On this week’s show Patrick Gray is on holiday so Amberleigh Jack and Adam Boileau hijack the studio to discuss the week’s cybersecurity news, including:

• Hackers learn that trying to coerce a journalist just makes for … a great story?
• A man in his 40s gets arrested over the European airport chaos. Yep, we’re surprised, too.
• Adam fanboys over Watchtowr Labs while bemoaning Fortra.
• Academics pick apart Tile trackers and find them lacking
• CISA tells agencies to patch their damn Cisco gear

This episode is also available on YouTube.

• 'You'll never need to work again': Criminals offer reporter money to hack BBC
• Government to guarantee £1.5bn Jaguar Land Rover loan after cyber shutdown
• Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms – Krebs on Security
• UK authorities arrest man in connection with cyberattack against aviation vendor | Cybersecurity Dive
• Chinese scammer pleads guilty after UK seizes nearly $7 billion in bitcoin
• Cyberattack on Japanese beer giant Asahi limits shipping, call center operations | The Record from Recorded Future News
• Afghanistan plunged into nationwide internet blackout, disrupting air travel, medical care | The Record from Recorded Future News
• Tile trackers are a stalker's dream, say Georgia Tech researchers
• Intel and AMD trusted enclaves, the backbone of network security, fall to physical attacks - Ars Technica
• Supermicro server motherboards can be infected with unremovable malware - Ars Technica
• China-linked hackers use ‘BRICKSTORM’ backdoor to steal IP | The Record from Recorded Future News
• Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors
• Federal agencies given one day to patch exploited Cisco firewall bugs | The Record from Recorded Future News
• Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability
• Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035)
• It Is Bad (Exploitation of Fortra GoAnywhere MFT CVE-2025-10035) - Part 2

On this week’s show Patrick Gray and special guest Rob Joyce discuss the week’s cybersecurity news, including:

• Secret Service raids a SIM farm in New York
• MI6 launches a dark web portal
• Are the 2023 Scattered Spider kids finally getting their comeuppance?
• Production halt continues for Jaguar Land Rover
• GitHub tightens its security after Shai-Hulud worm

This week’s episode is sponsored by Sublime Security. In this week’s sponsor interview, Sublime founder and CEO Josh Kamdjou joins host Patrick Gray to chat about the pros and cons of using agentic AI in an email security platform.

This episode is also available on YouTube

• U.S. Secret Service disrupts telecom network that threatened NYC during U.N. General Assembly
• MI6 launches darkweb portal to recruit foreign spies | The Record from Recorded Future News
• One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens | dirkjanm.io
• Github npm changes
• Flights across Europe delayed after cyberattack targets third-party vendor | Cybersecurity Dive
• Major European airports work to restore services after cyberattack on check-in systems | The Record from Recorded Future News
• When “Goodbye” isn’t the end: Scattered LAPSUS$ Hunters hack on | DataBreaches.Net
• UK arrests 2 more alleged Scattered Spider hackers over London transit system breach | Cybersecurity Dive
• Alleged Scattered Spider member turns self in to Las Vegas police | The Record from Recorded Future News
• Las Vegas police arrest minor accused of high-profile 2023 casino attacks | CyberScoop
• DOJ: Scattered Spider took $115 million in ransoms, breached a US court system | The Record from Recorded Future News
• vx-underground on X: "Scattered Spider ransoms company for 964BTC - wtf_thats_alot.jpeg - Document says "Cost of BTC at time was $36M" - $36M / 964BTC = $37.5K - BTC value was $37.5K in November, 2023 - Google "Ransomware, November, 2023" - omfg.exe https://t.co/uv2EzbL5HT" | X
• JLR ‘cyber shockwave ripping through UK industry’ as supplier share price plummets by 55% | The Record from Recorded Future News
• Jaguar Land Rover to extend production pause into October following cyberattack | Cybersecurity Dive
• New plan would give Congress another 18 months to revisit Section 702 surveillance powers | The Record from Recorded Future News
• AI-powered vulnerability detection will make things worse, not better, former US cyber official warns | Cybersecurity Dive

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• Shai-Hulud worm propagates via npm and steals credentials
• Jaguar Land Rover attack may put smaller suppliers out of business
• Leaked data emerges from the vendor behind the Great Firewall of China
• Vastaamo hacker walks free while appeal is underway
• Why is a senator so mad about Kerberos?

This week’s episode is sponsored by Knocknoc. Chief exec Adam Pointon joins to talk through the surprising number of customers that are using Knocknoc’s identity-to-firewall glue to protect internal services and networks.

This week’s episode is also available on Youtube.

• Self-Replicating Worm Hits 180+ Software Packages – Krebs on Security
• Jaguar Land Rover: Some suppliers 'face bankruptcy' due to hack crisis
• Jaguar Land Rover production shutdown could last until November
• U.S. Investors, Trump Close In on TikTok Deal With China - WSJ
• U.S. Investors, Trump Close In on TikTok Deal With China - WSJ
• How China’s Propaganda and Surveillance Systems Really Operate | WIRED
• Mythical Beasts: Diving into the depths of the global spyware market - Atlantic Council
• Hacker convicted of extorting 20,000 psychotherapy victims walks free during appeal | The Record from Recorded Future News
• US national charged in Finnish psychotherapy center extortion | The Record from Recorded Future News
• BreachForums administrator given three-year prison stint after resentencing | The Record from Recorded Future News
• Microsoft, Cloudflare disrupt RaccoonO365 credential stealing tool run by Nigerian national | The Record from Recorded Future News
• Senator blasts Microsoft for making default Windows vulnerable to “Kerberoasting” - Ars Technica
• Exclusive: US warns hidden radios may be embedded in solar-powered highway infrastructure | Reuters
• Israel announces seizure of $1.5M from crypto wallets tied to Iran | TechCrunch

In this sponsored Soap Box edition of the Risky Business podcast, industry legend HD Moore joins the show to talk about runZero’s major push into vulnerability management.

With its new Nuclei integration, runZero is now able to get a very accurate picture of what’s vulnerable in your environment, without spraying highly privileged credentials at attackers on your network.

It can also integrate with your EDR platform, and other data sources, to give you powerful visibility into the true state of things on your network and in your cloud.

This episode is also available on Youtube.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• Apple ruins exploit developers’ week with fresh memory corruption mitigations
• Feross Aboukhadijeh drops by to talk about the big, dumb npm supply chain attack
• Salesloft says its GitHub was the initial entry point for its compromise
• Sitecore says people should “patch” its using-the-keymat-from-the-documentation “zero day”
• Rogue certs for 1.1.1.1 appear to be just (stupid) testing
• Jaguar Land Rover ransomware attackers are courting trouble

This week’s episode is sponsored by open source cloud security tool, Prowler. Founder Toni de la Fuente joins to discuss their new support for Microsoft 365. Time to point Prowler at your OneDrive and Sharepoint!

This episode is also available on Youtube.

• Blog - Memory Integrity Enforcement: A complete vision for memory safety in Apple devices - Apple Security Research
• Venezuela's president thinks American spies can't hack Huawei phones | TechCrunch
• 18 Popular Code Packages Hacked, Rigged to Steal Crypto – Krebs on Security
• Software packages with more than 2 billion weekly downloads hit in supply-chain attack - Ars Technica
• Salesloft platform integration restored after probe reveals monthslong GitHub account compromise | Cybersecurity Dive
• CISA orders federal agencies to patch Sitecore zero-day following hacking reports | The Record from Recorded Future News
• SAP warns of high-severity vulnerabilities in multiple products - Ars Technica
• The number of mis-issued 1.1.1.1 certificates grows. Here’s the latest. - Ars Technica
• Cyberattack on Jaguar Land Rover threatens to hit British economic growth | The Record from Recorded Future News
• Cyberattack forces Jaguar Land Rover to tell staff to stay at home | The Record from Recorded Future News
• Bridgestone Americas continues probe as it looks to restore operations | Cybersecurity Dive
• Qantas penalizes executives for July cyberattack | The Record from Recorded Future News
• Cyber Command, NSA to remain under single leader as officials shelve plan to end 'dual hat' | The Record from Recorded Future News
• GOP Cries Censorship Over Spam Filters That Work – Krebs on Security
• Risky Bulletin: APT report? No, just a phishing test! - Risky Business Media
• Post by @patrick.risky.biz — Bluesky

