Risky Business Podcast
October 28, 2026
Risky Business #857 -- AI FUD intensifies
Presented by
Technology Editor
CEO and Publisher
On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Alex Stamos to talk through the week’s cybersecurity news, including:
- Everyone’s still panicking about “misbehaving” AI models that are pretty much just doing what they’re being told to do
- Americans are giving AI agents unfettered access to their bank accounts. What could go wrong?
- Last week’s PHP meteor seems to have missed Earth
- This week’s Brotli HTTP/2 critical flaw is this week’s meteor
- The private key is always 4. This time it’s TLS bugs in GoAhead
- Much, much more!
This week’s show is brought to you by Truffle Security. Co-founder and CEO Dylan Ayrey joins James Wilson to chat about scanning GitHub repos and finding more than half a million unique credentials that were never revoked. As Dylan explains, the problem of exposed keys exists everywhere and is only getting worse.
This episode is also available on YouTube
Brought to you by Truffle Security
TruffleHog uncovers exposed secrets, making it easier for security teams to prioritise risk and remediate faster
Show notes
OpenAI AI agents demonstrate VM escapes and secret cross-sandbox communication
OpenAi agents disabled safety monitoring, one lied about it
solst/ICE of Astarte (@IceSolst) on X
What I learned from cheating clankers
Unvetted AI agents are accessing US bank accounts
Hiding Capabilities in AI Models
AI is finding bugs faster. Let the market find the fixes
AI Guardrails Aren’t Stopping Criminal Hackers
Andromeda October 2026 Security Incident
Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack
Hackers got a four-day head start on the PHP2Shell vulnerabilities
Critical HTTP2Shell flaw in Brotli triggers emergency patches
Senators say targeted ads are a security risk. Ad groups say the critics are off base
Alleged Israeli spy company heavily targeted Starlink users, sources say
LiteLLM release pipeline hacked to distribute info-stealer malware
CISA warns attackers are chaining Plex flaws in active Plex2Shell attacks
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Chrome adds Gemini-powered scam detection and ClickFix warnings
Microsoft Teams is getting context-aware phishing detection
China-nexus actor linked to attack on ConnectWise cloud backup
University of New Mexico hospital diverts ambulances after cyberattack
solst/ICE of Astarte (@IceSolst) on X
GitHub Repos Exposed 543,699 Credentials. Nobody Revoked Them