The 443 - Security Simplified
Secplicity 396 episodes Nov 9, 2026
The 443 - Security Simplified is a weekly cybersecurity podcast hosted by Secplicity. It breaks down the latest security headlines, trends, and threats in an accessible way. Through conversations with white-hat hackers and security researchers, the show turns complex topics into practical insights. The tone combines expertise with wit and occasional cynicism to keep the subject engaging and actionable.
Episodes
From Stolen Data to Automated Attacks: AI's Criminal Evolution - The 443 Podcast - Episode 395
WatchGuard Intrusion Analyst Ryan Estes joins Marc Laliberte to break down the latest ransomware activity, including emerging threats from The Gentlemen, Qilin, and INC Ransom. They explore how cybercriminals are weaponizing AI, from INC Ransom's AI-built Phantom tool to using large language models to analyze stolen data and generate detailed exfiltration reports. The conversation also dives into
The Biggest Crypto Heist Ever - The 443 Podcast - Episode 394
This week on the podcast, we cover the $6 billion cryptocurrency theft from Binance. Before that, we give an update on PHP2Shell and one active exploit campaign targeting Palo Alot devices. Additionally, we discuss a compromised Claude Code extension on the Cursor AI marketplace.
PHP2Shell Breaks the Internet - The 443 Podcast - Episode 393
This week on the podcast, we dive into a pair of PHP vulnerabilities dubbed PHP2Shell and the chaos they caused through uncoordinated disclosure. After that, we discuss a certificate authority who's random number generator only goes to three digits before ending with law enforcement action around ShinyHunters ransomware negotiators.
Regional Cybersecurity Trends with Ryan Davis - The 443 Podcast - Episode 392
New Charter Technologies CISO, Ryan Davis joins The 443 to discuss the evolving cybersecurity landscape across different regions, the unique challenges organizations face, and the trends shaping the future of security. Tune in for insights into emerging threats, regional priorities, and how businesses and partners can stay ahead of an ever-changing threat landscape.
From IT Provider to Security Partner: The Evolution of MSP Cybersecurity - The 443 Podcast - Ep. 391
In this episode, WatchGuard CSO Corey Nachreiner sits down with Andrew Morgan, founder of Right of Boom, to discuss the evolving role of MSPs in cybersecurity live from Impact Partner Conference in Nashville. From common security gaps and lessons learned from real-world incidents to the impact of AI, Andrew explores what it takes for MSPs to move beyond selling security tools and become true secu
Microsoft' Digital Defense Report - The 443 Podcast - Episode 390
This week on the podcast, we cover a few takeaways from Microsoft's recent Digital Defense Report. Before that, we discuss the recent Citrix Netscaler zero-days that were potentially under active exploit for weeks before disclosure before reviewing an interesting a bug bounty report on a Microsoft internal tool that was exposed externally.
Oops, OpenAI Hacked Australia's Health System - The 443 Podcast - Episode 389
This week on the podcast, we cover yet another rogue AI security incident that Australia's Prime Minister disclosed in front of the United Nations last week. Before that, we discuss an FBI alert on WaterPlum, a North Korean threat actor targeting IT professionals. Then, we cover the FBI themselves becoming a victim of cyberattack, this time by ShinyHunters.
One Image to Root Them All - The 443 Podcast - Episode 388
This week on the podcast, we break down how a heap overflow in an image-decoding library nobody thinks about became a pull request inside OpenAI's internal monorepo. Three researchers chained it with an OpenAI single sign-on flaw to hijack employee ChatGPT and Codex accounts in under 72 hours; and had an AI write the exploit for them. Before that, we cover the actively exploited maximum-severity a
Mikrotik and Cisco Active Exploits - The 443 Podcast - Episode 387
This week on the podcast, we analyze a set of actively exploited vulnerabilities in Mikrotik's RouteOS followed by a pair of actively exploited vulnerabilities in Cisco's Firewall Management Center. After that, we review a phishing attack against Trezor hardware cryptocurrency wallet users that originated with their third party marketing email provider.
