How do we handle scope creep for vulnerabilities?, find the bugs before it hits the real world, risk or hype vulnerabilities, RTL-SDR in a browser, using AI to hack AI and protect AI, 73 vulnerabilities of which 0 patches have been issued, Spinning Cats, bypassing WDAC with Teams and JavaScript, Rust will solve all the security problems, did you hear some Signal chats were leaked?, ingress nginx, robot dogs, what happens to your 23andme data?, Oracle's cloud was hacked, despite what Oracle PR says, inside the SCIF, and cvemap to the rescue. Visit <a rel="noopener" target="_blank" href= "https://www.securityweekly.com/psw">https://www.securityweekly.com/psw</a> for all the latest episodes! Show Notes: <a rel="noopener" target="_blank" href= "https://securityweekly.com/psw-867">https://securityweekly.com/psw-867</a>

How do we handle scope creep for vulnerabilities?, find the bugs before it hits the real world, risk or hype vulnerabilities, RTL-SDR in a browser, using AI to hack AI and protect AI, 73 vulnerabilities of which 0 patches have been issued, Spinning Cats, bypassing WDAC with Teams and JavaScript, Rust will solve all the security problems, did you hear some Signal chats were leaked?, ingress nginx, robot dogs, what happens to your 23andme data?, Oracle's cloud was hacked, despite what Oracle PR says, inside the SCIF, and cvemap to the rescue. Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-867

How do we handle scope creep for vulnerabilities?, find the bugs before it hits the real world, risk or hype vulnerabilities, RTL-SDR in a browser, using AI to hack AI and protect AI, 73 vulnerabilities of which 0 patches have been issued, Spinning Cats, bypassing WDAC with Teams and JavaScript, Rust will solve all the security problems, did you hear some Signal chats were leaked?, ingress nginx, robot dogs, what happens to your 23andme data?, Oracle's cloud was hacked, despite what Oracle PR says, inside the SCIF, and cvemap to the rescue. Visit <a href="https://www.securityweekly.com/psw" rel="noopener noreferrer">https://www.securityweekly.com/psw</a> for all the latest episodes! Show Notes: <a href="https://securityweekly.com/psw-867" rel="noopener noreferrer">https://securityweekly.com/psw-867</a>

SignalGate and How Not To Protect Secrets - PSW #867

This week: Compliance, localization, blah blah, the Greatest Cybersecurity Myth Ever Told, trolling Microsoft with a video, Github actions give birth to a supply chain attack, prioritizing security research, I'm tired of 0-Days that are not 0-Days, sticking your head in the sand and believing everything is fine, I'm excited about AI crawlers, but some are not, Room 641A, a real ESP32 vulnerability, do we need a CVE for every default credential?, smart Flipper Zero add-ons, one more reason why people fear firmware updates, no more Windows 10, you should use Linux, and I have a Linux terminal in my pocket, now what? Visit <a rel="noopener" target="_blank" href= "https://www.securityweekly.com/psw">https://www.securityweekly.com/psw</a> for all the latest episodes! Show Notes: <a rel="noopener" target="_blank" href= "https://securityweekly.com/psw-866">https://securityweekly.com/psw-866</a>

This week: Compliance, localization, blah blah, the Greatest Cybersecurity Myth Ever Told, trolling Microsoft with a video, Github actions give birth to a supply chain attack, prioritizing security research, I'm tired of 0-Days that are not 0-Days, sticking your head in the sand and believing everything is fine, I'm excited about AI crawlers, but some are not, Room 641A, a real ESP32 vulnerability, do we need a CVE for every default credential?, smart Flipper Zero add-ons, one more reason why people fear firmware updates, no more Windows 10, you should use Linux, and I have a Linux terminal in my pocket, now what? Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-866

This week: Compliance, localization, blah blah, the Greatest Cybersecurity Myth Ever Told, trolling Microsoft with a video, Github actions give birth to a supply chain attack, prioritizing security research, I'm tired of 0-Days that are not 0-Days, sticking your head in the sand and believing everything is fine, I'm excited about AI crawlers, but some are not, Room 641A, a real ESP32 vulnerability, do we need a CVE for every default credential?, smart Flipper Zero add-ons, one more reason why people fear firmware updates, no more Windows 10, you should use Linux, and I have a Linux terminal in my pocket, now what? Visit <a href="https://www.securityweekly.com/psw" rel="noopener noreferrer">https://www.securityweekly.com/psw</a> for all the latest episodes! Show Notes: <a href="https://securityweekly.com/psw-866" rel="noopener noreferrer">https://securityweekly.com/psw-866</a>

