Videos

In this edition of Between Two Nerds Tom Uren and The Grugq talk about why PHP2Shell failed to live up to its hype. A critical bug in a very widely used web scripting language amounted to… not much. The pair dissect the reasons why.

Tom Uren and Amberleigh Jack talk about North Korea’s hack of the Binance cryptocurrency exchange. Binance’s founder CZ says it is a wake up call for real banks, but he’s wrong. Even though they are probably just as hackable as crypto exchanges, real banks cooperate to reverse fraudulent transactions and it is far harder to get away with billions.

They also discuss the pressure being felt in tech firms everywhere to speed up software development using AI. From a security perspective, results will be mixed.

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Ciaran Martin, former CEO of the UK’s National Cyber Security Centre (NCSC), to talk through the week’s cybersecurity news, including:

• The $6.3 billion dollar Binance hack turned out to be pretty clunky, but it ain’t dumb if it works we guess
• Meanwhile Brazil’s Mercado Bitcoin loses “millions”. Cute!
• A bit late to make the Word of the Year shortlist, but Google’s coined a new term with “LLMjacking”
• An infosec guy’s clankers hacked another infosec guy, everyone’s arguing about it, it’s funny
• Much, much more!…

In this edition of the Risky Business Features podcast, Patrick Gray and The Grugq chat to Nazar Tymoshyk about Russia’s use of AI in recent state-back cyberattacks against Ukraine.

Nazar is the founder and CEO of Ukraine-based cybersecurity firm UnderDefence. He also spent the first few years of the war working for Ukraine’s CERT.

The three discuss the speed and impact of these automated attacks and how organisations can best prepare themselves against AI-scaled attacks.

You can subscribe to the Risky Business Features podcast channel by searching for “Risky Business Features” in your podcatcher.

In this edition of Between Two Nerds Tom Uren and The Grugq discuss CISO’s expectations and priorities regarding budgets and what they will spend their money on. AI features heavily in 2027 priorities, but what will it deliver?

In this edition of the Snake Oilers podcast, three vendors drop by to pitch their products.

• Minimal.dev (https://minimal.dev/)::) A sandbox for AI agents! Co-Founder and CEO Jake King explains what the company is and how it works.

• Request Rocket (https://requestrocket.com/)::) Runtime access control for AI agents and APIs. Founder and CTO Alex Ferguson drops by to talk about the problem the company is trying to solve.

• TRM Labs (https://www.trmlabs.com/)::) All-source threat intelligence. Global Strategic Accounts Director Simon Warren talks about the company’s platform Ardence.

Tom Uren and Amberleigh Jack talk about new research that shows that Chinese open-weight AI models can be reeducated to remove pro-CCP bias. Good news for American businesses that want cheap AI, but we suspect that many knives will still be out for Chinese open-weight models.

They also discuss the near-misses from the PHP and Brotli bugs. We collectively dodged the bullet so that we only got grazed, but the good luck won’t last forever.

Finally, Tom looked at CISA’s 2030 strategy. Amazingly, it doesn’t really mention AI at all. Bizarre!

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Alex Stamos to talk through the week’s cybersecurity news, including:

• Everyone’s still panicking about “misbehaving” AI models that are pretty much just doing what they’re being told to do
• Americans are giving AI agents unfettered access to their bank accounts. What could go wrong?
• Last week’s PHP meteor seems to have missed Earth
• This week’s Brotli HTTP/2 critical flaw is this week’s meteor
• The private key is always 4. This time it’s TLS bugs in GoAhead
• Much, much more!

This week’s show is brought to you by Truffle Security. Co-founder and CEO Dylan Ayrey joins James Wilson to chat about scanning GitHub repos and finding more than half a million unique credentials that were never revoked. As Dylan explains, the problem of exposed keys exists everywhere and is only getting worse….

In this edition of Between Two Nerds Tom Uren and The Grugq talk about security culture. The PHP foundation seems to have had a change of heart about security, but what are the chances that OpenAI or other frontier AI labs will start to take it seriously?

Tom Uren and Amberleigh Jack talk about the weird bugging incident at OpenAI. It doesn’t look at all like it was normal state-backed espionage, but there are still  good reasons  the frontier labs should ensure that their crown jewels are safe.

They also discuss how cybercriminals are rapidly evolving their use of AI. The technology and harnesses available are getting better and the criminals are also discovering business models where they can sit back while AI automates most of the work.