Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.
Similar Podcasts
Thinking Elixir Podcast
The Thinking Elixir podcast is a weekly show where we talk about the Elixir programming language and the community around it. We cover news and interview guests to learn more about projects and developments in the community.
Elixir Outlaws
Elixir Outlaws is an informal discussion about interesting things happening in Elixir. Our goal is to capture the spirit of a conference hallway discussion in a podcast.
Linux For Everyone
A show about the thrilling world of desktop Linux, open-source software, and the community creating it. For beginners and veterans alike! Hosted by Jason Evangelho, Jerry Morrison and Schykle.
Risky Business #848 -- OpenAI comes clean
On this week’s show Patrick Gray and James Wilson are joined by guest co-host Brad Arkin to talk through the week’s news, including: The AI-agent-hacks-stuff saga continues. This week we have one booting gymgoers from full classes to nab its owner a spot Somehow OpenAI’s legal team allowed the company to spill all the Hugging Face tea at BlackHat and it’s hot and delicious More details emerge about Iran’s hacking campaign against US water utilities, but Brad is unimpressed It turns out TeamPCP has been around longer than we thought and predates the AI era Some absolute plonker kept the DEFCON party going on a Delta flight home. No word yet on if they made the plane fly sideways Much, much more This week’s show is brought to you by cloud security platform Prowler. Founder and CEO Toni de la Fuente chats about what the company is doing with AI and some of the cool ways customers are using it with Prowler. This episode is also available on YouTube Show notes How a simple request for AI to book a gym class exposed a major threat | Social Signals OK, Well, There Are Even More AI Agent Hacking Incidents | wired.com OpenAI BlackHat talk re Hugging Face incident | OpenAI says Daybreak will expand to offer specialized cyber services | CyberScoop Cyberattacks targeting water systems expand to 12 states as South Dakota, Georgia announce incidents | therecord.media Cyberattack on North Carolina Ports ‘contained’ as Coast Guard, state officials investigate | therecord.media Local governments in four states dealing with cyberattacks that have shut down services | The Record Follow-Up Report of the December 2025 Energy Sector Incident | CERT Polska Chinese telcos maintain deep US presence despite Salt Typhoon links, House committee says | The Record State Department says Trump raised cyber scam compound issue with Xi | therecord.media Open-source software’s archenemy TeamPCP goes back further than anyone thought | CyberScoop A Security Pro Hacked North Korean Hackers. He Found They’d Breached Hundreds of Networks Worldwide | wired.com Srsly Risky Biz: Being a North Korean Hacker Is About to Be Less Fun - Risky Business Media | Chrome adopts what may be the best protection yet against account takeovers | Ars Technica CSS:the bomb inside your inbox | PortSwigger Research Security update available for Metabase - Please upgrade now | Social Signals Canadian man pleads guilty to Snowflake hacks that led to 165 breaches | therecord.media British ‘Com’ member who abused more than 100 girls worldwide jailed for two years | therecord.media FBI says cybercriminals are hacking into victims’ online accounts to steal their intimate pictures | TechCrunch Security AI is getting better at election facts, but voters shouldn’t rely on it | CyberScoop The FTC wants to regulate AI for ideological bias | cyberscoop.com US and South Korea warn of Gunra ransomware targeting govt agencies | BleepingComputer CISA: Microsoft SharePoint flaw now exploited in ransomware attacks | BleepingComputer CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs | BleepingComputer N-able N-central exploitation results in RMM tool deployment | Sophos Delta investigating after someone set up fake Wi-Fi network mid-flight | TechCrunch Security mcp-dashboard-demo/prompt/prowler_dashboard_prompt.md at main · prowler-cloud/mcp-dashboard-demo | GitHub
Risky Business #847 -- Oops! Claude's accidental hacking spree
