Fabrizio Scanavini’s Post

In a poll of 2,000 adults in the US who own a Windows PC, 86% believe they should have "primary control over default browser choice." So why isn’t that the case? A recent TechRadar article analyzed findings from our consumer survey. Read it here: https://bit.ly/4zoVAaU

"From 206 to 622: Inside the Fastest-Growing Vulnerability Count in Microsoft's History Microsoft's July 2026 Patch Tuesday addressed 622 vulnerabilities which is triple the amount of June's previous record of 206. 63 rated critical; 416 in Windows, 82 in Office, 46 in Microsoft Edge. Two actively exploited zero-days: CVE-2026-56155 (AD FS privilege escalation) and CVE-2026-56164 (SharePoint Server privilege escalation). Microsoft attributes the surge to its new multi-model agentic scanning harness (MDASH), used to find and patch defects at AI-driven speed and scale.

The absence of a supported Linux GUI is not an access-control boundary. This research reached Find My people-location data by reproducing the underlying enrollment, messaging, and decryption flow—not by porting Apple’s interface. That distinction matters anywhere teams equate “there is no client for Linux” with “Linux cannot access it.” Protocols, APIs, certificates, and push channels are the real path. **In practical terms, it is a good time to:** - identify security assumptions based solely on a vendor’s supported-client matrix - inspect Linux hosts for custom clients that reproduce mobile or desktop service behavior - test sensitive workflows at the protocol or API layer rather than only through the official UI #LinuxSecurity #SysAdmin #AccessControl #DevSecOps https://lnkd.in/ettwncbV

“No evidence of unauthorized access” is not the same statement as “the key could not have been copied.” Mozilla reviewed available audit records and found no evidence that an unauthorized party accessed the exposed signing subkey. That is meaningful—but it also illustrates a recurring incident-response limitation: conclusions are bounded by what the logging system actually recorded and retained. When sensitive material lands in source control, investigators need more than repository membership. Useful evidence can span Git hosting audit logs, identity-provider events, token use, clone activity, CI runners, API integrations, workstation telemetry, and retention windows. Missing telemetry turns a technical exposure into an assurance problem for security leadership. In practical terms, it is a good time to: - confirm source-control audit logs record repository access, clone-related activity, token use, and administrative changes relevant to your threat model - compare Git hosting retention periods with incident-response and compliance requirements - correlate repository access with identity-provider and endpoint telemetry for privileged engineering accounts - identify CI integrations that can read sensitive repositories without producing sufficiently detailed audit trails - test whether security teams can reconstruct access to a sensitive repository months after the fact The point is not to distrust audit logs. It is to understand exactly what claim they can support. #IncidentResponse #SecurityOperations #LinuxSecurity #DevSecOps #Compliance https://lnkd.in/gaB3ypGs

Security researchers showed how Windows can be tricked into installing legitimate but flawed vendor software that hands an attacker full control of the computer — either by plugging in a rigged USB device or, in some setups, over a remote desktop connection. This is a research demonstration, not an attack happening right now. It only works if someone can physically connect a device, or if a specific remote desktop setting most people never touch is switched on by whoever manages the machine. 🚨 #CyberNewsLive https://lnkd.in/gZS8YBmC

Sign-in logs can tell you a lot about the real condition of a Microsoft 365 tenant. They help answer questions like: - Who is signing in? - Which apps are being used? - Where are sign-ins coming from? - Which attempts are failing? - Are users being challenged for MFA? - Are Conditional Access policies applying correctly? - Are old clients still connecting? - Are there unusual patterns? When troubleshooting access issues, sign-in logs are often one of the first places to look. They can show whether the problem is a password issue, MFA challenge, Conditional Access block, device condition, app assignment, location rule, or policy misconfiguration. For security reviews, sign-in logs also help identify risky patterns before they become incidents. Good administrators do not only configure policies. They also review the signals those policies produce. #SignInLogs #MicrosoftEntraID #Microsoft365Security #ConditionalAccess #CloudSecurity

🌐 Website not loading? It might not be your Internet—it could be DNS. Many "No Internet" complaints are actually DNS resolution issues. Before replacing hardware or reinstalling Windows, I always go through a structured troubleshooting process. Here's the 5-step checklist I use before escalating the issue: ✅ Verify network connectivity ✅ Flush the DNS cache ✅ Renew the IP address ✅ Test DNS resolution with nslookup ✅ Try a different DNS server (Google or Cloudflare) One quick tip that often saves time: 💡 If ping 8.8.8.8 works but ping google.com fails, you're most likely dealing with a DNS issue—not an Internet outage. A few simple checks can resolve the problem in minutes and avoid unnecessary troubleshooting. 👇 What's your go-to command or first step when troubleshooting DNS issues? #Windows #Networking #DNS #ITSupport #SysAdmin #HelpDesk #Microsoft #TechSupport

Two deadlines are converging on Acronis Files Connect (formerly ExtremeZ-IP). Acronis has published an end-of-life notice: new sales have stopped and support ends December 31, 2026. Apple removed the AFP client from the first developer beta of macOS 27, due this fall. AFP was deprecated in macOS Sequoia 15.5 back in May 2025, and macOS 26 Tahoe confirmed removal was coming. For most organizations, the December date is not the real deadline. The practical one arrives the day the first Mac in the fleet upgrades to macOS 27 and AFP volumes stop mounting. Worth checking before then: - Which shares Files Connect publishes, and who depends on Network Spotlight for search - Whether the print server role is in use (Windows print services handle this) - Time Machine destinations, since macOS 27 requires SMBv2 or SMBv3 regardless - Whether your MDM can defer the macOS 27 upgrade long enough to finish a migration On the replacement side, the thing to avoid is trading one protocol dependency for another. Direct SMB works on the LAN but puts remote Macs back on a VPN. MyWorkDrive publishes existing SMB and NTFS shares to a macOS mapped drive over HTTPS on port 443, with AD or Entra ID authentication and NTFS permissions enforced in each user's own context. No data migration, and Windows Search integration covers the search gap. https://lnkd.in/guJECdnE #MacAdmins #ITInfrastructure #AFP #FileSharing

"The network is down!" It usually isn't. After enough time on-call, I've learned that most "network" outages are one of five things — and you can rule them out in under 5 minutes with commands already sitting on your laptop. The trick: work UP the stack, one layer at a time. Is it me or them? ping 1.1.1.1 → if you reach the internet by IP, your link is fine. ping google.com → works by IP but fails by name? It's DNS. (It's always DNS.) Where does it actually break? traceroute google.com (tracert on Windows) shows the exact hop where packets die. Dying at hop 1 = your gateway. Dying deep in the path = not your problem to fix. Is the port really open? nc -zv host 443 beats "the firewall might be blocking it" every single time. Test the port. Don't guess. Who's actually listening? ss -tulpn on Linux, netstat -ano on Windows — before you swear the service is running, check what's truly bound to the port. What does DNS really return? dig +short api.yourservice.com — a stale or wrong record is behind more "ghost" bugs than anyone admits. The pattern: connectivity → find the break → check the port → check the process → validate DNS. 90% of the time, you'll either fix it or prove it's someone else's fix before you ever open a ticket.