Agents, Train Robberies, Jazz, Microsoft, Elvis Gyrates, Aaran Leyland, and More - SWN #628 Video
Security Weekly Podcast Network (Video)Summary
A recent surge in cyber threats has emerged, particularly with the exploitation of critical vulnerabilities in PHP, which have been added to the U.S. Cybersecurity and Infrastructure Security Agency's catalog of actively exploited flaws. Attackers have been targeting these vulnerabilities to gain remote code execution, prompting federal agencies to prioritize patching. Despite widespread attempts at exploitation, reports indicate that none have succeeded, although the urgency for organizations to secure their systems remains high.
In a separate incident, the University of Copenhagen confirmed a data breach affecting over 525,000 individuals, including sensitive personal information. This breach serves as a stark reminder of the importance of cybersecurity awareness, particularly in educational institutions where test environments may be inadequately secured. Experts advise organizations to reinforce training on spear phishing and to regularly audit their test environments to prevent similar incidents.
Additionally, a new indirect prompt injection attack has been identified, utilizing markdown files to install malware and steal credentials from unsuspecting users. This highlights the growing risks associated with AI agents and the need for stringent policies governing their interactions with user data. Meanwhile, a flaw in Microsoft Authenticator has raised concerns about the security of work account tokens, although Microsoft reports no known exploitation of this vulnerability to date.
Lastly, a sophisticated scheme involving GPS spoofing has led to the theft of over $100 million in data center-bound cargo. Thieves have been hacking freight brokers' accounts to post fake shipments, subsequently directing real bids to their own operations. This alarming trend underscores the evolving tactics of cybercriminals and the necessity for enhanced security measures in logistics and transportation sectors.
Show Notes
Agents, Train Robberies, Jazz, Microsoft, Elvis Gyrates, Aaran Leyland, and More, on the Security Weekly News. Show Notes: https://securityweekly.com/swn-628
More from Security Weekly Podcast Network (Video)
Proactive security doesn't have to wait for a vuln to be disclosed. Even if a patch isn't available, it's possible to deploy controls and design systems to be resilient against how vulns are exploited. Rashid Feroze talks about runtime security and the benefits of deploying eBPF filters to improve observability and block unauthorized behavior. He walks through scenarios related to supply chain attacks, prompt injections against agents, and responding to major events like PHP2Shell. We touch on threat models to help distinguish between what eBPF filters can protect against and what still requires secure coding discipline from developers. Resources https://ebpf.io https://falco.org Show Notes: https://securityweekly.com/asw-406
Interview with Barrett Lyon Why do we need a Parallel Internet? Barrett details his journey to build truly private access to the Internet. My first thought was, "why not VPN? Why not TOR?" He has good answers to both. To get there, he had to ship his own hardware all over the world. He had to stand up a CDN. DNS. BGP. Anti-DDoS. This is more than just a safer, more secure way to access the Internet - it is an API-driven, optionally agent-controlled software-defined network. And it's a consumer-priced product that starts at $6 a month? My head is spinning. Note: this is NOT a sponsored segment, I'm just legitimately fascinated by it! When this was pitched to me, it sounded so outlandish, I almost passed on it. Then I saw that Barrett created and sold 5 companies, two of which were major anti-DDoS vendors. Clearly, this guy knows how to build serious, scalable infrastructure. Enjoy the conversation! Segment Resources: The main website: https://doxx.net Doxx.net Discord channel: https://discord.gg/595hAxHH4 Barrett's previous work mapping the internet for the Opte project: https://www.opte.org Vibe Check Which security acronym/phrases deserves to be retired? 38% - XDR 25% - Zero Trust 25% - UEBA 6% - CNAPP 6% - Non-Human 0% - Other (leave a comment) Nothing like some acronym soup and buzzwords to really get people out to vote! Shared anger can be a powerful thing, and I'm here for the rants. I have to agree with the top three votes: XDR, Zero Trust, and UEBA (User and Entity Behavior Analytics). CNAPP can see ya later, and since agents outnumber humans 100-1,000 to 1 now, can we call our user accounts "Pro-Human" instead of calling service accounts and agent IDs "Non-Human"? I'm currently raising on this business concept - pre-revenue, pre-TAM, pre-founder, and pre-idea. Expecting to close a $150M pre-seed at a $100B post-money valuation in the next few weeks. Let me know if you want in. ???? Top Comments "Other - The "AI TRiSM" term can go kick the biggest of rocks" "Other - Shift left" "My god I have always hated zero trust and would love to see it die. What a stupid, over-the-top & exaggerated phrase to just basically mean that having a bunch of unauth/flat user roles things is bad… how an entire category of the industry managed to piggyback off cloud to make ZTNA a thing I've no idea. Also led to the annoying trend of overly segmenting all the things. rant over" Enterprise Weekly News Finally, in the enterprise security news, We check out funding There are a lot of acquisitions And a round of layoffs A tech startup goes out of business after two breaches Private keys should be larger than "4" PHP2Shell disrupts everyone's plans this week Want to impress your friends with the quirkiest 2FA authenticator ever? Stick around until the end of the news. All that and more, on this episode of Enterprise Security Weekly. Show Notes: https://securityweekly.com/esw-482
Tor, PhP2Shell, Deepfakes, eMudhra, LiteLLM, Meta, Josh Marpet, and More on this episode of the Security Weekly News. Show Notes: https://securityweekly.com/swn-627
Special guest Joshua Wright joins us for a timely incident-response discussion! Then, in the security news this week: Have you heard about PHP2Shell? Certificates with keys small enough to guess Tor exit nodes turn into SSH credential traps Do USB-C cables need firmware updates now? HaleHound packs a radio lab into a cheap display Claude solves part of the NIST curve mystery The Army and self-directed offensive cyber agents Retired nuclear reactors return to power AI PatchSlop NGINX, NODE.js patches critical flaws BeyondTrust exploited before the patch landed Plex vulnerabilities move from PoC to exploitation ICS patches, including a Siemens flaw exploited in the wild Can fake data trigger Japan's emergency alert? Agentic pentests? AI may add noise more than skill AI agents navigate OT and move equipment AI model helps build a Chrome exploit Utah's VPN law runs into technical reality Segment Resources: https://dynamicincidentresponse.com/ - A New Era for Incident Response! Show Notes: https://securityweekly.com/psw-949
In this episode, Kriss Stephen, Principal Solutions Architect at Semperis, explores the concept of the Minimum Viable Company and the three foundational capabilities every organization needs to withstand and recover from a cyberattack. Drawing from his experience in identity security and cyber resilience, Kriss shares practical lessons on how organizations can prioritize recovery, protect critical identity systems, and maintain business operations during disruptive incidents. Listeners will gain actionable insights into building resilience before a breach occurs and accelerating recovery when it matters most. Segment Resources: Part 1: Minimum Viable Company: True Cyber Resilience Starts with Identity https://www.semperis.com/blog/minimum-viable-company-true-cyber-resilience-starts-with-identity/ Part 2: Minimum Viable Company: Cyber Resilience Beyond the Breach https://www.semperis.com/blog/minimum-viable-company-cyber-resilience-beyond-the-breach/ Part 3: Minimum Viable Company: Enabling Visibility, Control, Resilience https://www.semperis.com/blog/minimum-viable-company-enabling-visibility-control-resilience/ This segment is sponsored by Semperis. Visit https://securityweekly.com/semperis to learn more about them! In the leadership and communications segment, Crisis Communication for Boards handbook, Unclear AI risk ownership could leave CISOs in familiar scapegoat role, Optimism Is Now an Essential Leadership Skill, and more! Show Notes: https://securityweekly.com/bsw-470