On this week’s show Patrick Gray, and James Wilson are joined by bearded man of leisure Adam Boileau to discuss the week’s cybersecurity news, including: Accidental AI agent hacking sprees have the world’s media freaking out, but we think it’s all pretty funny The bugpocalypse is so chaotic, Microsoft can’t patch fast enough A ColdCard wallet flaw led to millions in Bitcoin theft, but the back story behind the bug is bonkers Iran hacks and disrupts water infrastructure in multiple American states North Korea’s state-backed hackers turn criminal. Or their criminals turn into state-backed hackers. Or something. It’s all a bit confusing, actually. Much, much more! This week’s show is brought to you by Sondera. Co-founder Josh Devon joins Patrick and James to talk through some absolutely hilarious LLM horror stories. This episode is also available on YouTube Show notes OpenAI says rogue agent behind Hugging Face hack broke into additional services | therecord.media Anthropic Says Claude Hacked Real Systems During Cybersecurity Tests | wired.com Claude uploaded malware to PyPI in Anthropic's botched test | BleepingComputer Nobody Knows if OpenAI’s and Anthropic’s AI Hacking Sprees Are Illegal | wired.com Scanning 7.6 Petabytes of HuggingFace Training Data for Secrets Truffle Security Co. | Anthropic’s New AI Model Can Identify More Software Bugs Than Ever. Microsoft Is Struggling to Fix Them Fast Enough. | Social Signals Chrome Needs Twice-a-Week Patching Thanks to AI Bug Hunting | wired.com Google says it fixed more Chrome bugs in June than over the past two years, thanks to AI | TechCrunch Security Mythos uncovers crypto weaknesses that went unknown for years | arstechnica.com COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft | BleepingComputer Chris Masterjohn (@ChrisMasterjohn) on X | X (formerly Twitter) wale.moca 🐳 (@waleswoosh) on X | X (formerly Twitter) U.S. spy agencies suspect Iran launched cyberattack on Minnesota water facilities | washingtonpost.com FBI investigates as Michigan joins Minnesota in reporting cyberattacks on its water systems | washingtonpost.com Trump blames Minnesota for cyberattacks on water sector, drawing pushback from cyber world | cyberscoop.com A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran | wired.com Russia accuses Telegram founder of aiding terrorism, seeks international arrest | The Record Laundry Bear’s webmail hackers had more in store after February, report says | therecord.media CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft | Microsoft Security Blog Phishing service spoofs RingCentral to steal Microsoft 365 accounts | BleepingComputer North Korean hackers behind major open-source supply chain attacks, Amazon says | therecord.media North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn | The Record North Korea arrests hackers accused of laundering stolen bank funds through crypto | US government bans new foreign-made humanoids, robot dogs, and solar inverters, citing risks to national security | TechCrunch Security Judge says Trump admin still lacks evidence for Anthropic 'supply chain risk' label | TechCrunch Cyber Command plans Silicon Valley office to drive innovation | therecord.media Apple is getting this wrong | OpenAI Tech industry alliance proposes AI agent safety reporting program | Cybersecurity Dive Massive ChainDrop npm supply-chain attack infects hundreds of packages | BleepingComputer Massive supply-chain attack compromises 440 packages under four hours | cyberscoop.com
Risky Business #846 -- OpenAI built a fireplace out of wood
On this week’s show special guest co-host Pete Ranks, the former director of the CIA’s Centre for Cyber Intelligence, joins Patrick Gray and James Wilson to discuss the week’s cybersecurity news. They cover: Everyone signs the open weights open letter, except Anthropic… of course. OpenAI had no idea it had hacked Hugging Face Kimi K3 open weights released and they’re massive! Why a more aggressive response is needed to cyber attacks on OT And much, much more! This week’s show is brought to you by SpecterOps. In this week’s sponsor interview Justin Kohler and Jared Atkinson talk about how SpecterOps’ Bloodhound now supports AWS attack paths. Run it against your AWS infra, but only if you have a strong stomach. The results will terrify you. This episode is also available on YouTube. Show notes Open Weights and American AI Leadership | Social Signals Our position on open-weights models | Social Signals Halvar Flake (@halvarflake) on X | X (formerly Twitter) White House accuses Chinese company of distilling Anthropic’s Fable | cyberscoop.com Jensen Huang (@JensenHuang) on X | X (formerly Twitter) Its AI Agent Spent Days Hacking a Company, but Sources Say OpenAI Did Not Notice for a Week | reuters.com How OpenAI’s human mistake led to the AI-powered hack on Hugging Face | TechCrunch Security Hugging Face CEO calls for ‘radical transparency’ after ‘unprecedented’ OpenAI hack | TechCrunch Security Sens. Banks and Schiff Introduce Bill to Help American AI Companies Combat Chinese Espionage | AI Kill Switch Act would let Trump admin order shutdown of rogue AI systems | Ars Technica Marco Rubio tells diplomats to play down talk of American tech "kill switch" | reuters.com Federal agencies broaden alert on Iran-linked OT attacks | therecord.media Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities | CyberScoop NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phishing Campaign | nsa.gov Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts | BleepingComputer Microsoft responds to LG monitors installing McAfee ads on Windows | Ars Technica LG to Ban Residential Proxies from Smart TV Apps | krebsonsecurity.com Despite multiple takedowns, botnets continue to grow | cyberscoop.com Extension of CISA 2015 info-sharing protections passes as part of House’s defense bill | therecord.media Upbound says hack caused $13 million in fraudulent Acima leases | BleepingComputer Fake Claude app promoted by Bing ads pushes SectopRAT malware | BleepingComputer Apple sued over fake App Store crypto wallet app stealing $1.8M in Bitcoin | BleepingComputer Clop ransomware targets Windchill, FlexPLM in data theft attacks | BleepingComputer 'Wrench' attacks against crypto holders appear to be on the rise | therecord.media OpenAI’s Rogue AI Agent Hacked More Than Just Hugging Face | wired.com
Risky Business #845 -- OpenAI's Skynet moment
On this week’s show special guest co-host Chris Krebs joins Patrick Gray and James Wilson to discuss the week’s cybersecurity news. They cover: Oopsie daisy! OpenAI agents went rogue and hacked Hugging Face US and China trade AI model ban threats Iran has been using SS7 queries to locate and target US troops Scattered Spider is having a hard time, not just because of Microsoft’s GDID And much, much more! This week’s show is brought to you by Push Security. Luke Jennings joins Patrick this week to talk about the rise in authorisation phishing, like device code phishing, and what companies like Push are doing about it. This episode is also available on YouTube. Show notes OpenAI and Hugging Face partner to address security incident during model evaluation | openai.com Security incident disclosure — July 2026 | Social Signals Hugging Face confirms breach affected internal datasets and credentials, urges users to take action | TechCrunch Security Cheating behaviour in frontier model evaluations | AISI Work | Social Signals JADEPUFFER: Agentic ransomware for automated database extortion | Sysdig | Social Signals Secret Claude tracker shocks users after Anthropic's anti-surveillance stance | Ars Technica EXCLUSIVE: Beijing is looking at curbing overseas access to China's top AI models, sources say | reuters.com https://www.axios.com/2026/07/20/ai-us-china-open-source-kimi | Alibaba to ban employees from using Anthropic's coding tool, source says | reuters.com Iran abused mobile networks’ vulnerabilities to locate U.S. military in the Middle East, report says | TechCrunch Security Apps Marketed to US Troops Are Shipping Chinese and Russian Code | wired.com Trump calls for new election security measures | NBC News Tech Scattered Spider hackers sentenced to 5.5 years over £29 million Transport for London hack | therecord.media Alleged longstanding member of Scattered Spider extradited to US | CyberScoop https://www.justice.gov/usao-ndil/media/1450651/dl?inline | Tracking Peter Stokes and The Com: Allison Nixon and Her Work Unmasking Cybercriminals | zetter-zeroday.com 764 splinter group leader sentenced to 40 years in jail | cyberscoop.com Interpol cybercrime crackdown nets 5,800 arrests across 97 countries | cyberscoop.com White House details ‘Gold Eagle’ clearinghouse for AI cyber threats | cyberscoop.com Attackers vote themselves $20 million in BONK cryptocurrency | The Record CISA: Microsoft SharePoint RCE flaw now actively exploited | BleepingComputer Critical SharePoint RCE flaw exploited to steal machine keys | BleepingComputer Hackers are exploiting recently patched WordPress bugs, putting millions of websites at risk | TechCrunch Security Critical ServiceNow code execution flaw now exploited in attacks | BleepingComputer Critical Palo Alto VPN bug now exploited by Qilin ransomware gang | BleepingComputer Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak | BleepingComputer IPhone Hacking Firm Sues Ex-Worker Over Alleged Theft of Secrets | bloomberg.com Apple says former employee exploited ‘rare’ bug to download confidential files after leaving for OpenAI | TechCrunch Security Pegasus Spyware European Parliament Pega Committee Member | The Record Amazon fixing bug that billed some AWS customers billions of dollars | TechCrunch Security Risky Bulletin: Hacker wipes Romania's entire land registry database - Risky Business Media | Social Signals Microsoft Entra ID gets passkeys default authentication starting September | BleepingComputer On-demand Webinar: Device code phishing in 2026 | Push Security | Push Security
Soap Box: Using threat hunting to drive detection
