Paul's Security Weekly (Audio)

In the security news this week:
Build your own router, or just buy one
What to patch first
But maybe don't buy D-Link
AI nearly starts a war
Flock cameras lose their keys
The AI slowdown won't save bad security
Opus at home, just slower
Black Hat says fundamentals still work
Hacker gadgets, and my top pick
Gyazo screenshots
Fake job interviews, real malware
VINCE gets a new home
Munich university gets disconnected
LinkedIn fights the scraping machine
SolarWinds hard-codes another bad idea
Fake LastPass kills 145 security tools
Colorado water gets its settings changed
AI CEOs sell apocalypse and bonds
The AI safety cult gets audited
Ransomware recovery takes weeks, not hours
TeamPCP's supply-chain tour continues
Zuckoff hunts smart glasses
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-945

In the security news this week:
UK government rolls out passkeys to 20 million users
Phishing-resistant authentication and replay resistance
Passkey adoption, device security, and user acceptance
EU Cyber Resilience Act guidance, scope, and compliance
CRA vulnerability disclosure and reporting requirements
The real cost of cyberattacks and cybersecurity spending
Cyber insurance and improving organizational security
Nightmare Eclipse and the release of Windows zero-days
Check Point VPN vulnerabilities and perimeter security
GitLab security updates and shadow IT
Discovering unmanaged GitLab instances
Cyberattacks against oil tankers and insider threats
VPN patching and implied rules
Zero-downtime GitLab updates and version management
Running Windows ARM on Apple Silicon with VMware and Parallels
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-944

In the security news this week:
Microsoft patches all the things
Commissary freezers enter cyberwar
Fake AV, real Defender nap
Rowhammer comes for the GPU
BIOS updates are no longer optional
CVSS is not a crystal ball
Kworker, but make it malware
FortiGate gets a post-exploitation RAT
CERN goes Debian underground
UEFI shells strike again
Australia loses the plot, and phones
Cisco routers become covert gateways
MikroTik patches the takeover chain
WeWorm wriggles through mobile
The year of Linux television
Browsers become backdoors
Fake IT calls, real data theft
CVE attribution gets weird
Boston Scientific keeps talking
Security tools misconfigure themselves
AI circuit breakers for rogue agents
Passkeys meet the real world
Vibe coding, vibe vulnerabilities
AI loss of control keeps climbing
AI agents report themselves to Schneier
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-943

First up: a technical segment on Linux threat hunting. We'll start this series by covering the best places to look for IoCs on Linux systems and devices, starting with startup services and scheduled tasks. Then, in the security news this week:
SonicWall zero-days, again
AI finds a pile of Cisco bugs, and a root RCE
Claude Code Auto Mode dangers
BGP hijacks your unsigned software update
California, Linux and age verification
Free movies, complimentary malware
Citrix puts Linux alongside Windows
Signal's "secure" enclave
An expired domain answers military phone calls
MORE Cheap Android TV boxes arrive pre-pwned
CISA red teams meet critical infrastructure
PaperCut vulnerability cuts both ways
Big Tech asks everyone to secure its AI future
Pacemaker monitoring
DOJ files on a criminal leak site
Water utility security, right after the breaches
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-942

Rob Allen from ThreatLocker joins us to discuss securing agentic AI with zero-trust controls, least privilege, and access controls to limit what agents can access and do.
This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!
In the security news this week:
Sixteen-year-old Linux LPEs still work
Ubiquiti UniFi, patch it, also light on details
If you remember magicJack, you too are old
Slovakia doesn't trust its own speed cameras
More homework on NIST's vulnerability database
Your webcam, mic, and key light, all owned
Printer moonlights as Minecraft server
Zombie credit cards
Your car's infotainment system fuels botnets
Feds warn about AI-powered PLC attacks
Can an AI actually reverse engineer its way out?
Denver International's security breach, volume six
Charlotte's breach and a parking company
Why your ancient tech might be the safe one
Microsoft counts billions of phishing emails
A password vault that leaked to any website
Australia sells password books at the post office
Another perfect ten, this time in Entra ID
Cisco's bug scores read like Olympic gymnastics
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-941