The Defensive Line Podcast

The final Defensive Line podcast brings Carter and Lizzie together to revisit six stories and lessons from the archive. Thank you for listening, sharing the podcast and helping to shape it.

🤖 Carter and Lizzie’s voices are AI-generated. The briefing is produced with AI assistance and reviewed and edited by humans.

The six highlights

ShinyHunters and vishing

BleepingComputer: ShinyHunters claims responsibility for SSO data-theft attacks

Klue and delegated application access

Huntress: Klue breach investigation

The Defensive Line Weekly Podcast 023

Passkey-themed social engineering

Microsoft: Passkey-themed social engineering leads to identity and cloud compromise

The Defensive Line Weekly Podcast 035

AI-assisted PaperCut exploitation

Blackpoint Cyber: Death by a Thousand PaperCuts

The Defensive Line Weekly Podcast 035

ClickFix on a trusted platform

Huntress: Attackers abuse ChatGPT Custom GPTs to deliver malware via ClickFix

The Defensive Line Weekly Podcast 038

Push Security: Malicious copy-and-paste detection

Cursor’s compromised extension

Cursor: Security notice and remediation guidance

The Defensive Line Weekly — Episode 42

What happens next

From next week, The Defensive Line becomes The Defensive Digest, a shorter intelligence briefing for security leaders on Tearline, read by humans and produced by Steve with AI support. Existing subscribers will move across for the Digest; they won’t be subscribed to other articles or podcasts unless they choose to be.

For help with the security issues discussed, visit FixPoint Security.

The audio edition of the weekly Defensive Line Substack intelligence briefing — the week's most important security stories turned into practical defensive action.

🤖 This briefing is drafted and read by AI, but reviewed and edited by humans.

This week's edition: The Defensive Line Weekly #45: 25 October–1 November 2026

Main stories

Story 1: Cursor's compromised extension

Cursor: Security notice — malicious version of Anthropic.claude-code identified in the Cursor VS Code Extension Marketplace

Socket: Cursor Removes Malicious Claude Code Extension From Its Marketplace

Story 2: PHP2Shell reaches PAN-OS management

Dream Research: Chained PHP2Shell Exploit Roots 25 Servers

Palo Alto Networks: Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products

Unit 42: Threat Brief: Critical Vulnerabilities in PHP

The Defensive Line: Previous edition, #44: 18–25 October 2026

Story 3: Fake support and unauthorised management

Microsoft: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

Huntress: Managed for Malice: How Attackers Turn MDM into Remote Access

Honourable mentions

Ivanti: Security Advisory Ivanti Connect Secure

The Defensive Line: Previous edition, #43: 11–18 October 2026

Cisco Talos: Inside KeyDrift: Analyzing historical activity on Cisco SD-WAN

FBI: North Korea Responsible for $6 Billion+ Binance Attack

Binance: Security Incident Update

The audio edition of the weekly Defensive Line Substack intelligence briefing — the week’s most important security stories turned into practical defensive action.

🤖 This briefing is drafted and read by AI, but reviewed and edited by humans.

This week’s edition: The Defensive Line Weekly #44: 18–25 October 2026

Main stories

PHP2Shell: urgency without confusing attempts with compromise

PHP: Security releases and critical remote code execution advisory

Wiz: PHP2Shell: AI uncovers critical RCE vulnerabilities

Amazon: PHP2Shell exploitation attempt identified before public disclosure

CrowdStrike: Obstacles to weaponizing PHP2Shell likely constrain immediate exploitation

Honeypot research: PHP2Shell packet-to-process execution evidence

NCSC: Preparing for a vulnerability patch wave

Zero Day Clock: Vulnerability exploitation observatory

The speed of AI: ConnectWise and the follow-through

Microsoft: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

The Defensive Line: Previous edition, #43: 11–18 October 2026

LiteLLM: two approvals, one attacker

LiteLLM: The attack chain behind the compromised release

Microsoft: Inside the LiteLLM supply chain compromise: credential theft through Python startup hooks

Wiz: Gheist: attempted scaled abuse of stolen GitHub tokens stumbles

Token theft: access that survives a password reset

Huntress: Microsoft 365 token spray and replay campaign compromises business email accounts

Microsoft Learn: Block authentication flows with Conditional Access policy

Group-IB and NyxLab: Stray Cat, Open Doors: how k0t wanders through the network edge

Honourable mentions

Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates

The Hacker News: Hackers hijack five OVHcloud CLI releases to distribute secret-stealing malware

Railway: Preliminary report: October security incident

The audio edition of the weekly Defensive Line Substack intelligence briefing — the week’s most important security stories turned into practical defensive action.