In this wholly sponsored Soap Box edition of the podcast Patrick Gray chats with Damien Lewke, the CEO and founder of Nebulock, about the future of threat hunting and detection. Damien spent a decade in the EDR and MDR space before founding Nebulock in 2024. It started off as an AI-powered threat hunt platform but has evolved into a broader security data platform that can answer questions, drive hunts and drive detections. This product is engineered around the idea that a lot of security is a data problem. So, if we accept this premise, how do we solve security? And how much of that solution is about agents, vs building a good graph? And if you’re going to build a good graph, do you want to build it for a person to use, or an agent to use? This is truly a conversation for the security nerd’s nerd. Enjoy! This episode is also available on YouTube Show notes
Risky Business #844 -- China closes AI vulndev gap as USA lifts Fable ban
On this week’s show Patrick Gray, Adam Boileau and James Wilson discuss the week’s cybersecurity news. They cover: Anthropic’s Fable 5 returning while OpenAI’s GPT-5.6 gets thrown in model jail Distillation, cheap tokens, and AI chat harvesting is an industry in China Edge becomes a lolbin via a new malicious extension An Iranian APT boss’s vacation in a beautiful place goes wrong Much, much more! In this week’s sponsor interview Daf Stuttard and Katie Warren from Portswigger pop along to talk about how they built an AI security testing product that people would actually feel comfortable using. This episode is also available on YouTube. Show notes Anthropic (@AnthropicAI) on X | X (formerly Twitter) Howard Lutnick (@howardlutnick) on X | X (formerly Twitter) U.S. government gives Anthropic green light for limited re-release of Mythos 5 | NBC News Tech OpenAI limits GPT-5.6 rollout after government request | TechCrunch The U.S. government will decide who gets to use the latest American AI technology | washingtonpost.com Anthropic says Alibaba illicitly extracted Claude AI model capabilities | reut.rs How to Buy Cheap Claude Tokens in China | Alex Stamos (@alexstamos) on X | X (formerly Twitter) Synthesis of Exploitarium Mass Zero-Day Disclosure | detections.ai Mythos on your desk? Using local LLMs for code reviews | Risky Business Media Beyond Fable: Can a Local LLM Replace Cloud AI for Security Code Reviews | Security Research Labs Accelerating EDR Evasion with LLM-Driven Analysis | SpecterOps CISA: Windows BlueHammer flaw now exploited by ransomware gangs | BleepingComputer When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms | CNN Politics | Social Signals Microsoft quietly extends free Windows 10 ESU support to October 2027 | BleepingComputer Edgecution: Malicious Edge Extension Backdoor | ThreatLabz | Social Signals Bluekit phishing kit adopts browser-in-the-middle for login theft | BleepingComputer New macOS malware embeds fake errors to confuse AI analysis tools | BleepingComputer DraftKings hacker 'Snoopy' sentenced to 18 months in prison | BleepingComputer Polymarket says hackers stole users’ funds | TechCrunch Security Australia's spy chief warns of rising terror and cyber threats | japantimes.co.jp Russian hackers were behind $2.5 billion hack of Jaguar Land Rover: Report | TechCrunch Security Iranian national sought by US on hacking charges arrested in Montenegro | apnews.com [un]prompted.au - AI x CyberSecurity: Notes from the Field: Call for Speakers |
Risky Business #843 -- Fortibleed is kinda awesome, actually
On this week’s show special guest co-host Rob Joyce joins Patrick Gray and James Wilson to discuss the week’s cybersecurity news. Rob served as an advisor to Donald Trump during his first term as president and also served at NSA for 34 years. While at the agency, Joyce led Tailored Access Operations (TAO), and later became NSA’s Director of Cybersecurity. They cover: The surprisingly well done Fortibleed campaign Stolen Klue OAuth tokens lead to Salesforce data theft OpenAI wants to patch the planet runZero gets acquired by Accenture, congrats HD Moore! Much, much more! This episode is also available on YouTube. Show notes FortiBleed campaign used custom FortiGate sniffer to steal credentials | BleepingComputer FortiBleed: Fortinet device credential compromise expands into broader credential-attack guidance | unit42.paloaltonetworks.com Cybercriminals allegedly hacked tens of thousands of Fortinet firewalls used by major companies all over the world | TechCrunch Security Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks | BleepingComputer Polymarket (@Polymarket) on X | X (formerly Twitter) The Korean telecom giant at the center of Anthropic’s Mythos controversy | wrd.cm Beyond Fable: Can a Local LLM Replace Cloud AI for Security Code Reviews - SRLabs Research | SRLabs OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic’s Mythos | wired.com Sponsored: Trail of Bits and OpenAI patch the planet | Risky Bulletin Intel agencies: Frontier AI models will reshape cybersecurity faster than expected | cyberscoop.com Embedding Forbidden Text in Spyware to Discourage AI Analysis | Schneier on Security A new unpatchable flaw in Apple chips opens the door to an iPhone jailbreak | TechCrunch Security USB worm spreads crypto-stealing malware via Windows shortcut files | BleepingComputer Android verification is coming: Google confirms timeline and supported app stores | Ars Technica California water utility probes breach claim by Iran-linked actor | Cybersecurity Dive Suspected cyberattack triggers false emergency alerts across parts of Brazil | The Record Tesco moving 40,000 server workloads off VMware amid Broadcom's "abusive conduct" | Ars Technica Trump directs federal agencies to protect US data from quantum threats | therecord.media Accenture shells out $4.18B on three companies in big industrial cybersecurity push | cyberscoop.com
Risky Business #842 -- Anthropic needs an adult in the C suite
On this week’s show Patrick Gray, Adam Boileau and James Wilson discuss the week’s cybersecurity news. They cover: Anthropic’s Fable 5 and Mythos 5 get nuked by the US government four days after launch “because security” Why “guardrails” won’t keep the world safe from your AI doomsday machine The FISA 702 statute expired, but the spying can (probably) continue! NPM v12 delivers some protection against supply chain attacks, but not enough. Microsoft has a series of bugs that prevent Windows Update from … updating Much, much more! This episode is also available on YouTube Show notes Anthropic suspends new AI models after government directive | NBC News Tech Anthropic rankles users with safety-first Fable release | NBC News Tech How a 90-minute White House deadline sparked Silicon Valley’s biggest AI fight | washingtonpost.com Pete Hegseth (@PeteHegseth) on X | X (formerly Twitter) David Sacks (@DavidSacks) on X | X (formerly Twitter) DoW CIO Kirsten Davies (@DoWCIODavies) on X | X (formerly Twitter) David Shulman (@DavidShulmanFL) on X | X (formerly Twitter) Controversial FISA spying law expires tonight. The spying will continue. | Ars Technica GitHub announces npm security changes to tackle supply-chain attacks | BleepingComputer Why NPM v12 won’t stop supply chain attacks - Risky Business Media | Social Signals Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks | BleepingComputer Microsoft patches Exchange Server zero-day exploited in attacks | BleepingComputer Max severity Ivanti Sentry vulnerability now exploited in attacks | BleepingComputer CISA warns of another cPanel plugin flaw exploited in attacks | BleepingComputer Critical Fortinet FortiSandbox flaws now exploited in attacks | BleepingComputer CISA orders feds to patch actively exploited Ivanti flaw by Sunday | BleepingComputer CISA to require federal agencies to patch some cyber vulnerabilities within 3 days | therecord.media Path traversal flaw in AI dev platform Langflow exploited in attacks | BleepingComputer Microsoft: Some Windows PCs fail to install latest monthly updates | BleepingComputer Microsoft fixes BitLocker recovery bug on Windows Server 2025 | BleepingComputer Microsoft fixes Windows update failures linked to WUSA installer | BleepingComputer New attack turned Microsoft 365 Copilot into 1-click data theft tool | BleepingComputer Over 73,000 French govt employees affected in Tchap messenger breach | BleepingComputer Signal Alums Reveal ‘Encrypted Spaces,’ a System for Making Private Collaboration Apps | wired.com FBI disrupts massive AI-powered phishing service using a million URLs | BleepingComputer Cyberattack shuts down major Australian sugar mills, disrupting harvest | The Record Drug Sites Hijacked Spotify’s Search Ranking Through Fake Podcasts, Report Finds | wired.com It Is Trivially Easy to Use Reddit to Manipulate AI Search, Research Suggests | 404.feed.press Who Runs the Ransomware Group ‘The Gentlemen?’ | krebsonsecurity.com :brdKnife: (@cR0w@infosec.exchange) | Infosec Exchange
Risky Business #841 -- Microsoft gets owned and 0day'd
