Risky Business

Latest Episodes:

Risky Business #821 -- Wiz researchers could have owned every AWS customer Jan 21, 2026

Show notes

In this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, joined by a special guest. BBC World Cyber Correspondent Joe Tidy is a long time listener and he pops in for a ride-along in the news segment plus a chat about his new book.

This week news includes:

Did the US cyber Venezuela’s power grid, or do they just want us to think they coulda?
US govt might boycott the RSAC Conference ‘cause Jen Easterly being CEO makes them mad
MS Patch Tuesday fixes CVSS5.5 bug and … stops you shutting down
Wiz pulls off cloud stunt hack that ends with control of everyone’s AWS console
Millions of Bluetooth devices that use Google’s Fast Pairing will pair with anyone, any time
GNU inet-tools’ telnetd parties like it’s 2007, and brings -f root unauthed remote login back

Thinkst is this week’s sponsor, and long time friend of the show Haroon Meer joins. As always they’re polishing their Canary tokens - adding breadcrumbs to lead you to them - but they’re also a bunch of giant nerds who now run South Africa’s Computer Olympiad.

This episode is also available on Youtube.

Show notes

Risky Business #820 -- Asian fraud kingpin will face Chinese justice (pew pew!) Jan 14, 2026

Show notes

Risky Business returns for 2026! Patrick Gray and Adam Boileau talk through the week’s cybersecurity news, including:

Santa brings hackers MongoDB memory leaks for Christmas
Vercel pays out a million bucks to improve its React2Shell WAF defences
39C3 delivers; the pink Power Ranger deletes nazis, while a catgirl ruins GnuPG
Cambodian scam compound kingpin gets extradited to China, and we don’t think it’ll go well for him
Krebs picks apart the Kimwolf botnet and residential proxy networks
So many healthcare data leaks that we have a roundup section

This week’s episode is sponsored by Airlock Digital. The founders of the application allow-listing vendor, David Cottingham and Daniel Schell, discuss Microsoft’s ClickOnce .NET app packaging, and how attackers have been abusing it to load code. Airlock hates it when you load code!

This episode is also available on Youtube.

Show notes

How the World Got Owned Episode 1: The 1980s Jan 07, 2026

Show notes

In this special documentary episode, Patrick Gray and Amberleigh Jack take a historical dive into hacking in the 1980s. Through the words of those that were there, they discuss life on the ARPANET, the 414s hacking group, the Morris Worm, the vibe inside the NSA and a parallel hunt for German hackers happening at a similar time to Cliff Stoll’s famous Cuckoo’s Egg story.

This podcast features the memories of:

Jon Callas, former principal software engineer at Digital Equipment Corporation
Mark Rasch, Morris Worm prosecutor
Timothy Winslow, former 414 hacker
Greg Chartrand, author of Cracking the Cuckoos Egg and
Tony Sager, former NSA

How the World Got Owned is produced in partnership with SentinelOne.

Show notes

Risky Business #819 -- Venezuela (credibly?!) blames USA for wiper attack Dec 17, 2025

Show notes

In the final show of 2025, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

React2Shell attacks continue, surprising no one
The unholy combination of OAuth consent phishing, social engineering and Azure CLI
Venezuela’s state oil firm gets ransomware’d, blames US… but what if it really is a US cyber op?!
Russian junk-hacktivist gets indicted for cybering critical… err… a car wash and a fountain
Microsoft finally turns RC4 off by default in Active Directory Kerberos
Traefik’s TLS verify=on … turns it off, whoopsie 🤡

This week’s episode is sponsored by Sublime Security, makers of an email filtering solution that’s up for dealing with modern problems. Founder and CEO Josh Kamdjou joins to talk about calendar invite phishing, and the extra steps they’ve had to take to reach into people’s calendars and fix the mess.

The Risky Business weekly show is taking holiday break, and will return on 14 January for its twentieth year! Good luck out there, internet friends.

This episode is also available on Youtube.

