Security Weekly Podcast Network (Video)

This week in the security news:

• Linux process injection
• Threat actors need training too
• A Linux device "capable of practically anything"
• The Internet of webcams
• Hacking cheap devices
• Automating exploitation with local AI models
• Lame C2
• Smallest SSH backdoor
• Your RDP is on the Internet
• These are not the high severity bugs you were looking for
• Low hanging fruit
• Your TV is spying on you, again
• no such thing as "offensive security"
• MCPs and RCEs
• Browser extensions collecting your AI chats
• And flooding TikTok with AI influencers

Show Notes: https://securityweekly.com/psw-905

Business Security Weekly is well aware of the cybersecurity hiring challenges. From hiring CISOs to finding the right skills to developing your employees, we cover it weekly in the leadership and communications segment. But this week, our guest interview digs into the global cybersecurity hiring trends.

Jim McCoy, CEO at Atlas, joins Business Security Weekly to share his expertise on the global workforce needs in the 160 countries where Atlas provides direct Employer of Record services. From CISO hiring to where to build security teams, Jim will help us navigate the cybersecurity hiring challenges most organizations face.

In the leadership and communications segment, CISOs, CIOs and Boards: Bridging the Cybersecurity Confidence Gap, Rethinking the CIO-CISO Dynamic in the Age of AI, Transparent Leadership Beats Servant Leadership, and more!

Show Notes: https://securityweekly.com/bsw-426

Pornhub, WSL, Santastealer, Geoserver, Webkit, Fortiyomama, Dad's Pix, Aaran Leyland, and More, on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-538

Open source projects benefit from support that takes many shapes. Kat Cosgrove shares her experience across the Kubernetes project and the different ways people can make meaningful contributions to it. One of the underlying themes is that code is written for other people. That means PRs need to be understandable, discussions need to be enlightening, documentation needs to be clear, and collaboration needs to cross all sorts of boundaries.

Show Notes: https://securityweekly.com/asw-361

Illuminating Data Blind Spots

As data sprawls across clouds and collaboration tools, shadow data and fragmented controls have become some of the biggest blind spots in enterprise security. In this segment, we'll unpack how Data Security Posture Management (DSPM) helps organizations regain visibility and control over their most sensitive assets.

Our guest will break down how DSPM differs from adjacent technologies like DLP, CSPM, and DSP, and how it integrates into broader Zero Trust and cloud security strategies. We'll also explore how compliance and regulatory pressures are shaping the next evolution of the DSPM market—and what security leaders should be doing now to prepare.

Segment Resources:

https://static.fortra.com/corporate/pdfs/brochure/fta-corp-fortra-dspm-br.pdf

This segment is sponsored by Fortra. Visit https://securityweekly.com/fortra to learn more about them!

Over this year on this podcast, we've talked a lot about infostealers. Passkeys are a clear solution to implementing phishing and theft-resistant authentication, but what about all these infostealers stealing OAuth keys and refresh tokens? As long as session hijacking is as simple as moving a cookie from one machine to another, securing authentication seems like solving only half the problem. Locking the front door, but leaving a side door unlocked.

After doing some research, it appears that there has been some work on this front, including a few standards that have been introduced:

1. DBSC (Device Bound Session Credentials) for browsers
2. DPoP (Demonstrating Proof of Possession) for OAuth applications

We'll address a few key questions in this segment: 1. how do these new standards help stop token theft? 2. how broadly have they been adopted?

Segment Resources:

• FIDO Alliance White Paper: DBSC/DPOP as Complementary Technologies to FIDO Authentication

Show Notes: https://securityweekly.com/esw-437

Disney Gone Wild, Docker, AIs, Passkeys, Gogs, React2Shell, Notepad++, Josh Marpet, and More

Show Notes: https://securityweekly.com/swn-537

This week in our technical segment, you will learn how to build a MITM proxy device using Kali Linux, some custom scripts, and a Raspberry PI! In the security news:

• Hacking Smart BBQ Probes
• China uses us as a proxy
• LOLPROX and living off the Hypervisor
• Are we overreating to React4Shell?
• Prolific Spyware vendors
• EDR evaluations and tin foil hats
• Compiling to Bash!
• How e-waste became a conference badge
• Overflows via underflows and reporting to CERT
• Users are using AI to complete mandatory infosec training!
• AI in your IDE is not a good idea
• Cybercrime is on the rise, and its the kids
• AI can replace humans in power plants
• Will AI prompt injection ever go away?
• To use a VPN or to not use a VPN, that is the question

Show Notes: https://securityweekly.com/psw-904

Organizations rely heavily on Salesforce to manage vasts amounts of sensitive data, but hidden security risks lurk beneath the surface. Misconfigurations, excessive user permissions, and unmonitored third party integrations can expose this data to attackers. How do I secure this data?

Justin Hazard, Principal Security Architect at AutoRABIT, joins Business Security Weekly to discuss the security challenges of Salesforce. Justin will discuss how proactive oversight and a strong security posture in Salesforce requires additional capabilities, including:

• Continuous monitoring of your Salesforce environment,
• Strict access controls of Salesforce users, and
• Automated backup of sensitive data.

Think your data in Salesforce is safe and secure, think again.

This segment is sponsored by AutoRABIT. Visit https://securityweekly.com/autorabit to learn more about them!

In the leadership and communications segment, Boards Have a Digital Duty of Care, The CISO's greatest risk? Department leaders quitting, The 15 Habits of Highly Empathetic People, and more!

Show Notes: https://securityweekly.com/bsw-425

We've got: Hypnotoad, AI Galore, Storm-0249, DocuSign, Broadside, Goldblade, Ships at Sea, Sora, Aaran Leyland, and More on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-536

The MCP standard gave rise to dreams of interconnected agents and nightmares of what those interconnected agents would do with unfettered access to APIs, data, and local systems. Aaron Parecki explains how OAuth's new Client ID Metadata Documents spec provides more security for MCPs and the reasons why the behavior and design of MCPs required a new spec like this.

Segment resources:

• https://aaronparecki.com/2025/11/25/1/mcp-authorization-spec-update
• https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html
• https://oauth.net/cross-app-access/
• https://oauth.net/2/oauth-best-practice/

Show Notes: https://securityweekly.com/asw-360