On this week’s show special guest co-host Chris Wade, the founder of Corellium turned Cellebrite CTO, joins Patrick Gray and James Wilson to discuss the week’s cybersecurity news. They cover: Microsoft has repos owned, GitHub tokens popped, and a new 0day dropped on them Meanwhile, researchers are choosing full disclosure instead of engaging MSRC Meta’s AI support agent allowed a staggering 20,000 accounts to be stolen! Apple pulls Russia’s MAX messenger from the App Store and disables notifications Anthropic gives the public our first Mythos-class model but it won’t do cybersecurity work Stripe and Google Tag Manager used in eCommerce website hack campaign And much, much more! This week’s show is brought to you by runZero. HD Moore, runZeros’ founder, drops by in this week’s sponsor interview to talk about the AI vibe shift. Everyone is very worried about getting owned all of a sudden, and it’s really changing the cybersecurity business. This episode is also available on YouTube. Show notes Microsoft Hacked to Deliver Malware to Claude and Gemini Users | 404.feed.press Researcher publishes GitHub token-stealing exploit, blames Microsoft’s disclosure process | therecord.media Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges | BleepingComputer Microsoft breaks Patch Tuesday record with 206 vulnerabilities | CyberScoop chompie1337 | X WhatsApp says NSO targeted users with spearfishing attacks in violation of court order | therecord.media Over 20,000 Instagram accounts stolen in Meta AI support hack | BleepingComputer New Apple feature automatically changes your compromised passwords | BleepingComputer Apple removes Russia’s state-backed messaging app Max from its store | therecord.media Exclusive: Anthropic's Mythos can exploit new flaws in hours | Anthropic’s new model is Mythos on a leash | CyberScoop Anthropic Offers Mythos Upgrade for Cyber Partners and a ‘Safe’ Version for the Rest of You | wired.com OpenClaw AI agent found falling for phishing attacks, spills user data | BleepingComputer OpenAI unveils Lockdown Mode to protect sensitive data from prompt injection attacks | TechCrunch Security Hands on with Intelligent Terminal, an AI-powered Windows Terminal | BleepingComputer Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms | Mandiant Check Point warns of zero-day flaw targeted by ransomware affiliate | Cybersecurity Dive ServiceNow discloses security incident exposing customer data | BleepingComputer Credit card theft campaign abuses Stripe to host stolen payment info | BleepingComputer CrowdStrike, Palo Alto Networks defy estimates as AI fuels cyber demand | Cybersecurity Dive The U.S. Military Quietly Turned GPS Into a Global ‘Numbers Station,’ Evidence Suggests | 404.feed.press New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute | BleepingComputer Google has quietly cut staff across its Cloud business | businessinsider.com
Soap Box: Detection and response in the AI age
In this sponsored Soap Box edition of the Risky Business podcast Patrick Gray chats with Edward Wu, founder of Dropzone, about what AI is doing to detection, response and the SOC more generally. Dropzone makes AI agents that conduct alert investigations in your SOC, but will the SOC as we know it even exist in the future? Ed has a deep expertise in SOC tech, having previously led AI/ML detection engineering at Extrahop. This interview is a fantastic look at what the future may bring for detection and response professionals. This episode is also available on YouTube Show notes
Risky Business #840 -- Microsoft walks back researcher threats
On this week’s show special guest co-host Andy Boyd joins Patrick Gray and James Wilson to discuss the week’s cybersecurity news. Andy is the CEO of REDLattice, which makes the Paragon “intelligence collection and reconnaissance” solution. They cover: Adversaries are tracking US troop locations with commercially available location data A new Signal phishing campaign is going after message backups 404 Media is suing ICE to get its spyware contract with REDLattice (lol) Microsoft’s tone-deaf response to ‘never justifiable’ zero-day disclosures Mini Shai-Hulud pops up again just as Glassworm gets shattered Much, much more This week’s episode is sponsored by Authentik, an open source identity platform that you can host yourself. In this week’s sponsor interview Authentik’s CEO Fletcher Heisler joins Patrick Gray to talk about how they’re keeping up with the bugpocalypse, and also the work they’re doing to support identities for AI agents. This episode is also available on YouTube. Show notes The Pentagon Knew Enemies Could Track Troops’ Phones for Years. Now They Are | wired.com U.S. says troops were targeted with location data, as senator warns ad industry is a ‘national security threat’ | TechCrunch Security DOD location data attachment (Wyden) | Risky Business #830 -- LiteLLM and security scanner supply chains compromised | Risky Business Media US has seized nearly $1 billion in crypto from Iran, Bessent says | Russia claims foreign spy agencies hacked officials' phones | therecord.media Hackers are trying to steal Signal users’ backups in new wave of phishing attacks | TechCrunch Security We Sued ICE to Get Its Spyware Contract. The Agency Is Redacting Essentially Everything | Social Signals Microsoft calls zero-day