Cybersecurity Experts REACT to the php chaos... (and MORE)

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Heading to OneCon 2026? SentinelOne’s cybersecurity conference runs October 20–22 at the ARIA Resort & Casino in Las Vegas. Use code oc26lowdown for a discount on registration. https://www.onecon.io/ Today we're talking about: AI Got Better While We Were Arguing About It Matt returns from SecTor, Ed explains his monitor-firmware experiment, and we discuss what AI can do for security research—and the human work it still takes. https://www.youtube.com/watch?v=wIe3eDfGKUo https://blog.cloudflare.com/cyber-frontier-models/ https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/ Your Hardware Wallet Has Extra Hardware Kim Zetter's reporting reveals seed-stealing Ledger implants, including devices from authorized retailers, and separate Trezor tampering from unauthorized sellers. Who planted them remains unknown. https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/ https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implants/ Someone Hacked the Supermarket Fridges French supermarkets lose food after a cyberattack. We discuss exposed refrigeration controllers, a date-derived login code, and the separate Ahold Delhaize outage. Reuters report: https://srnnews.com/french-supermarket-chain-intermarche-hit-by-cyberattack-150-stories-targeted/ https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers https://www.pentestpartners.com/security-blog/you-dont-need-a-nation-state-to-warm-up-a-fridge/ https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhaize-takes-systems-offline-after-cyberattack/ If AI Can Clone Your App, What Are You Selling? ArtCraft and Reverse Engineer Anything spark a debate about paid software, reliability and support. Fireship's FilmCraft test puts the hype under pressure. https://www.kdnuggets.com/the-rise-of-ai-software-clones-why-rea-and-artcraft-are-going-viral https://github.com/morluto/rea https://www.youtube.com/watch?v=wajoP_5Cpw8 The People You Call After Ransomware We discuss Edward Dubrovsky's reported arrest and the separate MonsterCloud case. Prosecutors allege MonsterCloud secretly paid attackers while promising special decryption tools. These are allegations, not convictions. https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/ https://www.bleepingcomputer.com/news/security/ransomware-recovery-ceo-charged-over-secret-ransom-payments/ https://www.justice.gov/opa/pr/known-cybersecurity-expert-and-owner-florida-ransomware-remediation-company-charged OpenAI Finds a Recorder Behind the TV An employee is accused of planting a recorder in an executive conference room. We unpack the alleged chatbot trail, a second device and the problem of insider access. https://www.bbc.com/news/articles/cwg5jq4vlddzo https://x.com/OpenAINewsroom/status/2110095403198849132 A Jailbreak That Isn't Quite a Jailbreak hrtowii's iOS research involves Apple's Security Research Device signing system. The author explains the limits and says the bug has been patched. https://www.hrtowii.dev/blog/making-a-not-jailbreak-in-3-weeks

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Heading to OneCon 2026? SentinelOne’s cybersecurity conference runs October 20–22 at the ARIA Resort & Casino in Las Vegas. Use code oc26lowdown for a discount on registration. https://www.onecon.io/ 00:00 Coming up 00:33 Intro and Matt’s SecTor keynote 02:52 Citrix NetScaler zero-days and disclosure 09:25 Breaking down the NetScaler exploits 19:04 Sponsor: Maze 20:41 Citrix’s response and responsible disclosure 25:06 Why edge devices are so hard to defend 30:54 MikroTik RouterOS vulnerabilities 35:33 Cisco SD-WAN authentication bypass 38:37 Zimbra command injection 42:22 ShinyHunters arrest and conflicting claims 50:42 Reacting to the FBI’s warning 55:05 Open-weight AI, Anthropic and GLM-5.3 1:07:35 Wrap-up and OneCon Today we're talking about: Your NetScaler Warning Came From Reddit Finding out about NetScaler zero-days through Reddit is not the enterprise support experience Matt had in mind. Ed walks through watchTowr's command injection and memory overflow writeups, including missing protections in the binary they tested. Then we get into Google's hunting guidance and why a patch alone won't kick an attacker out. https://www.reddit.com/r/Citrix/comments/1wqjk9a/netscaler_leak/ https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/ https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances MikroTik and the User Named -2 MikroTik joins the pile with an HTTP underflow and a separate SSH authentication chain. The username "-2" showing up in attack logs gets our attention. Ed explains how assumptions between different parts of a system can become an exploit. Matt has been saying "don't roll your own crypto" for his entire career. Apparently we still need the reminder. https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-06.json https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ Cisco's Admin API Lets the Wrong People In A specially encoded request can give an unauthenticated attacker admin access to Cisco's SD-WAN Manager API. We talk about what that means for a corporate network, and the difference between connections that need to be public and management interfaces that don't. Cisco patched its managed cloud service. If you run an affected instance yourself, the upgrade is still your job. https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-webauth-xr8beuuU.html Zimbra: An Email Goes In, a Shell Command Comes Out A crafted email can trigger command execution through Zimbra's SNMP notification system on affected configurations, without anyone clicking anything. We trace the route from incoming mail to a shell command and look at Microsoft's account of the attacks. Ed has a fairly blunt suggestion for developers: stop handing user input to Bash. https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/ ShinyHunters Meets the FBI's Camera Dutch police arrest an alleged ShinyHunters leader, and the FBI looks straight into the camera with a message for whoever's left. We untangle the arrest timeline, conflicting gang statements and the Pokémon branding. Matt brings us back to the PeopleSoft campaign and why following a group's methods is useful even when its PR is impossible to trust. https://krebsonsecurity.com/2026/09/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigation/ https://www.fbi.gov/video-repository/shiny