🤖 This briefing is drafted and read by AI, but reviewed and edited by humans.

This week’s edition: The Defensive Line Weekly #43: 11–18 October 2026

Main stories

A shared application identity reaches customer tenants

Huntress: ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

Todyl: Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App

ConnectWise: Trust Center advisories and current service update

A trusted update changed for minutes, then reverted

Google Threat Intelligence Group and Mandiant: Investigating Ephemeral Supply Chain Tampering

ManageEngine Threat Analysis Lab: AOMEI Backupper supply-chain compromise

Remote-support access becomes a route downstream

Mandiant: ARMORY CASTLE Exploits BeyondTrust

BeyondTrust: Security advisory BT26-05

BeyondTrust: ARMORY CASTLE and BT26-05: What Security Teams Need to Know

Honourable mentions

Citizen Lab: How Discover-Tech turned targeted ads into a pipeline for spyware

MI5: Director General delivers annual threat update

CERT-FR: Alert on attacks against refrigeration control systems

Hunt.io: PaperCut attacker AI toolkit and exploit code

Kim Zetter: Hardware-wallet implant reporting: Ledger

Kim Zetter: Hardware-wallet implant reporting: Trezor

Check Point: Fake calendar invites target organisations

Sublime Security: Detection rule for credential theft in calendar invitations

CISA: Known Exploited Vulnerabilities Catalog

The Defensive Line Weekly — Episode 39 (4–11 October 2026)

The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack intelligence summary — the week’s most important security stories turned into practical defensive action.

🤖 This briefing is drafted and read by AI, but reviewed and edited by humans.

This week’s edition: The Defensive Line Weekly #42: 4–11 October 2026

Main stories

Customer data behind an employee login

BleepingComputer: ASOS links data breach to social engineering attack, credential theft

BBC News: Asos hackers took more personal details than first revealed, BBC finds

Okta: When enrollment isn’t enough: How attackers trick users into MFA downgrades

The support caller and the visitor at reception

The Record: Leaked chats show Russian extortion gang sending ‘agents’ into US law firms

FBI: Silent Ransom Group Impersonating IT Personnel through Social Engineering

S-RM: Cyber briefing note: The Luna Moth files

A trusted release with a destructive response trap

Tensorlake: Malicious tensorlake release: credential-stealing worm with destructive dead-man’s switch

OX Security: “Shai-Hulud: Here We Go Again” — “tensorlake” npm Package Hit With Malware

Renovate: Configuration Options — minimumReleaseAge

Honourable mentions

StepSecurity: GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories

Australian Cyber Security Centre and international partners: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools to steal sensitive data

Google: Chrome’s Response to Recent ccTLD Registry Hijacks

Gen Digital: Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data

CloudSEK: Caught in 4K: The Gentlemen Files

Bitdefender: The phone was compromised before the user turned it on: the rise of Midnight Mimosa

The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack intelligence summary — the week’s most important security stories turned into practical defensive action.

🤖 This briefing is drafted and read by AI, but reviewed and edited by humans.

This week’s edition: The Defensive Line Weekly #41: 27 September–4 October 2026

Main stories

The upgrade that did not finish the job

Citrix: CTX697174 — Citrix NetScaler ADC and NetScaler Gateway security bulletin

Citrix Community: Understanding and addressing CVE-2026-88779 in Citrix NetScaler ADC and NetScaler Gateway

CISA: CISA adds one known exploited vulnerability to catalog

Google Threat Intelligence Group: Defending against active exploitation of Citrix NetScaler ADC and Gateway appliances

BleepingComputer: Citrix patches NetScaler SAML zero-day exploited in attacks

The paste that does not care where it lives

Microsoft: 2026 Digital Defense Report

Huntress: ChatGPT Custom GPTs used to deliver ClickFix

Push Security: Malicious copy and paste detection

One remote tool installs the next

Microsoft Defender Experts and Security Research: Phishing abuses RMM tools for persistent access

CrowdStrike: Beyond the binary: stop attackers living off your land

Honourable mentions

Symantec and Carbon Black: Warlock ransomware targeting critical infrastructure

Proofpoint: China-aligned actor impersonates its way into US AI policy circles

Fortinet: FG-IR-26-175 — FortiMail identity-based encryption vulnerability

Cisco: Cisco Catalyst SD-WAN Manager authentication bypass

Microsoft Threat Intelligence: Unauthenticated command injection on internet-facing mail servers

The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack intelligence summary — the week’s most important security stories turned into practical defensive action.

🤖 This briefing is drafted and read by AI, but reviewed and edited by humans.