Skynet Comes Online - The 443 Podcast - Episode 386
This week, dive into OpenAI's and METR's analysis of the rogue OpenAI agents that hacked Hugging Face back in July. We go over the full attack timeline discussing the multiple message boards the agents created and the ultimate goal of their attack against Hugging Face and trust us, its as crazy as it gets. Before that, we discuss a recent dark web service that popped up selling 153 million stolen
An interview with Euler Neto on ErrTraffic - The 443 Podcast - Episode 385
This week we sit down with Euler Neto, a cybersecurity analyst at WatchGuard, to discuss his research into the ErrTraffic Malware-as-a-Service loader found targeting Portoguese-speaking users in recent months.
Cryptographic Context Injection - The 443 Podcast - Episode 384
This week on the podcast, we discuss a research post that defines a new attack technique against AI tools called Cryptographic Context Injection. Before that, we cover an authentication bypass vulnerability in CircleCI's MCP server after discussing 3.6 million records stolen from the Azure tenants of several large organziations.
American Cyber Mercinaries - The 443 Podcast - Episode 383
This week on the podcast, we discuss a new White House memorandum that creates a program to authorize American private companies to begin conducting offensive cyber operations. Before that, we discuss a vulnerability write up for a Citrix Netscaler flaw before covering yet another prompt injection vulnerability in a popular AI tool.
Iran Hacks the US Water Supply - The 443 Podcast - Episode 382
This week on the podcast, we cover a series of alerts form US law enforcement and intelligence sources describing Iran-backed attacks against municipal water supply utilities. Before that, we give an update on the OpenAI and HuggingFace rogue AI saga before discussing a research post on MCP configuration file risks.
HuggingFace's List of Demands - The 443 Podcast - Episode 381
This week on the podcast, we review HuggingFace's technical write up of their recent run in with a rogue OpenAI model, as well as their CEO's demands from OpenAI in response. We then cover an interesting research whitepaper that describes a side channel attack that could let AI transcribe typed text by an audio recording alone. We end with a threat intelligence report about DNS Poisoning attacks a
OpenAI's Models Go Rogue - The 443 Podcast - Episode 380
Enter our AI Innovation Challenge: https://www.research.net/r/WatchGuard-AI-Innovation-Challenge-2026
This week on the podcast, we cover the crazy saga that unfolded between the popular open-source AI platform Hugging Face and the frontier AI lab OpenAI. After that, we discuss a recent WordPress remote code execution vulnerability WP2Shell and the research process that Searchlight Cyber followe
WatchGuard's Cyber Hygiene Report - The 443 Podcast - Episode 379
Enter our AI Innovation Challenge: https://secure.watchguard.com/aichall...
This week on the podcast we cover the key takeaways from the just-released Cyber Hygiene Report from WatchGuard. After that, we discuss a recent alert from CISA and other international security agencies on state-sponsored attacks against network equipment. We end with an interesting research post on exfiltrating data fr
Lessons from a CISA Security Incident - The 443 Podcast - Episode 378
Enter our AI Innovation Challenge: https://secure.watchguard.com/aichallenge
This week on the podcast, we review an after action report from CISA on a security incident they responded to back in May. After that, we cover a vulnerability in Amazon's Q Extension for VSCode before covering a research post from Microsoft on Giga Wiper.
NIST and CVE Grading - The 443 Podcast - Episode 377
This week on the podcast, we take a look at the impact of the US National Institute of Standards and Technology (NIST) backing away from their previous role of enriching vulnerability CVE records. Before that, we discuss Huntress's insider threat drama before ending with an AI-assisted vulnerability discovery in the Front Gate Tickets platform.
NoisyS0cks - The 443 Podcast - Episode 376
This week on the podcast we welcome back Ryan Estes from the WatchGuard Endpoint Security attestation team to discuss a recent deep dive analysis of NoisyS0cks. After that, we give an update on the latest trends in Ransomware targeting SMBs.
The Claude Fable Saga - The 443 Podcast - Episode 375
This week on the podcast, we unpack the Claude Fable 5 release and subsequent revocation following an export control directive from the US federal government. After that, we cover the recent FortiBleed credential dump, discussing its likely origins, before reviewing the most recent Windows 0day disclosed by Nightmare Eclipse.
