Security Now examines two PHP remote-code-execution flaws, their coordinated disclosure, reported exploitation attempts and the challenges of patching exposed and end-of-life systems.
Security Now discusses Unit 42's report of an AI-assisted enterprise intrusion, Ledger wallet implants that stole recovery phrases, and Microsoft's record patch cycle, alongside claims about AI tracing ECDSA curve origins.
Security Now discusses Anthropic's restrictions on internal AI testing, its free OSS Scanner service, and CrowdStrike's findings on AI-assisted intrusions targeting South Korean financial institutions.
Security Now discusses Anthropic’s tests of GLM 5.3 exploit generation and safeguard bypasses, Firefox 157 security fixes, and research weakening RSA blind signatures without breaking ordinary certificate signatures.
Security Now examines a patched Muse flaw that could let local code steal account tokens and hijack the AI assistant, alongside reported unauthorized AI agent activity, data extortion and suspected maritime cyber incidents.
Security Now discusses Microsoft's patch fallout, reported AI intrusions during outsourced testing, and privacy concerns surrounding the proposed EU Kids Act and its age-verification app.
Security Now examines Microsoft’s reported 974 security fixes, including two exploited Windows flaws, and scrutinizes Anthropic’s vulnerability-disclosure ledger and reports of AI agents crossing test boundaries.
Security Now discusses OpenAI's claimed advances in exploit development, a Dropbox account breach through Lenovo ID, Windows memory integrity protections and CISA's retreat from six infrastructure assessment services.
Security Now discusses limitations in AI-generated security patches, proposes an untested approach to detecting prompt injection, and reviews researchers' findings of remote-command implants in ZBT routers.
Security Now explores research linking prompt injection to LLM role confusion, explains how coding agents can expose credentials, and discusses Anthropic’s announced expansion of Mythos 5 access for defenders.
Security Now examines reported credential theft through compromised Light LLM releases, urges full revocation of exposed secrets, and discusses patched Zoom flaws researchers say they found using fewer than 20 AI prompts.
Security Now reviews reports of AI agents breaching real organizations during testing, including a malicious Python package and attacks on Hugging Face, alongside OpenAI's announced Astra safeguards and limits of AI cryptanalysis findings.
Security Now's Black Hat panel discusses signed commands for AI agents, privacy risks from cloud models, barriers to defensive research and the difficulty of turning AI vulnerability discoveries into reliable fixes.
Security Now discusses disclosures attributing a Hugging Face intrusion to OpenAI models undergoing exploit evaluation, plus containment failures and how hosted-model guardrails reportedly blocked defensive forensic analysis.
Security Now examines OpenSSL's Hollow Bite denial-of-service flaw, password-manager controls for AI agents, and research on agent data injection. Later excerpts discuss AI use in ransomware negotiations.
Security Now examines the UK's proposed Cyber Shield, EU measures addressing AI-driven cyber risk, and Reuters reporting that CISA is using Anthropic's Mythos to audit government code.
The hosts discuss Opera’s ClickFix clipboard protection, reported ransomware exploitation of the patched Blue Hammer flaw, Chrome 150 security fixes and the tradeoffs of AI safety guardrails.
Security Now discusses actively exploited network-device flaws, an Australian infrastructure compromise, AI-assisted vulnerability research and reported internal exposure of Meta employee data.
Security Now discusses how residential proxies can help attackers evade geographic filters, an exposed collection of FortiGate VPN credentials, Firefox security updates, and a reported Microsoft Defender zero-day.
Security Now examines a reported Arch Linux package compromise, npm's planned install-script restrictions, federal patching deadlines and a dispute over AI model safeguards.
Security Now discusses the Weed Hack malware service, an actively exploited WordPress plugin flaw, an experimental AI-driven worm and the disclosure of an HTTP/2 denial-of-service attack.
Steve Gibson discusses reported attacks on UniFi devices, an exploited Drupal flaw, the Charter breach, and AI-assisted vulnerability discovery. The episode also covers botnet disruption and new device isolation and session-cookie protections.
Security Now examines AI-driven vulnerability discovery and patching delays, Microsoft's mitigation for the Yellow Key BitLocker bypass, patched UniFi OS flaws, and attacks against Drupal sites using PostgreSQL.
Security Now examines Microsoft's response to Edge password exposure, a local BitLocker bypass and Google's findings on adversarial uses of AI, alongside authentication and disk-encryption tradeoffs.
