Paul's Security Weekly (Audio)

In the security news:
Supermarket refrigeration attacks, again!
Rapid7's Ivanti findings and why we can't have "nice" things
Google's massive Android TV botnet takedown
Linux TCP kernel flaw that no one is patching
The Binance theft
APT flaw gives out root
PHP security debt
The porn and Digital billboard problem
Your own phone system to pwn
From PoC to weaponized exploit
Hacking to change time
Rooting an Echo Dot
Firmware should just work
AI chained bugs into working exploits
USB power states leak data across an air gap
AI-assisted vulnerability finding
GoAhead's TLS handling
Hackers hijack emergency alert apps
Taiwan's emergency services become an AI-agent target
CUI exposed through GSA's Google Drive
GCHQ can't account for thousands of storage devices
Railway employee blames an attempted intrusion on AI
VulnCheck opens its initial-access playground to the public
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-951

In the security news this week:
In the security news this week:
Cisco says patch faster, then sells you time
Turning AI refusals into vulnerability signals
Brotli's are hiding
WordPress image upload exploit
Fortinet ships fixes before details
PHP2Shell still claiming victims, including firewalls
Uncoordinated disclosure
Claude finds vulns, go figure
PXE strikes again!
Sony's PS5 bounty drama
Apple's October patches reach older devices
CISA looks ahead to 2030
ArubaOS gets a pile of critical fixes
New UK rules for protecting undersea infrastructure
PortaPack Mayhem goes mobile
Can AI agents police other AI agents?
DHS bans DeepSeek
A Chinese model writes riskier code for a US contractor
eMudhra exits the TLS business
BlackX bootkit exploits Secure Boot
Signal makes hanging up harder than it should be
Is AI solving math, or making it harder to trust?
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-950

Special guest Joshua Wright joins us for a timely incident-response discussion!
Then, in the security news this week:
Have you heard about PHP2Shell?
Certificates with keys small enough to guess
Tor exit nodes turn into SSH credential traps
Do USB-C cables need firmware updates now?
HaleHound packs a radio lab into a cheap display
Claude solves part of the NIST curve mystery
The Army and self-directed offensive cyber agents
Retired nuclear reactors return to power AI
PatchSlop
NGINX, NODE.js patches critical flaws
BeyondTrust exploited before the patch landed
Plex vulnerabilities move from PoC to exploitation
ICS patches, including a Siemens flaw exploited in the wild
Can fake data trigger Japan's emergency alert?
Agentic pentests?
AI may add noise more than skill
AI agents navigate OT and move equipment
AI model helps build a Chrome exploit
Utah's VPN law runs into technical reality
Segment Resources:
https://dynamicincidentresponse.com/ - A New Era for Incident Response!
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-949

In the security news this week:
Convert this router into an SDR
Ivanti straight to root
Anthropic's AI worm FUD
A kernel exploit to fix downloads
Supermarket refrigeration attacks
400 mystery Java vulnerabilities
Authentication bypass
Russia meets the data-center war
Stop & Shop attacked
Anthropic cuts eval agents
AI incident reporting
FortiBleed lives
Anthropic offers scanning
Pre-compromised phones
FakeGit returns
Teams deepfake detection
Let's Encrypt certificates get shorter
GitLab ships another critical patch
Engineer gets prison time for locking thousands of devices
OpenAI employee accused of planting a hidden recorder
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-948

In the security news this week:
BPFDoor
OpenSSH compresses a little too much
AI can find bugs. Who gets them fixed?
TP-Link and the courts
Cisco NX-API
ClingSTUN
LineageOS, Android TV, and a Raspberry PI
Dell's updater has a privilege problem
SonicWall SSRF
U-Boot's LogoFAIL like
Exploit-DB isn't dead
MFA passes. The attacker still gets in.
LakeShark and cool gadgets
Kasa cameras and an exposed debug interface
SharePoint hardening is back on the checklist
Google pauses open-source bug bounty submissions
NetScaler's latest vulnerability needs a closer look
Kiteworks tells customers to shut it down
Exchange gets an unexpected security update
Do LLMs actually reason?
disagree on AI risk?
Anthropic, AI consciousness and the Vatican
Grok gets involved in foreign policy
WordPress malware that survives cleanup
Can spyware vendors stop their own tools?
When an AI chatbot conversation reaches the police
Open-weight AI models enter the cyber debate
AI agents take their attacks shopping
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-947