bsky.social/post/3mj65z5jhv22iICYMI: FortiClient EMS Auth Bypass (CVE-2026-35616) Unauthenticated attackers can bypass cert-based auth via header spoofing + weak validation. Exploitation confirmed in the wild. Patch now or upgrade to 7.4.7. We also released a safe detection tool: https://bishopfox.com/blog/api-authentication-bypass-in-forticlient-ems-7-4-5-7-4-6-cve-2026-3561610 Apr 2026 20:29 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mj65z5jhv22ihttps://bsky.app/profile/bishopfox.bsky.social/post/3mj36znj4a227The Axios supply chain attack is a reminder that trusted software can still introduce risk. Malicious package versions were distributed through normal install workflows, leading to remote access and potential compromise.09 Apr 2026 16:09 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mj36znj4a227https://bsky.app/profile/bishopfox.bsky.social/post/3miyuwruz2k2c🔴 LIVE NOW Social engineering isn’t just phishing anymore. It's evolved to deepfakes, voice cloning, and real-time impersonation. Join Senior Security Consultant II @alethe.bsky.social in Tactics of Deception: Protecting Trust and Purpose: https://bishopfox.com/resources/tactics-of-deception-protecting-trust-and-purpose08 Apr 2026 18:04 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3miyuwruz2k2chttps://bsky.app/profile/bishopfox.bsky.social/post/3miwnqdgakk2qA fake Zoom call. A quick “update.” And the user does the rest.07 Apr 2026 20:49 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3miwnqdgakk2qhttps://bsky.app/profile/bishopfox.bsky.social/post/3mim2fdviwc2lPart 1 gave the foundation. Part 2 goes deeper. Inside Cirro: Schemas and Extensible Identity Graphs April 7 | 2 p.m. ET Leron Gray breaks down how Cirro approaches extensibility and identity risk at scale. Register: https://bishopfox.com/resources/workshop-series-cirro03 Apr 2026 15:37 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mim2fdviwc2lhttps://bsky.app/profile/bishopfox.bsky.social/post/3mierfhldgc26🔴 Happening now: Mapping Attack Paths in Azure We’re live with Part 1 of our Inside Cirro workshop. If you’re looking to better understand how identity, roles, and resources connect and how attack paths actually form in Azure join us now. You can still jump in: https://bishopfox.com/resources/workshop-series-cirro31 Mar 2026 18:07 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mierfhldgc26https://bsky.app/profile/bishopfox.bsky.social/post/3micgqdqpnc27Happening Tomorrow: Mapping Attack Paths in Azure In Part 1 of our Inside Cirro workshop series, Leron Gray walks through how graph-based modeling helps uncover: • Attack paths • Privilege propagation • Identity-driven risk in Azure and Entra ID30 Mar 2026 19:51 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3micgqdqpnc27https://bsky.app/profile/bishopfox.bsky.social/post/3mhyh7z3pck2bWe’re launching a new open-source tool, Cirro, along with a two-part workshop series on how it works! The sessions cover mapping attack paths in Azure and modeling identity relationships to better understand risk. March 31 & April 7 | 2 p.m. ET26 Mar 2026 20:33 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mhyh7z3pck2bhttps://bsky.app/profile/bishopfox.bsky.social/post/3mhyecteqyc2b🚨 New research from Bishop Fox: CVE-2026-25075 An integer underflow in strongSwan’s EAP-TTLS parser allows unauthenticated attackers to crash VPN services. The vulnerability affects versions going back over 15 years. Upgrade to 6.0.5 or disable EAP-TTLS.26 Mar 2026 19:41 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mhyecteqyc2bhttps://bsky.app/profile/bishopfox.bsky.social/post/3mht6j3qsd22j🔴 Now Live The Role of AI in Modernizing Enterprise Application Security How do you scale security testing across complex enterprise environments? Join Zach Moreno as he breaks down how AI is helping teams expand coverage without sacrificing depth. https://bishopfox.com/resources/the-role-of-ai-in-modernizing-enterprise-application-security24 Mar 2026 18:14 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mht6j3qsd22jhttps://bsky.app/profile/bishopfox.bsky.social/post/3mhgszibnu22z“If I found an iOS exploit… I might just sell it and retire.” iOS exploits are rare, expensive, and usually not something you just stumble across. Leron Gray & Thomas Wilson on: • why iOS is harder to exploit • who typically has access • the tradeoff between security & openness19 Mar 2026 20:16 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mhgszibnu22zhttps://bsky.app/profile/bishopfox.bsky.social/post/3mh22j5fie223Some puzzles take time. Happy Pi Day from Bishop Fox 🥧14 Mar 2026 18:26 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mh22j5fie223https://bsky.app/profile/bishopfox.bsky.social/post/3mgskoidk4c26Bishop Fox will be well represented at #HackGDL this week! Our team is presenting research and workshops on cloud security, hardware hacking, application security, reverse engineering, and career growth in cybersecurity. https://bishopfox.com/events/bishop-fox-at-hackgdl-202611 Mar 2026 18:54 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mgskoidk4c26https://bsky.app/profile/bishopfox.bsky.social/post/3mgpvmyfq4k2aAI agents inside developer environments introduce a new trust question: How much autonomy should they actually have? In this clip, Shad Malloy explains why applying least autonomy to agents may be the safest approach, essentially extending the idea of least privilege to AI systems.10 Mar 2026 17:32 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mgpvmyfq4k2ahttps://bsky.app/profile/bishopfox.bsky.social/post/3mgg5mpgzfk24Introducing