Security This Week explores enterprise security topics through the lens of current events. Hosts Carl Franklin, Patrick Hynds, and Duane LaFlotte discuss hacking methods, security measures, and the outcomes of real-world incidents. The show connects timely news stories to practical security concerns for organizations.
Episodes
History Repeats Itself
Frozen part II: Hackers remotely defrost produce in Euro supermarkets ... again
One guy saves the Internet!
Ondrej Surý: The Volunteer Who Shipped PHP2Shell Fixes for 12 PHP Versions. What Founders Owe the Open Source They Run On
Skynet... not the worst news!
PHP Warns of Two Critical 9.2 Security Vulnerabilities. Patch
Crazy AI Model Meltdown
Carl plays an insane recording of an audio interaction with a new kind of AI model.
The Shaggy Defense
“An AI did it” is no defense, says nonprofit suing OpenAI over Hugging Face hack
Let Me Guess. AI Goes Rogue?
OpenAI and Anthropic are probing a colossal wave of security incidents
To QUERY or not to QUERY
HTTP QUERY Method: The Grey Zone Between GET And POST.
Passing Notes
AI caught telling future versions of itself to bypass human controls, OpenAI reveals
Should you Trust your Router?
X/Twitter message revealing token router shenanigans
Radix Malorum
OpenAI Astra Brings Autonomous Zero-Day Exploitation to AI
Chinese Food Again?
FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
Hack the Spacecraft!
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
The Untouchables?
US government will let private companies hack criminal gangs
Rogue AI: Irregular?
Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations
Caught Passing Notes in Class
OpenAI finds AI agent leaving escape notes for its future versions
OpenAI Goes Rogue!
OpenAI Models Autonomously Hack Hugging Face
The Hives that Bind
New Windows LegacyHive zero-day gives hackers admin privileges
AWS Hacked!
AI-Powered Attack Compromises AWS Cloud in 72 Hours
Claude Unmuted
Trump administration lifts restrictions on Anthropic's Claude models after cybersecurity alarm
Don't Wear Your Face!
Hackers leak facial recognition records tied to millions of Madison Square Garden visitors
What's up with Fortinet?
FortiBleed campaign exposes 75,000 Fortinet firewalls worldwide
Aesop is Rolling in his Grave
Anthropic rolls out Claude Fable 5, but it's available for a limited time
Book: The Cat's Revenge by Claude Balls.
Claude Code’s GitHub Actions Vulnerability Lets Attackers Compromise Any Repository
Beware of the Landshark!
FBI warns of in-person data theft attacks from extortion gang
Et Tu, M5??
First public macOS kernel memory corruption exploit on Apple M5
Ding Dong! Linux Again!
New Linux 'Dirty Frag' zero-day gives root on all major distros
Every Linux System at Risk!
Copy Fail: 732 Bytes to Root on Every Major Linux Distribution.
Mythos: the Good and the Bad
Anthropic investigates unauthorized Mythos access by Discord group
Shall We Play a Game?
AI chatbots used tactical nuclear weapons in 95% of AI war games, launched strategic strikes three times!
Who's the Domain Master?
$10 Domain Could Have Handed Hackers 25k Endpoints, Including in OT and Gov Networks
Anthropic Gets Mythical
Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems
Worse Than Log4J?
Axios NPM Package Compromised: Supply Chain Attack Hits JavaScript HTTP Client with 100M+ Weekly Downloads
Your Router is Banned!
FCC bans foreign routers, putting enterprise network risk in focus
iSpy
Researchers uncover iPhone spyware capable of penetrating millions of devices.
SQL Server on Fire! Film at 11.
Microsoft SQL Server Zero-Day Vulnerability Allows Attackers to Escalate Privileges
Claude Balls
Anthropic ditches its core safety promise in the middle of an AI red line fight with the Pentagon
Is Your Password Manager Safe?
Exploitable Flaws Found in Cloud-Based Password Managers
Patrick Was Right!
iPhone Lockdown Mode is so good even the FBI can’t crack it
Is Your Pet AI Molting?
Hacking Moltbook: The AI Social Network Any Human Can Control
The Sound of Doom!
How to get Doom running on a pair of earbuds
GPT, the Uber Hacker
New Study Shows GPT-5.2 Can Reliably Develop Zero-Day Exploits at Scale
Get Off Of My Cloud!
New China Linked VoidLink Linux Malware Targets Major Cloud Providers
Here. Try This!
ConsentFix: Analysing a browser-native ClickFix-style attack that hijacks OAuth consent grants
Is This Your Mongo?
MongoDB warns admins to patch severe vulnerability immediately
Watch What You Watch!
