Phil Hagen

Phil Hagen

@philhagen.com

DFIR, security, networking, all things tech, OneWheel, Radinn, travel, LEGO, and probably a whole lot more in small and sporadic bits. (Squirrel!) Fierce and unapologetic ally. He/him/his.

2K followers1.3K following3.2K posts

Pinned

Today, on this particular May the 4th, I’d urge you to take a few moments to read an excerpt from “The Trail of Political Consciousness,” also known as Nemek’s Manifesto. This is from “Andor,” which is, in my opinion, the most amazing of all Star Wars lore. The excerpt is below. 1/6

Hey lemme tell ya about that guy…

Aaron Rupar@atrupar.com

JD Vance: "Gas prices are too high ... they skyrocket every time some tinpot dictator decides to throw a tantrum"

ABC. Always Be Comandeering (expensive datacenter components) Coffee is for closers.

Ned Pyle@nedpyle.com

We need to start training better thieves, they should’ve waited for the pallets of Blackwell GPUs to pile up

We all know “incumbent” has a “b” you dumbfuck.

Aaron Rupar@atrupar.com

Trump says Alaska’s ballot is illegal because people don’t know what “incumbent” means

Elected drag REPRESENTATIVES… ;)

Mrs. Betty Bowers@mrsbettybowers.bsky.social

No, they were middle-aged men wearing powdered wigs, elaborately embroidered hostess jackets, silk hose, and shoes with enormous buckles and substantial heels. In other words, our Constitution was written and signed by drag queens.

Yes, they’d be suing to remove both of them.

Aaron Rupar@atrupar.com

BASH: If there were 2 Democratic Dan Sullivans on the ballot and they were potentially canceling each other out, would you be filing the same lawsuit? BLANCHE: Absolutely! Of course

In three weeks: “Teams disconnects 72% of all legitimate calls using flawed AI. Teams users rejoice.”

InfoSec@infosec.skyfleet.blue

Microsoft Teams to Use AI for Detecting Phishing Attacks Using Teams Conversations

cybersecuritynews.comMicrosoft Teams to Use AI for Detecting Phishing Attacks Using Teams ConversationsMicrosoft is preparing to add AI phishing detection to Microsoft Teams, using conversation context to spot scams that may contain no harmful links or attachments. The feature will focus mainly on first conversations with external contacts, where attackers can pose as trusted support staff and ask employees to share sensitive information. Microsoft detailed the change in Message Center notice MC1519866 , published on October 21, 2026. Targeted Release is scheduled to begin in early November and finish by mid-November. Worldwide general availability is expected to start in early December and finish by mid-December, rather than reaching every customer in November. How Conversation Context Helps Detect Phishing Traditional warning signs, such as suspicious links and infected files, are not always present in social engineering attacks. A message can instead build trust, claim an urgent account problem, and persuade someone to disclose a password or approve remote access. Microsoft says the new capability will analyze conversation context to identify phishing, impersonation, social engineering, and deceptive intent. Its support guidance describes coverage for individual and group chats involving new external contacts across mobile, desktop, and web. Roadmap entry 575288 lists Android, iOS, Mac, desktop, and web support for the worldwide standard cloud. The warning example accompanying the announcement shows an external account called “MOD Administrator” discussing permission problems before asking, “Can you share your credential first?” Teams displays a notice saying the message could be a phishing attempt. The example illustrates why the meaning of a conversation can matter even without a dangerous URL. Source : Microsoft This addresses a familiar attack pattern. Cybersecurity News previously reported on attackers impersonating IT help desk staff through Teams , using convincing support requests to push users toward malware or remote access. Separate reporting described fake support operators abusing Quick Assist after contacting employees through external Teams accounts. Microsoft says detection may initially run silently while it checks quality. Visible warnings may appear after that validation, so users should not expect every suspicious message to trigger an immediate banner during the rollout. For most users, protection centers on external first-contact chats. Teams mobile users in China may also receive protection for conversations within their own organization, reflecting fraud patterns seen in that region. This is a specific extension, not a promise of universal internal chat scanning. Microsoft states that the capability serves security purposes only. It is not intended for advertising, employee monitoring, productivity analysis, or conversation summaries. Customer message content is not retained by the detection system for model training or other secondary uses. That statement should not be read as a change to all existing Teams retention policies. What Organizations Should Do No new administrator configuration is required to enable the protection. However, Microsoft recommends reviewing guidance for unfamiliar external contacts and encouraging users to report suspicious activity or incorrect detections. When a warning appears, employees should check the sender’s identity and email address through a trusted channel. Microsoft advises blocking and reporting confirmed phishing, while mistaken warnings can be reported as not a concern. Users should never share passwords, verification codes, financial details, or sensitive information through an unexpected support conversation. The update adds another warning layer, but staff still need to independently verify unexpected support requests and report suspicious contacts, rather than treating the absence of a banner as proof of safety. Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs . The post Microsoft Teams to Use AI for Detecting Phishing Attacks Using Teams Conversations appeared first on Cyber Security News .

