Paul's Security Weekly (Audio)

In the security news this week:
BPFDoor
OpenSSH compresses a little too much
AI can find bugs. Who gets them fixed?
TP-Link and the courts
Cisco NX-API
ClingSTUN
LineageOS, Android TV, and a Raspberry PI
Dell's updater has a privilege problem
SonicWall SSRF
U-Boot's LogoFAIL like
Exploit-DB isn't dead
MFA passes. The attacker still gets in.
LakeShark and cool gadgets
Kasa cameras and an exposed debug interface
SharePoint hardening is back on the checklist
Google pauses open-source bug bounty submissions
NetScaler's latest vulnerability needs a closer look
Kiteworks tells customers to shut it down
Exchange gets an unexpected security update
Do LLMs actually reason?
disagree on AI risk?
Anthropic, AI consciousness and the Vatican
Grok gets involved in foreign policy
WordPress malware that survives cleanup
Can spyware vendors stop their own tools?
When an AI chatbot conversation reaches the police
Open-weight AI models enter the cyber debate
AI agents take their attacks shopping
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-947

First up we talk with Threatlocker CTO Michael Jenkins about threat actors use of AI and keeping the bad things out with Zero Trust. Then in the security news:
Compiling spreadsheets, because that's why
Nvidia wants to put AI agents in timeout
Citrix NetScaler gets exploited again, and again
Spectre still refuses to die
Your SBOM is incomplete?
File notifications leak more than filenames
ENIAC had cables instead of a BIOS
Another Linux kernel root exploit lands
Containers share a kernel
ThinkNode M9 microSD card gets a virus notice
Google analyst infiltrates a supply-chain gang
Your phone speaker can transmit radio
Reconstructing firmware with a logic analyzer
Robot dogs learn cybersecurity
CISA warns about third-party ICS integrators
Dutch police arrest a ShinyHunters suspect
A soldier goes from telecom hacking to prison
AI companies discover their agents have opinions
Cloudflare containers accidentally share leftovers
OT networks are still mostly not isolated
Florida wants to pause ChatGPT
The interview segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-946

In the security news this week:
Build your own router, or just buy one
What to patch first
But maybe don't buy D-Link
AI nearly starts a war
Flock cameras lose their keys
The AI slowdown won't save bad security
Opus at home, just slower
Black Hat says fundamentals still work
Hacker gadgets, and my top pick
Gyazo screenshots
Fake job interviews, real malware
VINCE gets a new home
Munich university gets disconnected
LinkedIn fights the scraping machine
SolarWinds hard-codes another bad idea
Fake LastPass kills 145 security tools
Colorado water gets its settings changed
AI CEOs sell apocalypse and bonds
The AI safety cult gets audited
Ransomware recovery takes weeks, not hours
TeamPCP's supply-chain tour continues
Zuckoff hunts smart glasses
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-945

In the security news this week:
UK government rolls out passkeys to 20 million users
Phishing-resistant authentication and replay resistance
Passkey adoption, device security, and user acceptance
EU Cyber Resilience Act guidance, scope, and compliance
CRA vulnerability disclosure and reporting requirements
The real cost of cyberattacks and cybersecurity spending
Cyber insurance and improving organizational security
Nightmare Eclipse and the release of Windows zero-days
Check Point VPN vulnerabilities and perimeter security
GitLab security updates and shadow IT
Discovering unmanaged GitLab instances
Cyberattacks against oil tankers and insider threats
VPN patching and implied rules
Zero-downtime GitLab updates and version management
Running Windows ARM on Apple Silicon with VMware and Parallels
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-944

In the security news this week:
Microsoft patches all the things
Commissary freezers enter cyberwar
Fake AV, real Defender nap
Rowhammer comes for the GPU
BIOS updates are no longer optional
CVSS is not a crystal ball
Kworker, but make it malware
FortiGate gets a post-exploitation RAT
CERN goes Debian underground
UEFI shells strike again
Australia loses the plot, and phones
Cisco routers become covert gateways
MikroTik patches the takeover chain
WeWorm wriggles through mobile
The year of Linux television
Browsers become backdoors
Fake IT calls, real data theft
CVE attribution gets weird
Boston Scientific keeps talking
Security tools misconfigure themselves
AI circuit breakers for rogue agents
Passkeys meet the real world
Vibe coding, vibe vulnerabilities
AI loss of control keeps climbing
AI agents report themselves to Schneier
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-943