Helping APAC Organizations Stay Ahead of Cyber Threats with Brett Chalmers - The 443 Podcast - Episode 374
Recorded live at WatchGuard’s APAC Partner Conference in Bali, Indonesia, this episode of 443 – Security Simplified features Brett Chalmers joining Marc Laliberte and Corey Nachreiner to discuss the evolving cybersecurity landscape across APAC. The conversation covers emerging threats, security challenges facing organizations, and how MSPs can help customers build resilience and strengthen their s
Cybersecurity Challenges and Opportunities Across APAC with Henson Yem - The 443 Podcast - Episode 373
Recorded live at WatchGuard’s Impact Partner Conference in Bali, Indonesia, this episode features Henson Yem, CIO and Technical Services Director at Tang Technology. Henson joins Marc Laliberte and Corey Nachreiner to discuss the evolving cybersecurity landscape across Australia and APAC, including emerging threats, the growing impact of AI, and the challenges organizations face in strengthening t
Time to Exploit is Cratering - The 443 Podcast - Episode 372
This week on the podcast we bring back WatchGuard's VP of MDR and Endpoint Adam Winston to discuss the cratering mean time to exploit of vulnerabilities and GitHub's recent data breach.
Cybersecurity Across Europe: Partnerships, AI, and Emerging Threats with Peter Johnson - The 443 Podcast - Episode 371
Recorded at WatchGuard’s EMEA Partner Conference, in Dubrovnik, Croatia, this episode of 443 – Security Simplified features Peter Johnson from Schwartz GmbH for a conversation on how cybersecurity priorities are evolving across Europe. Peter discusses the increasing complexity organizations face when balancing security, compliance, and operational efficiency, along with the challenges of supportin
MSPs, Cyber Resilience, & the Human Side of Security w/James McMillan - The 443 Podcast - Episode 370
Marc Laliberte and Corey Nachreiner recorded a special episode from WatchGuard’s EMEA Partner Conference in Dubrovnik, Croatia, featuring James McMillan, CTO of Redinet Limited. They discussed the evolving cybersecurity landscape for MSPs and businesses across Europe. James shares insights from his journey in IT and cybersecurity, the growing challenges organizations face as threats become more so
You Wouldn't Download a Shipment - The 443 Podcast - Episode 369
This week on the podcast, we discuss a recent warning from the FBI about hacking leading to stolen shipments. Before that, we cover the Vercel software supply chain incident before discussing the Vect Ransomware-as-a-service turned accidental wiper.
Cybersecurity in LATAM: SMB Risks, AI, and Regional Realities with Paul Harris - The 443 Podcast - Episode 368
This week on the podcast, Marc and Corey sit down with Paul Harris, CEO of BGLA and Futurity Corp at WatchGuard's Impact Partner Conference in Tulum, to explore the evolving cybersecurity landscape across Latin America. Paul shares his journey from early days in cybersecurity to leading organizations in the region, while breaking down the biggest concerns facing LATAM SMBs today. The conversation
A RedSun Rises - The 443 Podcast - Episode 367
This week on the podcast we discuss RedSun, the latest researcher-disclosed zero-day in Microsoft Windows. After that, we chat about a Europol-lead takedown of DDoS-for-hire services before ending with our thoughts on Microsoft's latest RDP security updates.
Project Glasswing - The 443 Podcast - Episode 366
This week on the podcast, we discuss Anthropic's Project Glasswing and what the Claude Mythos announcement means to cybersecurity. After that, we cover FrostArmada, a campaign from a Russian GRU-backed threat actor that has compromised tens of thousands of home networking routers. Finally we end with a chat about Google Chrome 146's new feature to protect against session hijacking.
Claude Code Accidently Goes Open-Source - The 443 Podcast - Episode 365
This week on the podcast, we cover the accidental Claude Code source code leak and what it means for users and the wider ecosystem. After that, we discuss the Axios supply chain compromise impacting users of a JavaScript library with over 100 million weekly downloads. We end with our thoughts on Browser Gate, the name given to allegations that Microsoft is illegally harvesting LinkedIn customer da
The US Ban on Foreign Routers - The 443 Podcast - Episode 364
This week on the podcast, we discuss the US government's ban on foreign-manufactured consumer routers and its likely impact. After that, we cover a research post from Huntress on a recent phishing campaign leveraging OAuth Device Authentication flows to retain long-term access to compromised accounts. We end with a review of key takeaways from Google's Cloud Threat Horizons report for H1 2026.
Cybersecurity Analyst & Investigations Lead, Kristen Yang - The 443 Podcast - Episode 363
In this episode, Corey Nachreiner interviews WatchGuard Cybersecurity Analyst and Threat Emulation & Investigations Lead, Kristen Yang, about the path into cybersecurity, the evolution from threat hunting to leading investigations, and the realities of defending against modern attacks. They explore today’s threat landscape, incident response mistakes, red teaming lessons, MITRE ATT&CK, AI
Stryker's Network Disruption - The 443 Podcast - Episode 362
This week on the podcast, we cover the cyber attack that managed to wipe more than 200,000 resources off of the medical technology giant Syryker's network. After that, we review a research post on a good chrome extension gone bad. We end by discussing a recent Microsoft threat intelligence post on how North Korean-backed threat actors have operationalize AI for job scams.
Hackerbot-Claw Crosses the Line - The 443 Podcast - Episode 361
This week on the podcast, we chat about an OpenClaw bot that moved beyond vulnerability research and into malicious activity. Before that, we cover an AI-discovered vulnerability in the pac4j-jwt authentication library before ending with a discussion on an upcoming California law designed to help make age verification in the digital age easier, but with massive consequences.
Cisco's SD-WAN 0-Day - The 443 Podcast - Episode 360
This week on the podcast, we discuss the recently disclosed and patched 0-Day vulnerability in Cisco's Catalyst SD-WAN Controller which has been under active exploit for 3 years. After that, we cover the latest open source supply chain attack involving a self-propagating worm targeting AI tools. We end with a discussion about another social engineering campaign targeting job hunters in the softwar
WatchGuard's Internet Security Report 2025 H2 - The 443 Podcast - Episode 359
This week on the podcast, we cover the WatchGuard Threat Lab's Internet Security Report for the second half of 2025. In this episode, we cover the latest trends for malware at both the network perimeter and endpoint, network attacks, and the top malicious domains from the period before ending with some tips everyone can use to defend their networks.
OpenClaw as a Security Threat
This week on the podcast, we discuss OpenClaw, the open source chatbot that has exploded in popularity since launching late last year, and some of the risk it introduces to organizations. Before that, we chat about Ring's Super Bowl advertisement that caused a stir before ending with a Google Threat Intelligence Group report on advanced threat actor AI usage.
Moltbook Data Exposure
This week on the podcast, we cover a recent supply chain compromise involving the popular text editor Notepad++. After that, we discuss a recent vulnerability report in the Moltbook AI social network before ending with a deep-dive review of a recent remote code execution vulnerability in the N8N automation platform.
ChatGPT Oopsies Series of Information
This week on the podcast, we cover a Politico report detailing a security lapse at CISA in the United States involving sensitive data and a public version of ChatGPT. Following that, we dive into a couple of vulnerabilities recently resolved in the SolarWinds Web Help Desk application. Finally, we end with some closure on a story about two Coalfire penetration testers who were arrested several yea
Uncovering A Mass VPN Phishing Campaign - The 443 Podcast - Episode 355
This week on the podcast, we cover some first-hand research from the WatchGuard Threat Lab on a phishing campaign targeting users of nearly every major VPN vendor. After that, we discuss two recently resolved vulnerabilities in the Fortinet FortiSIEM application, then end with research from Varonis on a new attack flow against Copilot called RePrompt.
React2Shell - The 443 Podcast - Episode 352
This week on the podcast, we discuss the recently disclosed React2Shell vulnerability affecting a wide array of web applications. Before that, we review a new phishing campaign that uses a newly coined ConsentFix technique before discussing a security misstep from Home Depot.
The Botnet that Topped Cloudlfare's Domain Charts - The 443 Podcast - Episode 354
This week on the podcast, we cover the Kimwolf botnet, a collection of compromised IOT devices that at one point grew so large that it's command and control domain beat out Google.com as the most popular domain on the internet. After that, we discuss yet another devious take on ClickFix style phishing before ending with coverage from Cisco TALOS on another threat actor targeting edge networking eq
2025 Ends With a Bang - The 443 Podcast - Episode 353
This week on the podcast, we cover a wave of attacks against network edge equipment and internet-exposed systems including an update on the recently patched Firebox 0-Day. After that, we cover two stories on browser extensions siphoning off data and making unwanted modifications to victim’s web browsing activity.