CloudFox GCP A new extension of CloudFox designed to help practitioners assess Google Cloud environments from an attacker’s perspective. Now on GitHub: https://bishopfox.com/blog/introducing-cloudfox-gcp-attack-path-identification-for-google-cloud06 Mar 2026 20:28 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mgg5mpgzfk24https://bsky.app/profile/bishopfox.bsky.social/post/3mgdh6izfac2dEnterprise application portfolios are bigger and more complex than ever. But most testing models were built for a much smaller world. Join our session with Zach Moreno on how AI-assisted testing can help security teams scale coverage across modern enterprise environments. March 24 | 2 p.m. ET05 Mar 2026 18:41 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mgdh6izfac2dhttps://bsky.app/profile/bishopfox.bsky.social/post/3mganf5lv3c26Most underrated engineering principle? YAGNI. If you’re building for a future that doesn’t exist yet, you’re adding complexity. From our recent tool building workshop on Discord.04 Mar 2026 15:54 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mganf5lv3c26https://bsky.app/profile/bishopfox.bsky.social/post/3mfrioz6rrc2rSmart TVs are part of your attack surface. We identified an arbitrary command injection issue in Samsung Tizen OS (through 9.0) that allows OS-level command execution in developer mode. Details: https://bishopfox.com/blog/samsung-tizen-os-version-through-9-026 Feb 2026 15:20 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mfrioz6rrc2rhttps://bsky.app/profile/bishopfox.bsky.social/post/3mfmwd2rr422uAI risk doesn’t behave like traditional software risk in that: It’s probabilistic. It’s supply-chain dependent. It’s difficult to fully enumerate. In this clip from our AI & Security Risks panel, @kriskimmerle.bsky.social of RealPage, Inc. breaks down why governance needs a different framing.24 Feb 2026 19:41 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mfmwd2rr422uhttps://bsky.app/profile/bishopfox.bsky.social/post/3mfknrt4f7s2xBot traffic spikes on a ghost website. It's a weird headline. But the real defender question is: When you see activity in one area, is that the target or the distraction? From the latest Initial Access with Dan Petro and Justin Greis of acceligence.23 Feb 2026 22:03 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mfknrt4f7s2xhttps://bsky.app/profile/bishopfox.bsky.social/post/3mfakycbag225Christie Terrill (CISO, Bishop Fox) will speak at the Official Cybersecurity Summit on how diversity strengthens cybersecurity teams, improving innovation, threat detection, and long-term resilience. Complimentary registration with code CSS26-FAIR. Up to 8 CPE credits. Feb. 25 | New York19 Feb 2026 21:46 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mfakycbag225https://bsky.app/profile/bishopfox.bsky.social/post/3mf3dh2jnjc22Good step for RCS security! We've got a ways to go still, but this is progress. [contains quote post or other embedded content]17 Feb 2026 19:48 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mf3dh2jnjc22https://bsky.app/profile/bishopfox.bsky.social/post/3mf325ioy3s2bIf you’ve ever wondered why AppSec coverage never seems to catch up with reality, this is a good read. At its core, it's an operating model problem. This post by Principal Technology Strategist Rob Ragan walks through why most apps never get tested and what actually changes that.17 Feb 2026 17:01 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mf325ioy3s2bhttps://bsky.app/profile/bishopfox.bsky.social/post/3meyx6mzqck2bAI-powered impersonation into Live Zoom calls into ClickFix malware. Senior Security Consultant Brandon Kovacs explains how deepfake tech is now being used to gain real initial access into enterprise environments.16 Feb 2026 21:03 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3meyx6mzqck2bhttps://bsky.app/profile/bishopfox.bsky.social/post/3meyqa2qhp22bTrusted marketplace integrations can still be attack paths. Senior Security Consultant Leron Gray explains why if you’re not reviewing your Azure enterprise apps and Outlook add-ins regularly, you probably should be.16 Feb 2026 18:58 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3meyqa2qhp22bhttps://bsky.app/profile/bishopfox.bsky.social/post/3meu2cav2hc2bSocial engineering our way into your heart. 🤍🩶🖤❤️ Just kidding. We’d rather earn your trust the right way. Happy Valentine’s Day from Bishop Fox.14 Feb 2026 22:15 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3meu2cav2hc2bhttps://bsky.app/profile/bishopfox.bsky.social/post/3meotrntvxs2wThe security ecosystem is packed with tools. But sometimes the right move is to sit down and build exactly what you need. Tom Hudson (@tomnomnom.com ) is hosting a live Discord workshop on when to build, when not to, and how to approach tool-building without overengineering.12 Feb 2026 20:35 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3meotrntvxs2whttps://bsky.app/profile/bishopfox.bsky.social/post/3meosl2de2c2dBe honest: When you picked your last Red Team vendor, what mattered most?12 Feb 2026 20:14 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3meosl2de2c2dhttps://bsky.app/profile/bishopfox.bsky.social/post/3mem6ojzp6223Happening now AI & Security Risks: A Cyber Leadership Panel Real talk from security and AI leaders on where AI risk is showing up right now and what teams are doing about it. https://bishopfox.com/resources/ai-security-risks-a-cyber-leadership-panel11 Feb 2026 19:12 +0000at://did:plc:bmd7dwf5akrptlhxnirxttyp/app.bsky.feed.post/3mem6ojzp6223