Security Weekly (Download Only)

As the prevalence of AI continues to grow, more and more people are worried about their online safety. New scams seem to be popping up every day, packaged in creative and terrifying ways. How do you protect yourself?

Frank Riccardi, Author of CTRL+ALT+PWN: The Hacker's Playbook (And How to Beat It), joins Business Security Weekly to discuss why it's not the technology that PWNs you, it's the trickery. Rather than resign yourself to an inevitable fate or remove yourself from the online world entirely, learn the tricks of the trade to avoid being just another pwned noob. Frank exposes the secret weapons, sneaky tactics, and psychological tricks used by hackers today—and discusses how to stop them.

Segment Resources:

• https://www.amazon.com/CTRL-ALT-PWN-Hackers-Playbook/dp/B0F8GP89NL

In the leadership and communications segment, CISO Problems That Can't Be Solved With Technology, When Being Authentic Undermines Your Leadership, Empower Your Most Curious Employees to Drive Your Digital Transformation, and more!

Show Notes: https://securityweekly.com/bsw-472

Patrick Stewart, Videostrong, C3RB3R, GitLab, VMware, BTCPay, Binance, Aaran Leyland, and More, on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-630

Following the catalog of CVEs is great for enumeration, but chasing those CVEs for patching is terrible for strategy. Jeremiah Grossman shows what breach data tells us about the differences between having over 400,000 CVEs, a few thousand KEVs, and a few hundred ways that attackers compromise orgs. We go into the importance of distinguishing vulns from exploits and where we see agents making a meaningful impact. Then we touch on some history of appsec and why the trajectory of vulns like SQL injection and XSS, along with well-known security controls, point to a more secure future -- or even possibly a pretty secure present.

Resources

• https://www.rootevidence.com/blog-posts/stop-chasing-cves/
• https://www.rootevidence.com/blog-posts/the-defender-window-is-longer-than-you-think/

Show Notes: https://securityweekly.com/asw-407

Interview with Casey Ellis

Our focus for this interview with Casey Ellis are the massive changes in:

• Vulnerability Discovery
• Vulnerability Disclosure
• Exploitation and Remediation

The goal is to understand how expectations and strategies should shift as a result. What do we, as an industry, and defenders need to do to ensure 2027 isn't a total train wreck?

Vibe Check

This week's vibe check explores the question, which security project always takes twice as long as planned?

• 55% - Enforcing data classification
• 18% - SOAR automation buildout
• 9% - Rolling out SSO
• 9% - Moving to passwordless auth
• 9% - AI agent discovery
• 0% - Other

News Segment

Finally, in the enterprise security news,

1. funding and M&A
2. PHP2Shell update
3. floods of bugs
4. silent train
5. breaches
6. the script kiddy bar has been lowered
7. the basics continue to be important
8. an AI lab pulls a PR stunt
9. an old squirrel story was a scam!

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-483

Mrfoofoospicy, Binance, Polymarket, Ada Lovelace, Silent Train, Robosurance, Privacy Piracy, Josh Marpet, and More on this episode of Security Weekly News.

Show Notes: https://securityweekly.com/swn-629

In the security news this week:

In the security news this week:

• Cisco says patch faster, then sells you time
• Turning AI refusals into vulnerability signals
• Brotli's are hiding
• WordPress image upload exploit
• Fortinet ships fixes before details
• PHP2Shell still claiming victims, including firewalls
• Uncoordinated disclosure
• Claude finds vulns, go figure
• PXE strikes again!
• Sony's PS5 bounty drama
• Apple's October patches reach older devices
• CISA looks ahead to 2030
• ArubaOS gets a pile of critical fixes
• New UK rules for protecting undersea infrastructure
• PortaPack Mayhem goes mobile
• Can AI agents police other AI agents?
• DHS bans DeepSeek
• A Chinese model writes riskier code for a US contractor
• eMudhra exits the TLS business
• BlackX bootkit exploits Secure Boot
• Signal makes hanging up harder than it should be
• Is AI solving math, or making it harder to trust?

Show Notes: https://securityweekly.com/psw-950

CyberSN just released their Cybersecurity Jobs Report through September 2026. We'll cover that in the leadership and communications segment along with, Only 7% of CISOs at Large Companies Own AI Governance, Our Favorite Management Tips on Delegating Effectively, CIOs unprepared for agentic workforce shift, and more!

Show Notes: https://securityweekly.com/bsw-471

Agents, Train Robberies, Jazz, Microsoft, Elvis Gyrates, Aaran Leyland, and More, on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-628

Proactive security doesn't have to wait for a vuln to be disclosed. Even if a patch isn't available, it's possible to deploy controls and design systems to be resilient against how vulns are exploited. Rashid Feroze talks about runtime security and the benefits of deploying eBPF filters to improve observability and block unauthorized behavior. He walks through scenarios related to supply chain attacks, prompt injections against agents, and responding to major events like PHP2Shell. We touch on threat models to help distinguish between what eBPF filters can protect against and what still requires secure coding discipline from developers.

Resources

• https://ebpf.io
• https://falco.org

Show Notes: https://securityweekly.com/asw-406

Interview with Barrett Lyon

Why do we need a Parallel Internet? Barrett details his journey to build truly private access to the Internet. My first thought was, "why not VPN? Why not TOR?" He has good answers to both. To get there, he had to ship his own hardware all over the world. He had to stand up a CDN. DNS. BGP. Anti-DDoS.

This is more than just a safer, more secure way to access the Internet - it is an API-driven, optionally agent-controlled software-defined network. And it's a consumer-priced product that starts at $6 a month? My head is spinning.

Note: this is NOT a sponsored segment, I'm just legitimately fascinated by it! When this was pitched to me, it sounded so outlandish, I almost passed on it. Then I saw that Barrett created and sold 5 companies, two of which were major anti-DDoS vendors. Clearly, this guy knows how to build serious, scalable infrastructure. Enjoy the conversation!

Segment Resources:

• The main website: https://doxx.net
• Doxx.net Discord channel: https://discord.gg/595hAxHH4
• Barrett's previous work mapping the internet for the Opte project: https://www.opte.org

Vibe Check

Which security acronym/phrases deserves to be retired?

• 38% - XDR
• 25% - Zero Trust
• 25% - UEBA
• 6% - CNAPP
• 6% - Non-Human
• 0% - Other (leave a comment)

Nothing like some acronym soup and buzzwords to really get people out to vote! Shared anger can be a powerful thing, and I'm here for the rants.

I have to agree with the top three votes: XDR, Zero Trust, and UEBA (User and Entity Behavior Analytics). CNAPP can see ya later, and since agents outnumber humans 100-1,000 to 1 now, can we call our user accounts "Pro-Human" instead of calling service accounts and agent IDs "Non-Human"?

I'm currently raising on this business concept - pre-revenue, pre-TAM, pre-founder, and pre-idea. Expecting to close a $150M pre-seed at a $100B post-money valuation in the next few weeks. Let me know if you want in. ????

Top Comments

• "Other - The "AI TRiSM" term can go kick the biggest of rocks"
• "Other - Shift left"
• "My god I have always hated zero trust and would love to see it die. What a stupid, over-the-top & exaggerated phrase to just basically mean that having a bunch of unauth/flat user roles things is bad… how an entire category of the industry managed to piggyback off cloud to make ZTNA a thing I've no idea. Also led to the annoying trend of overly segmenting all the things. rant over"

Enterprise Weekly News

Finally, in the enterprise security news,

1. We check out funding
2. There are a lot of acquisitions
3. And a round of layoffs
4. A tech startup goes out of business after two breaches
5. Private keys should be larger than "4"
6. PHP2Shell disrupts everyone's plans this week
7. Want to impress your friends with the quirkiest 2FA authenticator ever? Stick around until the end of the news.

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-482