Paul's Security Weekly (Audio)

In the security news this week:
SSH in Shambles
Santa steals your podcast setup
SAP's double feature
Terminal2Shell is CVSS 11
Dormant neurons, active backdoor
Patched, but still exploitable
948 paths to root
Barracuda serves root
Node-RED, now with shell access
The secret cigar recipe
FBI agent, crypto thief
Another AI agent identity mess
7.7 million reasons to care
Reddit asks the breach question
Who's accountable when AI breaks?
Espionage, chips, geopolitics
Don't ask again, leak forever
AI catches cheating, flags everyone
1.4 million keys need revocation
RSA, now with a countdown
Fingerprint security, SD card reality
Proving Signal's machine code
Thirty zero-days, one offline switch
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-952

In the security news:
Supermarket refrigeration attacks, again!
Rapid7's Ivanti findings and why we can't have "nice" things
Google's massive Android TV botnet takedown
Linux TCP kernel flaw that no one is patching
The Binance theft
APT flaw gives out root
PHP security debt
The porn and Digital billboard problem
Your own phone system to pwn
From PoC to weaponized exploit
Hacking to change time
Rooting an Echo Dot
Firmware should just work
AI chained bugs into working exploits
USB power states leak data across an air gap
AI-assisted vulnerability finding
GoAhead's TLS handling
Hackers hijack emergency alert apps
Taiwan's emergency services become an AI-agent target
CUI exposed through GSA's Google Drive
GCHQ can't account for thousands of storage devices
Railway employee blames an attempted intrusion on AI
VulnCheck opens its initial-access playground to the public
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-951

In the security news this week:
In the security news this week:
Cisco says patch faster, then sells you time
Turning AI refusals into vulnerability signals
Brotli's are hiding
WordPress image upload exploit
Fortinet ships fixes before details
PHP2Shell still claiming victims, including firewalls
Uncoordinated disclosure
Claude finds vulns, go figure
PXE strikes again!
Sony's PS5 bounty drama
Apple's October patches reach older devices
CISA looks ahead to 2030
ArubaOS gets a pile of critical fixes
New UK rules for protecting undersea infrastructure
PortaPack Mayhem goes mobile
Can AI agents police other AI agents?
DHS bans DeepSeek
A Chinese model writes riskier code for a US contractor
eMudhra exits the TLS business
BlackX bootkit exploits Secure Boot
Signal makes hanging up harder than it should be
Is AI solving math, or making it harder to trust?
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-950

Special guest Joshua Wright joins us for a timely incident-response discussion!
Then, in the security news this week:
Have you heard about PHP2Shell?
Certificates with keys small enough to guess
Tor exit nodes turn into SSH credential traps
Do USB-C cables need firmware updates now?
HaleHound packs a radio lab into a cheap display
Claude solves part of the NIST curve mystery
The Army and self-directed offensive cyber agents
Retired nuclear reactors return to power AI
PatchSlop
NGINX, NODE.js patches critical flaws
BeyondTrust exploited before the patch landed
Plex vulnerabilities move from PoC to exploitation
ICS patches, including a Siemens flaw exploited in the wild
Can fake data trigger Japan's emergency alert?
Agentic pentests?
AI may add noise more than skill
AI agents navigate OT and move equipment
AI model helps build a Chrome exploit
Utah's VPN law runs into technical reality
Segment Resources:
https://dynamicincidentresponse.com/ - A New Era for Incident Response!
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-949

In the security news this week:
Convert this router into an SDR
Ivanti straight to root
Anthropic's AI worm FUD
A kernel exploit to fix downloads
Supermarket refrigeration attacks
400 mystery Java vulnerabilities
Authentication bypass
Russia meets the data-center war
Stop & Shop attacked
Anthropic cuts eval agents
AI incident reporting
FortiBleed lives
Anthropic offers scanning
Pre-compromised phones
FakeGit returns
Teams deepfake detection
Let's Encrypt certificates get shorter
GitLab ships another critical patch
Engineer gets prison time for locking thousands of devices
OpenAI employee accused of planting a hidden recorder
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-948