Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Jimmy Graham
Advent reminds us why Joseph’s faithful obedience matters in the Christmas story
During the Advent season, we remember the story of love incarnate, God stepping into our world to show us what true devotion looks like. Advent teaches us to wait, to expectantly hope, and to trust God’s timing even when the path ahead is uncertain. In that light, the quiet, costly commitment of Joseph, Jesus’ earthly father, gives us a shining example. To our modern culture obsessed with being seen and celebrated, Joseph’s patience, obedience and sacrificial love stand in stark contrast.
Memorial Day: For Those of Us Who Remain, Our Duty Is Not Done
Personalised advertising and content, advertising and content measurement, audience research and services development Store and/or access information on a device You can choose how your personal data is used.
Memorial Day: For Those of Us Who Remain, Our Duty Is Not Done
In our history as a nation we have lost many good servicemen and servicewomen. I, and many of you, have personally lost precious loved ones to the necessary cost of our freedom. Their day of recognition has been promoted from the honor of Veterans Day to the sanctity of Memorial Day. In 2012 I was the team lead in Benghazi, Libya. The infamous attack in September of that year - which inspired the movie titled "13 Hours: The Secret Soldiers of Benghazi" - occurred just weeks after I rotated home.
Memorial Day: For those of us who remain, our duty is not done
By Jimmy Graham U.S. Navy SEAL Real Clear Wire In our history as a nation, we have lost many good servicemen and servicewomen. I, and many of you, have personally lost precious loved ones to the necessary cost of our freedom. Their day of recognition has been promoted from the honor of Veterans Day to the sanctity of Memorial Day. In 2012, I was the team lead in Benghazi, Libya.
Memorial Day: For Those of Us Who Remain, Our Duty Is Not Done
In our history as a nation we have lost many good servicemen and servicewomen. I, and many of you, have personally lost precious loved ones to the necessary cost of our freedom. Their day of recognition has been promoted from the honor of Veterans Day to the sanctity of Memorial Day. In 2012 I was the team lead in Benghazi, Libya. The infamous attack in September of that year – which inspired the movie titled “13 Hours: The Secret Soldiers of Benghazi” – occurred just weeks after I rotated home.
COPELAND And GRAHAM: Marine Who Called For Afghanistan Accountability In Viral Video Should Have Resigned First
Hours after 13 American soldiers, including 11 Marines, and scores of Afghan civilians were killed in a suicide attack at the Kabul airport, Marine Corps Lt. Col. Stuart Scheller posted a video to Facebook in which he demanded accountability from military leadership. He singled out Secretary of Defense Lloyd Austin and Chairman of the Joint Chiefs of Staff Mark Milley for failing to provide better advice to President Joe Biden about how and when to withdraw all U.S. troops from Afghanistan.
Patch Tuesday – Septembre 2020 : 129 vulnérabilités dont 23 critiques affectant SharePoint, Exchange et les codecs Windows et vulnérabilités Adobe
Patch Tuesday – Septembre 2020 : 129 vulnérabilités dont 23 critiques affectant SharePoint, Exchange et les codecs Windows et vulnérabilités Adobe Le Patch Tuesday de ce mois traite 129 vulnérabilités dont 23 sont classées critiques. Ces 23 vulnérabilités critiques concernent SharePoint, Exchange, Dynamics 365, les codecs Windows ainsi que les postes de travail. Adobe a pour sa part publié des correctifs pour Experience Manager, Framemaker et InDesign.
May 2020 Patch Tuesday – 111 Vulns, 16 Critical, SharePoint, VS Code, Adobe Patches - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities Continuing the trend of large Microsoft Patch Tuesdays, this month’s addresses 111 vulnerabilities with 16 of them labeled as Critical. The 16 Critical vulnerabilities cover SharePoint, Browsers, Scripting Engines, Media Foundation, Microsoft Graphics, Microsoft Color Management, and the VS Code Python Extension. Adobe released patches today for Acrobat/Reader, and DNG SDK.
April 2020 Patch Tuesday – 113 Vulns, 19 Critical, Zero-Day Patches, SharePoint, Adobe ColdFusion - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities This month’s Microsoft Patch Tuesday addresses 113 vulnerabilities with 19 of them labeled as Critical. The 19 Critical vulnerabilities cover Adobe Font Manager Library (0-day), SharePoint, Hyper-V, Scripting Engines, Media Foundation, Microsoft Graphics, Windows Codecs, and Dynamics Business Central. Adobe released patches today for ColdFusion, After Effects, and Digital Editions.