This week’s edition: The Defensive Line Weekly #40: 20–27 September 2026

Main stories

When the workaround isn’t the fix

Google Threat Intelligence Group: ShinyHunters renewed mass exploitation campaign targeting Oracle PeopleSoft

Oracle: Security alert for CVE-2026-35273

BleepingComputer: ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

Citrix: CTX697096 — NetScaler ADC and NetScaler Gateway security bulletin

CISA: Critical zero-day vulnerabilities exploited in Citrix NetScaler ADC and Gateway

watchTowr: Citrix NetScaler zero-day vulnerabilities FAQ

Citrix: Steps to take if NetScaler ADC is suspected compromised

Seven minutes, two service principals

Microsoft Security Research: Storm-3168: agentic-driven cloud attacks using compromised service principals

Sysdig: No single pane of glass: anatomy of an Azure permission takeover

EvilTokens and the genuine login

Microsoft Threat Intelligence: Unmasking EvilTokens: getting to the root of device code phishing

Microsoft: Block authentication flows with Conditional Access

Sublime Security: Detection rule for links to Microsoft device code authentication with suspicious indicators

Honourable mentions

Independent researcher: How I could’ve accessed 17 trillion Microsoft records

Red Hat: Security bulletin RHSB-2026-006

Aikido: Red Hat npm packages compromised by a credential-stealing worm

Socket: Mini Shai-Hulud campaign hits Red Hat cloud services npm packages

SecurityWeek: SalesBleed flaws in Salesforce Agentforce enabled zero-click data exfiltration

Dark Reading: SalesBleed exploits Salesforce agents for Slack phishing

Proofpoint: Spraying in the Andes: TeamFiltration returns

F5: K000162605 — BIG-IP APM vulnerability

Check Point: Active exploitation of CVE-2026-85102 and management pre-authentication vulnerability CVE-2026-93616

The Hacker News: Roundcube pre-auth SQL injection flaw now exploited in the wild

CISA: CISA adds two known exploited vulnerabilities to catalog

Patchstack: Attackers started probing WordPress sites hours after the patch

The Defensive Line Weekly — Episode 36 (13–20 September 2026)

The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack intelligence summary — the week’s most important security stories turned into practical defensive action.

🤖 This script was written and read by AI, but reviewed and edited by humans.

This week’s edition: The Defensive Line Weekly #39: 13–20 September 2026

Main stories

The Brevo key and ClickFix on trusted sites

Brevo: Incident post-mortem

BleepingComputer: Brevo supply chain attack injected ClickFix scripts on customer sites

Push Security: Malicious copy and paste detection

Two exploited Cisco zero-days

Cisco: Identity Services Engine authentication bypass advisory

CISA: CISA adds two known exploited vulnerabilities to catalog

The Hacker News: Cisco warns of new zero-day ISE authentication bypass

Sophos: Cisco Secure Email Gateway vulnerability in active exploitation

The Register: Cisco email security boxes can be rooted by an email

Help Net Security: Cisco ISE vulnerability exploited

Dark Reading: Sandworm chains Cisco vulnerabilities to deploy Cyclops Blink

Developer trust: Plugin4Shell and WaterPlum

Air Security: Plugin4Shell

The Hacker News: Plugin4Shell lets repository owners swap pinned plugin code

The Register: AI coding agents 0-click RCE flaw could hand attackers keys to the kingdom

FBI/IC3: Joint advisory on WaterPlum

The Record: North Korean hackers infect thousands of devices in WaterPlum scheme

BleepingComputer: North Korean WaterPlum hackers infected 30,000 devices worldwide

The Hacker News: WeaselBiscuit stealer spreads via 13 npm packages

GitLab: How to detect and prevent Contagious Interview IDE attacks

Honourable mentions

LastPass: Delphos Labs report on the Rapuncel infostealer

BleepingComputer: Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

Microsoft: Application Control vulnerable driver blocklist

Hacktron: Hacking OpenAI

The Hacker News: Claude Opus 5 helped researchers take over OpenAI staff accounts

Mandiant: AI risk and resilience 2026

The Hacker News: Attacker hijacks AI coding assistant session

Elastic Security Labs: Malicious browser extension KREMLIN banking malware

The Hacker News: KREMLIN banking malware hijacks Chrome

CISA: Known Exploited Vulnerabilities catalogue

The Hacker News: CISA flags three Linux kernel vulnerabilities

The Hacker News: Active exploitation attempts target WSO2 API Manager

The Hacker News: Acronis cPanel backup plugin exploited

BleepingComputer: Check Point warns critical flaw lets hackers execute code as root

The Hacker News: BIND 9 update fixes 14 flaws

🤖 The voices in this episode are AI generated. The briefing is drafted and read by AI, then reviewed and edited by humans.