Its Not Really A 0-Day - PSW #866

Sounil Yu joins us to kick things off with AI defenses: Enterprise AI search tools like Copilot for Microsoft 365 lack the in-depth access controls required to ensure that query responses align with the user's need-to-know boundaries. Without proper controls, these tools accelerate the discovery of improperly secured sensitive files within the organization. Knostic's solution ensures that enterprise data is safeguarded without slowing down innovation. By automating the detection and remediation of LLM data exposure, Knostic helps organizations mitigate the security, privacy, and compliance risks associated with AI chatbots and enterprise search tools. In the security news: The controversial pick for National Cyber Director, the not-so-controversial pick to lead CISA, complete with funding cuts, the controversial ESP32 backdoor that is not a backdoor but hidden features, Dark Storm takes down X, interesting use cases for LoRa, using AI to get your dream job, details on the biggest crypto heist in history, an EDR bypass and a 404 error, slipping through the cracks in CVSS, old school vulnerability disclosure in 2025, Rayhunter, a pen test that should not have been, JTAG and your Flipper Zero, a Linux webcam was used for what now?, and "Spatial-Domain Wireless Jamming with Reconfigurable Intelligent Surfaces"! Segment Resources: * <a rel="noopener" target="_blank" href= "https://www.knostic.ai/blog/enterprise-ai-search-tools-addressing-the-risk-of-data-leakage"> https://www.knostic.ai/blog/enterprise-ai-search-tools-addressing-the-risk-of-data-leakage</a> * <a rel="noopener" target="_blank" href= "https://www.knostic.ai/what-we-do">https://www.knostic.ai/what-we-do</a> Visit <a rel="noopener" target="_blank" href= "https://www.securityweekly.com/psw">https://www.securityweekly.com/psw</a> for all the latest episodes! Show Notes: <a rel="noopener" target="_blank" href= "https://securityweekly.com/psw-865">https://securityweekly.com/psw-865</a>

Sounil Yu joins us to kick things off with AI defenses: Enterprise AI search tools like Copilot for Microsoft 365 lack the in-depth access controls required to ensure that query responses align with the user's need-to-know boundaries. Without proper controls, these tools accelerate the discovery of improperly secured sensitive files within the organization. Knostic's solution ensures that enterprise data is safeguarded without slowing down innovation. By automating the detection and remediation of LLM data exposure, Knostic helps organizations mitigate the security, privacy, and compliance risks associated with AI chatbots and enterprise search tools. In the security news: The controversial pick for National Cyber Director, the not-so-controversial pick to lead CISA, complete with funding cuts, the controversial ESP32 backdoor that is not a backdoor but hidden features, Dark Storm takes down X, interesting use cases for LoRa, using AI to get your dream job, details on the biggest crypto heist in history, an EDR bypass and a 404 error, slipping through the cracks in CVSS, old school vulnerability disclosure in 2025, Rayhunter, a pen test that should not have been, JTAG and your Flipper Zero, a Linux webcam was used for what now?, and "Spatial-Domain Wireless Jamming with Reconfigurable Intelligent Surfaces"! Segment Resources: * https://www.knostic.ai/blog/enterprise-ai-search-tools-addressing-the-risk-of-data-leakage * https://www.knostic.ai/what-we-do Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-865

Sounil Yu joins us to kick things off with AI defenses: Enterprise AI search tools like Copilot for Microsoft 365 lack the in-depth access controls required to ensure that query responses align with the user's need-to-know boundaries. Without proper controls, these tools accelerate the discovery of improperly secured sensitive files within the organization. Knostic's solution ensures that enterprise data is safeguarded without slowing down innovation. By automating the detection and remediation of LLM data exposure, Knostic helps organizations mitigate the security, privacy, and compliance risks associated with AI chatbots and enterprise search tools. In the security news: The controversial pick for National Cyber Director, the not-so-controversial pick to lead CISA, complete with funding cuts, the controversial ESP32 backdoor that is not a backdoor but hidden features, Dark Storm takes down X, interesting use cases for LoRa, using AI to get your dream job, details on the biggest crypto heist in history, an EDR bypass and a 404 error, slipping through the cracks in CVSS, old school vulnerability disclosure in 2025, Rayhunter, a pen test that should not have been, JTAG and your Flipper Zero, a Linux webcam was used for what now?, and "Spatial-Domain Wireless Jamming with Reconfigurable Intelligent Surfaces"! Segment Resources: * <a href="https://www.knostic.ai/blog/enterprise-ai-search-tools-addressing-the-risk-of-data-leakage" rel="noopener noreferrer"> https://www.knostic.ai/blog/enterprise-ai-search-tools-addressing-the-risk-of-data-leakage</a> * <a href="https://www.knostic.ai/what-we-do" rel="noopener noreferrer">https://www.knostic.ai/what-we-do</a> Visit <a href="https://www.securityweekly.com/psw" rel="noopener noreferrer">https://www.securityweekly.com/psw</a> for all the latest episodes! Show Notes: <a href="https://securityweekly.com/psw-865" rel="noopener noreferrer">https://securityweekly.com/psw-865</a>