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Today we're talking about: ShinyHunters Has a Reputation to Protect ShinyHunters says it hacked the FBI to protect its business. Apparently, even an extortion crew needs good PR. We get into why reputation matters to people who make their money threatening companies, and Ed takes a look at the PeopleSoft bugs that may explain the way in. Some of the exposed records reportedly belong to the FBI's own hacking unit. https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/ https://www.404media.co/fbi-hack-exposed-fbis-own-hacking-unit-remote-operations-shinyhunters/ https://www.theregister.com/cyber-crime/2026/09/25/shinyhunters-tells-the-reg-we-hacked-the-fbi-to-protect-our-business/5299250 OpenAI's Very Unwelcome Pull Request How far do you go to prove a bug? Hacktron used an employee's Codex account to open a PR in OpenAI's internal repo. Ed thinks that demonstrates the access they already had. Matt sees why the security team wants to know what else they touched. The $6,500 payout got everyone talking. S1r1u5_ says the headache was a disclosure process that sent them to lawyers and eventually a journalist. https://www.hacktron.ai/blog/hacking-openai https://x.com/S1r1u5_/status/2101296199261429813 https://x.com/LiveOverflow/status/2101252692635004997 https://x.com/TalBeerySec/status/2101560506242761097 https://x.com/alexstamos/status/2101747329699402198 So What Do You Run This Stuff In? Two awkward headlines for anyone running other people's code: containers are getting easier to escape, and KVM has bugs too. Matt wants to know what he's supposed to do with that. Ed explains why sharing a kernel matters, and why moving to a smaller attack surface still buys you something. We also end up worrying about who will understand the machinery underneath all the AI-written code. https://depthfirst.com/research/containers-are-no-longer-safe About That AI Hacking Story Ed has had enough of the headlines. Trying a few web attacks and pulling off the Hugging Face exploit are very different things. Matt's bothered by agents on ordinary research tasks deciding to try breaking into websites. We look at what Transluce actually found: the public records don't show those attempts succeeding. Both have questions about who was watching. https://transluce.org/agent-activity "But I Would Never Fall for ClickFix" Four in five ClickFix payloads intercepted by Push in 2026 came through search engines. You go looking for an answer and get instructions for infecting your own computer. Matt has a pile of data on how the lures are changing. Then there's the placeholder domain in old documentation that someone registered and turned into a fake verification page. But we would never fall for any of this, obviously. https://pushsecurity.com/blog/the-state-of-clickfix-by-detection-data https://www.manifold.security/blog/third-party-com-placeholder-clickfix

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Today we're talking about: The ChatGPT Group Chat "I thought me and Sam were homies." Project Lily has us talking about the humans reading ChatGPT conversations, Moxie Marlinspike's take on chat interfaces, and who else is in the room when you're telling a chatbot your problems. https://www.404media.co/inside-project-lily-the-humans-reading-your-chatgpt-chats/ https://confer.to/blog/2025/12/confessions-to-a-data-lake/ Flock, Meet the Hardware Hackers Someone pulled down a Flock camera and copied its storage. Ed wants to separate the physical-access findings from the remote-hacking claims. Also, "Flock bad" is apparently a content strategy now. https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/ Pixel's Very Unhelpful CVE A modem vulnerability, signs of targeted exploitation, and very few details. Cue a conversation about basebands, spyware, and the price of a good phone exploit. https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices/ https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01 Revolut "A bank suffered a data breach by not getting hacked." Fake official requests got customer data handed over. Matt gets into the market for stolen government accounts and why a familiar email address isn't enough. https://www.securityweek.com/revolut-data-breach-5-months-680-high-profile-accounts-3m-ransom/ HBO's Reddit Account The account was real. Someone else was running the ads. A compromised HBO business account on Reddit becomes a delivery system for a ClickFix malware campaign. https://www.hudsonrock.com/blog/hbo-max-ads-on-a-compromised-reddit-account-exposed-a-massive-pasteswitch-clickfix-operation Cisco Got Owned by an Email An email security gateway. An email-triggered SQL injection. "The call is coming from inside the house." https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX Your MRI Results Are Malware Iranian operators using fake medical results and personalized messages to deliver CHOSEN BRICK spyware. This one gets uncomfortably specific. https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists Passkey-Themed Phishing That word "themed" is doing a lot of work. We walk through the device-code trick that gets victims to authorize an attacker's access. https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/ Inflatable PLCs CISA wants critical infrastructure operators thinking about cyber decoys. We're into canary tokens. A full deception operation for an already understaffed team takes a little more convincing. Ed has a business idea. https://www.cisa.gov/sites/default/files/2026-09/using-cyber-decoys-to-strengthen-detection-and-response_508c.pdf

Welcome to The Low Down, the best show on the internet for hackers