G :donor: :Tick:

I do Cloud Security

Website: https://www.cirriustech.co.uk/
LinkedIn: https://uk.linkedin.com/in/graham-gold
GitHub: https://github.com/goldjg
Ko-Fi: https://ko-fi.com/cirriustech

Public Key

npub16ezqaqcxhc8y03e2pwkct7j2l67z06l7xrwlz5lkdu9qfs58zwtqyl59dp

NIP-05 Address

cirriustech_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsdv3qwsvrturj8cu4qhtv9lf90a0p8a0lrph0320mx7zsyc2r389sprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyt8wumn8ghj7un9d3shjtnswf5k6ctv9ehx2aqtzhfu5

Publishing to

relay.momostr.pink

relay.primal.net

offchain.pub

Author Public Key

npub16ezqaqcxhc8y03e2pwkct7j2l67z06l7xrwlz5lkdu9qfs58zwtqyl59dp

Show more details

Last Notes

2026-11-01 13:39:11 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/541/460/306/837/018/original/51f8a6e3cd688e69.png

2026-10-20 21:31:12 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/475/368/564/625/071/original/338296b03651bcb2.png

2026-06-05 18:59:46 UTC

- reply

Public GitHub API responses show 49 Azure repositories were blocked under GitHub ToS enforcement between 16:00:50 and 16:02:35 UTC on 2026-06-05. The affected repositories are heavily concentrated around Azure Functions, WebJobs, Durable Task, language workers, extensions, connectors, and related runtime/tooling components. This indicates a coordinated bulk block of a product/platform ecosystem rather than isolated repository actions.

2026-06-05 18:45:03 UTC

- reply

2026-06-05 18:40:32 UTC

So a mate had 8 repos disabled by GitHub that aren't offensive tooling or exploits but are forks of Azure Functions stuff.
The ones I know of aren’t offensive tooling or exploits - they are all related to azure functions…
I wondered if is related to the durabletask stuff being compromised as part of the GitHub breach the other week.
DurableTask is largely used by azure functions.
3 versions of it were pushed with malware in.
So I wondered if this is an incident response action.
Scanning the Azure org using gh CLI for disabled repos.
The timestamps are unnaturally clustered
Every single repo shows:
updated_at ≈ 2026-06-05 16:00 UTC
pushed_at ≈ 2026-06-05 02:00-07:00 UTC
That’s not organic project activity.
That looks like a bulk operation touching all repos in the set at roughly the same time.
This is clearly not just DurableTask
The blast radius includes:
Core Functions runtimeAll language workersAll durable extensionsCore ToolsWebJobs SDKDocker imagesGitHub ActionsExtension bundlesOpenAI extensionMCP extensionConnector SDKsAgent runtime
This is basically:
“everything related to Azure Functions as a platform”
The stars matter
Some of these are not obscure repos:
Repo Stars
azure-functions-host 2010
durabletask 1718
azure-functions-core-tools 1450
azure-webjobs-sdk 752
durable-extension 764
You don’t casually disable the flagship repos of a major cloud service.
The newer additions are fascinating
These jumped out:
azure-functions-openai-extension
azure-functions-mcp-extension
azure-functions-agents-runtime
Those are AI-era additions.
Which suggests the disablement logic wasn’t:
“disable the historically compromised repo”
It looks more like:
“disable the entire Functions ecosystem”
The Connectors repos are weird
These:
Connectors-NET-SDK
Connectors-NET-LSP
Connectors-NodeJS-SDK
connectors-python-sdk
have:
stars = 0
and are still disabled.
That argues against popularity, malware reports, forks, or stars being the trigger.
They’re simply part of the same family.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/698/960/387/749/537/original/f34e9a8b00b4f160.jpeg

2026-05-20 18:06:19 UTC

- reply

fixed it
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/608/228/291/163/719/original/81798e674652d394.jpeg

2026-01-16 15:22:20 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/905/458/157/566/690/original/5f16a3135843c2c1.jpeg

2025-09-28 20:49:39 UTC

- reply

Hard agree! Love his solo stiff too!
Current rotation:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/283/891/091/826/684/original/a77da1a93c362aff.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/283/891/288/357/953/original/bdaf046b9008b3ef.png

2025-09-28 20:46:09 UTC

- reply

See I started with rock. Then my intro to metal as Iron Maiden. So until maybe the last few years I wouldn’t listen to scream/roar/full on harsh vocals. That’s changed as I’ve aged - I still don’t enjoy all roar all the time but I do enjoy it along as there are still discernible lyrics and rhythm/melody.

2025-09-28 20:37:52 UTC

- reply

Depends on mood, I tend to gravitate towards symphonic, goth, NWOBHM, but then also Gojira etc too.

