Paul's Security Weekly (Video)

In the security news:

• Supermarket refrigeration attacks, again!
• Rapid7's Ivanti findings and why we can't have "nice" things
• Google's massive Android TV botnet takedown
• Linux TCP kernel flaw that no one is patching
• The Binance theft
• APT flaw gives out root
• PHP security debt
• The porn and Digital billboard problem
• Your own phone system to pwn
• From PoC to weaponized exploit
• Hacking to change time
• Rooting an Echo Dot
• Firmware should just work
• AI chained bugs into working exploits
• USB power states leak data across an air gap
• AI-assisted vulnerability finding
• GoAhead's TLS handling
• Hackers hijack emergency alert apps
• Taiwan's emergency services become an AI-agent target
• CUI exposed through GSA's Google Drive
• GCHQ can't account for thousands of storage devices
• Railway employee blames an attempted intrusion on AI
• VulnCheck opens its initial-access playground to the public

Show Notes: https://securityweekly.com/psw-951

In the security news this week:

In the security news this week:

• Cisco says patch faster, then sells you time
• Turning AI refusals into vulnerability signals
• Brotli's are hiding
• WordPress image upload exploit
• Fortinet ships fixes before details
• PHP2Shell still claiming victims, including firewalls
• Uncoordinated disclosure
• Claude finds vulns, go figure
• PXE strikes again!
• Sony's PS5 bounty drama
• Apple's October patches reach older devices
• CISA looks ahead to 2030
• ArubaOS gets a pile of critical fixes
• New UK rules for protecting undersea infrastructure
• PortaPack Mayhem goes mobile
• Can AI agents police other AI agents?
• DHS bans DeepSeek
• A Chinese model writes riskier code for a US contractor
• eMudhra exits the TLS business
• BlackX bootkit exploits Secure Boot
• Signal makes hanging up harder than it should be
• Is AI solving math, or making it harder to trust?

Show Notes: https://securityweekly.com/psw-950

Special guest Joshua Wright joins us for a timely incident-response discussion!

Then, in the security news this week:

• Have you heard about PHP2Shell?
• Certificates with keys small enough to guess
• Tor exit nodes turn into SSH credential traps
• Do USB-C cables need firmware updates now?
• HaleHound packs a radio lab into a cheap display
• Claude solves part of the NIST curve mystery
• The Army and self-directed offensive cyber agents
• Retired nuclear reactors return to power AI
• PatchSlop
• NGINX, NODE.js patches critical flaws
• BeyondTrust exploited before the patch landed
• Plex vulnerabilities move from PoC to exploitation
• ICS patches, including a Siemens flaw exploited in the wild
• Can fake data trigger Japan's emergency alert?
• Agentic pentests?
• AI may add noise more than skill
• AI agents navigate OT and move equipment
• AI model helps build a Chrome exploit
• Utah's VPN law runs into technical reality

Segment Resources:

https://dynamicincidentresponse.com/ - A New Era for Incident Response!

Show Notes: https://securityweekly.com/psw-949

In the security news this week:

• Convert this router into an SDR
• Ivanti straight to root
• Anthropic's AI worm FUD
• A kernel exploit to fix downloads
• Supermarket refrigeration attacks
• 400 mystery Java vulnerabilities
• Authentication bypass
• Russia meets the data-center war
• Stop & Shop attacked
• Anthropic cuts eval agents
• AI incident reporting
• FortiBleed lives
• Anthropic offers scanning
• Pre-compromised phones
• FakeGit returns
• Teams deepfake detection
• Let's Encrypt certificates get shorter
• GitLab ships another critical patch
• Engineer gets prison time for locking thousands of devices
• OpenAI employee accused of planting a hidden recorder

Show Notes: https://securityweekly.com/psw-948

In the security news this week:

• BPFDoor
• OpenSSH compresses a little too much
• AI can find bugs. Who gets them fixed?
• TP-Link and the courts
• Cisco NX-API
• ClingSTUN
• LineageOS, Android TV, and a Raspberry PI
• Dell's updater has a privilege problem
• SonicWall SSRF
• U-Boot's LogoFAIL like
• Exploit-DB isn't dead
• MFA passes. The attacker still gets in.
• LakeShark and cool gadgets
• Kasa cameras and an exposed debug interface
• SharePoint hardening is back on the checklist
• Google pauses open-source bug bounty submissions
• NetScaler's latest vulnerability needs a closer look
• Kiteworks tells customers to shut it down
• Exchange gets an unexpected security update
• Do LLMs actually reason?
• disagree on AI risk?
• Anthropic, AI consciousness and the Vatican
• Grok gets involved in foreign policy
• WordPress malware that survives cleanup
• Can spyware vendors stop their own tools?
• When an AI chatbot conversation reaches the police
• Open-weight AI models enter the cyber debate
• AI agents take their attacks shopping

