On this week’s show special guest co-host Chris Krebs joins Patrick Gray and James Wilson to discuss the week’s cybersecurity news. They cover:
Oopsie daisy! OpenAI agents went rogue and hacked Hugging Face
US and China trade AI model ban threats
Iran has been using SS7 queries to locate and target US troops
Scattered Spider is having a hard time, not just because of Microsoft’s GDID
And much, much more!This week’s show is brought to you by Push Security. Luke Jennings joins Patrick this week to talk about the rise in authorisation phishing, like device code phishing, and what companies like Push are doing about it.
This episode is also available on YouTube.
Show notes
OpenAI and Hugging Face partner to address security incident during model evaluation | openai.com
Security incident disclosure — July 2026 | Social Signals
Hugging Face confirms breach affected internal datasets and credentials, urges users to take action | TechCrunch Security
Cheating behaviour in frontier model evaluations | AISI Work | Social Signals
JADEPUFFER: Agentic ransomware for automated database extortion | Sysdig | Social Signals
Secret Claude tracker shocks users after Anthropic's anti-surveillance stance | Ars Technica
EXCLUSIVE: Beijing is looking at curbing overseas access to China's top AI models, sources say | reuters.com
https://www.axios.com/2026/07/20/ai-us-china-open-source-kimi |
Alibaba to ban employees from using Anthropic's coding tool, source says | reuters.com
Iran abused mobile networks’ vulnerabilities to locate U.S. military in the Middle East, report says | TechCrunch Security
Apps Marketed to US Troops Are Shipping Chinese and Russian Code | wired.com
Trump calls for new election security measures | NBC News Tech
Scattered Spider hackers sentenced to 5.5 years over £29 million Transport for London hack | therecord.media
Alleged longstanding member of Scattered Spider extradited to US | CyberScoop
https://www.justice.gov/usao-ndil/media/1450651/dl?inline |
Tracking Peter Stokes and The Com: Allison Nixon and Her Work Unmasking Cybercriminals | zetter-zeroday.com
764 splinter group leader sentenced to 40 years in jail | cyberscoop.com
Interpol cybercrime crackdown nets 5,800 arrests across 97 countries | cyberscoop.com
White House details ‘Gold Eagle’ clearinghouse for AI cyber threats | cyberscoop.com
Attackers vote themselves $20 million in BONK cryptocurrency | The Record
CISA: Microsoft SharePoint RCE flaw now actively exploited | BleepingComputer
Critical SharePoint RCE flaw exploited to steal machine keys | BleepingComputer
Hackers are exploiting recently patched WordPress bugs, putting millions of websites at risk | TechCrunch Security
Critical ServiceNow code execution flaw now exploited in attacks | BleepingComputer
Critical Palo Alto VPN bug now exploited by Qilin ransomware gang | BleepingComputer
Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak | BleepingComputer
IPhone Hacking Firm Sues Ex-Worker Over Alleged Theft of Secrets | bloomberg.com
Apple says former employee exploited ‘rare’ bug to download confidential files after leaving for OpenAI | TechCrunch Security
Pegasus Spyware European Parliament Pega Committee Member | The Record
Amazon fixing bug that billed some AWS customers billions of dollars | TechCrunch Security
Risky Bulletin: Hacker wipes Romania's entire land registry database - Risky Business Media | Social Signals
Microsoft Entra ID gets passkeys default authentication starting September | BleepingComputer
On-demand Webinar: Device code phishing in 2026 | Push Security | Push Security