Paul's Security Weekly (Audio)

Latest Episodes:

Getting Rid of Your VPN - Rob Allen - PSW #925 May 07, 2026

Show notes

Rob Allen from Threatlocker joins us to discuss the risks associated with VPN appliances and how to implement better security solutions that don't leave you hanging out on the open Internet. The interview segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlockerrsac to learn more about them!

In the Security News:

Less details about the FCC router ban
Canary traps that work
Hacking trains and getting arrested
You can be an adult if you have a mustache
cPanel is being exploited
Pro-Iran group takes down Ubuntu
Anthropic's new security solution
Safe AI Agents and other lies
People still use screensavers?
CISA and operating for weeks or months in isolation
Paramiko issues fixes
Find security research
Copy/Fail and AI slop debate
ESP32 simulator
Spotting vibe coded malware
Fast16 - Stuxnet before Stuxnet

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-925

FIRESTARTER - PSW #924 Apr 30, 2026

Show notes

This week in the security news:

Are you a FIRESTARTER?
Eavesdropping via fiber-optic cables
Copy Fail - more Linux LPE
Github RCE
Running Linux on a PS5
BadUSB tricks
SilentGlass and HDMI threats
Sonicwall and vague details
Universities are for porn?
The Banshee
Before CVEs comes scanning
Vendor addresses AirSnitch
GitHub and not serious work
Routers have country-specific backdoors
Phones with Hotspot are fine

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-924

Back to (or Start) Fundamentals? - Rajesh Khazanchi - PSW #923 Apr 23, 2026

Show notes

This week:

Larry's in the host seat and chaos ensues. We dig into:

A very questionable story about tracking a warship with a $5 Bluetooth tracker
Serial-to-IP devices quietly sitting in critical infrastructure… and full of holes
New York regulators mandating MFA and asset inventory—aka CIS Control #1 is now breaking news
A ransomware negotiator who decided to double-dip (and landed in prison)
"Brand new" hard drives that come preloaded… with someone else's data
The Vercel breach: no zero-day, just shadow IT, stolen tokens, and bad decisions
AI-driven vulnerability discovery and the looming "vulnpocalypse"
Quantum crypto debates: real threat or just another security boogeyman?
Mirai is STILL alive—because apparently we still don't patch routers
And yes… Flipper Zero makes an appearance (no, you're not hacking airplanes… calm down)

Then, we rebroadcast an interview from RSAC.

Breach Readiness for Measurable Risk Reduction in the Age of AI Cyber leaders no longer debate whether a breach will occur. What has changed is the speed and scale at which AI now enables those breaches. The real question is how far an attacker can move once inside. In this conversation, Rajesh Khazanchi explores why breach readiness, including AI-assisted containment, measurable blast radius reduction, and pervasive microsegmentation, has become mission-critical for business continuity in 2026.

This segment is sponsored by ColorTokens. Visit https://securityweekly.com/colortokensrsac to learn more about them!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-923

The AI "Vulnpocolypse" Is Real? - PSW #922 Apr 16, 2026

Show notes

This week:

CSA issues guidance to CISOs on Mythos
Vuln management woes
Windows tells you about Secure Boot
AI-assisted firmware vuln hunting
The dumbest hack
Edge decay and the failing perimeter
Mac OS X on a Wii
Little snitch comes to Linux
CPUID served malware
Buying plugins to backdoor them
Addicted to hacking
Is Mythos just a sales pitch?
We are still talking about Adobe Acrobat vulns
A single line AI jailbreak
Hacking Apple Intelligence
Don't leave your ICS device or RDP exposed to the Internet!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-922

AI Makes All Bug Shallow? - PSW #921 Apr 09, 2026

Show notes

This week:

Rage dropping 0-Day
Claude Mythos, things are different now
From UART to root, on a device made in China, where's the FCC?
More CUPS vulnerabilities
Russians are hacking routers, FCC ban doesn't stop them
Mongoose vulnerabilities, and FCC still does nothing
Renting virtual phones
Iran's cyber attacks
SHA-256 almost broken?
Catching Axios
New Rowhammer, dubbed GPUBreach, gives you root
Windows 11 has sudo! (And SSH...)
And Inside a Kubernetes Scanning Fleet

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-921

What Is A Router? (And all things AI) - PSW #920 Apr 02, 2026

Show notes

In the Security News:

Claude leaks source code and new models
Two really smart people say AI is finding vulnerabilities better than ever
Windows is using your internet to send updates to strangers
BIG-IP APM vulnerability - all you need to know
Linux KVM for the win
The bus factor and open source
Axios supply chain breach
Trimming Grub
Depotting and hacking e-Motorcycles
Trivy and Cisco source code leaks
The FCC ban and What is a router?

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-920

Scanning The Internet with Linux Tools - PSW #919 Mar 26, 2026

Show notes

In this segment, we will explore some pretty awesome tools for scanning the Internet, with a focus on network edge devices. We'll bring it all together with Claude Code and look at some sample results. Tools include:

Shodan | Passive recon — query existing scan data for exposed devices, services, and vulns | Passive (API) | Instant (no packets sent)
ZMap | Host discovery — find live hosts with open ports | L4 (TCP SYN, UDP, ICMP) | Millions of packets/sec
ZGrab2 | Application-layer handshakes — grab banners, certs, headers | L7 (30+ protocol modules) | Thousands of hosts/sec
Nerva | Service fingerprinting — identify 140+ protocols with metadata, CPEs, technology stacks | L7 (TCP, UDP, SCTP) | Fast, concurrent
Nuclei | Template-based vulnerability scanning — default creds, exposed panels, known CVEs | L7 (HTTP, network) | Hundreds of targets/min
Shannon | Vulnerability exploitation — AI-powered whitebox pentesting of web apps | Application | ~1-1.5 hrs per target
edgescan.py | Automated pipeline — orchestrates all tools above into a single command | Orchestration | End-to-end

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw-919

Hacking IP KVMs & Reversing with Radare2 - Sergi Àlvarez - PSW #918 Mar 19, 2026

Show notes

In this episode, we sit down with the Radare community leader, Pancake, the creator of the Radare2 reverse engineering framework. Whether you've never heard of Radare, already use it daily, or are thinking about contributing to its development, this conversation will demystify what makes Radare unique, why thousands of engineers rely on it, and how you can step into the community.

This segment is sponsored by NowSecure. Discover how AI-powered mobile app security testing finds hidden vulns and leaks at https://securityweekly.com/nowsecure.

In the security news: