Show Notes
This week we have a technical segment focused on Linux! Paul released a script that helps you get a handle on Linux supply chain security, and new features allow you to assess the state of Secure Boot on your Linux systems (that also use MS certificates, ironically). The script is in his Git repo: https://github.com/pasadoorian/Linux_Hacks. In the security news: The CVE chase The new security basics Enterprises are lacking more than AI Detections are falling behind Why DOOM!?! Chromium vulnerability The ambitious Flipper One I'm still curious who was behind these leaks Mitre moves Caldera to Apache foundation Wind cybersecurity PQC updates YellowKey Bitlocker Bypass updates The software supply chain is in deep trouble Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-928
More from Paul's Security Weekly (Audio)
Special guest Joshua Wright joins us for a timely incident-response discussion! Then, in the security news this week: Have you heard about PHP2Shell? Certificates with keys small enough to guess Tor exit nodes turn into SSH credential traps Do USB-C cables need firmware updates now? HaleHound packs a radio lab into a cheap display Claude solves part of the NIST curve mystery The Army and self-directed offensive cyber agents Retired nuclear reactors return to power AI PatchSlop NGINX, NODE.js patches critical flaws BeyondTrust exploited before the patch landed Plex vulnerabilities move from PoC to exploitation ICS patches, including a Siemens flaw exploited in the wild Can fake data trigger Japan's emergency alert? Agentic pentests? AI may add noise more than skill AI agents navigate OT and move equipment AI model helps build a Chrome exploit Utah's VPN law runs into technical reality Segment Resources: https://dynamicincidentresponse.com/ - A New Era for Incident Response! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-949
In the security news this week: Convert this router into an SDR Ivanti straight to root Anthropic's AI worm FUD A kernel exploit to fix downloads Supermarket refrigeration attacks 400 mystery Java vulnerabilities Authentication bypass Russia meets the data-center war Stop & Shop attacked Anthropic cuts eval agents AI incident reporting FortiBleed lives Anthropic offers scanning Pre-compromised phones FakeGit returns Teams deepfake detection Let's Encrypt certificates get shorter GitLab ships another critical patch Engineer gets prison time for locking thousands of devices OpenAI employee accused of planting a hidden recorder Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-948
In the security news this week: BPFDoor OpenSSH compresses a little too much AI can find bugs. Who gets them fixed? TP-Link and the courts Cisco NX-API ClingSTUN LineageOS, Android TV, and a Raspberry PI Dell's updater has a privilege problem SonicWall SSRF U-Boot's LogoFAIL like Exploit-DB isn't dead MFA passes. The attacker still gets in. LakeShark and cool gadgets Kasa cameras and an exposed debug interface SharePoint hardening is back on the checklist Google pauses open-source bug bounty submissions NetScaler's latest vulnerability needs a closer look Kiteworks tells customers to shut it down Exchange gets an unexpected security update Do LLMs actually reason? disagree on AI risk? Anthropic, AI consciousness and the Vatican Grok gets involved in foreign policy WordPress malware that survives cleanup Can spyware vendors stop their own tools? When an AI chatbot conversation reaches the police Open-weight AI models enter the cyber debate AI agents take their attacks shopping Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-947
First up we talk with Threatlocker CTO Michael Jenkins about threat actors use of AI and keeping the bad things out with Zero Trust. Then in the security news: Compiling spreadsheets, because that's why Nvidia wants to put AI agents in timeout Citrix NetScaler gets exploited again, and again Spectre still refuses to die Your SBOM is incomplete? File notifications leak more than filenames ENIAC had cables instead of a BIOS Another Linux kernel root exploit lands Containers share a kernel ThinkNode M9 microSD card gets a virus notice Google analyst infiltrates a supply-chain gang Your phone speaker can transmit radio Reconstructing firmware with a logic analyzer Robot dogs learn cybersecurity CISA warns about third-party ICS integrators Dutch police arrest a ShinyHunters suspect A soldier goes from telecom hacking to prison AI companies discover their agents have opinions Cloudflare containers accidentally share leftovers OT networks are still mostly not isolated Florida wants to pause ChatGPT The interview segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-946
In the security news this week: Build your own router, or just buy one What to patch first But maybe don't buy D-Link AI nearly starts a war Flock cameras lose their keys The AI slowdown won't save bad security Opus at home, just slower Black Hat says fundamentals still work Hacker gadgets, and my top pick Gyazo screenshots Fake job interviews, real malware VINCE gets a new home Munich university gets disconnected LinkedIn fights the scraping machine SolarWinds hard-codes another bad idea Fake LastPass kills 145 security tools Colorado water gets its settings changed AI CEOs sell apocalypse and bonds The AI safety cult gets audited Ransomware recovery takes weeks, not hours TeamPCP's supply-chain tour continues Zuckoff hunts smart glasses Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-945