John Z Black

The Auth Layer Is Leaking: Why cPanel, GitHub, and Microsoft Are All Scrambling

John Z Black May 4, 2026

Vulnerabilities & Patching #NTLM #cpanel #github #entra-id #authentication #zero-day #vulnerability

A single week brought critical auth bypasses in cPanel, GitHub Enterprise, Microsoft Entra ID, and a zero-click NTLM re-patch. This isn't a run of bad luck.

Read More

Europol Took Down Tycoon2FA. It Was Back in Days, and Smarter Than Before.

John Z Black Mar 31, 2026

Ransomware & Cybercrime #phishing #tycoon2fa #phishing-as-a-service #microsoft-365 #entra-id #conditional-access #mfa #aitm #europol #crowdstrike

Tycoon2FA's rapid return after Europol's March 4 takedown shows why seizing infrastructure doesn't shut down phishing platforms. The operators pre-staged backup infrastructure before the first domain was seized.

Read More