Videos

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host security engineer Mark El-Khoury to talk through the week’s cybersecurity news, including:

• The PHP foundation is about to release patches for a couple of critical bugs… We’re watching to see if the internet burns down
• 8 private keys underpinning some CA certs got compromised. The keys only had 8 bits of entropy!
• Is the breach-polcalypse upon us?
• OpenAI’s inside spy, Anthropic’s safety bill and election influence campaigns are coming for your chatbots
• Ukraine drone strikes hit more Russian data centres, this time VK’s in the firing line…

In this edition of Between Two Nerds Tom Uren and The Grugq discuss whether the rise of AI coding will result in more or less bugs and ultimately make software more secure.

Tom Uren and Amberleigh Jack talk about Russian targeting of Ukrainian data centres. That’s not good, but it looks like Russia is very poorly prepared for Ukraine’s retaliatory strikes. Karma!

They also discuss how open-weight models are getting good at cyber tasks while safeguards are easily bypassed. There is no chance of international regulation that will rein in these models, so it is time to loosen cyber safety restrictions on American frontier models.

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Brad Arkin to talk through the week’s cybersecurity news, including:

• Sacré bleu! Hackers turn up the heat at French supermarket freezers
• ShinyHunters enters “find out” stage
• Netscaler, Zimbra, SharePoint, Atlassian…. So many bugs exploited in the wild
• More models “behave badly” (by… doing exactly what we’re telling them to do)
• Ukraine hit another Yandex data centre in Russia and all those Texan patriots with numbers in their usernames have gone super quiet
• Much, much more…

This week’s show is brought to you by Corelight. Co-founder and Chief Strategy Officer Gregory Bell joins James Wilson to chat about the company’s new white paper that looks into whether a sophisticated model or nicely structured data is more important with automated SOC work….

In this edition of Between Two Nerds Tom Uren and The Grugq examine how ShinyHunters and the FBI both deceived themselves into believing they were immune to cyber threats.

Amberleigh Jack and James Wilson chat about OpenAI agents’ recent escapades into Australian government websites. OpenAI has promised to “rebuild trust with Australians” but we’re likely getting a glimpse into the new normal, here.

They also discuss how the ShinyHunters hacking group has found itself on law enforcement’s target list after breaching FBI systems. The group played some stupid games and they appear to be in the “stupid prizes” stage.

In this sponsored Soap Box edition of the Risky Business podcast Patrick Gray chats with industry legend HD Moore about how his company runZero wound up being used heavily to discover OT devices in enterprise networks.

They also talk about the vulnpocalypse and how frontier lab fearmongering is reminiscent of the collective freakout when HD released the Metasploit exploit framework back in 2003.

In this edition of Between Two Nerds Tom Uren and The Grugq talk about the rise of fully automated LLM-driven hacking campaigns among criminals and even state hacking groups. For those with the right risk appetite, a move fast and break things hacking approach using AI can pay off.

Tom Uren and Patrick Gray talk about US Treasury Secretary Scott Bessent ruling out liability exemptions for AI companies. Its a good move. Leaving the companies on the hook keeps the pressure on them to do better with their cyber security and testing controls.

They also discuss a Russian AI-powered cyberespionage campaign run by a group known as Midnight Blizzard. It used AI workflows to run the entire campaign so they got a lot more hacking done and accepted AI mistakes. This makes sense given that they want more intelligence from Ukrainian targets and don’t care at all about getting caught.

THE RISKY BUSINESS WEEKLY SHOW IS NOW ON HIATUS FOR TWO WEEKS AND WILL RETURN OCTOBER 14

On this week’s show Patrick Gray and James Wilson are joined by Adam Boileau to talk through the week’s news, including:

• Google’s Gemini finally did some crimes
• OpenAI admits more agents did silly things because “alignment”
• US Treasury’s Scott Bessent rules out a liability waiver for the frontier labs, saying, roughly: “Lol. Lmao even.”
• Jev is Silicon Valley’s “hot dog/not hotdog” app brought to life, and it will really improve security tooling
• The FBI and Coast Guard boarded oil tankers after they were allegedly hacked…