2025-08-04 21:40:28 UTC

🚨 𝗢𝘂𝘁𝘁𝗮𝗧𝘂𝗻𝗲: 𝗧𝗵𝗲 𝘀𝗼𝗿𝘁𝗮, 𝗻𝗼𝘁-𝗿𝗲𝗮𝗹𝗹𝘆, 𝗳𝗶𝘅
Earlier this year, I disclosed a security flaw in Microsoft Intune’s Conditional Access device filtering — where attackers with local admin rights could 𝙨𝙥𝙤𝙤𝙛 𝙙𝙚𝙫𝙞𝙘𝙚 𝙥𝙧𝙤𝙥𝙚𝙧𝙩𝙞𝙚𝙨 like device.model to 𝙗𝙮𝙥𝙖𝙨𝙨 𝙥𝙤𝙡𝙞𝙘𝙮 𝙚𝙣𝙛𝙤𝙧𝙘𝙚𝙢𝙚𝙣𝙩.
At first, it was marked “𝘽𝙮 𝘿𝙚𝙨𝙞𝙜𝙣.”
Then “𝙈𝙤𝙙𝙚𝙧𝙖𝙩𝙚 𝙨𝙚𝙫𝙚𝙧𝙞𝙩𝙮.”
Now, Microsoft says it’s “𝙛𝙞𝙭𝙚𝙙.”
🩹 𝗪𝗵𝗮𝘁 𝗰𝗵𝗮𝗻𝗴𝗲𝗱?
• Documentation now warns that 𝙨𝙤𝙢𝙚 𝙙𝙚𝙫𝙞𝙘𝙚 𝙥𝙧𝙤𝙥𝙚𝙧𝙩𝙞𝙚𝙨 𝙖𝙧𝙚 𝙪𝙣𝙩𝙧𝙪𝙨𝙩𝙚𝙙
• UX nudges were added in the CA policy editor and dashboard
• My name will appear in the MSRC researcher acknowledgements
🔐 𝗪𝗵𝗮𝘁 𝗱𝗶𝗱𝗻’𝘁 𝗰𝗵𝗮𝗻𝗴𝗲?
• 𝙉𝙤 𝙩𝙚𝙘𝙝𝙣𝙞𝙘𝙖𝙡 𝙘𝙤𝙣𝙩𝙧𝙤𝙡𝙨 prevent tampering
• Attackers can still 𝙢𝙤𝙙𝙞𝙛𝙮 𝙧𝙚𝙜𝙞𝙨𝙩𝙧𝙮 𝙫𝙖𝙡𝙪𝙚𝙨 and pass Conditional Access checks
• 𝘿𝙚𝙫𝙞𝙘𝙚 𝙩𝙧𝙪𝙨𝙩 𝙞𝙨 𝙨𝙩𝙞𝙡𝙡 𝙬𝙧𝙞𝙩𝙖𝙗𝙡𝙚 𝙗𝙮 𝙩𝙝𝙚 𝙙𝙚𝙫𝙞𝙘𝙚
New blog post here →
🔗 https://cirriustech.co.uk/blog/outtatune-tunedout/
If you rely on Intune or Entra for Zero Trust enforcement, 𝗿𝗲𝗮𝗱 𝘁𝗵𝗶𝘀.
And maybe… stop trusting the registry.
#Microsoft #Intune #Entra #ConditionalAccess #EndpointSecurity #OuttaTune #CyberSecurity #Bypass #ZeroTrust #DefenseEvasion

2025-05-10 22:46:32 UTC

- reply

They're responding really well! Quick, clear, decisive!

2025-05-10 09:17:22 UTC

If anyone has cyber security contacts at Celebrity Cruises let me know please

2025-04-28 21:37:08 UTC

I uncovered a trivial to execute bypass of Conditional Access via Microsoft Intune - if you are using device filters, you need to read this now!
#Microsoft #Entra #Intune #ConditionalAccess #SecurityFeatureBypass #SecurityVulnerability #MSRC
https://cirriustech.co.uk/blog/outtatune-vulnerability/

2025-03-23 12:38:34 UTC

This is kinda cool - my #Azure #VaultRecon vulnerability (that #Microsoft say is by design and is not a vulnerability) is now listed in the #CloudVulnDB 🤩 #SecurityResearch —#CloudSecurity #KeyVault #Enumeration #SharingIsSecuring #WeAllWinTogether 🤘🏻💪🏻
https://www.cloudvulndb.org/azure-vault-recon-keyvault-secret-metadata-control-plane-exfiltration

2025-02-22 00:04:50 UTC

- reply

It’s being sunsetted on December 1st 2025 BTW: https://help.clearbit.com/hc/en-us/articles/6987867587607-Legacy-Logo-API-I-FAQ

2025-02-16 22:45:40 UTC

- reply

Thing is, just as you’re within your rights to object to them, I’m within my rights to use them.
I get the reasons you might have for boycotting AI imagery or even AI full stop.
My content is still written by me if that matters.

2025-02-16 22:05:40 UTC

- reply

What if the author just has no artistic talent?
I used to use unsplash images but I do find I use AI generated images for my blog hero image more often as time goes on.

2025-02-16 21:16:17 UTC

Timeline cleanse
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/015/638/470/178/748/original/bf4c15efcf4bf0ac.jpeg