During active testing for a client in August, I found that the local administrator account on their BMC Helix Network Management platform would sign in with any password. That finding is now CVE-2026-111283, a critical authentication bypass (CVSS 4.0: 9.5).

The Palo Alto Networks firewall Master Key is p1a2l3o4a5l6t7o8 and it is well past time you changed it!

I had a great time presenting to the @bsidesmelbourne.bsky.social crowd on the weekend. Thanks to the crew and volunteers for running such a welcoming, vibrant conference, with a great selection of talks! Big ❤️ to Edwina Richards for the photos! #BSidesMelb2026 #WontSomebodyPleaseEatTheFruit

I'm excited to announce I'll be taking the stage at @bsidesmelbourne.bsky.social 16-17 May 2026 at SEEK HQ in Cremorne. I'll be presenting Panning for Gold: A Hacker's Guide to Next Generation Firewalls on how attackers can exploit FW features and weaknesses to increase the impact of a compromise.

Woohoo! 700, we're filling up! Stoked, can't wait to see you Saturday next week. If you're keen to join us 21st March, get in now and grab your tickets here: events.humanitix.com/crikeycon-11

CrikeyCon 11

Brisbane hacker conference, run by the community for the community.

events.humanitix.com

It's Monday morning, but you have the best news: CrikeyCon is at the end of the tunnel. What a way to start the week. Droppy wanted to start the week off strong too, so another massive 'high paw' for stepping up to be a sponsor of our hacker show to @volkis.au! See you at the con!

Thursday 19th March 2026, you're drinking and eating some nibbles. You're chatting to a friend. If that's future you, you signed up to Women of CrikeyCon. It's for attendees, friends, and wider community get to meet before CrikeyCon. Sign up: events.humanitix.com/women-of-cri...

Women of CrikeyCon 11 networking event

Get tickets on Humanitix - Women of CrikeyCon 11 networking event. Venue provided after registering for a ticket!. Thursday 19th March 2026. Find event information.

events.humanitix.com

You've heard about some of our speakers, and we're stoked to announce another: Simeon Miteff joins us with "Phoning it in: active scam campaign tracking with a small-scale SMS honeypot". Join the journey through hobby honeypot to a "telecom telescope".

What do you do when you find yourself the new owner of Kubernetes config during a pentest? Find out the answer, and more with Finn Foulds-Cook during his talk on Saturday - "Help I got a k8s config?"

Hey hey Women of CrikeyCon! Get your tickets for the networking event here: events.humanitix.com/women-of-cri...

Women of CrikeyCon 11 networking event

Get tickets on Humanitix - Women of CrikeyCon 11 networking event. Venue provided after registering for a ticket!. Thursday 19th March 2026. Find event information.

events.humanitix.com

Come join Alex Tilley on stage as we're brought through lived experiences in "Real world management in the world of Bad Days". We're stoked to hear this one as no one wants to deal with, but everyone should be prepped to get through, a massively bad day.

First up on 21st March we have @ellearmageddon.bsky.social taking the stage. Elle's joining us with their talk "nothing we do matters (so it can’t hurt to try!)". Join us to see them at the RNA showgrounds, and get some much needed hope in these times!

Our schedule is up, and we're excited to announce our speaker @snyff.pentesterlab.com is joining us on stage with I DON'T LIKE THIS CODE!!! Get ready to walk through a series of real-world inspired code snippets with one minute to figure it out. Only question, will there be jeopardy music?

Thanks Crikey crew! It’s a great bunch of speaker you’ve got lined up this year. Can’t wait to see the! 😍

CrikeyCon@crikeycon.bsky.social · 8mo ago

We're two weeks and counting so we wanted to give another shout out to @cybliminal.com. Thank you so much for their sponsorship, providing us support to host CrikeyCon 11!

25% of the tickets gone! Don't miss out: events.humanitix.com/crikeycon-11... We're excited to be announcing CFP and CFE results soon, so get your ideas in!

CrikeyCon 11

Brisbane hacker conference, run by the community for the community.

events.humanitix.com

CFP and CFE has officially closed. We had a huge turnout, thank you so much for your time and effort to submit your ideas. Droppy & the Sleuth are busily reviewing and looking to get a response to everyone that submitted latest by the 21st. Reach out if you have any questions! Droppy & the Sleuth

Sunday when CFP and CFE closes, get your ideas in now! CFP: docs.google.com/forms/d/e/1F... CFE: docs.google.com/forms/d/e/1F...

CrikeyCon 11 (2026) Call for Presentations

*** CFE CLOSES February 1 2026 *** Saturday March 21 2026 Royal International Convention Centre, Bowen Hills, Brisbane, QLD CrikeyCon is a community-led conference targeting those with an interest i...

docs.google.com

If you missed my talk at BSides Canberra you can catch up on it now on YouTube

BSides Canberra@bsidescbr.bsky.social · 12mo ago

New BSides Canberra 2025 talk by Matthew Flanagan is now live: “Panning for Gold - A Hacker’s Guide to Next Generation Firewalls.” Watch here: youtu.be/2PF4aSY1gVo

Get along to CrikeyCon XI - 21st March 2026. The best hacker conference that side of the border! 😜 🎟️ Tickets on sale now at CrikeyCon.com

CrikeyCon@crikeycon.bsky.social · 12mo ago

Big shout out to @cybliminal.com our first silver sponsor this year! Massive hugs for the returning support; can't wait to see you out at the showgrounds.

Big shout out to @cybliminal.com our first silver sponsor this year! Massive hugs for the returning support; can't wait to see you out at the showgrounds.

Thanks again to @bsidescbr.bsky.social for inviting me to present my research on living off the land on Palo Alto Networks firewalls as well as sharing new tools I’ve developed to creatively misuse 😜 firewall features for credential harvesting and port scanning. Some great questions too!

Just one week to go until I present the research from my “Panning for Gold: A Hacker’s Guide to Next Generation Firewalls” paper. Come along and listen to it at @bsidescbr.bsky.social if you’d like to up your post-exploitation game or learn how to better defend your environment.

Matthew Flanagan@mattimustang.com · last yr.

I’m incredibly excited to be accepted by @bsidescbr.bsky.social to present my research on Next Gen Firewalls. I can’t wait to get up there for the first time to share it with you all!

I’m incredibly excited to be accepted by @bsidescbr.bsky.social to present my research on Next Gen Firewalls. I can’t wait to get up there for the first time to share it with you all!

BSides Canberra@bsidescbr.bsky.social · last yr.

"Panning for Gold - A Hacker's Guide to Next Generation Firewalls" What happens when a firewall stops being the defence and becomes the foothold? @mattimustang.com explores real-world tactics for abusing NGFWs: credential theft, mapping, lateral movement. cfp.bsidescbr.com.au/bsides-canbe...

Open source sits at the base of the software supply chain. Fraser talks about how critical it is for open source to establish security response teams and infrastructure. Listen to the experiences learned from bootstrapping and leading the Haskell security response team.

Justin's talk title speaks for itself: “Well well well, if it isn’t the consequences of my own actions” - the time I got in the middle of 100,000 Linux machines and their LVFS firmware updates and then somehow bypassed the fwupd PGP signature checking

We're a week away and we wanted to say another big thank you to our sponsors. This year Cybliminal has joined us as a Silver sponsor! Big thanks to Cybliminal #crikeycon

We're excited to announce we have Georgia back on stage with us to present 'Hacking Minds not machines: How meetings not malware can compromise your controls'!

Jumping on stage we have Simbo who will be talking all things SIEM in the talk "SIEM-less security; Panacea or placebo". Join us March 22 to see this talk and more at CrikeyCon. Get your ticket here: events.humanitix.com/crikeycon-x

CrikeyCon X

Get Tickets on Humanitix - CrikeyCon X hosted by Droppy & The Sleuth. Royal International Convention Centre (Royal ICC), 600 Gregory Terrace, Bowen Hills QLD 4006, Australia. Saturday 22nd March 2025....

events.humanitix.com

Come learn with Kelsy how to develop your cyber team as trustworthy within an org, rather than a compliance function, and how increasing levels of perceived legitimacy may allow security teams to further leverage employees as practical and informed resources!

Hey cyber people, Cybliminal have a ticket to @crikeycon.bsky.social X on 22nd March in Brisbane to giveaway. DM us if you are keen to attend.