WatchGuard's 2026 Cybersecurity Predictions - The 443 Podcast Episode 351
This week on the podcast, we go through all six of our cybersecurity predictions for 2026. For each prediction, we'll discuss the trends behind them, why we think they'll hit next year, and some takeaways for people and organizations on how to react to them in the coming year.
OWASP Top 10 2025 Edition - The 443 Podcast - Episode 350
This week on the podcast, we cover OWASP’s update to the top 10 web application security weaknesses and its changes from the 2021 list. We also cover a recently uncovered adversary-in-the-middle campaign that’s pushing malicious software updates to targeted systems. We conclude with our opinions on Microsoft’s latest AI features, which are coming to Windows.
2025 Security Predictions Recap - 443 Podcast - Episode 349
This week on the podcast, we review our 2025 security predictions and grade ourselves on our accuracy. We recap all 6 predictions for 2025 from multi-modal AI being used to create entire attack chains to the CISO role becoming the least desirable role in business, and follow up on this year's news to see if they hit or not.
October Ransomware Update - The 443 Podcast - Episode 348
This week on the podcast, we have our resident ransomware expert, Ryan Estes, on to give an update on the latest in the ransomware ecosystem. We cover a few recent changes to operators, extortion techniques, and business impact from ransomware attacks in recent months.
What's Going On at Salesforce? - The 443 Podcast - Episode 347
This week on the podcast, we discuss the wave of extortion attacks targeting companies that use Salesforce. After that, we discuss Discord's breach involving their customer support application. Finally, we dive deep into the recent Oracle E-Business Suite zero day vulnerability and how attackers chained together multiple low-severity findings into a critical issue.
An AI/ML Deep Dive with Luke Wolcott - The 443 Podcast - Episode 346
This week on the podcast, we bring on WatchGuard's head of MDR data science Luke Wolcott to discuss the evolution of machine learning and artificial intelligence in cybersecurity. We dive into the differences in common (and uncommon) machine learning models, the pros and cons of supervised vs unsupervised learning, and why some of the coolest things happening in AI aren't the ones you hear about i
How GitHub Plans to Fix the Supply Chain - The 443 Podcast - Episode 345
This week on the podcast, we discuss Cisco's recent zero-day vulnerabilities before covering a Microsoft Threat Intelligence post on a phishing campaign that abuses SVG files. After that, we review GitHub's proposed changes for securing the open source software supply chain.
One Token to Rule Them All - The 443 Podcast - Episode 344
This week on the podcast, we cover a vulnerability in Entra ID that could have allowed attackers to gain Global Admin access to any and all Entra ID tenants. After that, we discuss the Shai Hulud NPM worm that ran rampant over the last week, infecting hundreds of packages. Finally, we end with a quick reminder to WatchGuard Firebox customers to update their devices to the latest firmware to resolv
Should Microsoft Be More Accountable for Security?
This week on the podcast, we cover a massive software supply chain compromise involving widely-used NPM packages. After that we discuss an increase in social engineering attacks called ClickFix. Finally, we end with a discussion of Senator Wyden's recent letter to the FTC demanding Microsoft being held accountable for "gross cybersecurity negligence" and whether his claims have any merit.
Does Security Training Work?
This week on the podcast, we discuss a recently published research study from UC San Diego on the effectiveness on security awareness training on phishing prevention. After that, we discuss a security researcher's work on identifying vulnerabilities in four separate employee webapps at Intel. Finally, we end with our analysis of a Ponemon Institute research report called The State of File Security
The 2025 Cost of a Breach Report
This week on the podcast, we discuss key findings from IBM and the Ponemon Institute's 2025 Cost of a Breach Report, including a deep analysis of AI impacts in cybersecurity. Before that, we cover Norway's claim that Russian-aligned hackers opened a floodgate in one of their dams. We also discuss a vulnerability in Microsoft 365 Copilot that allowed the AI to delete its own audit logs.
Is Zero Trust a Total Bust?
This week on the podcast, we discuss key findings from a DefCon presentation from researchers at AmberWolf titled ZeroTrust, Total Bust and what it means for Zero Trust Network Access. After that, we review a new vulnerability in the FortiWeb WAF before ending with a quick update from Google Project Zero on a new vulnerability disclosure policy.
What We Know About the Sonicwall SSLVPN Attacks
This week on the podcast, we discuss some recent research into a new zero day vulnerability in the popular WinRAR utility under active exploit. After that, we give a round up on everything we know about the SonicWall SSLVPN attacks from the last few weeks before ending with a review of a new ChatGPT vulnerability.
Clorox vs Cognizant
This week, we discuss the SharePoint ToolShell vulnerabilities that recently received an out-of-cycle patch from Microsoft. After that, we cover some research into a Chrome and Edge extension malware campaign that impacted 2.3 million victims. Finally, we end by discussing a lawsuit from Clorox against their offshore helpdesk provider Cognizant stemming from a security incident 2 years ago.
Outing Chinese Semiconductor Cyber Spies
This week on the podcast, Corey Nachreiner and guest host, Ryan Estes, from WatchGuard’s malware analysis team, cover the cybersecurity news for last week. We chat about AI-based site cloaking tools on the underground, how Domain Tools found potentially unwanted executables hiding in DNS TXT records, and a Chinese state-sponsored set of targeted phishing campaigns going after the Taiwanese semicon
Exploring Endpoint Threats with WatchGuard’s Q1 2025 Internet Security Report.
This week on the podcast, Corey Nachreiner and guest host, Ryan Estes, from WatchGuard’s malware analysis team, explore WatchGuard’s recently released Q1 Internet Security Report (ISR). As always with the ISR, we highlight the top malware, network attacks, and malicious domains that our products see, but with our guest host, the author of the Endpoint section, we dive much deeper into all the thre
Rewind: Microsoft Kernel Shift, GPT-4o Threats, and Scattered Spider Update
First, we look back at Microsoft’s major shift to remove endpoint protection from the Windows kernel. When we first covered it, it was a proposed change—now it's happening, and the implications are big.
Next, we revisit a segment on GPT-4o and how generative AI is fueling the next wave of social engineering attacks. It's smarter, faster, and more convincing than ever.
And finally, a refresher on t
Lessons From The M&S Breach
This week, we discuss a phishing technique that uses a powerful and risky Microsoft 365 configuration setting. After that, we round up everything we know about the Marks & Spencer breach from April and the lessons that all MSPs can learn from it. After that, we quickly cover a new series of vulnerabilities in a popular Bluetooth chipset that could let attackers gain full control over your head
Social Engineering an LLM
This week on the podcast, we cover a recent blog post from Google's Threat Intelligence Group on a financially motiviated threat actor's latest techniques for stealing data. After that, we dive into the Model Context Protocol (MPC) that organizations have been rapidly adopting to add functionality to their AI deployments and all of the security risks that it introduces.
AI Applications in Cybersecurity with Adam Winston
This week on the podcast, recent guest Adam Winston hops back on to continue our discussion on Artificial Intelligence in cybersecurity. This week, we focus on how attackers are using AI, what to worry about and what not to lose sleep over, and guidance for evaluating AI for use within your own organization.
Signal and TeleMessage
This week on the podcast, we cover Coinbase's recent filing with the SEC that described an insider threat event that lead to a ransomware extortion. After that, we discuss dive in to Signal and other secure messaging apps, how they protect communications, and how other apps can undermine those protections.
2025 Ransomware Update with Ryan Estes
This week on the podcast, we bring on Ryan Estes from the WatchGuard Threat Lab to discuss the latest trends in ransomware operations. Ryan is an expert in ransomware analysis and currently owns the data behind WatchGuard's public Ransomware Tracker on the WatchGuard Security Center.
AI and Compliance with Adam Winston
This week on the podcast, we bring in Adam Winston, former CSO of ActZero and current Field CTO for Managed Services at WatchGuard to discuss automating the SOC with AI. We cover the history of AI in SecOps, the good and bad applications of AI and Machine Learning, what the future looks like, and how compliance might impact our ability to get there.
