Scott Foreman

"The threat actor behind the exploitation of vulnerable Craft Content Management System (CMS) instances has shifted its tactics to target Magento CMS and misconfigured Docker instances. The activity has been attributed to a threat actor tracked as Mimo (aka Hezb), which has a long history of leveraging N-day security flaws in various web applications to deploy cryptocurrency miners. "Although Mimo's primary motivation remains financial, through cryptocurrency mining and bandwidth monetization, the sophistication of their recent operations suggests potential preparation for more lucrative criminal activities," Datadog Security Labs said in a report published this week. Mimo's exploitation of CVE-2025-32432, a critical security flaw in Craft CMS, for cryptojacking and proxyjacking was documented by Sekoia in May 2025." https://lnkd.in/d-j33inX

1

Where do our thoughts come from? Today, I got excited about implementing automation to handle remediation. Then came that part of my brain that says it's too easy, it's too good. The product vendor is saying all the things I've heard before. For example, we took ALL the necessary preventative measures to ensure abc and xyz. Just trust us, all our other clients have, so what's your problem? I, of course, begin to fantasize about circumventing said measures if one were to need to do so at all. Just hand me some popcorn and pay my bills until I'm done. The fact is that all these tools, which can isolate systems, interact with system folders and files, and disable accounts, can be turned against us in a living-off-the-land attack. I'm exploring Azure Logic apps as well, and after 40 minutes of euphoria, that sadness creeps in. This, too, can be turned against us. Consider this: we invest a significant amount of time in establishing separation of duties and least privilege access, only to create a separate space where those principles are disregarded. That one workflow has Godmode. All it takes is a new bug that allows for exploiting your global admin or domain admin creds, and all that segmentation you spent months planning and implementing goes out the door. Ok, enough venting!! What additional steps are you adding to add security to automation in your environment? You can skip the basics in your answer...

3

🚨 The Major Incident was resolved in 20 minutes… Everyone on the bridge call was relieved. Service restored. Users happy again. Leadership informed. The incident was closed with a temporary workaround. A few days later… 📞 Another P1 alert. Same service. Same symptoms. Same bridge call. And someone quietly says… "Didn't we see this last week?" This is one of the most common challenges in Major Incident Management — Recurring Incidents. Quick restoration is important. But workarounds are not solutions. If the Root Cause Analysis (RCA) is not driven properly, the incident simply waits… …to come back again. A strong Major Incident Manager doesn't just focus on restoring service. They ensure: ✔ Problem Management is engaged ✔ Permanent fixes are tracked ✔ Lessons are captured after the incident Because success in incident management is not: ❌ How fast you close incidents. It’s actually: ✅ How many incidents never happen again.

2

🚀 Stop celebrating output. Start measuring outcomes 🚀 Many teams still equate “busy” with “impact.” But real progress isn’t measured by how many features we ship — it’s measured by the value we create and the problems we solve. When we focus on outcomes, we build with purpose, prioritize what truly matters, and create meaningful change for our users and our business. 👉 Read full article here: (https://lnkd.in/eh5KabrU) Let’s build value, not only features

13

1 Comment

Your CMDB can only manage what it can see. 👀 Missing unmanaged devices = blind spots, compliance gaps, and slow incident response. ORDR's AI discovers and updates everything automatically.

16

I had the pleasure of working on three out of four resources to simplify your management of the DevOps package management tooling. If you're looking for ways to manage multiple of these developer tools using a single one, check out my new blog post: https://lnkd.in/ePzyF-DS #devops #winget #dsc #dscv3 #tooling #developer

12

Patch management doesn’t have to be complicated when you know the right steps. Here’s a visual breakdown of how Patchifi simplifies the journey from vulnerability to remediation.🚀

11

Anonymous access isn’t just a visibility problem. It’s a remediation problem. When identities go missing, risk spreads quietly across applications, APIs, and cloud environments. Axiler doesn’t just detect abnormal access; it remediates it automatically, closing gaps before they are exploited.

10

Your infrastructure isn’t failing. It’s bleeding cash. There’s a truth no monitoring dashboard will ever report: Your infrastructure isn’t failing. It’s bleeding cash. In silence. Here’s the uncomfortable question: Why do you want “observability” if all you’re observing is how you’re NOT generating money? Dashboards show green. Finance only asks one thing: “Show me the money.” That Wi-Fi that "parpadea pero nunca se cae." That old server everyone prays to. "El que nunca falla… pero factura como si fuera SaaS." That technology that stays “up” while slowly destroying your credibility. Those aren’t incidents. They’re financial hemorrhages disguised as tickets. After auditing large-scale infrastructures, I learned something brutal: uptime is the most expensive lie in IT. An asset can be 100% operational and still be devouring your innovation budget. I call this: CHRONIC OPERATIONAL FRICTION. More tomorrow. 👇 ¿Te suena familiar? #ITStrategy #TechFinance #CIO #ITLeadership #TechnicalDebt #RetailTech #ApeProject

5

🌤️ “The Cloud” ⛅️ ….It’s more than just using someone else's computer. Its a marketing term as well. 😱 Here is one way to visually break it down. Cloud resource balance is key knowing what are the bare minimal requirments vs risks you are willing to accept. #TheWhiteGloveMacGyver #Cloud #InformationTechnology #Infrastructure

3

1 Comment