Three Buddy Problem

Latest Episodes:

The Great Binance $6.34 Billion Crypto Heist Oct 30, 2026

Show notes

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 118: On the show this week, the buddies dig into the $6.34 billion Binance heist, the largest crypto hack ever, walking through its multi-chain laundering, the North Korea fingerprints, and whether offensive AI quietly helped pull it off.

Plus, thoughts on Sam Altman's swipe at local hardware, the PHP2Shell "cannonball," why defenders keep hitting guardrails while GLM-5.3 happily does the work, a trojanized Claude Code extension, Apple's fresh spyware alerts, and Volt Typhoon's Silent Train.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter
3:46 CTI training & the AI model stack
8:03 The $6.34B Binance hack: the largest crypto heist ever
12:40 Inside the multi-chain laundering
18:23 Sam Altman & the AI hardware crunch
20:44 Root cause: a compromised DevOps laptop
23:43 Did AI help pull it off?
31:22 Who actually loses six billion dollars?
44:00 Crypto as a financial instrument
51:04 Can it get bigger? Hardware-wallet implants
57:04 Attribution, "misalignment" & is Binance Chinese?
1:10:00 Cash, privacy & the Mt. Gox lesson
1:22:12 PHP2Shell: dodging the cannonball
1:30:52 AI for defense & the productization gap
2:09:32 GLM-5.3, the refusal trap & open weights
2:32:26 Apple spyware alerts & Silent Train

Links:

Lumen's Michael Horka on China's 'Silent Train' Router Hacking Oct 28, 2026

Show notes

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

SECURITY CONVERSATIONS: Black Lotus Labs researcher Michael Horka joins the show to discuss Silent Train, a Volt Typhoon framework that spins up four-to-six-hop chains of hijacked SOHO routers in about two minutes and wipes every hop when the day's session ends.

We discuss how ORB networks differ from botnets, why Silent Train took over after the FBI's KV-botnet takedown, the zero-days hitting control plane software from Versa, N-able and VeloCloud, and the NetFlow and logging moves defenders can make right now.

TIMESTAMPS:
0:00 Intros
0:29 What is an ORB network?
2:34 Silent Train, an operational framework for Volt Typhoon
3:30 Why call it Silent Train?
4:12 Chains that exist for a few hours
6:47 The hijacked routers in the chain
8:16 Burning zero-days on a single hop
9:48 Attribution and the KV-botnet successor
11:02 Crown jewels and NetFlow visibility
14:53 Why network monitoring gets skipped
17:23 Victims in Hawaii, California and Texas
19:23 Four confirmed zero-days, all patched
20:47 Control plane software as the target
26:00 No-brainer defenses: logs and internet exposure
29:41 Threat hunting, agentic AI and where ORBs go next

Links:

PHP2Shell Meltdown: AI Found It. Who's Going to Patch It? Oct 24, 2026

Show notes

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 117: This week, we dig into PHP2Shell, the AI-assisted PHP bug that led governments to take websites offline, and the arguments over broken embargoes, who found it first, and the AI doomers taking an "I-told-you-so" victory lap.

Plus, why patching hasn't kept up with AI bug finding, a failure of SBOMs, Terence Tao on math after AI, the iPhone Duo jailbreak and the eMudhra certificate authority key leak.

Cast: Juan Andres Guerrero-Saade and Ryan Naraine. Costin Raiu is traveling.

Timestamps:
0:00 Introductory banter
1:07 Black October's pile of critical bugs
2:34 PHP2Shell and the AI victory lap
8:28 Twenty years of PHP technical debt
16:54 Wiz, Gemini 4 Argon and the credit fight
21:01 Chainguard breaks the embargo
28:42 The doomers' warnings and the patching gap
39:32 Is this an SBOM problem?
55:33 Inside the PHP Foundation's post-mortem
1:03:13 Are bugs sparse or dense?
1:11:24 Should frontier labs fix coding?
1:20:14 Vibe coding and math's industrial era
1:27:26 Who pays to maintain open source?
1:44:59 iPhone Duo hacked already, eMudhra and the news

Links:

Who's Hacking Supermarket Fridges in France? Oct 18, 2026

Show notes

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 116: This week, the buddies dig into a mystery hack that cooked French supermarket fridges, cyberattacks against food supply networks, and why this smells like nation-state sabotage in Europe?