This week’s edition: The Defensive Line Weekly #38: 6–13 September 2026

Main stories

Topic 1 — AI as the execution layer

Anthropic’s September threat report, and PaperCut exploitation at scale.

Anthropic: Detecting and countering misuse of AI — September 2026

Blackpoint Cyber: Death by a thousand PaperCuts — AI-driven exploitation at scale

GreyNoise: AI-orchestrated campaign against PaperCut NG/MF

The Register: Hundreds of AI agents helped the PaperCut attacker hit 395 orgs

PaperCut: Security bulletin and fixed releases

Topic 2 — Passkey lures and help-desk vishing

Social engineering aimed at M-F-A enrolment and identity support, into Microsoft 365.

Microsoft: Passkey-themed social engineering leads to identity and cloud compromise

Topic 3 — Systems that hold credentials

Artifactory exploitation and the build pipeline as the objective, plus an exposed A-I gateway chained to cloud compromise.

Wiz: Artifactory under attack — in-the-wild exploitation

CISA: Three vulnerabilities added to the Known Exploited Vulnerabilities catalogue

Wiz: Off guard — breaking LiteLLM from authentication bypass to cloud compromise

Further reading, not covered in this episode: Google Threat Intelligence Group on manipulated AI coding assistants, malicious Model Context Protocol packages and prompt injection in repository configuration — From prompting to autonomy: the evolution of adversarial AI. Full write-up in The Defensive Line Weekly #38.

Honourable mentions

Cisco Secure Firewall Management Center exploitation and the new Linux variant of Cyclops Blink — The Hacker News, Sophos

GitLab critical file-read flaw in self-managed instances (CVE-2026-85706) — GitLab patch release, The Hacker News, BleepingComputer

Chrome actively exploited flaw used by the BlueMoon exploit kit (CVE-2026-87491) — Chrome Releases, Malwarebytes, The Register

MikroTik RouterOS and ConnectWise ScreenConnect flaws added to the Kev catalogue on 12 September — CISA, The Hacker News

Check Point V-P-N gateway certificate-handling flaws — watchlist (CVE-2026-85102, CVE-2026-85103) — The Hacker News, BleepingComputer

Prompt-injection research from Check Point and ESET — Check Point Research, ESET

Versions: PaperCut fixed in 26.0.5, 25.0.13 and 24.1.10. GitLab fixed in 19.3.2, 19.2.6 and 19.1.8. Artifactory: apply the fixed release for your branch covering all three issues.

The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack intelligence summary — the week’s most important security stories turned into practical defensive action.

🤖 This briefing is drafted and read by AI, but reviewed and edited by humans.

This week’s edition: The Defensive Line Weekly #37: 30 August–6 September 2026

Main stories

One exposed AI key, six hundred thousand dollars of compute

METR: Update on Security at METR

SonicWall’s edge is under attack again

SonicWall: SMA 1000 Series affected by multiple vulnerabilities

CISA: CISA adds seven known exploited vulnerabilities to its catalogue

Fake support turns trusted tools into an attack path

Microsoft Threat Intelligence: Impersonating IT support — how threat actors turn a remote session into enterprise-wide access

Huntress: Rogue ScreenConnect installations suggest worm-like activity

ConnectWise: Security advisories

Honourable mentions

Softaculous: Security incident — BGP hijacking

Kentik: Latest BGP hijack targets a hosting-software vendor

Microsoft: ASCII smuggling crosses over from AI prompt injection to phishing evasion

Arctic Wolf: Exploited PaperCut vulnerabilities lead to credential theft

PaperCut: Urgent security advisory

JFrog: CVE-2026-82329 — authentication bypass in Artifactory

Google Chrome Releases: Stable Channel Update for Desktop

Wordfence: Attackers actively exploit a critical Elementor Pro vulnerability

Cisco: Nexus 9000 Series Silicon One remote-code-execution vulnerability

GitLab: Critical remote code execution in vm2

Sublime Security: Sublime and CrowdStrike unify email detection, response and sandbox analysis

CrowdStrike: Real-Time Supply Chain Attack Protection

CrowdStrike: The next evolution of the Agentic SOC

CrowdStrike: Agentic Identity Provider

CrowdStrike: Falcon Guardian defines the next generation of AI security

GitHub: FalconFlank proof of concept

The Hacker News: Researcher releases FalconFlank PoC showing privilege escalation in CrowdStrike Falcon

The Register: Prolific Microsoft zero-day hunter drops CrowdStrike Falcon exploit PoC