Security Weekly Podcast Network (Video)

Latest Episodes:

Astro Oblivion, FreePBX, GitHub, OWASP, Promptlock, Claude Aaran Leyland - SWN #507 Aug 29, 2025

Show notes

Porn bombing the celestial zoom room and Astro Oblivion, FreePBX, GitHub, OWASP, Promptlock, Claude Aaran Leyland, and More, on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-507

Hackers Steal Your Car and Vulnerabilities - Rob Allen - PSW #889 Aug 28, 2025

Show notes

Rob Allen joins us to discuss the importance of security research teams, and some cool stuff they've worked on. Then, in the Security News:

Flipper Zero, unlocking cars: The saga continues
The one where they stole the vulnerabilities
ESP32 Bus Pirates
AI will weaponize everything, maybe
What are in-the-wild exploits?
Docker and security boundaries, and other such lies
AI-powered ransomeware
BadCAM, BadUSB, and novel defenses
5G sniffers
Jeff breaks down all the breach reports
AI in your browser is a bad idea
And How to rob a hotel - a nod to the way hacking used to be

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

Show Notes: https://securityweekly.com/psw-889

vCISO Benefits as the CISO Becomes Strategic and the Board's Responsible for Security - Brian Haugli - BSW #410 Aug 27, 2025

Show notes

Securing top-tier cybersecurity leadership is not just a necessity but a significant challenge, especially when working within budget constraints. Should you hire a full-time CISO or outsource to a vCISO provider?

Brian Haugli, CEO at SideChannel, joins BSW to discuss how organizations can hire a Virtual CISO (vCISO) to benefit from their expertise without the costs and resource requirements of a full-time hire. Brian will share:

Current vCISO trends
What to look for in vCISO services
Who fits/doesn't fit as a vCISO

vCISOs can be an effective solution for organizations that need to enhance their security program or respond to a breach, but know what to look for. If you're in the market for vCISO services or want to become a vCISO, don't miss this interview.

In the leadership and communications segment, Boards should bear ultimate responsibility for cybersecurity, From WannaCry to AI: How CISOs Became Strategic Leaders, The Best Leaders Edit What They Say Before They Say It, and more!

Show Notes: https://securityweekly.com/bsw-410

Naughty RBG, Docker, RDP, SBOMS, Kullback-Leibler, Oneflip, Youtube, Josh Marpet... - SWN #506 Aug 26, 2025

Show notes

Naughty RBG, Docker, RDP, SBOMS, Kullback-Leibler, Oneflip, Youtube, Josh Marpet, and more on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-506

Translating Security Regulations into Secure Projects - Emily Fox, Roman Zhukov - ASW #345 Aug 26, 2025

Show notes

The EU Cyber Resilience Act joins the long list of regulations intended to improve the security of software delivered to users. Emily Fox and Roman Zhukov share their experience education regulators on open source software and educating open source projects on security. They talk about creating a baseline for security that addresses technical items, maintaining projects, and supporting project owners so they can focus on their projects.

Segment resources:

github.com/ossf/wg-globalcyberpolicy
github.com/orcwg
baseline.openssf.org

Show Notes: https://securityweekly.com/asw-345

Oktane Preview with Harish Peri, Invisible Prompt Attacks, and the weekly news! - Harish Peri - ESW #421 Aug 25, 2025

Show notes

Interview with Harish Peri from Okta

Oktane Preview: building frameworks to secure our Agentic AI future

Like it or not, Agentic AI and protocols like MCP and A2A are getting pushed as the glue to take business process automation to the next level. Giving agents the power and access they need to accomplish these lofty goals is going to be challenging, from a security perspective.

How do put AI agents in the position to perform broad tasks autonomously without granting them all the privileges? How do we avoid making AI agents a gold mine for attackers - the first place they stop once they hack into our companies? These are some examples of the questions Okta aims to answer at this year's Oktane event, and we aim to kick off the conversations a little early - with this interview!

Segment Resources:

Check out securityweekly.com/oktane for all our live coverage during the event this year!
More information about the event and how you can attend can be found here: https://www.okta.com/oktane/
AI at Work 2025: Securing the AI-powered workforce

Topic - Indirect Prompt Injection Getting Out of Hand

Reports of indirect prompt injection issues have been around for a while. Of particular note was Michael Bargury's Living off Microsoft Copilot presentation from Black Hat USA 2024. Simply sending an email to a Copilot user could make bad stuff happen.

Now, at Black Hat 2025, we've got more: the ability to plunder any data resource connected to ChatGPT (they call these integrations "Connectors") from Tamir Ishay Sharbat at Zenity Labs. The research is titled AgentFlayer: ChatGPT Connectors 0click Attack.

Looks like Google Jules is also vulnerable to what the Embrace the Red blog is calling invisible prompts. Sourcegraph's Amp Code is also vulnerable to the same attack, which encodes instructions to make them invisible.