In this edition of the Snake Oilers podcasts, three vendors pop in to pitch you all on their wares:

• Automated, AI-powered threat hunting with Nebulock

Damien Lewke from Nebulock joins the show to talk about how its agentic AI platform can surface attacker activity out of all those “low” and “informational” findings your detection team doesn’t have time to look at.

• Runtime security for hypervisors from Vali Cyber

Austin Gadient from Vali Cyber stops by to talk about ZeroLock, its hypervisor security product. It’s marketed as a counter-ransomware control but is just a generally useful security platform for virtualised environments.

• A secure mobile telco: Cape

The only thing American cell providers love more than providing patchy coverage is getting their customers’ data owned. Cape is here to change that. It’s a security and anonymity-focussed virtual mobile network operator (MVNO) that’s been spun up by a highly competent team. If we lived in the USA we would be customers, and a bunch of CISOs listening to this might want to consider Cape subscriptions for their workforce.

This episode is also available on Youtube

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• The Salesloft breach and why OAuth soup is a problem
• The Salt Typhoon telco hackers turn out to be Chinese private sector, but state-directed
• Google says it will stand up a “disruption unit”
• Microsoft writes up a ransomware gang that’s all-in on the cloud future
• Aussie firm hot-mics its work-from-home employees’ laptops
• Youtube scam baiters help the feds take down a fraud ring

This episode is sponsored by Dropzone.AI. Founder and CEO Edward Wu joins the show to talk about how AI driven SOC tools can help smaller organisations claw their way above the “security poverty line”. A dedicated monitoring team, threat hunting and alert triage, in a company that only has a couple of part time infosec people? Yes please!

This episode is also available on Youtube.

• The Ongoing Fallout from a Breach at AI Chatbot Maker Salesloft – Krebs on Security
• Salesloft: The Leading AI Revenue Orchestration Platform
• Palo Alto Networks, Zscaler customers impacted by supply chain attacks | Cybersecurity Dive
• The impact of the Salesloft Drift breach on Cloudflare and our customers
• China used three private companies to hack global telecoms, U.S. says
• CSA_COUNTERING_CHINA_STATE_ACTORS_COMPROMISE_OF_NETWORKS.PDF
• Google previews cyber ‘disruption unit’ as U.S. government, industry weigh going heavier on offense | CyberScoop
• Ransomware gang takedowns causing explosion of new, smaller groups | The Record from Recorded Future News
• Hundreds of Swedish municipalities impacted by suspected ransomware attack on IT supplier | The Record from Recorded Future News
• Storm-0501’s evolving techniques lead to cloud-based ransomware | Microsoft Security Blog
• The Era of AI-Generated Ransomware Has Arrived | WIRED
• Between Two Nerds: How threat actors are using AI to run wild - YouTube
• Affiliates Flock to ‘Soulless’ Scam Gambling Machine – Krebs on Security
• UK sought broad access to Apple customers’ data, court filing suggests
• ICE reactivates contract with spyware maker Paragon | TechCrunch
• WhatsApp fixes 'zero-click' bug used to hack Apple users with spyware | TechCrunch
• Safetrac turned staff laptops into covert recording devices to monitor WFH
• Risky Bulletin: YouTubers unmask and help dismantle giant Chinese scam ring - Risky Business Media