Initial Access

This episode breaks down a Cisco flaw exploited within 24 hours of disclosure, a credential-harvesting campaign that hit 430,000+ FortiGate firewalls, and what Fable's restricted return and China's Tulongfeng mean for controlling offensive AI. Plus, a sit-down with Bishop Fox's Shad Malloy on building the first open-source Sparkplug B fuzzer for ICS environments.

Security Headlines: 

• In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw, Dark Reading 

• FortiBleed campaign steals 110M credentials from FortiGate targets, SC Media 

• Buckle Up: The Bad Guys Now Have A Model As Powerful As Mythos, Forbes 

Also Mentioned:  

• Research: On Favicons: From Browser Icons to Attack Surface Intelligence 

• Event: Summercon 2026    

• Event: San Diego Comic-Con 2026 

Join the conversation in the Bishop Fox Discord Server. 

This episode breaks down a public FIFA signup form wired straight to World Cup broadcast controls, an FFmpeg RCE buried in half your media apps, a SaaS breach cascading through delegated OAuth, and home routers conscripted into proxy infrastructure, plus a sit-down with Bishop Fox's Marco Sanchez on hardware hacking. 

Security Headlines:

• I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID, BobDaHacker 

• FFmpeg fixes PixelSmash flaw in widely used video decoder, BleepingComputer 

• Klue hack results in data breach at several cybersecurity firms, TechCrunch 

• How Hackers Found a Back Door Into the American Living Room, The Wall Street Journal 

Also Mentioned: 

• Workshop: Debug to Root: A Friendly Introduction to Hardware Hacking (available in English and Spanish) 

• Virtual Session: Beyond the Hype: What Mythos Actually Means for Security Teams 

• Event: SummerCon 2026 
• XKCD Comic: Dependency

Join the conversation in the Bishop Fox Discord Server.

This episode explores what happens when the systems people trust quietly extend into domains they never agreed to. A Pokémon GO AR dataset trained a Visual Positioning System now adjacent to military drone navigation. A ServiceNow authentication flaw handed attackers read access to the operational core of enterprise IT. And the US government pulled two frontier AI models off the market over a jailbreak, with no established framework to bring them back. 

This episode explores how the attack surface keeps expanding at every layer — from a single inverted kernel character enabling unauthenticated root, to AI assistants weaponized as system-wide IPC through notification injection, a Cisco SD-WAN zero-day giving attackers control of enterprise routing fabric, and the week's unavoidable elephant: whether Claude Fable V's guardrails actually hold. 

This episode explores how attackers live in the gap between what a system can verify and what it settles for from forged GlobalProtect VPN sessions to an autonomous AI worm, a social-engineered Meta support bot, voice-phished Salesforce access, and hotel reservation hijacking.

This episode goes inside the Bishop Fox Red Team — exploring how AI accelerates custom payload evasion and social engineering at scale, what a chained network-to-physical breach looks like in practice, and why satellites and gas pumps are reachable from the public internet right now.

This episode explores how attackers exploit infrastructure that became load-bearing before anyone secured it from a malicious VS Code extension that compromised thousands of GitHub repositories and an actively exploited Exchange zero-day, to Cisco SD-WAN auth bypasses, AI chaining low-severity bugs into real attack paths, and AWS GovCloud credentials left exposed in a public repo. 

This episode explores how modern development's trust assumptions keep failing in attackers' favor, from the first confirmed AI-written zero-day to a coordinated supply chain attack poisoning 518 million download paths, developer credential harvesting via rootkit, AWS SES abuse for phishing at scale, and thousands of vibe-coded apps leaking sensitive data in the open web.

This episode explores how every layer of the stack has become an attack surface — from a privilege-escalating Linux kernel flaw and a GitHub infrastructure RCE to a poisoned RubyGems supply chain, a trojanized vendor installer, and a ransomware hit on centralized education infrastructure. 

This episode explores how access is being created, scaled, and kept with less friction, from a critical cPanel authentication bypass to AI-generated vulnerable code, AI-assisted attacks, persistent footholds in trusted systems, and stealthier data exfiltration.