The bots have taken over—and they’re not just crawling your website. In this episode, we dig into the alarming reality that automated bots now generate over half of all internet traffic. Armed with artificial intelligence and cloaked in residential proxies, these bots are evolving beyond simple scripts into highly evasive, persistent threats targeting every industry.

We break down the latest findings from Imperva, F5, Thales, and more to explore:

• The explosive growth of bot traffic—and why 37% of it is now malicious.
• How AI is enabling attackers to scale, adapt, and bypass traditional defenses.
• The rise of Bots-as-a-Service (BaaS) and residential proxy networks that make it easier than ever to launch credential stuffing, account takeovers, data scraping, and automated fraud.
• Why APIs are the new front line for bot attacks.
• Real-world impacts: From chargebacks and churn to brand damage and regulatory risks.
• What modern bot mitigation looks like—and why your legacy WAF won’t cut it.

Whether you're in eCommerce, finance, government, or healthcare, this conversation will change how you think about traffic—and threat detection. Tune in to learn what your business must do to detect, adapt, and stay one step ahead in the escalating war against AI-powered bots.

In this episode, we investigate the massive data breach at VeriSource Services, Inc. (VSI), a Houston-based HR outsourcing and employee benefits administrator. Initially reported as affecting fewer than 2,000 individuals, the breach has now ballooned to a confirmed 4 million affected people. We trace the timeline from the initial detection of suspicious network activity on February 28, 2024, to the eventual notification of millions of impacted individuals beginning in April 2025.

Listeners will learn how sensitive information—names, addresses, birthdates, gender, and Social Security numbers—was exposed, and why this data combination poses a high risk of identity theft. We also unpack the reasons behind the prolonged disclosure process, VSI’s response efforts, the role of federal regulators, and the legal consequences now unfolding, including multiple class-action lawsuits.

Was this a case of evolving forensic findings—or of organizational opacity? And what does this incident tell us about third-party HR data security standards in 2025? Join us for a detailed breakdown of one of the year's largest and most quietly escalated data breaches.

Three actively exploited vulnerabilities—CVE-2025-42599 (Qualitia Active! mail), CVE-2025-3928 (Commvault Web Server), and CVE-2025-1976 (Broadcom Brocade Fabric OS)—have been added to CISA’s KEV catalog. The Qualitia flaw is a remote stack-based buffer overflow (CVSS 9.8) allowing code execution without authentication. Commvault's vulnerability permits authenticated attackers to deploy web shells for persistent access (CVSS 8.8), while Broadcom's code injection flaw lets local admin users escalate to root (CVSS 8.4). All three are confirmed to be under active exploitation.

CISA has issued remediation deadlines under BOD 22-01—May 17 for Qualitia and Commvault, and May 19 for Broadcom. Federal agencies must comply or disconnect affected assets. The KEV catalog’s inclusion signals reliable evidence of exploitation and elevates the urgency of patching beyond CVSS severity alone. Notably, Commvault's ecosystem also includes CVE-2025-34028, a separate unauthenticated path traversal vulnerability with PoC available, increasing its threat profile.

Web shells—used in the Commvault attack vector—highlight a broader trend in persistent access techniques. These scripts give attackers command execution abilities post-compromise, enabling exfiltration, lateral movement, and integration into broader C2 infrastructures. Effective countermeasures include integrity monitoring, privilege restrictions, and layered network defenses.

A wave of critical vulnerabilities in Planet Technology’s industrial switches and network management systems could let attackers hijack devices, steal data, and sabotage industrial networks—with no credentials required.

In this urgent episode, we dissect:
🔓 The 5 worst flaws (CVSS 9.3+)—from hard-coded database passwords to pre-auth command injection—discovered by Immersive Labs’ Kev Breen.
🏭 Why factories and critical infrastructure are prime targets: These switches are widely used in manufacturing, energy, and OT environments.
💻 How hackers exploit them:

• MongoDB exposed? Default creds (planet:123456) let attackers dump configs.
• Bypass auth entirely with a malformed URL parameter (/dispatcher.cgi?cmd=532&ip_URL=;).
• Intercept device communications due to hard-coded keys.
  🛡️ CISA’s emergency advisory (ICSA-25-114-06)—and why patching WGS, NMS, and UNI-NMS devices is non-negotiable.
  🔍 The researcher’s journey: How a home lab, firmware analysis, and a lucky accident uncovered these flaws.

If your network relies on Planet Technology switches, this episode is a wake-up call. Tune in before attackers beat you to the patch.

A critical, actively exploited vulnerability (CVE-2025-32432) is wreaking havoc on Craft CMS—allowing attackers to execute arbitrary PHP code on unpatched servers with no authentication required.

In this urgent episode, we break down:
💥 Why this flaw scores a perfect 10.0 CVSS—the highest severity rating possible.
🔍 How hackers are exploiting it: From stealing data to uploading PHP web shells (like filemanager.php) for persistent access.
🛠️ The root cause: A Yii framework regression (CVE-2024-58136) that lets attackers hijack servers via crafted __class payloads.
🌍 Real-world attacks: Evidence of in-the-wild exploitation since February 2025, with 13,000+ vulnerable instances still exposed.
⚡ The Metasploit factor: How a public exploit module is lowering the bar for cybercriminals.
🔒 Patch or perish: Why updating to Craft CMS 3.9.15/4.14.15/5.6.17 and Yii 2.0.52+ is non-negotiable.

Plus: Indicators of Compromise (IOCs) to check if you’ve been hit, and why "just patching" isn’t enough—malicious files persist even after updates.

If you run Craft CMS, this episode is a must-listen. Tune in before your server becomes the next victim.