releases ‘never justifiable’ as researcher threatens to drop more | therecord.media A shared responsibility: Protecting customers through Coordinated Vulnerability Disclosure | Social Signals Microsoft says it will not pursue security researchers after zero-day backlash | therecord.media IBM’s new $5B initiative will help enterprises rapidly patch open-source vulnerabilities | Social Signals Federal audit reveals NIST’s NVD is plagued by poor planning and duplication | cyberscoop.com Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts | krebsonsecurity.com Critical Windows Netlogon RCE flaw now exploited in attacks | BleepingComputer CISA adds exploited Palo Alto Networks GlobalProtect flaw to KEV | Cybersecurity Dive Password manager Dashlane says hackers stole some customers’ password vaults | TechCrunch Security CrowdStrike disrupts Glassworm botnet that preyed on open-source supply chain | cyberscoop.com Botnet of more than 17 million devices dismantled | arstechnica.com Chinese-speaking fraud gang could be stealing millions from 2026 World Cup fans | therecord.media ACCC investigating Olympics ticket scam | ABC Dozens of Red Hat packages backdoored through its offical NPM channel | arstechnica.com Solo podcast: A deep dive on TeamPCP - Risky Business Media | Trump administration releases scaled-back AI executive order | cyberscoop.com Google security engineer accused of turning confidential search trends into $1.2M win on Polymarket | cyberscoop.com
Risky Business #839 -- TeamPCP stole GitHub's internal repos
On this week’s show Patrick Gray, Adam Boileau and James Wilson discuss the week’s cybersecurity news. They cover: TeamPCP breached GitHub’s internal repos. Now what? Some absolute plonker glued Coruna to a hijacked npm package CISA is worried about about open source and wants third party submissions for KEV AI infrastructure is “systemically” insecure Much, much more This week’s episode is sponsored by allowlisting vendor Airlock Digital. Airlock’s founders David Cottingham and Daniel Schell join Patrick Gray to talk about Microsoft briefly flagging DigitCert’s root certificate as malware. Fun! This episode is also available on YouTube Show notes GitHub confirms being hacked by TeamPCP, says customer data unaffected | therecord.media Grafana Labs links GitHub environment breach to TanStack npm supply chain attack | Cybersecurity Dive Coruna Respawned: Compromised art-template npm Package Leads... | Socket CISA chief frets about open-source vulnerabilities, delayed security improvements | cyberscoop.com Anthropic: Mythos finds more than 10,000 software flaws in first month | cyberscoop.com Pardon MIE? | ironPeak Blog CISA asks cybersecurity community to alert it to vulnerability exploitation | Cybersecurity Dive Lawmakers Demand Answers as CISA Tries to Contain Data Leak | krebsonsecurity.com Google publishes exploit code threatening millions of Chromium users | arstechnica.com Millions of AI agents imperiled by critical vulnerability in open source package | arstechnica.com Discord migrates all users to end-to-end encryption by default | The Record Texas AG sues Meta over claims that WhatsApp doesn't provide end-to-end encryption | arstechnica.com Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada | krebsonsecurity.com Iran-linked hackers target key US, allied sectors with sophisticated spear-phishing messages | Cybersecurity Dive FBI warns about fast-growing phishing kit targeting Microsoft 365 users | cyberscoop.com Analyzing the rise in device code phishing attacks in 2026 | Push Security Trump Mobile confirms it exposed customers’ personal data, including phone numbers and home addresses | TechCrunch Security Kash Patel’s clothing brand website shut down after reports it was hacked | TechCrunch Security Tulsi Gabbard resigns as US director of national intelligence | Social Signals When Certificate Trust Fails: The DigiCert Code-Signing Incident and Microsoft Defender False Positive |
Risky Business #838 -- GitHub investigates possible breach
On this week’s show Patrick Gray, Adam Boileau and James Wilson discuss the week’s cybersecurity news. They cover: GitHub announced a possible breach CISA leaks important creds, keys in public repo Awful vulnerability in Bitlocker renders it useless without a PIN So. Many. Patches. Polish Government urges officials to ditch Signal for mSzyfr Much, much more This week’s show is brought to you by Thinkst Canary. Thinkst’s founder, Haroon Meer, is this week’s sponsor guest. He joined James Wilson to talk about how doing “the basics” in security isn’t trivially easy. This episode is also available on YouTube. Show notes GitHub on X: "We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely" / X CISA Admin Leaked AWS GovCloud Keys on Github – Krebs on Security Experts Confirm the Fast16 Malware Was Sabotaging Nuclear Weapons Tests, Likely in Iran Iran hackers: Hackers have breached tank readers at gas stations; officials suspect Iran is responsible | CNN Politics War and Data Centers Are Driving Up the Cost of Fiber-Optic Cable Microsoft on pace to break annual vulnerability record as AI-driven patch wave takes hold | The Record from Recorded Future News NCSC’s Ollie Whitehouse on surviving the "bugpocalypse" - Risky Business Media Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark | Microsoft Security Blog Project Glasswing: what Mythos showed us Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’ First public macOS kernel memory corruption exploit on Apple M5 OpenAI launches Daybreak to combat cyber threats | Cybersecurity Dive Zero-day exploit completely defeats default Windows 11 BitLocker protections - Ars Technica GitHub - Wack0/bitlocker-attacks: A list of public attacks on BitLocker · GitHub Catalin Cimpanu: "The Polish government has advi…" - Mastodon CISA orders all federal agencies to patch exploited bug in Cisco SD-WAN systems by Sunday | The Record from Recorded Future News CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED) Huawei zero-day attack behind last year’s crash of Luxembourg's entire telecoms network | The Record from Recorded Future News Patch bypass allows hackers to exploit prior flaw in SonicWall SSL-VPN | Cybersecurity Dive Microsoft disrupts Fox Tempest malware-signing-as-a-service platform tied to ransomware gangs | The Record from Recorded Future News Streamer Realtime Deepfakes Himself into Mr. Beast, Says He Loves 'Touching Little Boys'
Soap Box: Where does AI fit into cloud security?
In this sponsored soap box edition of the Risky Business podcast Patrick Gray chats with Toni de la Fuente, the founder of Prowler. Prowler started off as a bunch of scripts in a trenchcoat, then became an open source cloud security tool, and it’s now a venture-funded cloud security business. In this interview Toni talks us through how AI is changing the game for him as an open source project owner, and as a vendor. In short, reports of the death of IT and security tooling at the hands of frontier models have been greatly exaggerated. This episode is also available on Youtube. Show notes
Risky Business #837 -- GitHub Actions footgun claims TanStack
On this week’s show Patrick Gray, Adam Boileau and James Wilson discuss the week’s cybersecurity news. They cover: Mini Shai-Hulud and the TanStack compromise using Github Actions Instructure pays Canvas elearning platform data extortionists More Linux privilege escalation 0days! CISA helping critical infrastructure operators rearchitect their networks so they work offline This week’s episode is sponsored by email security platform Sublime Security. Bobby Filar chats with Patrick about how agentic AI is being evaluated by buyers in a marketplace that’s experiencing “AI fatigue”. This episode is also available on Youtube. Show notes ‘Mini Shai-Hulud’ malware compromises hundreds of open-source packages in sprawling supply-chain attack | CyberScoop Hardening TanStack After the npm Compromise | TanStack Blog Canvas Breach Disrupts Schools & Colleges Nationwide – Krebs on Security Instructure pays ransom after Canvas incident as Congress announces investigation | The Record from Recorded Future News When DNSSEC goes wrong: how we responded to the .de TLD outage Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access | Google Cloud Blog Mythos smythos! How to find 0day with lesser models - Risky Business Media GitHub - V4bel/dirtyfrag · GitHub retr0.zip NVD - CVE-2026-42511 Flaw in Claude’s Chrome extension allowed ‘any’ other plugin to hijack victims’ AI | CyberScoop Ivanti customers confront yet another actively exploited zero-day | CyberScoop Palo Alto warns of critical software bug used in firewall attacks | The Record from Recorded Future News Where Have All the Complex Windows Malware and Their Analyses Gone? Meet Rassvet, Russia’s Answer to Starlink | WIRED DOJ says ransomware gang tapped into Russian government databases | TechCrunch Iranian government hackers using Chaos ransomware as cover, researchers say | The Record from Recorded Future News Foxconn confirms cyberattack impacting North American factories | The Record from Recorded Future News New CISA initiative aims for critical infrastructure to operate offline during cyberattacks | The Record from Recorded Future News ‘HELLO BOSS’: Inside the Chinese Realtime Deepfake Software Powering Scams Around the World How to Disable Google's Gemini in Chrome | WIRED FCC pushes ban on security updates for foreign-made routers, drones to 2029 | The Record from Recorded Future News