February 2020 Patch Tuesday – 99 Vulns, 12 Critical, Patch for IE 0-Day, Exchange Vuln, Adobe Vulns - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities This month’s Microsoft Patch Tuesday addresses 99 vulnerabilities with 12 of them labeled as Critical. Of the 12 Critical vulns, 7 are for browser and scripting engines, 2 are for Remote Desktop Client, and the remaining 3 are for LNK files, Media Foundation, and Windows. The IE 0-day disclosed in January is patched as part of the scripting engine fixes. Microsoft also issued a patch for an RCE in Exchange.
The importance of proactive patch management
IT teams appreciate it when vendors or security researchers discover new vulnerabilities and develop patches for them. So do attackers. The same information that lets IT teams know where they may be vulnerable so they can take action, also lets attackers know where the weaknesses are – providing an opportunity and a map to guide them so they can develop an exploit.
December 2019 Patch Tuesday – 36 Vulns, 7 Critical, Actively Attacked Win32k vuln, Adobe vulns - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities This month’s Patch Tuesday is rather light and addresses 36 vulnerabilities, with only 7 labeled as Critical. Five of the seven Critical vulns are in Git for Visual Studio. The others are for Hyper-V and Win32k. Also, there is one actively attacked “Important” vuln in Win32k. Adobe released patches today covering Acrobat/Reader, ColdFusion, Photoshop, and Brackets.
November 2019 Patch Tuesday – 74 vulns, 13 Critical, Actively Attacked IE vuln, Hyper-V escapes, Adobe - Security Boulevard
This month’s Microsoft Patch Tuesday addresses 74 vulnerabilities with 13 of them labeled as Critical. Of the 13 Critical vulns, 5 are for browsers and scripting engines. Out of the 8 remaining Critical vulns, 4 are potential hypervisor escapes in Hyper-V, as well as vulnerabilities in Microsoft Exchange, Win32k, Windows Media Foundations, and OpenType. Adobe’s Patch Tuesday was on time this month, and covers 11 vulns spread across Animate, Illustrator, Media Encoder, and Bridge.
October 2019 Patch Tuesday – 59 vulns, 9 Critical, Azure App Service, Remote Desktop Client, PoC for Windows Error Reporting - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities This month’s Microsoft Patch Tuesday addresses 59 vulnerabilities with only 9 of them labeled as Critical. Of the 9 Critical vulns, 7 of them are for browsers and scripting engines. The remaining 2 are for Azure App Service and Remote Desktop Client. In addition, PoC code has been published for an Important Windows Error Reporting vulnerability.
Optimizing the patch management process
In this podcast recorded at Black Hat USA 2019, Jimmy Graham, Senior Director of Product Management at Qualys, discusses the importance of a tailored patch management process. Security obviously will have some say in a patch management process because a lot of patching is security driven, but patching is beyond just security, there’s also stability performance updates that have to be taken into account. Here’s a transcript of the podcast for your convenience.
July 2019 Patch Tuesday – 77 Vulns, 15 Critical, DHCP RCE, Exploited PrivEsc, SQL, Adobe Vulns - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities This month’s Microsoft Patch Tuesday addresses 77 vulnerabilities with 15 of them labeled as Critical. Of the 15 Critical vulns, 11 are for scripting engines and browsers, with the remaining four covering DHCP Server, GDI+, .NET Framework, and Azure DevOps Server / Team Foundation Server. In addition, Microsoft has released Important patches for two actively exploited privilege escalation vulnerabilities, as well as a SQL Server RCE.
Exim MTA Vulnerability (The Return of the WIZard – CVE-2019-10149) - Security Boulevard
Last week, Qualys issued a security advisory for a vulnerability we discovered during a code review of Exim. This vulnerability can lead to Remote Command Injection, and is currently being actively attacked in the wild. This blog will show you how to quickly identify assets that are impacted by this vulnerability. The Vulnerability This vulnerability exists in all versions of Exim’s MTA from version 4.87 to 4.91.
June 2019 Patch Tuesday – 88 Vulns, 21 Critical, Hyper-V Escape, Adobe Vulns - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities This month’s Microsoft Patch Tuesday addresses 88 vulnerabilities with 21 of them labeled as Critical. Of the 21 Critical vulns, 17 are for scripting engines and browsers, and 3 are potential hypervisor escapes in Hyper-V. The remaining vulnerability is an RCE in the Microsoft Speech API. Microsoft also issued guidance on Bluetooth Low Energy FIDO keys, HoloLens, and Microsoft Exchange. Adobe issues patches today for Flash, ColdFusion, and Campaign.
