Risky Bulletin

Latest Episodes:

Risky Bulletin: RubyGems adds dependency cooldowns to counter supply chain attacks Jun 08, 2026

Show notes

RubyGems adds dependency-cooldowns to counter supply chain attacks, AT&T and IBM are accused of hiding foreign hacks, Cisco warns of a new SD-WAN zero-day, and Google layoffs hit security teams.

Show notes

Risky Bulletin: RubyGems adds dependency cooldowns to counter supply chain attacks

Risky Bulletin: EU unveils digital sovereignty plan Jun 05, 2026

Show notes

The EU unveils its digital sovereignty plan, an American law firm pays a $20 million ransom, authorities take down millions of email and social media scam accounts, and a new DoS bug can crash servers within seconds.

Show notes

Risky Bulletin: The EU debuts digital sovereignty plan

Srsly Risky Biz: NATO's cyber approach needs to change Jun 04, 2026

Show notes

Tom Uren and James Wilson talk about Tom’s trip to NATO’s Cyber Conflict conference. NATO countries want to bulk up their cyber efforts, and the pair discuss what that could look like.

They also look at the US military’s admission that commercial location data was used to target personnel involved in Epic Fury, the US war on Iran. This is not surprising at all, and is just the most visible manifestation of the national security risks of this kind of data sloshing around. If Iran is analysing this data in wartime, China is doing it in peacetime for intelligence and counter-espionage purposes.

This episode is also available on YouTube

Show notes

Risky Bulletin: FSB calls out Western spyware operation Jun 03, 2026

Show notes

Russia’s FSB calls out a Western spyware operation, high-profile Instagram accounts hijacked via Meta’s AI support agents, Red Hat npm packages were compromised in another supply chain attack, and ten percent of domains registered last year were malicious.

Show notes

Risky Bulletin: A tenth of all new domains last year were malicious

Between Two Nerds: The intelligence cult Jun 02, 2026

Show notes

In this edition of Between Two Nerds Tom Uren and The Grugq talk about the ways in which intelligence agencies are just like cults.

This episode is also available on YouTube

Show notes

Risky Bulletin: Recently patched PAN 0day exploited in the wild Jun 01, 2026

Show notes

A new Palo Alto Networks firewall bug is being exploited in the wild, Russia expands SORM surveillance, NIST is looking for new post quantum algorithms, and ENSOC launches in Europe.

Show notes

Risky Bulletin: Russia greatly expands SORM surveillance requirements

Sponsored: Inside CISA's disastrous secrets leak Jun 01, 2026

Show notes

In this sponsored interview Casey Ellis chats with Truffle Security’s founder and CEO Dylan Ayrey about the recent CISA secrets leak.

Days after Brian Krebs ran the story, plenty of the exposed credentials were still live, including an admin-level GitHub app key with full rights over CISA’s org.

Dylan walks through why deleting the repo doesn’t fix anything, why most cloud vendors won’t hard-revoke exposed keys (OpenAI and Slack will; AWS, Google and friends mostly won’t), why Hugging Face datasets now hold more secrets than GitHub itself, and what the next generation of multi-provider credential-harvesting supply chain worms is going to look like.

Show notes

Risky Bulletin: Dutch police take down 17m device botnet May 29, 2026

Show notes

Dutch police take down a botnet of 17 million devices, US military staff have been tracked with ad-tech location data, a Google engineer is arrested for insider trading on Polymarket, and Gogs and the Casdoor IAM leave major bugs unpatched.

Show notes

Risky Bulletin: Dutch police take down giant botnet of 17 million devices

Risky Bulletin: Iran to reconnect to the Internet May 27, 2026

Show notes

Iran will reconnect to the Internet, a new vulnerability lets attackers bypass authentication on AI infrastructure, hackers breach Lithuania’s state registry, security firms take down the Glassworm botnet, and CERT India releases strict patching advice.

Show notes

Risky Bulletin: BadHost vulnerability bypasses authentication on AI infrastructure

Risky Bulletin: Mythos has found thousands of critical bugs May 25, 2026

Show notes

Anthropic says Mythos has found thousands of critical bugs, hackers leak documents from a Russian disinfo group, GitHub rolls out new npm security features, and Dutch police raid two bulletproof hosting providers.