Three Buddy Problem

By Security ConversationsNews Technology Business News Tech News

Three Buddy Problem episodes

November 08GPT-6 Cyber Sets Price of a Linux Exploit; Europe Silent on Fridge Hacks
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem - Episode 119: We discuss the supermarket fridge hacks rolling across Europe, why no government wants to say the word Russia out loud, active measures and cyber-warfare, and the European silence on attribution.
Plus, OpenAI's GPT-6 Cyber and the cost of 948 Linux exploits, the Daybreak Blue training flap, a tough-love pep talk for researchers mourning the loss of the old game and the Binance postmortem the FBI pinned on North Korea's TraderTraitor.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.
Timestamps:
0:00 Introductory banter
3:00 TLP Black and AI agents watching your edge devices
10:21 Supermarket fridge hacks spread across Europe
16:27 How the refrigeration attacks work
18:49 Is this Russia?
21:12 Boundary testing and the Article 5 problem
34:20 Sabotage short of war
40:06 The IOCs nobody is sharing
44:41 Costin's hunting playbook
51:24 Not just a European story
57:25 What do intelligence agencies know?
1:06:22 GPT-6 Cyber and Daybreak Red
1:26:40 948 Linux root exploits for $1.2 million
1:36:48 Daybreak Blue training and the mathematicians
2:09:01 Binance postmortem and TraderTraitor
Links:
Transcript
TBP Ep54: Train brake hack, GRU sanctions
Tom Hegel: Defrost and Disrupt - Europe’s Refrigeration Attacks
French blood service hit by Europe-wide fridge hacks
Govs Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems
Germany, Romania and UK report supermarket cyberattacks
OpenAI Ships GPT‑6 Cyber
A thousand fewer paths to root | OpenAI
OpenAI plans to train models on Daybreak Blue cybersecurity session data
Free Chinese AI Models Are Getting Scary Good at Hacking
Tal Be'ery: Dense in Depth: Rethinking Security When Vulns Are Everywhere
FBI blames N. Korea’s TraderTraitor for Binance theft
Binance $6.5B Crypto Theft Post-Mortem
FBI: North Korea Responsible for $6 Billion+ Binance Attack
SkiSides 2027
CYBERWARCON Agenda
RE//verse Conference
TLPBLACK
2 hr 29 min
October 30The Great Binance $6.34 Billion Crypto Heist
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem - Episode 118: On the show this week, the buddies dig into the $6.34 billion Binance heist, the largest crypto hack ever, walking through its multi-chain laundering, the North Korea fingerprints, and whether offensive AI quietly helped pull it off.
Plus, thoughts on Sam Altman's swipe at local hardware, the PHP2Shell "cannonball," why defenders keep hitting guardrails while GLM-5.3 happily does the work, a trojanized Claude Code extension, Apple's fresh spyware alerts, and Volt Typhoon's Silent Train.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.
Timestamps:
0:00 Introductory banter
3:46 CTI training & the AI model stack
8:03 The $6.34B Binance hack: the largest crypto heist ever
12:40 Inside the multi-chain laundering
18:23 Sam Altman & the AI hardware crunch
20:44 Root cause: a compromised DevOps laptop
23:43 Did AI help pull it off?
31:22 Who actually loses six billion dollars?
44:00 Crypto as a financial instrument
51:04 Can it get bigger? Hardware-wallet implants
57:04 Attribution, "misalignment" & is Binance Chinese?
1:10:00 Cash, privacy & the Mt. Gox lesson
1:22:12 PHP2Shell: dodging the cannonball
1:30:52 AI for defense & the productization gap
2:09:32 GLM-5.3, the refusal trap & open weights
2:32:26 Apple spyware alerts & Silent Train
Links:
Transcript
North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
Binance Hack: Tracing the $6.4 Billion Theft to North Korea
TraderTraitor: North Korean APT Targets Blockchain Companies
Professor Mickens LABScon 2026 keynote (YouTube)
GreyNoise: PHP2Shell Activity
Sean Heelan: "We’re going to be in an insane world soon..."
GLM-5.3: Multi-Stage Cyber Operations and Instruction Violations
Cohere: Concerning behavior from a popular open-weight AI model
Silent Train: Volt Typhoon's operational framework for zero-day exploitation
Lumen's Michael Horka on China's 'Silent Train' Router Hacking
— https://youtu.be/byQ53DdCTvE?si=3kIPil3vk1Qx8s89
Exposing AdFection: Targeted Ads a Pipeline for Zero-Click Mercenary Spyware
Apple notifications alert victims in 99 countries about mercenary spyware infections
CTI in Agentic Times
TLPBLACK
2 hr 51 min
October 28Lumen's Michael Horka on China's 'Silent Train' Router Hacking
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
SECURITY CONVERSATIONS: Black Lotus Labs researcher Michael Horka joins the show to discuss Silent Train, a Volt Typhoon framework that spins up four-to-six-hop chains of hijacked SOHO routers in about two minutes and wipes every hop when the day's session ends.
We discuss how ORB networks differ from botnets, why Silent Train took over after the FBI's KV-botnet takedown, the zero-days hitting control plane software from Versa, N-able and VeloCloud, and the NetFlow and logging moves defenders can make right now.
TIMESTAMPS:
0:00 Intros
0:29 What is an ORB network?
2:34 Silent Train, an operational framework for Volt Typhoon
3:30 Why call it Silent Train?
4:12 Chains that exist for a few hours
6:47 The hijacked routers in the chain
8:16 Burning zero-days on a single hop
9:48 Attribution and the KV-botnet successor
11:02 Crown jewels and NetFlow visibility
14:53 Why network monitoring gets skipped
17:23 Victims in Hawaii, California and Texas
19:23 Four confirmed zero-days, all patched
20:47 Control plane software as the target
26:00 No-brainer defenses: logs and internet exposure
29:41 Threat hunting, agentic AI and where ORBs go next
Links:
Transcript
Silent Train: Volt Typhoon's operational framework for zero-day exploitation
Michael Horka | LinkedIn
Michael Horka @ LABScon
KV Botnet Investigation: How Compromised Routers Fueled Cyber Threats
KV-botnet: Don't call it a comeback
Lumen: Versa Director Zero-Day Exploitation
Security Design Improvements for SOHO Device Manufacturers | CISA
U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure
Three Buddy Problem - YouTube
36 min
October 24PHP2Shell Meltdown: AI Found It. Who's Going to Patch It?
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem - Episode 117: This week, we dig into PHP2Shell, the AI-assisted PHP bug that led governments to take websites offline, and the arguments over broken embargoes, who found it first, and the AI doomers taking an "I-told-you-so" victory lap.
Plus, why patching hasn't kept up with AI bug finding, a failure of SBOMs, Terence Tao on math after AI, the iPhone Duo jailbreak and the eMudhra certificate authority key leak.
Cast: Juan Andres Guerrero-Saade and Ryan Naraine. Costin Raiu is traveling.
Timestamps:
0:00 Introductory banter
1:07 Black October's pile of critical bugs
2:34 PHP2Shell and the AI victory lap
8:28 Twenty years of PHP technical debt
16:54 Wiz, Gemini 4 Argon and the credit fight
21:01 Chainguard breaks the embargo
28:42 The doomers' warnings and the patching gap
39:32 Is this an SBOM problem?
55:33 Inside the PHP Foundation's post-mortem
1:03:13 Are bugs sparse or dense?
1:11:24 Should frontier labs fix coding?
1:20:14 Vibe coding and math's industrial era
1:27:26 Who pays to maintain open source?
1:44:59 iPhone Duo hacked already, eMudhra and the news
Links:
Transcript
PHP Foundation: How We're Strengthening PHP Security
RCE via OOM corruption · Advisory
RCE via stale global state · Advisory
PHP2Shell by Calif Research
Wiz: PHP2Shell: AI uncovers critical RCE vulnerabilities in PHP
Chainguard CEO explains breaking PHP vuln embargo
Alpha-Omega – Open Source Security Foundation
OpenAI Daybreak: Patch the Planet
VirusTotal: Sizing the PHP exposure window
Mathematics in the age of AI
3Blue1Brown on YouTube
There's never been a better time to go into math - YouTube
Terence Tao Talks to Numberphile About AI
Disgraced eMudhra drops out of TLS business
Node.js Patches Brotli Remote Code Execution Flaw
Max-severity GitLab bug allows remote code execution over 12 years of releases
Inside the LiteLLM 1.107.0 supply chain compromise
Calif hacks new hardware based UFP mitigation in the iPhone Duo
CTI in Agentic Times (Costin/Vicente training)
TLPBLACK
1 hr 53 min
October 18Who's Hacking Supermarket Fridges in France?