Windows RDP Remote Code Execution Vulnerability (BlueKeep) – How to Detect and Patch - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities This month’s Microsoft Patch Tuesday included a very high-risk vulnerability (CVE-2019-0708, aka BlueKeep) in Remote Desktop that impacts Windows XP, Windows 7, Server 2003, Server 2008, and Server 2008 R2. This vulnerability allows an unauthenticated attacker (or malware) to execute code on the vulnerable system. It is very likely that PoC code will be published soon, and this may result in a WannaCry-style attack.
Windows RDP Remote Code Execution Vulnerability (BlueKeep) – How to Detect and Patch | Qualys Blog
This month’s Microsoft Patch Tuesday included a very high-risk vulnerability (CVE-2019-0708, aka BlueKeep) in Remote Desktop that impacts Windows XP, Windows 7, Server 2003, Server 2008, and Server 2008 R2. This vulnerability allows an unauthenticated attacker (or malware) to execute code on the vulnerable system. It is very likely that PoC code will be published soon, and this may result in a WannaCry-style attack.
May 2019 Patch Tuesday – 79 Vulns, 22 Critical, RDP RCE, MDS Attacks, Adobe Vulns - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities This month’s Microsoft Patch Tuesday addresses 79 vulnerabilities with 22 of them labeled as Critical. Of the 22 Critical vulns, 18 are for scripting engines and browsers. The remaining 4 are remote code execution (RCE) in Remote Desktop, DHCP Server, GDI+, and Word. Microsoft also released guidance on the recently disclosed Microarchitectural Data Sampling (MDS) techniques, known as ZombieLoad, Fallout, and RIDL.
April 2019 Patch Tuesday – 74 Vulns, 16 Critical, 2 Actively Attacked, 1 PoC Exploit, Adobe Vulns - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities This month’s Patch Tuesday addresses 74 vulnerabilities, with 16 labeled as Critical. Eight of the Critical vulns are for scripting engines and browser components, impacting Microsoft browsers and Office, along with another 5 Critical vulns in MSXML. Two Critical remote code execution (RCE) vulnerabilities are patched in GDI+ and IOleCvt.
March 2019 Patch Tuesday – 65 Vulns, 18 Critical, RCEs in DHCP Client, Adobe Vulns - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities This month’s Patch Tuesday addresses 65 vulnerabilities, with 18 of them labeled as Critical. Thirteen of the Critical vulns are for scripting engines and browser components, impacting Microsoft browsers and Office. Three remote code execution (RCE) vulnerabilities are patched in the Windows DHCP Client, as well as an RCE vuln in Windows Deployment Services TFTP Server and Privilege Escalation in Microsoft Dynamics 365.
February 2019 Patch Tuesday – 74 Vulns, 20 Critical, Exchange 0-day, Adobe Vulns - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities This month’s Patch Tuesday is very large, with 74 vulns being addressed with 20 labeled as critical. Fifteen of these critical vulns are in the Scripting Engine and browsers, with the remainder being GDI+, SharePoint, and DHCP. Microsoft also issued an Advisory for an Exchange 0-day, along with a patch for one of the two reported vulns. Adobe also released updates for Acrobat/Reader, Flash, Coldfusion, and Creative Cloud.
January 2018 Patch Tuesday – 47 Vulns, 7 Critical, Adobe Vulns - Security Boulevard
SBN News Security Bloggers Network Vulnerabilities This month’s Patch Tuesday is medium in size, with 47 vulns covered and only 7 labeled as Critical. Twenty-six of the vulns apply to Windows Servers and Workstation operating systems. Two of the Criticals apply to Hyper-V and could lead to RCE on the host system. Microsoft also issued and out-of-band patch in December for Internet Explorer 9 through 11 due to active attacks in the wild.
November 2018 Patch Tuesday – 62 Vulns, TFTP Server RCE, Adobe PoC - Security Boulevard
Workstation Patches Browser and Scripting Engine patches should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users. Out of the 12 Critical vulnerabilities, 10 can be exploited through browsers or opening malicious files.
September 2018 Patch Tuesday – 61 Vulns, FragmentSmack, Hyper-V Escape - Security Boulevard
Browser and Scripting Engine patches should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. The PDF viewer, Windows image parsing, .net Framework, and Windows font library also have patches available that require a user to interact with a malicious site or file. With two of these vulnerabilities being publicly disclosed, it is important to prioritize Windows workstation patching.