PornHub extorted after hackers steal Premium member activity data
Over Reacting?
Attackers hit React defect as researchers quibble over proof
iScam?
An ingenious Apple Service hoax is convincing users their account is under attack
Did Claude Go Rogue?
Anthropic claims of Claude AI-automated cyberattacks met with doubt
Should You Disable Hyper-V? Da!
Hackers Weaponize Windows Hyper-V to Hide Linux VM and Evade EDR Detection
Patrick was Right!
No one pays ransomware demands anymore - so attackers have a new goal. Also: Ransomware Surge in Europe: Cybercriminals Exploit GDPR Penalties, Target Key Sectors
AWS Story Put To Bed
AWS crash causes $2,000 Smart Beds to overheat and get stuck upright
Terminate This!
Skynet-1A: Military Spacecraft Launched 56 Years Ago Has Been Moved By Persons Unknown
Live in Orlando!
Carl, Duane, and Patrick recorded this week's episode in front of a live audience at CyberSecurity Intersection, a cyber conference held at Universal Studio in Orlando, FL the week of October 5.
No! Not the Beer!!
Japan's beer giant Asahi Group cannot resume production after cyberattack
Secret Service FTW!
U.S. Secret Service dismantles imminent telecommunications threat in New York tristate area
Read Your Own Damn Email!
New attack on ChatGPT research agent pilfers secrets from Gmail inboxes
The Largest Supply Chain Attack in History!
Hackers left empty-handed after massive NPM supply-chain attack
The End of Privacy?
Salt Typhoon pwned 'nearly every American'
AI-Powered Ransomware: Uh Oh.
Someone Created the First AI-Powered Ransomware Using OpenAI's gpt-oss:20b Model
What would you do for nuggets?
Security researcher driven by free nuggets unearths McDonald's security flaw — changing 'login' to 'register' in URL prompted site to issue plain text password for a new account
We Don't Need No Stinking BitLocker Keys!
BitUnlocker – Multiple 0-days to Bypass BitLocker and Extract All Protected Data
Government Informants Reveled!
Federal court filing system hit in sweeping hack
St. Paul Shut Down Dontcha Know
Minnesota National Guard activated, state of emergency declared after cyberattack against St. Paul
Sharing is NOT the Point!
Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
White Russians, Anyone?
Russian alcohol retailer WineLab closes stores after ransomware attack
Call of Duty?? WTF!
Call of Duty: WW2 pulled from PC following reports of remote code exploit trolling players with 'Notepad pop-ups, PC shutdowns' and desktop wallpaper of a lawyer
Quantum is the Answer. What's the Question?
Quantum tech is coming — and with it a risk of cyber doomsday
Gmail Hacked?
Russian hackers bypass Gmail MFA using stolen app passwords.
Google for Phone Numbers?
https://www.malwarebytes.com/blog/news/2025/06/google-bug-allowed-phone-number-of-almost-any-user-to-be-discovered
New TV or Smart Device? Kill it!
BADBOX 2.0 Android malware infects millions of consumer devices
Meta Caught Spying. Shocker!
Meta found 'covertly tracking' Android users through Instagram and Facebook
Signal sends a Signal to Windows!
Signal says no to Windows 11’s Recall screenshots
Can China Disable Your Solar Panels?
Chinese ‘kill switches’ found hidden in US solar farms
Siri Spied! Who Knew?
You can now submit your claims for Apple’s $95 million Siri spying settlement
Is This The Apple Pandemic?
Apple 'AirBorne' flaws can lead to zero-click AirPlay RCE attacks
Android Spyware!
Android Spyware Disguised as Alpine Quest App Targets Russian Military Devices
Is you is or is you ain't my CVE?
Funding Expires for Key Cyber Vulnerability Database
Stand-up Security
Incomplete Patch in NVIDIA Toolkit Leaves CVE-2024-0132 Open to Container Escapes
Freeze Your Credit Now!
Protect Yourself from Identity Theft and Fraud
Should We Be Worried About Signal?
National Security Officials Were Warned in February That Signal Was Vulnerable to Attack
Recommended
Deadline: White House
The Great Detectives of Old Time Radio| Daily Mystery Dramas
TED Business
Ranger Bill | Old Time Radio Adventure & Family Drama
زن بودن
Christmas Old Time Radio
The Adventures of Superman | Old Time Radio
Booked, Blonde & Busy w/ Olivia Ponton
The Human-Animal Connection - Pet Life Radio Original
Medicine with Meaning
Homemaking with Jesus | Weekly Devotionals, Biblical Application, Simple Living, Home Management, Healthy Relationships
Disney+ Hulu Throwbacks Podcast
