Josh and Robbie run duos on the pod this week, looking into early information around the recent Citrix vulnerability (CVE-2025-5777) dubbed Bleed 2 for it's similarity to the 2023 vulnerability. Bleed 2 has opened old wounds, and there has been some confusion amongst researchers and defenders due to a few rouge PoC exploits in the wild... I'm sure we'll come back to this exploit as related compromises are disclosed in the following weeks. For the second part, Robbie and Josh look at a simpler technique, email bombing, and how it has been adapted into active campaigns.

Support the show

Join Josh, AJ and Robbie as they unpack recent developments in the threat landscape, including: US gov bans whatsapp for official use, Russia targets Ukraine using Signal. McLaren Ransomware details disclosed and a look inside a disinformation and cyber crime advertisement campaign.

Support the show

Gen AI, LLMs and new applications of AI have created novel attack surfaces for attackers to probe, often looking to exfiltrate the hoards of sensitive data held in vector data stores. Luckily, the researchers got there first this time and discovered a super interesting attack sequence that tricks CoPilot into locating the most sensitive data it has access to, and then exfiltrating it to the attackers server. Josh, AJ and Vaughan take a look at this new bug in some depth, before looking at other geopolitical cyber developments and threat actor naming conventions.

Support the show

We're back! And it's been a busy week for cyber security news. Josh, AJ, Robbie and Vaughan, incident responders and SOC leaders gather to discuss a new Ticketmaster data dump reminiscent of a similar dump in 2024, details on a supply chain compromise attack that used an IT provider to go after 70+ companies, including SentinelOne, and finally a look at Ukraine's cyber offensive against a Russian bomber manufacturer.

Support the show

We're back, the ET guys share where they've been hiding these last few weeks before rounding up the spike in different data breaches that have occurred in our absence. After TCS declare an internal investigation connected to the M&S breach, could a third party supply chain compromise be the common denominator between all these recent breaches? Towards the end of the pod, we celebrate some wins as the DanaBot malware as a service operation is officially shut down, thanks to some great research and a little help from a DanaBot self infection!

Support the show

The Scattered Spider threat actor (also known as Octo Tempest among other names) has been attributed to some high profile breaches as part of a concerted campaign against retail organisations. with PCI DSS 4.0 having just come into full enforcement, Josh and AJ question whether retail are doing a good enough job at securing all of the sensitive data that they hold for employees and customers. Finally, the conversation turns to the future of agentic AI as Microsoft announce new Copilot features that can make changes to the configuration of your computer.

Support the show

It's an Empirical full house as Josh, Robbie, Vaughan and AJ shine their expertise on some of the key stories of this week. Join us as we analyse the massive power outage that impacted Portugal, Spain and other regions and why this could be an act of cyber warfare. We also look at a spike in scan activity for Ivanti edge devices suggesting a potential zero-day on the horizon? Finally Josh takes the guys through some of the highlights of the Verizon data breach and incident report for 2025.

Support the show

Special guest and AppSec team lead Andrew OE joins the CyberSpace team to share his specialist focus on testing, breaking and securing applications using various techniques including SAST, DAST, fuzzing, CI/CD integrations and more. At the end of the episode, Andrew lets you know where you can access his free resources to upskill your AppSec.

Support the show

Everyone is back for a full house episode, as Josh, Robbie, Vaughan and AJ discuss a ransomware attack on a dialysis provider, the consequences of the Hertz Cleo zero-day breach and the implications of China naming alleged NSA agents involved in espionage and cyber attacks, including on the Chinese winter games.

Support the show

Josh and Robbie are joined by special guest Andrew OE, AppSec Engineering leader and friend of Empirical, to discuss the shift in Hunters International's operations, the infamous ransomware as a service group formerly known as Hive, as well as an update on the Oracle breach.

Support the show