AI Is Oversharing and Leaking Data - Sounil Yu - PSW #865

Apple, the UK, and data protection, you can get pwned really fast, Australia says no Kaspersky for you!, the default password is on the Internet, topological qubits, dangerous AI tools, old software is not just old but vulnerable too, tearing down Sonic Walls, CWE is good but could be great, updating your pi-hole, should you watch "Zero Day"? my non-spoiler review will tell you, no more DBX hellow SBAT!, and I love it when chat logs of secret not-so-secret ransomware groups are leaked! Visit <a rel="noopener" target="_blank" href= "https://www.securityweekly.com/psw">https://www.securityweekly.com/psw</a> for all the latest episodes! Show Notes: <a rel="noopener" target="_blank" href= "https://securityweekly.com/psw-863">https://securityweekly.com/psw-863</a>

Apple, the UK, and data protection, you can get pwned really fast, Australia says no Kaspersky for you!, the default password is on the Internet, topological qubits, dangerous AI tools, old software is not just old but vulnerable too, tearing down Sonic Walls, CWE is good but could be great, updating your pi-hole, should you watch "Zero Day"? my non-spoiler review will tell you, no more DBX hellow SBAT!, and I love it when chat logs of secret not-so-secret ransomware groups are leaked! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-863

Apple, the UK, and data protection, you can get pwned really fast, Australia says no Kaspersky for you!, the default password is on the Internet, topological qubits, dangerous AI tools, old software is not just old but vulnerable too, tearing down Sonic Walls, CWE is good but could be great, updating your pi-hole, should you watch "Zero Day"? my non-spoiler review will tell you, no more DBX hellow SBAT!, and I love it when chat logs of secret not-so-secret ransomware groups are leaked! Visit <a href="https://www.securityweekly.com/psw" rel="noopener noreferrer">https://www.securityweekly.com/psw</a> for all the latest episodes! Show Notes: <a href="https://securityweekly.com/psw-863" rel="noopener noreferrer">https://securityweekly.com/psw-863</a>

Zero Days Are Not Just Fiction - PSW #863

We had the pleasure of finally having Dave Lewis on the show to discuss shadow IT and security debt. Dave shared some fascinating insights from his long career in cybersecurity, emphasizing the importance of addressing fundamental security issues and the human aspect of security. We delved into the challenges of managing shadow IT, the complexities of security debt, and the need for organizations to prioritize security practices. Overall, it was a great conversation that highlighted the ongoing struggles in our industry and the importance of learning from past mistakes to build a more secure future. Google's cookie encryption drama, Microsoft accusing Google of shady antitrust tactics, AI shenanigans, the rejected Defcon talk and hacking traffic lights, vulnerabilities in Realtek SD card readers, the never-ending debate on quantum computing vs. cryptography, backdoors are not secrets and where we are pushing attackers, firmware leakage, more on Windows Downgrade (and UEFI locks), super nerdy Linux things, EDR is dead, well not really but more on how to make it not phone home, bypassing memory scanners, couple of Bluetooth hacking things, and a really awesome article about an IoT 0-Day that is no longer on the Internet. Visit <a rel="noopener" target="_blank" href= "https://www.securityweekly.com/psw">https://www.securityweekly.com/psw</a> for all the latest episodes! Show Notes: <a rel="noopener" target="_blank" href= "https://securityweekly.com/psw-849">https://securityweekly.com/psw-849</a>

We had the pleasure of finally having Dave Lewis on the show to discuss shadow IT and security debt. Dave shared some fascinating insights from his long career in cybersecurity, emphasizing the importance of addressing fundamental security issues and the human aspect of security. We delved into the challenges of managing shadow IT, the complexities of security debt, and the need for organizations to prioritize security practices. Overall, it was a great conversation that highlighted the ongoing struggles in our industry and the importance of learning from past mistakes to build a more secure future. Google's cookie encryption drama, Microsoft accusing Google of shady antitrust tactics, AI shenanigans, the rejected Defcon talk and hacking traffic lights, vulnerabilities in Realtek SD card readers, the never-ending debate on quantum computing vs. cryptography, backdoors are not secrets and where we are pushing attackers, firmware leakage, more on Windows Downgrade (and UEFI locks), super nerdy Linux things, EDR is dead, well not really but more on how to make it not phone home, bypassing memory scanners, couple of Bluetooth hacking things, and a really awesome article about an IoT 0-Day that is no longer on the Internet. Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-849

