Paul's Security Weekly (Audio)

In the security news this week:
Cursor opens your repo, the repo opens you
If you want the good model I'm going to need to see your ID
Flock's a Flocking mess
Defender was supposed to be the chosen one
Side stepping Secure boot - twice
SonicWall: a LAMP stack in a fancy case
Macs don't get viruses, part infinity
Flipper One, but why not Nix?
NetScaler is back in the room
Borrowing phone's good reputation
USB and how to make Windows download stuff
A KVM with the expensive letters removed
Five steps to stop the webcam creeps
PlexTrac acquired
NIST asks the internet to fix the NVD
Poland's health software has a very bad week
If Apple pings you about spyware, believe it
A macOS stealer that drives your browser for you
T-Mobile's incident response tool of choice may suprise you, or not...
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-940

In the security news this week:
North Carolina ports and contingency plans
Back to paper and pencils
Midnight Blizzard compromises hotel Wi-Fi
DNS strikes again
Captive portals, stolen credentials, and nation-state scale
Phishing-resistant MFA
Goodbye SMS and voice authentication
Cornflake RAT and Chaco Shell
The NPM worm
Hundreds of compromised packages
AI lowers the barrier to mass exploitation
Rethinking "secure enough"
Back to basics: know what's on your network
Get off my PCI lawn
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-939

This week:
When you are not at summer camp you can't read about it
The Fettle continues
Using the CFAA against AI
Social contracts are not security models
VSCode extentions, again
Bugtraq is back!
NVIDA, LVFS, and unraveling AI infrastructure
More routers that come with backdoors
Do we care about LPE?
Even more AI that finds vulnerabilities
When AI breaks its own guardtails
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-938

In the security news:
2.2 million cars, one shared Bluetooth key
JFrog tries to spin an AI 0-day into a win
Sextortion scammers recycling ShinyHunters' leaks
The first hack ever, from 1966
Prompt injection as a service, $150 a month
Cisco's mystery "static credential"
BMCs still on the internet, still handing out hashes
Scattered Spider duo sentenced over the TfL hack
Air-gapped data sneaking out over the video cable
A ghost in the network
DNS poisoning checks into hotel WiFi
Microsoft's cut-rate cybersecurity AI
Learning to trust USB drives again
Agentic pentesting shows up just in time for Black Hat
Microsoft rethinks security for the AI age, again
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-937

In the news this week:
InfraTrust and knowing what to patch
Adversary in the middle triggered command injection
Exploitarium again
FreeRDP comes with free vulnerabilities
AI breaking out of sandboxes on its own
Wordpress RCE
DMA dangers
Nightmware eclypse is at it again
Fortisandbox
Turning AI to the dark side
more prompt injection
Secure boot is broken, still and again...
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-936