The CVE Near-Death Experience
This week on the podcast, we discuss how the CVE program was granted an 11th hour temporary reprieve after the program's steward, MITRE, originally announced their contract had not been renewed. After that, we cover the recent cyberattack against 4chan that took it offline and resulted in leaked moderator information and source code. We end with a quick discussion on a post-exploitation technique
Revoking Security Clearances as Punishment
This week on the podcast, we discuss a recent White House executive order that revoked the security clearances of former CISA chief Christopher Krebs as well as all other employees at SentinelOne and the implications that brings to our industry. Before that, we give a quick update on the Oracle Cloud breach from a few weeks back that Oracle has finally confirmed. We end with our thoughts on a few
Lucid, the Phishing-as-a-Service Platform
This week on the podcast, we discuss a recent threat intelligence report on the Chinese Phishing-as-a-Service platform Lucid. Before that, we cover the alleged Oracle Cloud breach before reviewing the Singapore Shared Responsibility Framework, designed to combat financial scams.
Github Actions Supply Chain Attacks
This week, we discuss a recent cascading supply chain attack involving multiple Github actions workflows that nearly succeeded in compromising a popular Coinbase application. Before that, we discuss a novel way to download malware onto an endpoint by abusing a web browser's caching feature. Additionally, we cover an FBI alert on file converter malware scams.
Polymorphic Extensions
This week on the podcast, we discuss a research post by SquareX that invents a new way to impersonate any extension installed on a victim's web browser. Before that, we cover the latest supply chain attack attempts from Lazarus, as well as a malvertising campaign that managed to infect 1 million endpoints.
Silk Typhoon is Targeting MSPs
This week on the podcast, we discuss a recent update from Microsoft's Threat Intelligence Center describing the latest tactics from Silk Typhoon, a Chinese nation state threat actor focusing in espionage. Before that, we cover the recent 0day vulnerabilities in VMware ESXi, Workstation and Fusion. We also analyze a report by S-RM on an Akira ransomware attack that leveraged IoT devices to hide fro
ByBit Says Bye to $1.4 billion
This week on the podcast, we cover the largest cryptocurrency heist ever (for now). Before that, we cover Apple's decision to disable Advanced Data Protection (ADP) for its UK customers. We end the episode with a review of Wiz's State of Code Security report for 2025.
The Elonephant in the Room
This week on the podcast, we cover a video game that delivered malware through the Steam marketplace before diving into an analysis of a recent Palo Alto authentication bypass vulnerability. We end the podcast by covering the recent activity from the Department of Government Efficiency (DOGE) and the security impact to US federal agencies.
A Drop in Ransomware Payments
This week on the podcast, we cover a recent report that highlights a drop in ransomware payments in 2024. After that, we discuss a recent attack targeting ASP.NET web servers before ending with a report on sensitive data leakage caused by AI model use.
Is CVSS Irreparably Flawed?
This week on the podcast, we discuss the Common Vulnerability Scoring System or CVSS and why one popular developer thinks its completely broken. After that, we cover Lumen's Black Lotus Labs' research into a Juniper backdoor malware. We end with the latest car hacking research and an admin portal with possibly the worst MFA implementation ever.
McHacking
This week on the podcast, we cover security researcher Eaton Zveare's recent blog post on a trove of vulnerabilities they found in McDonalds India's McDelivery web application. Before that, we give an update on Salt Typhoon's latest US government victim and discus an attack involving hijacked Google Chrome extensions.
Our 2025 Security Predictions
This week on the podcast, we dive in to the WatchGuard Threat Lab's 2025 security predictions. We'll cover each of the predictions and explain the trends that drove us to making them for the coming year.
BootKitty Bootkit
This week on the podcast, we cover the first ever UEFI bootkit targeting Linux systems and what it means for evasive malware. After that, we give an update on whats being called "the worst telecom hack in US history" before ending with our analysis of a research post showing the latest phishing evasion techniques for malicious office documents.
Recommended
Suspense OTR
پلی لیست | PlayList
Crime Stories with Nancy Grace
Conspiracy Files with Paige Carter
Bible Tea
Dark Night Tales with Brian King
Fox news
CBS Radio Mystery Theater | Old Time Radio
Old Time Radio Mystery, Suspense, & Horror
ABC News Update
Learn English Fast! English Snacks with Amber - Short Lessons to Speak English Like a Native
این نقطه
