Show Notes
In the security news this week: BPFDoor OpenSSH compresses a little too much AI can find bugs. Who gets them fixed? TP-Link and the courts Cisco NX-API ClingSTUN LineageOS, Android TV, and a Raspberry PI Dell’s updater has a privilege problem SonicWall SSRF U-Boot’s LogoFAIL like Exploit-DB isn’t dead MFA passes. The attacker still gets in. LakeShark and cool gadgets Kasa cameras and an exposed debug interface SharePoint hardening is back on the checklist Google pauses open-source bug bounty submissions NetScaler’s latest vulnerability needs a closer look Kiteworks tells customers to shut it down Exchange gets an unexpected security update Do LLMs actually reason? disagree on AI risk? Anthropic, AI consciousness and the Vatican Grok gets involved in foreign policy WordPress malware that survives cleanup Can spyware vendors stop their own tools? When an AI chatbot conversation reaches the police Open-weight AI models enter the cyber debate AI agents take their attacks shopping Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-947
More from Security Weekly Podcast Network (Audio)
In this episode, Kriss Stephen, Principal Solutions Architect at Semperis, explores the concept of the Minimum Viable Company and the three foundational capabilities every organization needs to withstand and recover from a cyberattack. Drawing from his experience in identity security and cyber resilience, Kriss shares practical lessons on how organizations can prioritize recovery, protect critical identity systems, and maintain business operations during disruptive incidents. Listeners will gain actionable insights into building resilience before a breach occurs and accelerating recovery when it matters most. This segment is sponsored by Semperis. Visit https://securityweekly.com/semperis to learn more about them! In the leadership and communications segment, Crisis Communication for Boards handbook, Unclear AI risk ownership could leave CISOs in familiar scapegoat role, Optimism Is Now an Essential Leadership Skill, and more! Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://securityweekly.com/bsw-470
Klingons, Stop and Shop, OvHCloud, Microsoft, Plex2Shell, ReactOS, Aaran Leyland, and More on the Security Weekly News. Visit https://www.securityweekly.com/swn for all the latest episodes! Show Notes: https://securityweekly.com/swn-626
The OWAS Mobile Application Security (MAS) project recently released an updated version of its guidance, with excellent advice organized into common weaknesses, a verification standard for devs (MASVS), and a testing guide (MASTG). Ryan Lloyd and Jan Seredynski from Guardsquare dive into the project to talk about how it's been updated, how orgs can use it, and the challenges orgs face in managing their mobile frameworks and environments. We also cover how agents and LLMs are impacting mobile security and what future iterations of the MAS project might include for securing mobile apps interacting with LLMs or being written by LLMs. Finally, we share practical ways for developers to get involved as OWASP contributors and advocates. Segment Resources: https://mas.owasp.org https://mas.owasp.org/MASWE/ https://hubs.ly/Q04ykvgm0 This segment is sponsored by Guardsquare. Visit https://securityweekly.com/guardsquare to learn more! Visit https://www.securityweekly.com/asw for all the latest episodes! Show Notes: https://securityweekly.com/asw-405
Interview with Michael Jenkins from ThreatLocker Securing AI on the Endpoint - Zero Trust or Bust Michael joins us for the first time to discuss strategies for securing the latest evolution of AI: local endpoint-based AI agents. Tools like Claude Code, OpenAI Codex, and Google AntiGravity give employees the power to build any software or workflow they can imagine, but what is the risk impact? These models aren't shy about adopting and downloading libraries, tools, and untrusted software to fulfill the goals they've been given. We explore how execution control and ringfencing can add some sanity and security to the process. This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! Topic Segment: Anthropic Dreams of AI Replicants Of all the things AI labs could be researching or cooking up, I wouldn't have guessed AI worms distributing inference across smart TVs would be on the list, but here we are. Adrian, Tyler, and Ayman mull over this strange research. It is too loose to be an academic paper, but maybe should have been? Is really a pressing AI risk we should be worried about right now? Why did Anthropic choose to focus on smart TVs and not more powerful IoT devices? Weekly Enterprise News Finally, in the enterprise security news, we discuss the vibes certified organic books don’t mess with criminals the history of ShinyHunters building strategies on the wrong lessons crypto wallet supply chain drama Hot refrigerators Reddit is great for breach tracking Microsoft patch Tuesday is on track to hit 12,000 patches by next April All that and more, on this episode of Enterprise Security Weekly. Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw-481
Mr. Sparkle, Burger King, Pwnscape, Linux, Cisco, GitHub, Microsoft, Josh Marpet, and More on this episode of the Security Weekly News. Visit https://www.securityweekly.com/swn for all the latest episodes! Show Notes: https://securityweekly.com/swn-625