Show Notes
The security and reliability of the code in AI models is a huge question mark, because the models are black boxes that aren't accessible to outsiders. Matt Fredrikson, professor at Carnegie Mellon University and founder of Gray Swan AI, joins Dennis to talk about the challenge of assessing these models and how a community of red teamers is trying to meet it.
More from Decipher Security Podcast
This week was a tale of two stories: the PHP2Shell vulnerabilities and the compromise of several certificates issued by CA eMudhra in India. Timestamps00:00 — A wild week in security news02:50 — PHP vulnerabilities and the disclosure drama08:07 — Why coordinating an embargo is so difficult10:02 — Preparing for the PHP patches11:29 — The PHP bugs make national headlines13:44 — Inside the researchers’ PHP vulnerability analysis15:56 — Exploit risk, patching, and the long tail18:06 — Cloudflare’s mitigation and the response so far21:44 — Compromised certificate authority keys23:37 — Revoking certificates and restoring trust25:07 — The hidden infrastructure behind internet security28:11 — “We have a problem here” — shout-out to Wayne29:22 — What’s coming next
The newly disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are as serious as everyone feared, and Ben Harris of watchTowr joins Dennis Fisher to discuss their long-term impact.Timestamps00:00 - Introduction and why the PHP bugs are a big deal00:22 - The disclosure process starts to unravel01:04 - Why the two PHP vulnerabilities are so severe02:07 - Why the embargo mattered and why the leak was dangerous02:49 - PHP’s massive footprint across the internet04:08 - What mitigations can and cannot do05:35 - Comparing this to Log4Shell06:32 - Why sysadmins outside security are suddenly paying attention07:22 - Why old assumptions about disclosure may no longer hold08:48 - How LLMs accelerate reproduction from tiny clues09:13 - Why even partial screenshots and leaked video can be enough10:33 - A rough six to twelve months ahead for security teamsLinksPHP blog: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/Our story: https://decipher.sc/2026/10/20/critical-php-flaws-disclosed-patches-out-now/
Cybersecurity policy can stall when technical experts and lawmakers speak different languages. Beau Woods, CEO and founder of Stratigos Security joins Lindsey O’Donnell-Welch to explain how Hackers on the Hill brings cybersecurity researchers and policymakers together to build understanding and move ideas forward.
This week, we're talking about hacked refrigerators, the FBI disrupting a North Korean laptop farm run by Famous Chollima, and a stealthy network of ads used to deliver mercenary spyware via a zero-click exploit. imestamps0:00 Intro & new video bumper2:00 Hacked supermarket refrigerators3:39 Default credentials and exposed controllers6:47 Food losses, overheating, and real-world impact9:47 The risk of “smart” connected devices15:29 Why security warnings don’t reach operators22:09 Spyware delivered through targeted ads27:17 The scale of modern mercenary spyware33:10 North Korean fake IT-worker operations37:56 Inside the laptop-farm scheme42:57 What’s coming next on DecipherLinksCitizen Lab report: https://citizenlab.ca/research/how-di...FBI advisory on Famous Chollima: https://www.justice.gov/opa/pr/justic...
John Hammond of Huntress joins Dennis Fisher to dive into the ClickFix attack episdemic, how these attacks work, what the payloads are, and what individuals and organizations can do to protect themselves against them.