August Patch Tuesday – 63 Vulns, L1TF (Foreshadow), Exchange, SQL, Active Attacks on IE flaw - Security Boulevard
In this month’s Patch Tuesday release there are 63 vulnerabilities patched with 20 Criticals. Out of the criticals, over half are browser-related, with the rest including Windows, SQL, and Exchange. Active exploits have been detected against CVE-2018-8373, one of the scripting engine vulnerabilities. Browser and Scripting Engine patches should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser.
July Patch Tuesday – Critical browser patches, Lazy FP, Exchange, Adobe vulns - Security Boulevard
This month’s Patch Tuesday is medium in weight, with 54 CVEs containing 17 Criticals. All but two of the Critical vulnerabilities are in Microsoft’s browsers or browser-related technologies. An additional speculative execution vulnerability announced in June was patched as well.
July Patch Tuesday – Critical browser patches, Lazy FP, Exchange, Adobe vulns | Qualys Blog
This month’s Patch Tuesday is medium in weight, with 54 CVEs containing 17 Criticals. All but two of the Critical vulnerabilities are in Microsoft’s browsers or browser-related technologies. An additional speculative execution vulnerability announced in June was patched as well.
June Patch Tuesday – new Speculative Store Bypass fixes, Adobe vulns - Security Boulevard
June’s Patch Tuesday is lighter weight compared to previous months. In all, 51 unique CVEs are addressed, with 11 CVEs marked as Critical. Adobe also released an out-of-band update for a Flash Player vulnerability last week, which is being actively exploited. Speculative Store Bypass Microsoft released patches for Speculative Store Bypass, also known as Spectre Variant 4.
March Patch Tuesday – 75 Microsoft vulnerabilities, 7 for Adobe - Security Boulevard
Today’s Patch Tuesday covers a lot of vulnerabilities, but in terms of critical updates, it is still light. Out of the 75 vulnerabilities covered, only 15 are marked as critical. Adobe has released a patches as well, covering 7 critical vulnerabilities. All of the critical vulnerabilities from Microsoft are in browsers and browser-related technologies. It is recommended that these be… This is a Security Bloggers Network syndicated blog post authored by Jimmy Graham.
Recline on the Qualys Couch: Examining Patching Behavior
In a perfect world, organizations would patch vulnerabilities immediately after they’re disclosed, preemptively blocking exploits and dodging most cyber attacks. Of course, reality is far from that hypothetically ideal state. Organizations often leave critical vulnerabilities unpatched for months, even years. Hackers routinely feast on all that low-hanging fruit to hijack systems, steal data, deface websites and disrupt operations. We all know it’s impossible to patch every single vulnerability.
February Patch Tuesday – 55 Microsoft vulnerabilities patched, 45 for Adobe - Security Boulevard
For this month’s Patch Tuesday, Microsoft has released patches covering 55 vulnerabilities, with 15 ranked as critical. This includes out-of-band Office patches from mid-January as well as patches for Adobe Flash that were released last week. From this list, there are patches for a vulnerability (CVE-2018-0825) that impacts StructuredQuery in Windows servers and workstations. Exploitation of… This is a Security Bloggers Network syndicated blog post authored by Jimmy Graham.
January Patch Tuesday – Meltdown/Spectre, 16 critical Microsoft patches, 1 Adobe patch - Security Boulevard
Due to the disclosure of Meltdown and Spectre, Microsoft released several patches last week with the ranking “Important.” While there are no active attacks against these vulnerabilities, a special focus should be placed on any of the browser patches, due to potential attacks using JavaScript. It is important to note that OS-level and BIOS (microcode) patches that are designed to… This is a Security Bloggers Network syndicated blog post authored by Jimmy Graham.
Countdown to GDPR: Manage Vulnerabilities
If your organization needs a compelling reason for establishing or enhancing its vulnerability management program, circle this date in bold, red ink on your corporate calendar: May 25, 2018. On that day, the EU’s General Data Protection Regulation (GDPR) goes into effect, intensifying the need for organizations to painstakingly protect EU residents’ data from accidental mishandling and foul play.
Proud To Be An American
Growing up in a military community, with the helicopters flying above, seeing my family literally walk through the door every day in their uniforms, you grow up with a sense of pride and respect for the flag. I know what the members of the military do and have done to uphold the flag so that we can do the things that we do. And so for me, the military is very close to my heart. Growing up, I always thought that I would be in the military. My road to football was a little different.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Jimmy
Contact Jimmy, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack