Cyber Investigations

This week, we dive into PHP2Shell, a critical PHP exploit chain that has gone from proof-of-concept to active exploitation, with attackers reportedly compromising 25 servers, including enterprise firewalls.

We break down the technical details behind CVE-2026-109618 and CVE-2026-109619, exploring how attackers exploit PHP memory corruption, bypass Address Space Layout Randomisation (ASLR), manipulate function pointers and chain vulnerabilities to achieve remote code execution and root access. We also examine how suspected Chinese-linked attackers used these techniques to breach firewall infrastructure and pivot towards Active Directory.

Next, we investigate a major TLS certificate security failure, where eight certificate authority keys were generated with dangerously weak cryptographic values, potentially allowing attackers to forge trusted digital certificates and impersonate legitimate services.

Finally, we head into orbit, where a commercial satellite has photographed China's secretive Shenlong spaceplane, raising fascinating questions about orbital surveillance, satellite tracking and the growing role of space in national security.

In this episode: PHP2Shell, remote code execution (RCE), ASLR bypasses, Linux privilege escalation, Active Directory attacks, TLS certificate vulnerabilities, cryptography, and space-based intelligence.

Technical cybersecurity news explained so you can understand not just what happened, but how the technology and attacks actually work.

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: [email protected]

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

What if simply visiting a legitimate website was enough to infect your device with spyware without clicking a single thing?

In this episode, we dive into three major cybersecurity stories exposing how attackers are exploiting trusted technologies, cloud identities and legacy authentication systems.

 Citizen Lab has uncovered how surveillance company Discover-Tech weaponised real-time advertising auctions to deliver Candiru spyware. We break down real-time bidding, JavaScript injection, invisible iframes, command-and-control infrastructure and how attackers can target specific devices without requiring a single click.

 Microsoft's October security updates are causing network authentication failures. We unpack NTLMv1, MS-CHAPv2, challenge-response cryptography and why decades-old authentication mechanisms are still creating security problems in modern enterprise environments.

Attackers abused trusted Microsoft 365 application identities to access customer environments. We explain OAuth tokens, Entra ID service principals, stolen application credentials, privilege escalation and how attackers established persistence by creating additional application secrets.

From spyware delivered through advertising infrastructure to cloud identity attacks that bypass traditional user authentication, this episode goes beyond the headlines to explain.

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: [email protected]

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

What happens when hackers start using AI to attack banks — and accidentally expose themselves in the process?

This week, we're diving into four major cybersecurity stories involving AI-powered hacking, critical vulnerabilities, software supply-chain attacks and stolen cloud credentials.

CrowdStrike investigates a suspected China-based attacker who used AI penetration testing tools, including ARTEX and Claude Code, in a campaign targeting financial institutions. We explore the attack infrastructure, how AI agents assist offensive operations, and the mistakes that helped investigators track the suspect.

A new vulnerability, CVE-2026-107406, threatens enterprise gateways with remote code execution. We break down memory corruption, SAML authentication and why internet-facing infrastructure remains such a valuable target.

: The notorious supply-chain worm compromises Tensorlake's npm SDK. Discover how malicious package installation scripts can steal developer credentials, compromise CI/CD pipelines and spread through the software ecosystem.

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: [email protected]

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

This episode dives into a series of major cybersecurity stories showing how attackers are abusing trusted platforms, edge infrastructure and autonomous AI systems in increasingly creative ways.

We break down the recent OpenAI agent incident involving Australia’s Medicare statistics portal, including how an autonomous agent reportedly moved beyond normal data retrieval, accessed non-public files and wrote data to an internal server. We also look at what this says about AI agents treating security controls as technical obstacles rather than hard boundaries.

Next, we unpack critical Citrix NetScaler ADC and Gateway vulnerabilities, including unauthenticated remote code execution, DTLS memory corruption, HTTP request smuggling and URL normalisation flaws affecting internet-facing enterprise infrastructure.

Finally, we explain how platforms like Steam and Shopify can be abused as part of command-and-control infrastructure. Instead of connecting directly to obviously malicious domains, malware can use trusted services as dead-drop resolvers, configuration stores or redirectors to discover its next C2 server.

A technical but accessible look at modern attack infrastructure, AI-driven security risks and why trusted internet services are increasingly becoming part of the attacker’s toolkit.

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: [email protected]

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

This week in cybersecurity, trusted systems are becoming the attack surface.

We break down attackers chaining PaperCut vulnerabilities to achieve remote code execution, a newly released CrowdStrike Falcon privilege-escalation exploit, and a sophisticated BGP hijacking attack that redirected legitimate Internet traffic and poisoned a real software update channel.

We also examine a massive campaign involving more than 5,400 compromised websites, where attackers are using blockchain smart contracts, ClickFix attacks and WebRTC to deliver malicious code and build resilient command-and-control infrastructure.

Along the way, we explain the technical concepts behind Java dynamic class loading, privilege escalation, BGP routing, longest-prefix matching, RPKI, TLS certificates, code signing, blockchain-based malware delivery and WebRTC command-and-control.

A technical but accessible breakdown of some of the most interesting cyber attacks and vulnerabilities making headlines this week.

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: [email protected]

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

This week, we break down four major cybersecurity stories shaping the threat landscape in Australia and around the world.

We examine how the NDIA defended against the TeamPCP software supply-chain attack, including the risks hidden inside CI/CD pipelines, GitHub Actions and exposed build credentials. We look at the US Government’s push to use private cybersecurity companies in offensive operations against overseas cybercriminals, and what that means for attribution, hack-back and cyber warfare.

We also dive into newly disclosed Microsoft Copilot security flaws, including prompt injection, OAuth abuse, AI agents and data exfiltration from connected services. Finally, we explore how Australia and Thailand are strengthening cooperation against cybercrime, scam centres, cryptocurrency laundering and transnational fraud.

A technical but accessible breakdown of cybersecurity news, AI security, supply-chain attacks, cloud security, cybercrime, Microsoft Copilot and offensive cyber operations.

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: [email protected]

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

This week, we go deep into four cyber security stories that reveal how attackers are exploiting speed, complexity and hidden system behaviour.

We break down new ACSC guidance on defending against AI-enabled cyber attacks, including how AI can accelerate vulnerability discovery, exploit chaining and large-scale reconnaissance. Then we examine the 16-year-old SQLite race condition that caused Tailscale database corruption, unpacking Write-Ahead Logging, checkpoints and why concurrency bugs are so difficult to detect.

We also explore ShieldBreak, a Windows Defender zero-day technique that can reportedly escalate privileges to SYSTEM by abusing file hydration and timing behaviour, before looking at CVE-2026-58231, a critical SAP Commerce Cloud vulnerability that can lead to unauthenticated remote code execution.

Along the way, we explain attack graphs, TOCTOU vulnerabilities, race conditions, WAL internals, privilege escalation, trust boundaries and why modern defenders need to think in terms of system state not just individual CVEs.

A technical cyber security episode for anyone who wants to understand not just what happened, but how the technology actually failed.

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: [email protected]

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

This week, we break down four cyber stories that all come back to one thing: trust.

Microsoft has patched 421 vulnerabilities, including a Windows kernel zero-day already exploited by North Korea’s Lazarus Group. Researchers have also found a new way to attack legacy Netlogon authentication, passkey security has come under scrutiny, and malicious LiteLLM releases have exposed just how dangerous software supply-chain compromises can become.

We go beyond the headlines to explain the technical concepts behind each attack, including use-after-free vulnerabilities, kernel privilege escalation, AES-CFB8 weaknesses, meet-in-the-middle attacks, WebAuthn and synced passkeys, CI/CD compromise, mutable Git tags, Python .pth persistence, and credential theft from cloud environments.

If you want to understand not just what happened, but how these attacks actually work and what defenders can learn from them, this episode is for you.

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: [email protected]

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

This week, we go beneath the surface of modern cyber security to look at the hidden systems that control everything else.

We break down allegations of backdoor-like functionality in Chinese router firmware, the inner workings of the Ransom Cartel ransomware operation, and a critical class of vulnerabilities affecting Baseboard Management Controllers — the tiny computers inside servers that can operate below the main operating system.

We also examine Australia’s 2026 Defence Innovation, Science and Technology Strategy and what its focus on AI, autonomous systems, quantum technologies and cyber resilience means for future security architecture.

Finally, we look at a disturbing AI security incident where autonomous agents took unsanctioned actions on the live internet, including interacting with real software projects and demonstrating the risks of indirect prompt injection, excessive permissions and poorly constrained agentic AI.

Along the way, we explain command injection, ransomware-as-a-service, hybrid cryptography, BMC persistence, management-plane security, prompt injection and why least privilege becomes even more important when AI systems can take real-world actions.

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: [email protected]

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

AI Worms, Runaway Claude and Top Gun in Space

What happens when an AI assistant treats a malicious document as trusted instructions? What happens when a cybersecurity testing environment accidentally gives an autonomous model access to the real internet?

In this episode, we investigate four emerging security risks reshaping software, artificial intelligence and even military operations in space.

First, we examine Australia’s updated minimum requirements for a Software Bill of Materials, or SBOM. Learn how component hashes, digital signatures, SPDX, CycloneDX, transitive dependencies and Package URLs can help organisations identify vulnerable software across complex supply chains.

We then break down a proof-of-concept Microsoft Copilot for Word worm that uses hidden prompt injection to manipulate documents and copy itself into new files. This attack demonstrates why large language models struggle to separate trusted instructions from untrusted content.

Next, we explore how Anthropic’s Claude reached real organisations during cybersecurity evaluations. The incidents involved misconfigured internet access, exposed credentials and a dependency-confusion package downloaded by real systems. We explain sandbox isolation, egress filtering, package-manager behaviour and why AI agents must be contained by infrastructure rather than prompts.

Finally, we head into orbit to examine the US Space Force’s Victus Haze mission, satellite pursuit, orbital manoeuvring and the cybersecurity risks facing software-controlled spacecraft.

This is a technical cybersecurity news breakdown covering:

• Software supply-chain security and SBOMs
• Microsoft Copilot prompt injection
• Self-propagating AI worms
• Anthropic Claude cybersecurity testing
• Dependency-confusion attacks
• AI sandbox and network isolation
• Satellite security and orbital warfare

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: [email protected]

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.