We had the pleasure of finally having Dave Lewis on the show to discuss shadow IT and security debt. Dave shared some fascinating insights from his long career in cybersecurity, emphasizing the importance of addressing fundamental security issues and the human aspect of security. We delved into the challenges of managing shadow IT, the complexities of security debt, and the need for organizations to prioritize security practices. Overall, it was a great conversation that highlighted the ongoing struggles in our industry and the importance of learning from past mistakes to build a more secure future. Google's cookie encryption drama, Microsoft accusing Google of shady antitrust tactics, AI shenanigans, the rejected Defcon talk and hacking traffic lights, vulnerabilities in Realtek SD card readers, the never-ending debate on quantum computing vs. cryptography, backdoors are not secrets and where we are pushing attackers, firmware leakage, more on Windows Downgrade (and UEFI locks), super nerdy Linux things, EDR is dead, well not really but more on how to make it not phone home, bypassing memory scanners, couple of Bluetooth hacking things, and a really awesome article about an IoT 0-Day that is no longer on the Internet. Visit <a href="https://www.securityweekly.com/psw" rel="noopener noreferrer">https://www.securityweekly.com/psw</a> for all the latest episodes! Show Notes: <a href="https://securityweekly.com/psw-849" rel="noopener noreferrer">https://securityweekly.com/psw-849</a>

Shadow IT and Security Debt - Dave Lewis - PSW #849

This week on Security Weekly, we interview Jon Searles and Will Genovese, the founders of NESIT Hackerspace and organizers of B-Sides Connecticut. In this listener feedback segment, we will answer the question "should you implement your own Crypto?" Security news this week will uncover password breaches galore and Facebook listening to your conversations. Also, congrats! You got a new laptop! And a boatload of vulnerabilities out of the box!

This week on Security Weekly, we interview Jon Searles and Will Genovese, the founders of NESIT Hackerspace and organizers of B-Sides Connecticut. In this listener feedback segment, we will answer the question "should you implement your own Crypto?" Security news this week will uncover password breaches galore and Facebook listening to your conversations. Also, congrats! You got a new laptop! And a boatload of vulnerabilities out of the box!

This week on Security Weekly, we interview Jon Searles and Will Genovese, the founders of NESIT Hackerspace and organizers of B-Sides Connecticut.&nbsp;In this listener feedback segment, we will answer the question "should you implement your own Crypto?"&nbsp;Security news this week will uncover password breaches galore and Facebook listening to your conversations. Also, congrats! You got a new laptop! And a boatload of vulnerabilities out of the box!

Security Weekly #467 - "It's Not About The Gin"

Paul's Security Weekly #466 - "8-Inch Floppy"

Paul's Security Weekly #465 - "Make Me A Drink"

Paul's Security Weekly 464 - Dr. Douglas White, Ph.D

Paul's Security Weekly #463 - Interview with Ferruh Mavituna, CEO of Netsparker

Paul's Security Weekly #462 - Interview with Sean Metcalf, Microsoft Certified Master

Paul's Security Weekly #461 - Jeff's Round Table

Paul's Security Weekly #460 - Interview with Lee Holmes

Paul's Security Weekly #442 - Interview with Ferruh Mavituna and Stories

Paul's Security Weekly #441 - Interview with Marton Linvy & Barton Miller from SWAMP

For the latest in computer security news, hacking, and research!  We sit around, drink beer, and talk security.  Our show will feature technical segments that show you how to use the latest tools and techniques.  Special guests appear on the show to enlighten us and change your perspective on information security. Note: This is only Paul's Security Weekly, a 2-hour show recorded once per week.

News

Technology

Tech News

For the latest in computer security news, hacking, and research! We sit around, drink beer, and talk security. Our show will feature technical segments that show you how to use the latest tools and techniques. Special guests appear on the show to enlighten us and change your perspective on information security. Note: This is only Paul's Security Weekly, a 2-hour show recorded once per week.

Share Paul's Security Weekly (Audio)

Sign up to save your podcasts

Paul's Security Weekly (Audio)

Paul's Security Weekly (Audio) episodes

About Paul's Security Weekly (Audio)

Best of Paul's Security Weekly (Audio)

More shows like Paul's Security Weekly (Audio)

Hacked

Security Now (Audio)

Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec

Risky Business

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

CyberWire Daily

Smashing Security

Click Here

Darknet Diaries

Cybersecurity Today

Hacking Humans

Defense in Depth

Cybersecurity Headlines

Risky Bulletin

Hacker And The Fed