SysAdmin Weekly Newsletter - #33 - The Battle-Hardened Blind Spot

[asyrewicze]

Hey everyone!

Issue 33 came out of my first time speaking at Black Hat, and then out of a session I sat in on while I was there.

What's inside:

• From the Console: Speaking at Black Hat for the first time, and the imposter syndrome that had me convinced a room full of security people would find my local-LLM spear phishing demo old news. I responded by making the talk MORE technical. Turnout was excellent and people were recording the attack chain. The lesson is about how much knowledge our industry sits on because everyone assumes somebody already covered it.
• The Take: We treat "old" and "legacy" as the same word, and generalist admins drop their guard on mature software. Not from lack of skill, but because most people are buried enough that lightening the mental security load by one item is a welcome mercy. Active Directory is the case study for why that costs you.
• Two CVEs worth knowing by name: Shai Laron's team at Semperis fuzzed UPN and SPN calls with unicode and got KerberLoss (CVE-2026-25177), an SPN collision that forces forest-wide NTLM fallback, and ResetNightmare (CVE-2026-27912), where any domain user can set their UPN to match another account's sAMAccountName and reset that password cold. Patched March 10 and April 14, 2026.
• Community Signal: João Ferreira on the July update that ended the RC4 audit phase and removed the domain-wide rollback key, plus Jerry Devore's AD hardening piece and the Event 4768 trick for finding which clients can only do RC4 rather than which ones you assumed could.
• Quick Win: A short Get-WinEvent block that hunts KDCSVC events 203, 204, 208, and 209 on your domain controllers. Those are enforcement-mode errors, so they are authentication that already failed, not a warning about later. Run it on every DC, not the one you always log into.
• The Podcast: Episode 056 with Eric Siron on how people actually get into this work, and which career advice survived thirty years of contact with reality.

Relevant Links Below!

Newsletter Link
Podcast Episode - YouTube
Podcast Episode - Spotify

What is the oldest piece of software still doing load-bearing work in your environment, and when did you last actually check whether anyone has published anything against it?