What's really going to ruffle feathers is the fact that all these companies know this stuff is possible, but don't seem to be able to figure out how to prevent it. Ideally, we'd want to be able to distinguish between intended instruction and instructions injected via attachments or some other means outside of the prompt box. I guess that's easier said than done?

News

Finally, in the enterprise security news,

Drones are coming for you… to help?
One of the most powerful botnets ever goes down
Phishing training is still pointless
Microsoft sets an alarm on its phone for 8 years from now to do post-quantum stuff
vulns galore in commercial ZTNA apps
GenAI projects are struggling to make it to production
Adblockers could be made illegal - in Germany
Windows is getting native Agentic support
Automating bug discovery AND remediation?
Public service announcement: time is running out for Windows 10

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-421

Humans extinct: 2040, Okta, Elastic, Bad Bots, Berserk Bear, Siemens, Aaran Leyland.. - SWN #505 Aug 22, 2025

Show notes

Humans wiped out by 2040, Okta, Elastic, Bad Bots, Berserk Bear, Siemens, Philip K. Dick, Aaran Leyland, and More, on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-505

What We've Learned from LockBit and Black Basta Leaks (and News) - Ian Gray - PSW #888 Aug 21, 2025

Show notes

This segment is sponsored by Flashpoint. Visit https://securityweekly.com/flashpoint to learn more about them!

Recent leaks tied to LockBit and Black Basta have exposed the inner workings of two of the most notorious ransomware groups—revealing their tactics, negotiation strategies, and operational infrastructure. For defenders, this rare window into adversary behavior offers critical intelligence to strengthen incident response and prevention strategies. In this interview, we'll break down what these leaks reveal and how security teams can use this intelligence to proactively harden their defenses, including:

Key takeaways from the LockBit and Black Basta leaks—and what they confirm about ransomware operations
How leaked playbooks, chats, and toolkits can inform detection and response
Practical steps to defend against modern ransomware tactics in 2025

In the security news:

Practical exploit code
Old vulnerabilities, new attackers
AI and web scraping - the battle continues
0-Days: You gotta prove it
WinRAR 0-Day
LLM patch diffing
$20 million bug bounty
Your APT is showing
Hacking from the routers
Its that easy eh?
NIST guidance on AI
Words have meaning
Developers knowingly push vulnerable code
My Hackberry PI post is live: https://eclypsium.com/blog/build-the-ultimate-cyberdeck-hackberry-pi/

Resources:

Inside the LockBit Leak: Rare Insights Into Their Operations: https://flashpoint.io/blog/inside-the-lockbit-leak/?utmcampaign=WBHostedSCMedia2025&utmsource=SCMedia&utmmedium=email&sfcampaign_id=701Rc00000S48bZIAR
2025 Ransomware Survival Guide: https://flashpoint.io/resources/e-book/2025-ransomware-survival-guide/?utmcampaign=WBHostedSCMedia2025&utmsource=SCMedia&utmmedium=email&sfcampaign_id=701Rc00000S48bZIAR
AI and Threat Intelligence: The Defenders' Guide https://go.flashpoint.io/ai-and-threat-intelligence-guide?utmcampaign=WBHostedSCMedia2025&utmsource=SCMedia&utmmedium=email&sfcampaign_id=701Rc00000S48bZIAR

Show Notes: https://securityweekly.com/psw-888

Misconfiguration, The Forgotten Vulnerability and the Power and Failure of "Yes" - Danny Jenkins - BSW #409 Aug 20, 2025

Show notes

The industry is obsessed with vulnerabilities. From vulnerability assessment to vulnerability management to exposure management and even zero days, we love to talk about vulnerabilities. But what about misconfiguration? By definition it's a vulnerability or weakness, but it doesn't have a CVE (common vulnerability enumeration). Should we ignore it?

Danny Jenkins, CEO and Founder at ThreatLocker, joins BSW to discuss why misconfigurations matter. Simply, you can prevent many cyberattacks by eliminating your misconfigurations. That's why ThreatLocker released Defense Against Configurations (DAC). Danny will discuss the benefits of DAC, including:

Immediate visibility into system misconfigurations before they become vulnerabilities
Compliance transparency, showing exactly where systems fall short of industry standards
One unified view, with filters by criticality, system, and framework
Actionable insights, updated weekly and delivered straight to customers' inboxes

Segment Resources:

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

In the leadership and communications segment, CEO Blind Spots That Put Your Company at Risk, The CISO Mindset Shift: From Risk Defender to Business Accelerator in the Age of AI, When "Yes, and…" Backfires, and more!

Show Notes: https://securityweekly.com/bsw-409

The cult of Doug, Crime, Pipemagic, Clickfix, Cats in Space, Josh Marpet, and more... - SWN #504 Aug 19, 2025

Show notes

The cult of Doug, Crime, Pipemagic, Clickfix, Cats in Space, Uncle Silvio, Josh Marpet, and more on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-504