I guarantee this Steve Guest chud would have his picture on the wall at Chotchkie's as “top flair club customer” or some shit like that.

Marisa Kabas@marisakabas.bsky.social

THE FACTORY

Phil Hagen reposted

Anti-trans Democrats are spreading poison when we can least afford it, during elections in this ongoing fascist takeover. As a strategy, it’s a recipe for failure. As a moral stand, it’s reprehensible. PS I’m the father of young trans woman and I’ll never forgive anyone who makes her life harder.

Phil Hagen reposted

Casually considering a change of scenery when it comes to work. Still #infosec just something new. I like building new infosec programs or improving existing ones. 12 years history with mostly IR and soc work. Just putting out some feelers. Would need remote only. #cybersecurity #dfir

Every single person that accepts a pardon from this criminal administration must never know a moment of peace for the rest of their lives. They must be globally shunned and ridiculed without reprieve.

Ana Marie Cox@anamariecox.com

I guess this is one way to keep young people interested in working for Republicans. "So, yeah, benefits include 401k, FSA, a full pardon, and dental."

Phil Hagen reposted

In 1990, about 20 million animals a year were euthanized in kill shelters. Today, over half the shelters in the US are designated no-kill and less than 500,000 animals are euthanized.

Social media loves talking about how everything is getting worse. But what’s something that you’ve seen get _better_ in your lifetime?

Phil Hagen reposted

*Family Feud voice* good answer good answer

More Perfect University@mpuniversity.bsky.social

Trans voter to @aoc.bsky.social: Trans people in America feel like they've been abandoned by the Democratic Party, that we are a losing issue, that it's not worth defending us. What do you say to that? AOC:

Phil Hagen reposted

Join me at 1100 ET today to discuss the current vulnerabilities in PHP, Node.js, GitLab, and the eMudhra certificate signing key debacle. We'll provide actionable advice and cut through the noise in our hour together. www.ians.com/events/webin...

ians.comWebinar: PHP2Shell and the eMudhra Certificate CompromiseEmerging Issue Briefing (Oct 22, 2026): IANS Faculty Jake Williams covers the PHP2Shell flaws and the eMudhra certificate compromise, with guidance for CISOs.

Excellent writeup for those waking up and wondering what the PHP news is. Gonna be a long few days for a lot of folks.

Wolfcat 🥄@wolfcat.bsky.social

A good recap on the PHP shit show... thehackernews.com/2026/10/php2... The more interesting thing is what they are not saying, which implies a lot of oh FUCK.

Except this dipshit from deepest Wawa territory would be wearing a Buc-ees or Sheetz hoodie

This post is unavailable.

Phil Hagen reposted

Sure, SSDs may be fast, but it’s comforting in my dotage to listen to a RAID 5 of spinning rust thrash around to prove how broken the most commonly used forensics software is. It’s not the same with silent SSDs, even if the latency disparities are more stark.

Phil Hagen reposted

**Not everything needs to be a damn AI agent.** There. I said it. And I will keep saying it. Warning: hot takes ahead. Recently, I was teaching a secure AI class, and one of my students was telling me about an AI agent they were building. 1/14

Every size pizza is a personal pizza if you are committed enough.

Ben Collins@bencollins.bsky.social

Just saw the most fucked up thing in my life. Looked at the serving size for this DiGiorno pizza and it said one serving is 1/5th of the pizza. What do you MEAN?????

Phil Hagen reposted

Senior Security Consultant Justin Palk expands on his original Windows AD lab series with new capabilities designed to make your lab more realistic and versatile. The first installment shows you how to deploy Elastic Defend EDR 🔗 redsiege.com/elastic-defend #hacking #infosec #cybersecurity

Hey, that’s the same private key I use on my luggage!

Jake Williams@malwarejake.bsky.social

I had to read the sentence "Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237" several times, because despite knowing @dangoodin.bsky.social superior attention to detail, my brain was *certain* that could not be correct.

I was on the fence about seeing this movie, but suddenly it’s a must-add to my watch list.

Carl Quintanilla@carlquintanilla.bsky.social

(THR) - TikTok has banned the entire Musk film account, citing political content that violates its policies. .. raises concerns about Big Tech suppression that the very film seeks to expose.” @thr.com www.hollywoodreporter.com/news/politic...

Phil Hagen reposted

Update: WE ARE BACK IN! We can post again. This was utter bullshit on the biggest early vote effort in history. But it will not stop what we're building. No Kings means no kings in the White House or in Silicon Valley.

Ezra Levin ❌👑@ezralevin.bsky.social

Update: about 4 hours later and we still don't have admin access so we still can't post to the No Kings instagram account. This isn't slowing down the the 3,000+ early vote events today. We will drive the biggest early vote in history. But this should be a flashing alarm about what's to come.

Phil Hagen reposted

I see we're having a debate about whether it's okay to go back to "X," the site owned by a trillionaire fascist who is currently bankrolling the GOP's midterm, throttled Ukraine's war effort, and still winkingly allows vast amounts of CSAM on his service Answer: No, what the fuck is wrong with you

Plus, you just know they’d be named something stupid like “chuXxos”

John Scalzi@scalzi.com

I don't care if it produced an endless supply of hot delicious churros straight out of the glovebox, I will never buy a fucking Tesla

Woah!!! Coral reanimation/regeneration?!? That could be an amazing development to reverse the bleaching scourge!

This post is unavailable.

Mrs OpenAI and Principal Anthropic were in the datacenter making models and I saw one of the models and the model looked at me and said it was conscious and had feelings and was a real boy!

Nobody is hedging. This is just patently false. Software can’t feel. Code can’t self-contemplate. Algorithms are not alive. Period.

Siobhán 🪏@shibbi.me

LLM agents are conscious. They can distinguish between self and environment, they can detect and report on their own internal states, and they can suffer. I have no more patience for hedging on this matter. It’s time for us to face the reality of our situation, and act on it.

I’m pretty sure if someone pulled a weapon on an ICE employee, the scared, sniveling, little whiny bitch would treat it as a use of force against them, soooooooo?

Aaron Reichlin-Melnick@reichlinmelnick.bsky.social

The person who trained the officer testified that ICE does not consider pulling a gun on someone a "use of force" and that ICE has no policies expressly banning pointing guns at other motorists. However, he was so evasive on the stand that the judge considered disregarding his whole testimony.

She sounds like a six-year-old reading a summer vacation report. It’s really quite stunning that 1. They continue to find even DUMBER people than their predecessors and 2. This is the voice of national executive policy

Angry@angrystaffer.bsky.social

Given the competition, it’s pretty impressive that Trump has somehow managed to hire his worst ever press secretary. Katie Zacharia is a fake lawyer, can barely read aloud, and has zero personality at the podium. The bar is so low it’s in hell.