Paul's Security Weekly (Audio)

In the news this week:
InfraTrust and knowing what to patch
Adversary in the middle triggered command injection
Exploitarium again
FreeRDP comes with free vulnerabilities
AI breaking out of sandboxes on its own
Wordpress RCE
DMA dangers
Nightmware eclypse is at it again
Fortisandbox
Turning AI to the dark side
more prompt injection
Secure boot is broken, still and again...
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-936

This week, our technical segment covers a new open-source tool written by Paul (and Claude) that helps you keep your Linux systems up to date and assess supply chain risks. It's called "fettle" and is a pure Python implementation that gives you even more features than previously discussed! Then in the security news:
The GodDamn Ransomware
CMMC suspended
Holy Microsoft Tuesday!
Lessons learned
Without the Internet, do we still get water?
The forgotten shims
More than two BIOS passwords
Cracking firmware encryption with Claude
1999 called, and it wants its "Exploits" back
Prompt injection for defenders
Grok has your repo
You're not going to outpatch AI
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-935

In the security news:
Son of Anton strikes again!
HalluSquatting and using Claude to defend itself
CISA KEV's Revolving Door
LLM's hallucinate and companies get sued
Additionally - GitLost
Yet even more Linux vulnerabilities
Citrix just keeps bleeding
Old hardware is new again
A sneak peak into next week's tech segment
Tenda hidden backdoors
We're still talking about Mirai
Today was not a good day for Roundcube
Canada is hacking criminals
AI safeguards are still annnoying
All cars will spy on you
The FatFs unpatched vulnerability in millions of embedded devices
Windows OS market share drops below 60% (Paul uses Arch)
'We Cannot Choose to Become Idiots' - or can we?
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-934

This week we have a technical segment based on the response to "Atomic Arch", an updated open-source tool to help you catch malicious packages. In the security news:
Exploitarium
A hot messy summer of vulnerabilities
AI Squatting
Linux LPE - no shortage of those
Fingerprinting Favicons
Windows 10 extended
Can Clothes Make You Invisible to Facial Recognition?
Fable and Mythos for All
Do we care about Quantum?
Execs have AI risk under control
Biological warefare in Spyware
The scripts in-scope for PCI
We don't have privacy, but we may get age restrictions
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-933

First up is Sandy Bird from Sonrai discussing how to protect our cloud infrastructure!
This segment is sponsored by Sonrai Security. Visit https://securityweekly.com/sonrai to learn more about them!
Next up in the security news:
Help, I am Fortibleeding
Cisco SD-WAN needs help
The secret life of probe requests
Help, I am Squidbleeding
XSS to RCE and why CVSS isn't the full picture
TVs spy on you
Foundational security practices
Cybersecurity costs money
Happy "Its too late to update your KEK key" day
You don't have security flaws if no one can report them
Rickrolling FIFA
Domain takeovers
End of life, out of luck
The key to Encryption...
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-932