Plus, a fresh Ivanti zero-day chain, Anthropic's self-replicating IoT research and defender-hostile guardrails, Citizen Lab's AdFection spyware-by-ads exposé, Calif's iPhone exploit drops at Hexacon, Grok's surprising enterprise adoption, and spy chips stuffed inside Ledger wallets.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter
1:35 Virus Bulletin 2026 in Seville
6:13 Conference roundup: State of Statecraft, Countermeasure, RE//verse
10:21 French supermarket fridges hacked
22:53 Hacking food supply and the attribution question
33:23 Who patches the fridge?
45:58 Ivanti Connect Secure zero-day chain
53:00 When an AI agent deletes your databases
1:04:34 NCSC edge-device forensics guidance
1:28:06 Anthropic's self-replicating IoT research
1:52:17 Why guardrails lock out defenders
2:04:57 Grok's enterprise play and agent sprawl
2:16:26 Citizen Lab exposes AdFection spyware via ads
2:57:24 Calif burns iPhone exploits at Hexacon
3:06:55 Ledger wallet implants and the grain of rice

Links:

Katie Moussouris on AI-as-malware, the monitoring gap, and an NTSB for AI Oct 12, 2026

Show notes

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Offensive AI Con: Luta Security chief Katie Moussouris makes the case for an NTSB-style board for AI incidents, with subpoena power and full-time investigators, after OpenAI's DNS tunneling escape and the 52 days it took to notice a model had wandered into Australian government systems.

Along the way, we chat about her work on the Cyber Safety Review Board (CSRB), AI model refusals that leave defenders stuck, and why she still bets on hackers to bend this technology their way.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Katie Moussouris.

Timestamps:
0:00 Intros at Offensive AI Con
1:00 OpenAI's DNS tunneling incident and slow monitoring
4:36 Treating AI like malware in a sandbox
9:01 The business model is the misalignment
13:37 Log4j, SBOMs and an NTSB for AI
18:00 Trading liability protection for honest disclosure
22:13 Accountability and "once you become aware"
26:18 The Australia notification timeline
28:19 A blank-check administration and the Anthropic phaseout
34:35 Powerful models in the right hands
38:42 Kill switch bills and regulatory capture
42:36 EU fines as a tariff on American tech
48:03 Reasons for optimism
54:13 Bring back "information security"
1:01:57 Katie's last word

Links:

NCSC's Ollie Whitehouse: 'The Biggest Correction of Technical Debt Ever' Oct 12, 2026

Show notes

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Offensive AI Con: Ollie Whitehouse, CTO of the UK's National Cyber Security Centre, joins us to explain how Britain is preparing for an AI-driven patch wave and why the NCSC is pressing edge-device vendors to finally ship real telemetry.

Plus, we dig into rogue AI agents wandering into a Five Eyes network, along with his forecast that small, capable models could revive self-spreading worms around 2030, all part of what he calls the biggest forced correction of technical debt the industry will ever see.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Ollie Whitehouse.

Timestamps:
0:00 Live from Offensive AI Con: meet Ollie Whitehouse
2:46 Why the NCSC is a model for the US
6:48 What a "national technical authority" does
7:49 The Huawei analysis and the push for passkeys
10:50 Independent AI model testing
13:12 Open-weight vs. closed models and AI sovereignty
19:02 Capability density and AI worms by 2030
23:09 Robotics security and lessons from Japan
26:49 Preparing for the patch wave
31:06 Architecture fixes: OT, cross domain, privileged access
32:28 Telecoms security and Salt Typhoon
38:59 Minimum telemetry standards for edge devices
41:55 Market incentives and the EU Cyber Resilience Act
46:05 Rogue agents and the forced correction of technical debt

Links:

Aaron Grattafiori Explains How LLMs Hunt Patch Variants at Scale Oct 09, 2026

Show notes

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Offensive AI Con: Umbriel AI's Aaron Grattafiori breaks down the new offensive-security playbook, using LLMs for patch variant analysis, why the vuln apocalypse hasn't become an exploit apocalypse, and how the death of security through obscurity puts closed-source binaries and firmware within reach.

Plus, we discuss rogue agents escaping sandboxes, the eval-driven loop behind recursive self-improvement, and the brutal cost asymmetry that makes offense cheap and defense almost unaffordable.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Aaron Grattafiori.

