Going From Bug Bounty Bugs to More Secure Systems - Shlomie Liberow - ASW #402 Video

Tor, PhP2Shell, Deepfakes, eMudhra, LiteLLM, Meta, Josh Marpet, and More on this episode of the Security Weekly News. Show Notes: https://securityweekly.com/swn-627

Special guest Joshua Wright joins us for a timely incident-response discussion! Then, in the security news this week: Have you heard about PHP2Shell? Certificates with keys small enough to guess Tor exit nodes turn into SSH credential traps Do USB-C cables need firmware updates now? HaleHound packs a radio lab into a cheap display Claude solves part of the NIST curve mystery The Army and self-directed offensive cyber agents Retired nuclear reactors return to power AI PatchSlop NGINX, NODE.js patches critical flaws BeyondTrust exploited before the patch landed Plex vulnerabilities move from PoC to exploitation ICS patches, including a Siemens flaw exploited in the wild Can fake data trigger Japan's emergency alert? Agentic pentests? AI may add noise more than skill AI agents navigate OT and move equipment AI model helps build a Chrome exploit Utah's VPN law runs into technical reality Segment Resources: https://dynamicincidentresponse.com/ - A New Era for Incident Response! Show Notes: https://securityweekly.com/psw-949

In this episode, Kriss Stephen, Principal Solutions Architect at Semperis, explores the concept of the Minimum Viable Company and the three foundational capabilities every organization needs to withstand and recover from a cyberattack. Drawing from his experience in identity security and cyber resilience, Kriss shares practical lessons on how organizations can prioritize recovery, protect critical identity systems, and maintain business operations during disruptive incidents. Listeners will gain actionable insights into building resilience before a breach occurs and accelerating recovery when it matters most. Segment Resources: Part 1: Minimum Viable Company: True Cyber Resilience Starts with Identity https://www.semperis.com/blog/minimum-viable-company-true-cyber-resilience-starts-with-identity/ Part 2: Minimum Viable Company: Cyber Resilience Beyond the Breach https://www.semperis.com/blog/minimum-viable-company-cyber-resilience-beyond-the-breach/ Part 3: Minimum Viable Company: Enabling Visibility, Control, Resilience https://www.semperis.com/blog/minimum-viable-company-enabling-visibility-control-resilience/ This segment is sponsored by Semperis. Visit https://securityweekly.com/semperis to learn more about them! In the leadership and communications segment, Crisis Communication for Boards handbook, Unclear AI risk ownership could leave CISOs in familiar scapegoat role, Optimism Is Now an Essential Leadership Skill, and more! Show Notes: https://securityweekly.com/bsw-470

Klingons, Stop and Shop, OvHCloud, Microsoft, Plex2Shell, ReactOS, Aaran Leyland, and More on the Security Weekly News. Show Notes: https://securityweekly.com/swn-626

The OWAS Mobile Application Security (MAS) project recently released an updated version of its guidance, with excellent advice organized into common weaknesses, a verification standard for devs (MASVS), and a testing guide (MASTG). Ryan Lloyd and Jan Seredynski from Guardsquare dive into the project to talk about how it's been updated, how orgs can use it, and the challenges orgs face in managing their mobile frameworks and environments. We also cover how agents and LLMs are impacting mobile security and what future iterations of the MAS project might include for securing mobile apps interacting with LLMs or being written by LLMs. Finally, we share practical ways for developers to get involved as OWASP contributors and advocates. Segment Resources: https://mas.owasp.org https://mas.owasp.org/MASWE/ https://hubs.ly/Q04ykvgm0 This segment is sponsored by Guardsquare. Visit https://securityweekly.com/guardsquare to learn more! Show Notes: https://securityweekly.com/asw-405