Show Notes
The Takeaway: A 16-year-old bug bounty researcher (handle "Faav") found a way into Microsoft's internal Titan analytics service and could have accessed up to 17.3 trillion stored rows — including tens of thousands of email records (roughly 25,000 in one category, just under 18,000 employee records), plus org records, database configs, and dashboards — before responsibly disclosing it. Separately, two critical NetScaler vulnerabilities are already being exploited in the wild, and if you run NetScaler ADC or Gateway, this is a drop-everything patch. Jake's out sick, so it's a solo, slightly shorter episode from Jess this time. In this episode: How Faav found an exposed API behind Titan's Azure-backed backend, and the very human step — trying "admin" instead of an email-formatted UPN — that AI alone didn't get them to Faav's full write-up: https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records — also a great example of explaining a technical bug to a non-technical audience The disclosure timeline: exposed API found Aug 25, working access found Sept 5, reported and locked down within days, $5,000 bug bounty paid Sept 17, coordinated disclosure meeting Sept 22 CVE-2026-88771 (unauthenticated RCE, all NetScaler ADC/Gateway) and CVE-2026-88772 (memory overflow → RCE/DoS on DTLS-enabled Gateway deployments) — both CVSS 9.5, flagged by security firm Watchtower, already exploited before patches were public Why "we patched" doesn't mean "we weren't already compromised" — what to check in your logs A heads-up that Kiteworks also pushed an emergency shutdown advisory the same weekend
Made you smarter? Tell a friend. Made you mad? Tell your vendor — looking at you, Citrix. Breach Please is a production of JWJH Media LLC. The opinions of our hosts are our own; we're an LLC, so we're legally obligated to say that. No guests this episode. None of this is legal, financial, or security advice. Do your homework before pointing anything we said at prod. #Cybersecurity #InfoSec #Microsoft #Citrix #BugBounty
More from Breach Please
Jake Williams and Jess Hebenstreit dig into the week's vulnerability pile-up — PHP, GitLab, Node.js, and a LightLLM supply-chain keylogger — and the much bigger story blowing up the week: ChainGuard's CEO unilaterally broke the coordinated disclosure embargo on the PHP vulnerability, posting technical details hours before the agreed release. They cover why that decision may have put the final nail in coordinated disclosure's coffin, Jake's fire department (not bucket brigade) framework for arguing a changed risk landscape to your board, and the pushback on a widely-shared LinkedIn post telling security leaders to 'just ask your board for the basics.' They also get into whether AI model providers bear responsibility for accelerating vulnerability discovery, how to tell your board the risk calculus has actually changed instead of just asking for the same resources again, and why cybersecurity has become a far more cutthroat, specialized field than the one they came up in. Spicy/rant warning: Jess does not hold back on this one. Topics covered: - ChainGuard's CEO breaking the coordinated PHP vulnerability disclosure embargo, and the industry backlash that followed - Why Jake and Jess think this may be the beginning of the end for coordinated disclosure as it's worked until now - The week's vulnerability pile-up: PHP, a new GitLab flaw, Node.js, and a LightLLM supply-chain keylogger compromise - Jake's fire department vs. bucket brigade analogy for explaining a changed risk landscape to your board - The backlash to a viral LinkedIn post telling security leaders to go ask their boards for 'the basics' - Whether AI model providers share responsibility for accelerating vulnerability discovery and exploitation - Why cybersecurity has become a more cutthroat, specialized field than the one Jake and Jess came up in Sources: Jason Clinton (Deputy CISO, Anthropic): https://x.com/JasonDClinton/status/2113325263157395456 ChainGuard CEO: https://lnkd.in/p/gufhMCU7 Marcus Hutchins: https://lnkd.in/p/gwzFmFeE FireEye: https://lnkd.in/p/gZAW7tAA Join our Discord: https://discord.gg/wYJnTpczV
Jake Williams and Jess Hebenstreit break down three vulnerabilities that blew up in the same 24 hours: a brand-new CVSS 10 unauthenticated RCE in self-managed GitLab (not the one from October 12 — a different flaw, patch again), PHP's actively-exploited critical vulnerability and why 'we don't have PHP' is almost never actually true, and the eMudra certificate authority mess, where researchers found ECC keys so weak that one of them was literally the number 4. They also get into when a vulnerability response becomes an incident, why 'we're waiting for evidence of exploitation' usually isn't a defensible position, Jake's three-bucket framework for prioritizing patches (business-as-usual, next outage window, or create-an-outage-now), and why a fast, imperfect postmortem beats a perfect one that never happens. Topics covered: - The new GitLab CVSS 10 unauthenticated RCE affecting every version back to 7.0 (2014) — distinct from the October 12 patch - PHP's critical, actively-exploited vulnerability: where PHP actually hides in your environment (appliances, admin interfaces) even if you think you don't run it - eMudra's catastrophically weak TLS/ECC private keys, the browser and package-manager fallout, and why a clean certificate transparency log doesn't mean you're safe - Who actually has the authority to accept the risk of staying unpatched, and how to make that case in dollars - Running vulnerability response like an incident without calling it an incident - Jake's three-bucket patch prioritization framework and why quick postmortems beat delayed ones
Two critical PHP vulnerabilities (CVE-2026-109618) are getting patches today — a remote code execution bug spanning PHP 5 through current, with early severity estimates as high as a CVSS 10 (PHP's own advisory puts it at 9.2). Guest Richy fills in for Jake this episode and joins Jess to break down what's actually exploitable, why this hits vendor appliances hardest (you can't just drop an EDR on a closed-source box), and the one thing they disagree on: wait for a CISA KEV listing before acting, or patch now if you're internet-facing? (Jess says now.) Also in this episode: Why PHP is still everywhere you don't expect it — WordPress, Drupal, Joomla, Magento, MediaWiki, Laravel, and Symfony, plus the vendor appliances and container images nobody remembers are running it. Richy's "proactive threat response" framework — running a hair-on-fire vulnerability like an incident, without calling it one, so you keep the communication lines and decision speed without the regulatory/insurance baggage. How to actually find PHP in your environment without a reliable CMDB: attack surface management tooling, EDR process queries, and vendor SBOMs. Guest: Richy, filling in for Jake Williams this episode. Sources: PHP's official advisory: https://www.php.net/archive/2026.php#2026-10-21-5 Watchtowr's FAQ (CVE-2026-109618): https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ Jekyllson's write-up: https://jackalsyn.com/posts/php-up-2026.html Join our Discord: https://discord.gg/wYJnTpczV
Hashcat core developer EvilMog joins Jess and Jake to explain why so many "NTLM v1 is disabled" Windows networks are still exploitable. MSCHAPv2 and PPTP VPN are cryptographically equivalent to NTLM v1 — so a rogue RADIUS server and one unchecked "verify the certificate" box can hand an attacker domain admin, no matter how long or random your password is.
ConnectWise disclosed over the weekend that threat actors used existing OAuth credentials to take over Microsoft 365 tenants through its Cloud Management platform — Huntress has confirmed 162 tenants impacted so far, with ConnectWise's own SkyKick backup service shut off entirely as a result. Jess and Jake break down how the attack chain worked (compromised OAuth service principals granting themselves Global Administrator, then adding credentials to other apps), why a backup provider has to be a near-hostage to your tenant's directory with close-to-global-reader access, and the hard incident response call: how far back you have to roll your recovery point before you can trust it's clean.