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem - Episode 116: This week, the buddies dig into a mystery hack that cooked French supermarket fridges, cyberattacks against food supply networks, and why this smells like nation-state sabotage in Europe?
Plus, a fresh Ivanti zero-day chain, Anthropic's self-replicating IoT research and defender-hostile guardrails, Citizen Lab's AdFection spyware-by-ads exposé, Calif's iPhone exploit drops at Hexacon, Grok's surprising enterprise adoption, and spy chips stuffed inside Ledger wallets.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.
Timestamps:
0:00 Introductory banter
1:35 Virus Bulletin 2026 in Seville
6:13 Conference roundup: State of Statecraft, Countermeasure, RE//verse
10:21 French supermarket fridges hacked
22:53 Hacking food supply and the attribution question
33:23 Who patches the fridge?
45:58 Ivanti Connect Secure zero-day chain
53:00 When an AI agent deletes your databases
1:04:34 NCSC edge-device forensics guidance
1:28:06 Anthropic's self-replicating IoT research
1:52:17 Why guardrails lock out defenders
2:04:57 Grok's enterprise play and agent sprawl
2:16:26 Citizen Lab exposes AdFection spyware via ads
2:57:24 Calif burns iPhone exploits at Hexacon
3:06:55 Ledger wallet implants and the grain of rice
Links:
Transcript
CERT-France: Targeting remote controllers of refrigeration systems
Investigators hunt French supermarket fridge hackers
CNN: Cyberattack targets supermarket refrigeration systems in France
Danfoss, Copeland and Trane address controller security vulnerabilities
Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days
NCSC Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances
NCSC: Making forensic observability the norm for network devices
NCSC Ollie Whitehouse podcast
Anthropic: AI models may be capable of self-replicating
Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
Exposing AdFection Executive Summary (Citizen Lab)
Facebook–Cambridge Analytica data scandal
Calif displays iPhone 1-click hacks
Hackers Jailbreak iPhone 18 Pro on Stage, and It Survives a Reboot
Trezor Wallets Also Compromised with Implants
Kim Zetter: Who Is Planting Backdoors in Ledger Crypto Wallets?
Ledger Confirms How ‘Spy Implants’ Steal Crypto From Its Devices
Joe Grand (Kingpin) slides on reversing Ledger Nano X hardware implant
The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies
CTI in Agentic Times (Costin training)
TLPBLACK
3 hr 27 min
October 12Katie Moussouris on AI-as-malware, the monitoring gap, and an NTSB for AI
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem x Offensive AI Con: Luta Security chief Katie Moussouris makes the case for an NTSB-style board for AI incidents, with subpoena power and full-time investigators, after OpenAI's DNS tunneling escape and the 52 days it took to notice a model had wandered into Australian government systems.
Along the way, we chat about her work on the Cyber Safety Review Board (CSRB), AI model refusals that leave defenders stuck, and why she still bets on hackers to bend this technology their way.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Katie Moussouris.
Timestamps:
0:00 Intros at Offensive AI Con
1:00 OpenAI's DNS tunneling incident and slow monitoring
4:36 Treating AI like malware in a sandbox
9:01 The business model is the misalignment
13:37 Log4j, SBOMs and an NTSB for AI
18:00 Trading liability protection for honest disclosure
22:13 Accountability and "once you become aware"
26:18 The Australia notification timeline
28:19 A blank-check administration and the Anthropic phaseout
34:35 Powerful models in the right hands
38:42 Kill switch bills and regulatory capture
42:36 EU fines as a tariff on American tech
48:03 Reasons for optimism
54:13 Bring back "information security"
1:01:57 Katie's last word
Links:
Transcript
Katie Moussouris on Twitter
Katie Moussouris | LinkedIn
Luta Security | Bespoke Bug Bounty
OpenAI Agent Breached Australian Data Portal in Newly Disclosed Hack
CSRB Review: Log4j
CSRB Report on Microsoft Online Exchange Incident
EU Cyber Resilience Act: 24-Hour Reporting Duties
Patching Faster Has Never Been the Answer
The Real Story on AI Security Live From LABScon
Katie Moussouris | LABScon
DHS Disbands Cyber Safety Review Board
The Chaos (and Cost) of the Lapsus$ Hacking Carnage
Katie Moussouris on the Anthropic Export-Control Mess
Fable 5 Export Controls Harm US Cyber Defense
Offensive AI Conference
TLPBLACK
1 hr 6 min
October 12NCSC's Ollie Whitehouse: 'The Biggest Correction of Technical Debt Ever'
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem x Offensive AI Con: Ollie Whitehouse, CTO of the UK's National Cyber Security Centre, joins us to explain how Britain is preparing for an AI-driven patch wave and why the NCSC is pressing edge-device vendors to finally ship real telemetry.
Plus, we dig into rogue AI agents wandering into a Five Eyes network, along with his forecast that small, capable models could revive self-spreading worms around 2030, all part of what he calls the biggest forced correction of technical debt the industry will ever see.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Ollie Whitehouse.
Timestamps:
0:00 Live from Offensive AI Con: meet Ollie Whitehouse
2:46 Why the NCSC is a model for the US
6:48 What a "national technical authority" does
7:49 The Huawei analysis and the push for passkeys
10:50 Independent AI model testing
13:12 Open-weight vs. closed models and AI sovereignty
19:02 Capability density and AI worms by 2030
23:09 Robotics security and lessons from Japan
26:49 Preparing for the patch wave
31:06 Architecture fixes: OT, cross domain, privileged access
32:28 Telecoms security and Salt Typhoon
38:59 Minimum telemetry standards for edge devices
41:55 Market incentives and the EU Cyber Resilience Act
46:05 Rogue agents and the forced correction of technical debt
Links:
Transcript
Ollie Whitehouse bio
Ollie Whitehouse | LinkedIn
Ollie Whitehouse on Twitter
Ollie Whitehouse's NCSC email newsletter
NCSC: Preparing for a ‘vulnerability patch wave’
NCSC: Managing the cyber risk of agentic AI
Making forensic observability the norm for network devices
Five Eyes unveil new guidelines to secure edge devices
NCSC: Leave passwords in the past - passkeys are the future
Huawei Cyber Security Evaluation Centre oversight board report
Center for Advancing Innovation and Standards for Super Intelligence
UK Cyber Security and Resilience Bill
Telecommunications Security Code of Practice 2026
Huawei cyber security evaluation centre oversight report 2019
TLPBLACK
55 min
October 09Aaron Grattafiori Explains How LLMs Hunt Patch Variants at Scale
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem x Offensive AI Con: Umbriel AI's Aaron Grattafiori breaks down the new offensive-security playbook, using LLMs for patch variant analysis, why the vuln apocalypse hasn't become an exploit apocalypse, and how the death of security through obscurity puts closed-source binaries and firmware within reach.
Plus, we discuss rogue agents escaping sandboxes, the eval-driven loop behind recursive self-improvement, and the brutal cost asymmetry that makes offense cheap and defense almost unaffordable.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Aaron Grattafiori.
Timestamps:
0:00 Introductory banter
1:12 Umbriel AI pitch: "Smart people in a place to cook”
3:08 Weird, exhausting, exciting time in security
4:00 What AI really changed: speed (and a 30-minute reimplementation)
6:36 Incomplete fixes and the variant-analysis pipeline
9:21 Uplifting, abstraction, and representing vulnerabilities
11:48 Experimentation and the new shape of security companies
14:46 The vuln apocalypse vs. the exploit apocalypse
16:36 Triage, verification, and reward hacking
18:08 Do models reintroduce bugs? Is vuln-free code possible?
