The Defensive Line Weekly podcast is the audio version of the weekly Defensive Line Substack intelligence summary. Written by humans but read by AI. It turns the week’s key cyber stories into a practical conversation between Carter and Lizzie.

FortiBleed and edge credential exposure

* CISA — CISA urges hardening Fortinet devices after reports of credential exposure

* NCSC — Advice following global targeting of Fortinet firewalls and VPN gateways

* The Hacker News — CISA warns Fortinet customers as compromised credentials leak

Klue, OAuth tokens and SaaS integration risk

* Huntress — Klue breach investigation

* Klue — Update on recent Klue security incident

* The Hacker News — Salesforce disables Klue app

* BleepingComputer — Klue OAuth breach linked to Icarus Salesforce data theft attacks

Mastra, AutoJack and trusted tooling

* Microsoft Threat Intelligence — Postinstall payload inside Mastra npm supply chain compromise

* Microsoft Defender Security Research — AutoJack: single-page RCE on host running AI agent

* BleepingComputer — Microsoft links Mastra AI supply-chain attack to North Korean hackers

* The Hacker News — 144 Mastra npm packages compromised

* The Hacker News — AutoJack attack lets one web page execute code

* BleepingComputer — Microsoft fixes AutoGen Studio flaw

Honourable mentions

* ESET Research — Killing me gently: inside Gentlemen’s EDR killer framework

* The Hacker News — F5 patches two critical NGINX Open Source flaws

* The Hacker News — Hackers exploit Gravity SMTP WordPress plugin

* Dark Reading — Novo Nordisk breach exposes dev pipeline risk

* The Hacker News — Operation Endgame disrupts SocGholish

* The Hacker News — AryStinger malware infects legacy D-Link routers

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com