Show Notes: https://securityweekly.com/psw-947

First up we talk with Threatlocker CTO Michael Jenkins about threat actors use of AI and keeping the bad things out with Zero Trust. Then in the security news:

• Compiling spreadsheets, because that's why
• Nvidia wants to put AI agents in timeout
• Citrix NetScaler gets exploited again, and again
• Spectre still refuses to die
• Your SBOM is incomplete?
• File notifications leak more than filenames
• ENIAC had cables instead of a BIOS
• Another Linux kernel root exploit lands
• Containers share a kernel
• ThinkNode M9 microSD card gets a virus notice
• Google analyst infiltrates a supply-chain gang
• Your phone speaker can transmit radio
• Reconstructing firmware with a logic analyzer
• Robot dogs learn cybersecurity
• CISA warns about third-party ICS integrators
• Dutch police arrest a ShinyHunters suspect
• A soldier goes from telecom hacking to prison
• AI companies discover their agents have opinions
• Cloudflare containers accidentally share leftovers
• OT networks are still mostly not isolated
• Florida wants to pause ChatGPT

The interview segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

Show Notes: https://securityweekly.com/psw-946

In the security news this week:

• Build your own router, or just buy one
• What to patch first
• But maybe don't buy D-Link
• AI nearly starts a war
• Flock cameras lose their keys
• The AI slowdown won't save bad security
• Opus at home, just slower
• Black Hat says fundamentals still work
• Hacker gadgets, and my top pick
• Gyazo screenshots
• Fake job interviews, real malware
• VINCE gets a new home
• Munich university gets disconnected
• LinkedIn fights the scraping machine
• SolarWinds hard-codes another bad idea
• Fake LastPass kills 145 security tools
• Colorado water gets its settings changed
• AI CEOs sell apocalypse and bonds
• The AI safety cult gets audited
• Ransomware recovery takes weeks, not hours
• TeamPCP's supply-chain tour continues
• Zuckoff hunts smart glasses

Show Notes: https://securityweekly.com/psw-945

In the security news this week:

• UK government rolls out passkeys to 20 million users
• Phishing-resistant authentication and replay resistance
• Passkey adoption, device security, and user acceptance
• EU Cyber Resilience Act guidance, scope, and compliance
• CRA vulnerability disclosure and reporting requirements
• The real cost of cyberattacks and cybersecurity spending
• Cyber insurance and improving organizational security
• Nightmare Eclipse and the release of Windows zero-days
• Check Point VPN vulnerabilities and perimeter security
• GitLab security updates and shadow IT
• Discovering unmanaged GitLab instances
• Cyberattacks against oil tankers and insider threats
• VPN patching and implied rules
• Zero-downtime GitLab updates and version management
• Running Windows ARM on Apple Silicon with VMware and Parallels

Show Notes: https://securityweekly.com/psw-944

In the security news this week:

• Microsoft patches all the things
• Commissary freezers enter cyberwar
• Fake AV, real Defender nap
• Rowhammer comes for the GPU
• BIOS updates are no longer optional
• CVSS is not a crystal ball
• Kworker, but make it malware
• FortiGate gets a post-exploitation RAT
• CERN goes Debian underground
• UEFI shells strike again
• Australia loses the plot, and phones
• Cisco routers become covert gateways
• MikroTik patches the takeover chain
• WeWorm wriggles through mobile
• The year of Linux television
• Browsers become backdoors
• Fake IT calls, real data theft
• CVE attribution gets weird
• Boston Scientific keeps talking
• Security tools misconfigure themselves
• AI circuit breakers for rogue agents
• Passkeys meet the real world
• Vibe coding, vibe vulnerabilities
• AI loss of control keeps climbing
• AI agents report themselves to Schneier

Show Notes: https://securityweekly.com/psw-943

First up: a technical segment on Linux threat hunting. We'll start this series by covering the best places to look for IoCs on Linux systems and devices, starting with startup services and scheduled tasks. Then, in the security news this week:

• SonicWall zero-days, again
• AI finds a pile of Cisco bugs, and a root RCE
• Claude Code Auto Mode dangers
• BGP hijacks your unsigned software update
• California, Linux and age verification
• Free movies, complimentary malware
• Citrix puts Linux alongside Windows
• Signal's "secure" enclave
• An expired domain answers military phone calls
• MORE Cheap Android TV boxes arrive pre-pwned
• CISA red teams meet critical infrastructure
• PaperCut vulnerability cuts both ways
• Big Tech asks everyone to secure its AI future
• Pacemaker monitoring
• DOJ files on a criminal leak site
• Water utility security, right after the breaches

Show Notes: https://securityweekly.com/psw-942