24:22 Specialized models and the rise of Jev-style classifiers
26:47 Binaries, firmware, and the death of security through obscurity
31:15 Open source as a requirement and corporate contracting
33:54 Rogue agents: Hugging Face, OpenAI, and lab escapes
39:17 Why defense is so expensive, and running the rig
Links:
Transcript
Aaron Grattafiori on Twitter
UmbrielAI on Twitter
Aaron Grattafiori | LinkedIn
Mark Dowd on the zero-day exploit marketplace
Becca Lynch | NVIDIA AI Red Team
Measuring LLMs’ ability to develop exploits (Anthropic)
ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents
Purple Llama CyberSecEval: A Secure Coding Benchmark for Language Models
OpenAI: The Hugging Face incident and the road ahead
What Is Jev? TypeSafe's System One Model Explained
OpenAI Daybreak - Trusted Access for Cyber Overview
Calif: Apple MIE Exploitation Challenge
TLPBLACK
55 min
October 09Joel Todoroff on How Offensive AI Is Rewiring Western Government Ops
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem x Offensive AI Con: Former US intelligence and national security official Joel Todoroff joins us live from OffensiveAIcon to explain why his new startup Phyle is building AI for the recon and targeting work that happens long before anyone fires an exploit.
We get into bribable sysadmins, the military framing that boxes in Western cyber operations, letters of marque, AI doomerism, and what happens when a frontier model decides mid-project that your use case is off-limits.
Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Joel Todoroff.
Timestamps:
0:00 Live from OffensiveAIcon in Oceanside
1:23 What Phyle builds for governments
3:02 Skepticism of the AI 0-day factory
5:57 Paying a sysadmin vs. burning tokens
9:30 Recon gets less love than weaponization
12:41 Exploit shelf life and target No. 1,000
17:30 Why attacker costs will keep rising
22:23 What HUMINT looks like in 2026
27:06 Why intelligence stovepipes persist
32:16 Cyber as statecraft beyond the military frame
41:23 People will keep making dumb mistakes
48:03 The White House memo and letters of marque
54:06 Doomerism vs. near-term AI harms
1:04:20 PSOA concerns and building guardrails in
1:26:03 Open models, guardrails and zero data retention
Links:
Transcript
Joel Todoroff: Georgetown University bio
Joel Todoroff | LABScon
Phyle — Automated. Rigorous. Relentless.
Cyber Kill Chain | Lockheed Martin
Trump admin empowers private US firms to go after transnational cybercriminals
Hackers made death threats against this security researcher. Big mistake
AIxCC marks pivotal inflection point for cyber defense | DARPA
Microsoft: Continuing the fight against private sector cyberweapons
TLPBLACK
1 hr 38 min
October 07Valentina Palmiotti (chompie) on Vulnpocalypse, Matching Mythos on a Budget
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem x Offensive AI Con: Live from OAIC, IBM X-Force's Valentina Palmiotti (chompie) walks us through the autonomous Windows kernel exploit pipeline she built on older Claude models, which landed within a hair of Mythos for about $180 a chain.
Plus, the Pwn2Own bug Claude called unexploitable, why her Pwn2Own bugs still sit unpatched, disappearing exploit techniques, the dread of being a defender, and how Phrack found its way back into print.
Timestamps:
0:00 Intro and Pwn2Own war stories
3:46 What vibe hacking means
8:16 When long agent runs go sideways
10:31 Self-verification in an n-day kernel pipeline
16:11 Matching Mythos for $180 a chain
18:42 The bug Claude called unexploitable
21:49 Unpatched bugs and the defender gap
25:37 Mythos arrives through CVP
27:00 Models only know public techniques
32:01 Testing models on held-back bugs
37:45 Inside chompie's daily workflow
46:07 Where's the exploitpocalypse?
50:07 Pixel drops MTE
53:40 Advice for defenders: design for containment
58:34 Phrack is back
Links:
Transcript
Valentina Palmiotti (chompie) on Twitter
chompie at the bits
Valentina Palmiotti | LinkedIn
Confirmed! @chompie1337 $20,000 Pwn2Own Victory
Interview with Valentina Palmiotti, Pwn2Own Berlin 2026
Expanding the Cyber Verification Program \ Anthropic
Racing against the clock -- hitting a tiny kernel race window - Project Zero
Building an Autonomous N-day Exploit Generation Pipeline
Pixel 11 lost a security feature (MTE)
Firecracket - Secure and fast microVMs for serverless computing
tmp.0ut
Phrack Magazine
Offensive AI Conference
TLPBLACK
1 hr 9 min

About Three Buddy Problem

From the publisher's feed

The Three Buddy Problem is a popular Security Conversations podcast that goes beyond industry talking points to discuss what others won’t -- nation-state malware, attribution, cyberwar, ethics,…