Timestamps:
0:00 Introductory banter
1:12 Umbriel AI pitch: "Smart people in a place to cook”
3:08 Weird, exhausting, exciting time in security
4:00 What AI really changed: speed (and a 30-minute reimplementation)
6:36 Incomplete fixes and the variant-analysis pipeline
9:21 Uplifting, abstraction, and representing vulnerabilities
11:48 Experimentation and the new shape of security companies
14:46 The vuln apocalypse vs. the exploit apocalypse
16:36 Triage, verification, and reward hacking
18:08 Do models reintroduce bugs? Is vuln-free code possible?
24:22 Specialized models and the rise of Jev-style classifiers
26:47 Binaries, firmware, and the death of security through obscurity
31:15 Open source as a requirement and corporate contracting
33:54 Rogue agents: Hugging Face, OpenAI, and lab escapes
39:17 Why defense is so expensive, and running the rig

Links:

Joel Todoroff on How Offensive AI Is Rewiring Western Government Ops Oct 09, 2026

Show notes

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Offensive AI Con: Former US intelligence and national security official Joel Todoroff joins us live from OffensiveAIcon to explain why his new startup Phyle is building AI for the recon and targeting work that happens long before anyone fires an exploit.

We get into bribable sysadmins, the military framing that boxes in Western cyber operations, letters of marque, AI doomerism, and what happens when a frontier model decides mid-project that your use case is off-limits.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Joel Todoroff.

Timestamps:
0:00 Live from OffensiveAIcon in Oceanside
1:23 What Phyle builds for governments
3:02 Skepticism of the AI 0-day factory
5:57 Paying a sysadmin vs. burning tokens
9:30 Recon gets less love than weaponization
12:41 Exploit shelf life and target No. 1,000
17:30 Why attacker costs will keep rising
22:23 What HUMINT looks like in 2026
27:06 Why intelligence stovepipes persist
32:16 Cyber as statecraft beyond the military frame
41:23 People will keep making dumb mistakes
48:03 The White House memo and letters of marque
54:06 Doomerism vs. near-term AI harms
1:04:20 PSOA concerns and building guardrails in
1:26:03 Open models, guardrails and zero data retention

Links:

Valentina Palmiotti (chompie) on Vulnpocalypse, Matching Mythos on a Budget Oct 07, 2026

Show notes

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Offensive AI Con: Live from OAIC, IBM X-Force's Valentina Palmiotti (chompie) walks us through the autonomous Windows kernel exploit pipeline she built on older Claude models, which landed within a hair of Mythos for about $180 a chain.

Plus, the Pwn2Own bug Claude called unexploitable, why her Pwn2Own bugs still sit unpatched, disappearing exploit techniques, the dread of being a defender, and how Phrack found its way back into print.

Timestamps:
0:00 Intro and Pwn2Own war stories
3:46 What vibe hacking means
8:16 When long agent runs go sideways
10:31 Self-verification in an n-day kernel pipeline
16:11 Matching Mythos for $180 a chain
18:42 The bug Claude called unexploitable
21:49 Unpatched bugs and the defender gap
25:37 Mythos arrives through CVP
27:00 Models only know public techniques
32:01 Testing models on held-back bugs
37:45 Inside chompie's daily workflow
46:07 Where's the exploitpocalypse?
50:07 Pixel drops MTE
53:40 Advice for defenders: design for containment
58:34 Phrack is back

Links:

Why is Anthropic Afraid of GLM 5.3? Oct 02, 2026

Show notes

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 115: We into Anthropic's Frontier Red Team fear-mongering on Zhipu's open-weight GLM 5.3 model and wonder why the AI labs' cyber programs do so little for defenders.

Plus, Citrix NetScaler zero-days, a new iOS zero-day tied to WhatsApp, AI agents that act on your behalf, and whether security teams should buy DGX Sparks to run models locally.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter, TLPBLACK
3:38 OffensiveAI Con and the missing defensive con
9:28 Anthropic's GLM 5.3 post
23:21 What do defensive AI coalitions do?
29:08 Inside Glasswing
36:01 Why can't vuln-finding models patch?
42:44 Gemini for Argon and Grok's CVE-Bench tie
47:54 Is hallucination a solved problem?
57:41 Zhipu's program and 4,000 zero-days
1:02:32 Citrix NetScaler zero-days
1:10:42 Half-days and automated patching
1:26:45 iOS 27.0.1 zero-day and WhatsApp
1:32:36 Dots, Instinct and agent monetization
1:52:06 DGX Spark 64GB and local AI hardware
2:18:38 Anthropic visits the Pope, then UFOs

Links:

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected