Zero Day, Zero Warning: Inside the Discovery That Could Have Crippled the Internet
Innovation HeroesShow Notes
Twelve years. That's how long a vulnerability sat in sudo—the command powering every Linux system—waiting for the wrong hands. When Stratascale researchers Rich Mirch and Quentin Rhoads-Herrera discovered not one, but two zero-day vulnerabilities in sudo, millions of systems worldwide were at risk.
Go behind the scenes of a discovery that could have changed everything—but didn't, thanks to ethical research and responsible disclosure. Learn how a 12-year-old vulnerability went undetected in one of the world's most scrutinized open-source projects, why human curiosity still outpaces automated security tools, and the methodology behind discovering critical flaws in mature, battle-tested software.
Guests: Rich Mirch, Principal Security Researcher, Stratascale; Quentin Rhoads-Herrera, VP of Security Services, Stratascale
Stratascale is a wholly owned subsidiary of SHI International, delivering cutting-edge cybersecurity research and managed security services.
Show Notes & Resources
Read our blog announcing the vulnerabilities: https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host
CVE Details: • CVE-2025-32462 - The 12-year sudo vulnerability • CVE-2025-32463 - The more severe chroot vulnerability
Key Timestamps: • [02:07] - Rich's discovery approach: assuming vulnerabilities exist • [08:03] - Quinton's validation process and initial disbelief • [13:31] - The "double take" moment of confirming the discovery • [21:21] - Dynamic vs. static testing methodology • [29:03] - Why offensive security research matters • [34:44] - Career advice for aspiring cybersecurity professionals
Learn More: When you need expert guidance on cybersecurity solutions and frameworks, trust SHI's Field CISOs and security experts. We help identify critical gaps, consolidate security platforms, and integrate AI into your cybersecurity practices. Learn more at https://www.shi.com/solutions/cybersecurity
More from Innovation Heroes
A decade of better tools. Better services. Better data. And yet the same statistic keeps showing up: 25-30% of enterprise technology spend is wasted. Why can't anyone move the needle?
Everyone’s talking about AI that writes code and answers questions. But what happens when AI has to operate in the physical world, where mistakes don’t just generate weird sentences, they have real consequences?
The encryption protecting your most sensitive data has as an expiration date. Nation-states are harvesting encrypted traffic right now, stockpiling it until quantum computers become powerful enough to crack it in seconds.
AI ambition is colliding with physical reality.
State and local governments are under pressure to deliver modern services, but budgets, staffing shortages, and long procurement cycles make innovation feel impossible. In this episode of Innovation Heroes, host Ed McNamara talks with three leaders proving that AI-powered Smart Cities aren’t a futuristic concept. They’re happening now.