9/11 at 25, OfferLoader, Gemini CLI, Liquid, 10% Doom, Josh Marpet, and More - SWN #615 Video
Security Weekly Podcast Network (Video)Show Notes
Twenty-five years since 9/11, and we open by marking it properly — the people who didn't come home, and the survivors and responders still carrying it, physically and mentally, a quarter of a century on. Then we get to work. Shift-left didn't fail. The starting line moved. AI coding agents now read the issue, write the code, pick the dependencies and open the pull request — so the earliest trust boundary isn't your first commit any more, it's the moment an agent gets context and authority. Most of us haven't moved our controls with it. Unit 42 pull the lid off a pay-per-install operation running out of eleven gaming YouTube channels, with over ten thousand loader samples underneath it. Every layer built to look too boring to escalate. When your analyst closes that alert as adware, they may have just closed three separate compromises. Google's threat tracker: a credential-harvesting campaign built and run in under six hours, with Markdown files as attacker playbooks. And malware carrying prompt-injection text designed to make your LLM scanner refuse to look at it — because a refusal that reads as "clean" is a free pass. A CVSS 10 in Gemini CLI that never touched the model. No prompt, no injection, no tool call. The attacker just turned up before the sandbox did. The first ever Take It Down Act sentencing — handled carefully, with what you actually do if someone tells you something, and a proper shout-out to Dale, the Cyber Safety Guy, whose work every parent with a teenager online should have bookmarked. Two hundred and sixty-three million dollars walks out of a Bitcoin sidechain and then walks back in. Nobody stole the keys. They just convinced the system to sign a lie. Anthropic's 154-page threat report. And an alignment lead who puts extinction odds above ten percent. All that, plus Josh Marpet's take, on Security Weekly News #615. Show Notes: https://securityweekly.com/swn-615
More from Security Weekly Podcast Network (Video)
Tor, PhP2Shell, Deepfakes, eMudhra, LiteLLM, Meta, Josh Marpet, and More on this episode of the Security Weekly News. Show Notes: https://securityweekly.com/swn-627
Special guest Joshua Wright joins us for a timely incident-response discussion! Then, in the security news this week: Have you heard about PHP2Shell? Certificates with keys small enough to guess Tor exit nodes turn into SSH credential traps Do USB-C cables need firmware updates now? HaleHound packs a radio lab into a cheap display Claude solves part of the NIST curve mystery The Army and self-directed offensive cyber agents Retired nuclear reactors return to power AI PatchSlop NGINX, NODE.js patches critical flaws BeyondTrust exploited before the patch landed Plex vulnerabilities move from PoC to exploitation ICS patches, including a Siemens flaw exploited in the wild Can fake data trigger Japan's emergency alert? Agentic pentests? AI may add noise more than skill AI agents navigate OT and move equipment AI model helps build a Chrome exploit Utah's VPN law runs into technical reality Segment Resources: https://dynamicincidentresponse.com/ - A New Era for Incident Response! Show Notes: https://securityweekly.com/psw-949
In this episode, Kriss Stephen, Principal Solutions Architect at Semperis, explores the concept of the Minimum Viable Company and the three foundational capabilities every organization needs to withstand and recover from a cyberattack. Drawing from his experience in identity security and cyber resilience, Kriss shares practical lessons on how organizations can prioritize recovery, protect critical identity systems, and maintain business operations during disruptive incidents. Listeners will gain actionable insights into building resilience before a breach occurs and accelerating recovery when it matters most. Segment Resources: Part 1: Minimum Viable Company: True Cyber Resilience Starts with Identity https://www.semperis.com/blog/minimum-viable-company-true-cyber-resilience-starts-with-identity/ Part 2: Minimum Viable Company: Cyber Resilience Beyond the Breach https://www.semperis.com/blog/minimum-viable-company-cyber-resilience-beyond-the-breach/ Part 3: Minimum Viable Company: Enabling Visibility, Control, Resilience https://www.semperis.com/blog/minimum-viable-company-enabling-visibility-control-resilience/ This segment is sponsored by Semperis. Visit https://securityweekly.com/semperis to learn more about them! In the leadership and communications segment, Crisis Communication for Boards handbook, Unclear AI risk ownership could leave CISOs in familiar scapegoat role, Optimism Is Now an Essential Leadership Skill, and more! Show Notes: https://securityweekly.com/bsw-470
Klingons, Stop and Shop, OvHCloud, Microsoft, Plex2Shell, ReactOS, Aaran Leyland, and More on the Security Weekly News. Show Notes: https://securityweekly.com/swn-626
The OWAS Mobile Application Security (MAS) project recently released an updated version of its guidance, with excellent advice organized into common weaknesses, a verification standard for devs (MASVS), and a testing guide (MASTG). Ryan Lloyd and Jan Seredynski from Guardsquare dive into the project to talk about how it's been updated, how orgs can use it, and the challenges orgs face in managing their mobile frameworks and environments. We also cover how agents and LLMs are impacting mobile security and what future iterations of the MAS project might include for securing mobile apps interacting with LLMs or being written by LLMs. Finally, we share practical ways for developers to get involved as OWASP contributors and advocates. Segment Resources: https://mas.owasp.org https://mas.owasp.org/MASWE/ https://hubs.ly/Q04ykvgm0 This segment is sponsored by Guardsquare. Visit https://securityweekly.com/guardsquare to learn more! Show Notes: https://securityweekly.com/asw-405