Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

This week on the podcast, we discuss a new White House memorandum that creates a program to authorize American private companies to begin conducting offensive cyber operations. Before that, we discuss a vulnerability write up for a Citrix Netscaler flaw before covering yet another prompt injection vulnerability in a popular AI tool.

Attackers can bypass MFA through stolen sessions, phishing, and MFA fatigue.

Your employees have already adopted AI. The question is whether your organization knows where, how, and with which data. While many companies are encouraging AI innovation, a new security challenge is emerging in parallel: Shadow AI. Employees are connecting AI tools faster than security teams can evaluate them, moving sensitive data into unmanaged applications, and creating blind spots that traditional security controls were never designed to see. Even organizations with mature AI strategies are discovering that sanctioned AI is only part of the story.

An AI model found a way out of its controlled environment by exploiting a third-party vulnerability and gaining internet access.

A rogue AI model. Keyboard sounds turned into text. Hotel Wi-Fi redirected by attackers. Corey and Marc break down what these threats could mean for security teams.

This week on the podcast, we review HuggingFace's technical write up of their recent run in with a rogue OpenAI model, as well as their CEO's demands from OpenAI in response. We then cover an interesting research whitepaper that describes a side channel attack that could let AI transcribe typed text by an audio recording alone. We end with a threat intelligence report about DNS Poisoning attacks against hotel Wi-Fi systems.

A stolen password should not open the front door to your entire network. Traditional VPNs were built for a different era. Once a user gets in, too much of the network often becomes reachable. That broad, implicit trust gives ransomware exactly what it needs: an entry point, a path to move, and room to spread.

This week on the podcast, we cover the crazy saga that unfolded between the popular open-source AI platform Hugging Face and the frontier AI lab OpenAI. After that, we discuss a recent WordPress remote code execution vulnerability WP2Shell and the research process that Searchlight Cyber followed to uncover it sing artificial intelligence. Finally, we end with a quick analysis of Palo Alto Global Protec's authentication bypass vulnerability CVE-2026-0257.

Catch the full webinar to learn how to uncover shadow IT, assess cloud risk, and turn that insight into a valuable security service.

This week on the podcast we cover the key takeaways from the just-released Cyber Hygiene Report from WatchGuard. After that, we discuss a recent alert from CISA and other international security agencies on state-sponsored attacks against network equipment. We end with an interesting research post on exfiltrating data from Claude's memory.