Recent research by HiddenLayer has uncovered a shocking new AI vulnerability—dubbed the "Policy Puppetry Attack"—that can bypass safety guardrails in all major LLMs, including ChatGPT, Gemini, Claude, and more.

In this episode, we dive deep into:
🔓 How a single, cleverly crafted prompt can trick AI into generating harmful content—from bomb-making guides to uranium enrichment.
💻 The scary simplicity of system prompt extraction—how researchers (and hackers) can force AI to reveal its hidden instructions.
🛡️ Why this flaw is "systemic" and nearly impossible to patch, exposing a fundamental weakness in how AI models are trained.
⚖️ The ethical dilemma: Should AI be censored? Or is the real danger in what it can do, not just what it says?
🔮 What this means for the future of AI security—and whether regulation can keep up with rapidly evolving threats.

We’ll also explore slopsquatting, a new AI cyberattack where fake software libraries hallucinated by chatbots can lead users to malware.

Is AI safety a lost cause? Or can developers outsmart the hackers? Tune in for a gripping discussion on the dark side of large language models.

In this episode, we break down the most urgent cybersecurity developments from late April 2025—including the Lazarus Group’s high-profile “Operation SyncHole” targeting South Korean industries. Discover how attackers are exploiting newly disclosed vulnerabilities faster than ever, with nearly 1 in 3 CVEs weaponized within 24 hours of publication.

We dive deep into the Lazarus Group's tactics, including watering hole attacks, one-day and potential zero-day vulnerabilities in tools like Innorix Agent and Cross EX, and their deployment of advanced malware families like ThreatNeedle and AGAMEMNON.

But that’s not all—we also cover:

• The evolution of phishing-as-a-service with generative AI (Darcula and Gamma AI),
• The increasing exploitation of browsers as attack surfaces,
• A Linux rootkit that avoids detection by bypassing system calls,
• Nation-state cyber activity from Russia, China, Iran, and North Korea,
• And the silent crisis looming over the CVE program’s future funding.

Plus, we explore the growing importance of non-human identities (NHIs) in security strategies, and the ongoing risks in software supply chains—from malicious npm packages to cryptocurrency library compromises.

If you're a cybersecurity professional or threat analyst, this is your essential 30-minute intel download.

In this episode, we dissect the real-world challenges of securing Microsoft 365 environments—especially for small and medium-sized businesses—amid rising threats and licensing limitations.

From Reddit frustrations to official Microsoft documentation, we explore the harsh truth: many essential security features, like alerting on suspicious logins, require Azure AD Premium or Defender for Cloud Apps. Can SMBs still stay secure without these? We look at third-party workarounds and how far PowerShell and community tools like Admindroid can go.

We also take a hard look at OAuth 2.0 phishing—a growing tactic used by Russian threat actors to hijack accounts via malicious app consent. Learn how attackers are bypassing traditional login alerts by quietly enrolling new devices, and how Microsoft recommends detecting these OAuth abuses through risky app investigation and alert configuration.

Other key topics include:

• How to manage access from unmanaged devices using Conditional Access (and the licensing hurdles involved)
• Why Microsoft’s default alert policies fall short—and how to build custom ones for better protection
• What "trusted device" really means in a Zero Trust world, and how attackers are exploiting that ambiguity
• A checklist of practical security recommendations specifically for Microsoft 365 Business users

Whether you’re an IT admin trying to protect your org with basic licenses, or a security lead facing OAuth phishing on the front lines, this episode offers concrete strategies, policy insights, and a dose of real talk.

🎧 Tune in and learn how to secure Microsoft 365—even when your tools are limited and the threats are anything but.

Microsoft has acknowledged a serious issue affecting users of classic Outlook for Windows: CPU usage spikes up to 50% just from typing emails. First appearing in builds released since November 2024, this bug is now hitting users across several update channels—including Current, Monthly Enterprise, and Insider—leading to power drain, sluggish performance, and user frustration.

In this episode, we unpack:

• What’s causing the CPU spike when typing
• Why Microsoft’s workaround is a trade-off between stability and security
• How switching to the Semi-Annual Channel may help
• The long and growing list of classic Outlook bugs, from calendar sync errors to crashes and UI glitches
• What this means for IT teams managing enterprise deployments
• Whether it’s finally time to move to the “New Outlook” or look at alternatives

We also explore Microsoft's update channels, why managing Outlook versions is so complex, and what this bug reveals about the future of the classic Outlook client.

🔧 Fix pending. Workarounds available. But is this the tipping point?

#Outlook #Microsoft365 #EmailClient #ITAdmin #SysAdmin #TechPodcast #ProductivityApps #InfoSec #PatchTuesday

A newly discovered Android spyware campaign is targeting Russian military personnel by weaponizing a popular mapping app. Disguised as a cracked version of Alpine Quest Pro, this trojanized app delivers Android.Spy.1292.origin—a powerful surveillance tool that steals data, tracks location in real-time, and downloads secondary payloads to extract confidential files from apps like Telegram and WhatsApp.

In this episode, we break down:

• How the malware is distributed through Telegram and Russian app catalogs
• What makes this attack stealthy and effective (fully functional app + hidden spyware)
• The scope of data being exfiltrated, including location logs and secure messaging content
• The broader implications for mobile device security in military environments
• Why cracked apps are an increasingly common cyber weapon in conflict zones

We also look at past incidents targeting Ukrainian forces and explore what this reveals about evolving cyber espionage tactics on both sides of the war.

This is a critical discussion for anyone interested in mobile security, military tech, and the intersection of modern warfare and cyber intelligence.

#MobileSecurity #Spyware #AndroidMalware #MilitaryCybersecurity #CyberEspionage #AlpineQuest #AndroidSpyware #Infosec #OperationalSecurity #MDM #ThreatIntel #Podcast