Risky Business Podcast
October 21, 2026
Risky Business #856 -- 8-bit encryption, PHP megabugs and more
Presented by
Technology Editor
CEO and Publisher
On this week’s show Patrick Gray and James Wilson are joined by special guest co-host security engineer Mark El-Khoury to talk through the week’s cybersecurity news, including:
- The PHP foundation is about to release patches for a couple of critical bugs… We’re watching to see if the internet burns down
- 8 private keys underpinning some CA certs got compromised. The keys only had 8 bits of entropy!
- Is the breach-polcalypse upon us?
- OpenAI’s inside spy, Anthropic’s safety bill and election influence campaigns are coming for your chatbots
- Ukraine drone strikes hit more Russian data centres, this time VK’s in the firing line
- Much, much more!
This week’s show is brought to you by Trail of Bits. Principal Security Engineer Anish Naik joins James Wilson to chat about two agent skills plugins, Patching Bugs and Regression Hunt, that the company is releasing off the back of its joint initiative with Open AI, Patch the Planet.
This episode is also available on YouTube
Brought to you by Trail of Bits
We don't just fix bugs, we fix software
Show notes
The PHP Foundation (@ThePHPF) on X
The Internet goes on high alert after discovery of 8 compromised TLS certs
OpenCode breach exposes users' external AI-provider API keys
DHS to ban DeepSeek from federal civilian agencies
OpenAI engineer accused of spying on executives remains in custody
An OpenAI Employee Allegedly Used a Chatbot to Help Plant a Recording Device at the Office
Anthropic quietly pitches its own AI safety bill to lawmakers
The next election influence campaign will target your AI chatbot
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
Thousands of refrigerator devices remain exposed following French cyberattack
AI agents navigated unfamiliar OT systems and moved equipment within minutes
Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem
Feds crack down on North Korean IT-worker schemes with new raids, charges and arrests
Federal bankruptcy courts dealing with outages after contractor cyberattack
Russian social media giant VK faces disruptions after data center drone strike
Data Centers Are War Targets Now
How a Massive Chinese Crime Ring Hacked Staples to Steal Millions
Microsoft Patches More Than 1,400 Security Flaws
GitHub expands malware advisories across eight package ecosystems
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
AdFection: How mercenary spyware invades victims’ devices through targeted advertising
CISA warns of new Ivanti bug being exploited as latest Patch Tuesday breaks records
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
Drupal patches critical RCE flaws and warns exploits may emerge soon
Palo Alto Networks patches PAN-OS zero-day exploited for root-level code execution
Eight US states sue OpenAI over alleged harms to users
Cyberattack halts work on the Denmark–Germany Fehmarnbelt tunnel
Ransomware groups expand targeting of Palo Alto Networks vulnerability
DHS Said They Searched Man Who Wiped GrapheneOS Phone for Child Abuse Material. They Lied