Show notes

Risky Biz Soap Box: Graph the planet! Dec 12, 2025

Show notes

In this sponsored Soap Box edition of the Risky Business podcast, Patrick Gray chats with Jared Atkinson, CTO of SpecterOps, about BloodHound OpenGraph.

OpenGraph enumerates attack paths across platforms and services, not just your primary directories.

A compromised GitHub account to on-prem AD compromise attack path? It’s a thing, and OpenGraph will find it.

Cross-platform attack path enumeration! So good!

This episode is also available on Youtube.

Show notes

Risky Business #818 -- React2Shell is a fun one Dec 10, 2025

Show notes

In this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

There’s a CVSS 10/10 remote code exec in the React javascript server. JS server? U wot mate?
China is out popping shells with it
Linux adds support for PCIe bus encryption
Amnesty International says Intellexa can just TeamViewer into its customers’ surveillance systems
…and a Belgian murder suspect complains that GrapheneOS’s duress wipe feature failed him?

This week’s episode is sponsored by Kroll Cyber. Simon Onyons is Managing Director at Kroll’s Cyber and Data Resilience arm, and he discusses a problem near to many of our hearts. Just how do you explain cyber risk to the board?

This episode is also available on Youtube.

Show notes

Risky Business #817 -- Less carnage than your usual Thanksgiving Dec 03, 2025

Show notes

In this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news. It’s a quiet week with Thanksgiving in the US, but there’s always some cyber to talk about:

Airbus rolls out software updates after a cosmic ray bitflips an A320 into a dive
Krebs tracks down a Scattered Lapsus$ Hunters teen through the usual poor opsec…
… as Wired publishes an opsec guide for teens.
Microsoft decides its login portal is worth a Content Security Policy
South Korean online retailer data breach covers 65% of the country

This week’s episode is sponsored by Nebulock. Founder and CEO Damien Lewke joins to talk through their work bringing more SIgma threat detection rules to MacOS.

This episode is also available on Youtube.

Show notes

Risky Business #816 -- Copilot Actions for Windows is extremely dicey Nov 26, 2025

Show notes

In this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

Salesforce partner Gainsight has customer data stolen
Crowdstrike fires insider who gave hackers screenshots of internal systems
Australian Parliament turns off wifi and bluetooth in fear of of visiting Chinese bigwigs
Shai-Hulud npm/Github worm is back, and rm -rf’ier than ever
SEC gives up on Solarwinds lawsuit
Dog eats cryptographer’s key material

This week’s episode is sponsored by runZero. HD Moore pops in to talk about how they’re integrating runZero with Bloodhound-style graph databases. He also discusses uses for driving runZero’s tools with an AI, plus the complexities of shipping AI when the company has a variety of deployment models.

This episode is also available on Youtube.

Show notes

Risky Biz Soap Box: Greynoise knows when bad bugs are coming Nov 21, 2025

Show notes

In this sponsored Soap Box edition of the podcast, Andrew Morris joins Patrick Gray to talk about how Greynoise can often get a 90 day heads up on serious vulnerabilities. Whether it’s malicious actors doing reconnaissance or the affected vendors trying to understand the scope of the problem, it seems that mass scanning activity lines up pretty nicely with typical 90-day disclosure timelines.

A fascinating chat with Andrew, as always.

This episode is also available on Youtube.

Show notes

Risky Business #815 -- Anthropic's AI APT report is a big deal Nov 19, 2025

Show notes

In this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

Anthropic says a Chinese APT orchestrated attacks using its AI
It’s a day ending in -y, so of course there are shamefully bad Fortinet exploits in the wild
Turns out slashing CISA was a bad idea, now it’s time for a hiring spree
Researchers brute force entire phone number space against Whatsapp contact discovery API
DOJ figures out how to make SpaceX turn off scam compounds’ Starlink service

This week’s episode is sponsored by Mastercard. Senior Vice President of Mastercard Cybersecurity Urooj Burney joins to talk about how the roles of fraud and cyber teams in the financial sector are starting to converge. Mastercard also recently acquired Recorded Future, and Urooj talks about how they aim to integrate cyber threat intelligence into the financial world.

This episode is also available on Youtube.