Paul's Security Weekly (Audio)

Paul Asadoorian

For the latest in computer security news, hacking, and research! We sit around, drink beer, and talk security. Our show will feature technical segments that show you how to use the latest tools and techniques. Special guests appear on the show to enlighten us and change your perspective on information security. Note: This is only Paul's Security Weekly, a 2-hour show recorded once per week.

Play

Open in

33 episodes
weekly
Avg 2 hr 4 min
English

Episodes 33

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

Yesterday · 2 hr 2 min
Holes In Everything, Even SSH - PSW #952
In the security news this week: SSH in Shambles Santa steals your podcast setup SAP's double feature Terminal2Shell is CVSS 11 Dormant neurons, active backdoor Patched, but still exploitable 948 paths to root Barracuda serves root Node-RED, now with shell access The secret cigar recipe FBI agent, crypto thief Another AI agent identity mess 7.7 million reasons to care Reddit asks the breach question Who's accountable when AI breaks? Espionage, chips, geopolitics Don't ask again, leak forever AI catches cheating, flags everyone 1.4 million keys need revocation RSA, now with a countdown Fingerprint security, SD card reality Proving Signal's machine code Thirty zero-days, one offline switch Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-952
November 5 · 2 hr 4 min
"That's Not Supposed to Happen" - PSW #951
In the security news: Supermarket refrigeration attacks, again! Rapid7's Ivanti findings and why we can't have "nice" things Google's massive Android TV botnet takedown Linux TCP kernel flaw that no one is patching The Binance theft APT flaw gives out root PHP security debt The porn and Digital billboard problem Your own phone system to pwn From PoC to weaponized exploit Hacking to change time Rooting an Echo Dot Firmware should just work AI chained bugs into working exploits USB power states leak data across an air gap AI-assisted vulnerability finding GoAhead's TLS handling Hackers hijack emergency alert apps Taiwan's emergency services become an AI-agent target CUI exposed through GSA's Google Drive GCHQ can't account for thousands of storage devices Railway employee blames an attempted intrusion on AI VulnCheck opens its initial-access playground to the public Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-951
October 29 · 2 hr 8 min
Vulnpocalypse Continues Until Defense Improves - PSW #950
In the security news this week: In the security news this week: Cisco says patch faster, then sells you time Turning AI refusals into vulnerability signals Brotli's are hiding WordPress image upload exploit Fortinet ships fixes before details PHP2Shell still claiming victims, including firewalls Uncoordinated disclosure Claude finds vulns, go figure PXE strikes again! Sony's PS5 bounty drama Apple's October patches reach older devices CISA looks ahead to 2030 ArubaOS gets a pile of critical fixes New UK rules for protecting undersea infrastructure PortaPack Mayhem goes mobile Can AI agents police other AI agents? DHS bans DeepSeek A Chinese model writes riskier code for a US contractor eMudhra exits the TLS business BlackX bootkit exploits Secure Boot Signal makes hanging up harder than it should be Is AI solving math, or making it harder to trust? Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-950
October 22 · 2 hr 9 min
PHP2Hell - Joshua Wright - PSW #949
Special guest Joshua Wright joins us for a timely incident-response discussion! Then, in the security news this week: Have you heard about PHP2Shell? Certificates with keys small enough to guess Tor exit nodes turn into SSH credential traps Do USB-C cables need firmware updates now? HaleHound packs a radio lab into a cheap display Claude solves part of the NIST curve mystery The Army and self-directed offensive cyber agents Retired nuclear reactors return to power AI PatchSlop NGINX, NODE.js patches critical flaws BeyondTrust exploited before the patch landed Plex vulnerabilities move from PoC to exploitation ICS patches, including a Siemens flaw exploited in the wild Can fake data trigger Japan's emergency alert? Agentic pentests? AI may add noise more than skill AI agents navigate OT and move equipment AI model helps build a Chrome exploit Utah's VPN law runs into technical reality Segment Resources: https://dynamicincidentresponse.com/ - A New Era for Incident Response! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-949
October 15 · 2 hr
AI Takes Over? - Danny Akacki - PSW #948
In the security news this week: Convert this router into an SDR Ivanti straight to root Anthropic's AI worm FUD A kernel exploit to fix downloads Supermarket refrigeration attacks 400 mystery Java vulnerabilities Authentication bypass Russia meets the data-center war Stop & Shop attacked Anthropic cuts eval agents AI incident reporting FortiBleed lives Anthropic offers scanning Pre-compromised phones FakeGit returns Teams deepfake detection Let's Encrypt certificates get shorter GitLab ships another critical patch Engineer gets prison time for locking thousands of devices OpenAI employee accused of planting a hidden recorder Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-948
October 8 · 2 hr 1 min
Routers on Trial, AI Found More Bugs - PSW #947
In the security news this week: BPFDoor OpenSSH compresses a little too much AI can find bugs. Who gets them fixed? TP-Link and the courts Cisco NX-API ClingSTUN LineageOS, Android TV, and a Raspberry PI Dell's updater has a privilege problem SonicWall SSRF U-Boot's LogoFAIL like Exploit-DB isn't dead MFA passes. The attacker still gets in. LakeShark and cool gadgets Kasa cameras and an exposed debug interface SharePoint hardening is back on the checklist Google pauses open-source bug bounty submissions NetScaler's latest vulnerability needs a closer look Kiteworks tells customers to shut it down Exchange gets an unexpected security update Do LLMs actually reason? disagree on AI risk? Anthropic, AI consciousness and the Vatican Grok gets involved in foreign policy WordPress malware that survives cleanup Can spyware vendors stop their own tools? When an AI chatbot conversation reaches the police Open-weight AI models enter the cyber debate AI agents take their attacks shopping Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-947
October 1 · 2 hr 1 min
Hacking Without Boundaries - Michael Jenkins - PSW #946
First up we talk with Threatlocker CTO Michael Jenkins about threat actors use of AI and keeping the bad things out with Zero Trust. Then in the security news: Compiling spreadsheets, because that's why Nvidia wants to put AI agents in timeout Citrix NetScaler gets exploited again, and again Spectre still refuses to die Your SBOM is incomplete? File notifications leak more than filenames ENIAC had cables instead of a BIOS Another Linux kernel root exploit lands Containers share a kernel ThinkNode M9 microSD card gets a virus notice Google analyst infiltrates a supply-chain gang Your phone speaker can transmit radio Reconstructing firmware with a logic analyzer Robot dogs learn cybersecurity CISA warns about third-party ICS integrators Dutch police arrest a ShinyHunters suspect A soldier goes from telecom hacking to prison AI companies discover their agents have opinions Cloudflare containers accidentally share leftovers OT networks are still mostly not isolated Florida wants to pause ChatGPT The interview segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-946
September 24 · 2 hr 3 min
AI Will Save Us, or Not? - PSW #945
In the security news this week: Build your own router, or just buy one What to patch first But maybe don't buy D-Link AI nearly starts a war Flock cameras lose their keys The AI slowdown won't save bad security Opus at home, just slower Black Hat says fundamentals still work Hacker gadgets, and my top pick Gyazo screenshots Fake job interviews, real malware VINCE gets a new home Munich university gets disconnected LinkedIn fights the scraping machine SolarWinds hard-codes another bad idea Fake LastPass kills 145 security tools Colorado water gets its settings changed AI CEOs sell apocalypse and bonds The AI safety cult gets audited Ransomware recovery takes weeks, not hours TeamPCP's supply-chain tour continues Zuckoff hunts smart glasses Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-945
September 17 · 2 hr 4 min
AI hates CAPTCHAs - PSW #944
In the security news this week: UK government rolls out passkeys to 20 million users Phishing-resistant authentication and replay resistance Passkey adoption, device security, and user acceptance EU Cyber Resilience Act guidance, scope, and compliance CRA vulnerability disclosure and reporting requirements The real cost of cyberattacks and cybersecurity spending Cyber insurance and improving organizational security Nightmare Eclipse and the release of Windows zero-days Check Point VPN vulnerabilities and perimeter security GitLab security updates and shadow IT Discovering unmanaged GitLab instances Cyberattacks against oil tankers and insider threats VPN patching and implied rules Zero-downtime GitLab updates and version management Running Windows ARM on Apple Silicon with VMware and Parallels Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-944
September 10 · 2 hr 2 min
It's More Secure When It's Disabled - PSW #943
In the security news this week: Microsoft patches all the things Commissary freezers enter cyberwar Fake AV, real Defender nap Rowhammer comes for the GPU BIOS updates are no longer optional CVSS is not a crystal ball Kworker, but make it malware FortiGate gets a post-exploitation RAT CERN goes Debian underground UEFI shells strike again Australia loses the plot, and phones Cisco routers become covert gateways MikroTik patches the takeover chain WeWorm wriggles through mobile The year of Linux television Browsers become backdoors Fake IT calls, real data theft CVE attribution gets weird Boston Scientific keeps talking Security tools misconfigure themselves AI circuit breakers for rogue agents Passkeys meet the real world Vibe coding, vibe vulnerabilities AI loss of control keeps climbing AI agents report themselves to Schneier Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-943
September 3 · 2 hr 12 min
Linux Threat Hunting - PSW #942
First up: a technical segment on Linux threat hunting. We'll start this series by covering the best places to look for IoCs on Linux systems and devices, starting with startup services and scheduled tasks. Then, in the security news this week: SonicWall zero-days, again AI finds a pile of Cisco bugs, and a root RCE Claude Code Auto Mode dangers BGP hijacks your unsigned software update California, Linux and age verification Free movies, complimentary malware Citrix puts Linux alongside Windows Signal's "secure" enclave An expired domain answers military phone calls MORE Cheap Android TV boxes arrive pre-pwned CISA red teams meet critical infrastructure PaperCut vulnerability cuts both ways Big Tech asks everyone to secure its AI future Pacemaker monitoring DOJ files on a criminal leak site Water utility security, right after the breaches Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-942
August 27 · 2 hr 6 min
Hacking All The Devices, with AI? - Rob Allen - PSW #941
Rob Allen from ThreatLocker joins us to discuss securing agentic AI with zero-trust controls, least privilege, and access controls to limit what agents can access and do. This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! In the security news this week: Sixteen-year-old Linux LPEs still work Ubiquiti UniFi, patch it, also light on details If you remember magicJack, you too are old Slovakia doesn't trust its own speed cameras More homework on NIST's vulnerability database Your webcam, mic, and key light, all owned Printer moonlights as Minecraft server Zombie credit cards Your car's infotainment system fuels botnets Feds warn about AI-powered PLC attacks Can an AI actually reverse engineer its way out? Denver International's security breach, volume six Charlotte's breach and a parking company Why your ancient tech might be the safe one Microsoft counts billions of phishing emails A password vault that leaked to any website Australia sells password books at the post office Another perfect ten, this time in Entra ID Cisco's bug scores read like Olympic gymnastics Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-941
August 20 · 2 hr 8 min
Rejoice In The Nostalgia - PSW #940
In the security news this week: Cursor opens your repo, the repo opens you If you want the good model I'm going to need to see your ID Flock's a Flocking mess Defender was supposed to be the chosen one Side stepping Secure boot - twice SonicWall: a LAMP stack in a fancy case Macs don't get viruses, part infinity Flipper One, but why not Nix? NetScaler is back in the room Borrowing phone's good reputation USB and how to make Windows download stuff A KVM with the expensive letters removed Five steps to stop the webcam creeps PlexTrac acquired NIST asks the internet to fix the NVD Poland's health software has a very bad week If Apple pings you about spyware, believe it A macOS stealer that drives your browser for you T-Mobile's incident response tool of choice may suprise you, or not... Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-940
August 13 · 2 hr 4 min
The Breached WiFi AI Ports... What? - PSW #939
In the security news this week: North Carolina ports and contingency plans Back to paper and pencils Midnight Blizzard compromises hotel Wi-Fi DNS strikes again Captive portals, stolen credentials, and nation-state scale Phishing-resistant MFA Goodbye SMS and voice authentication Cornflake RAT and Chaco Shell The NPM worm Hundreds of compromised packages AI lowers the barrier to mass exploitation Rethinking "secure enough" Back to basics: know what's on your network Get off my PCI lawn Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-939
August 6 · 1 hr 58 min
When AI Commits Felonies - PSW #938
This week: When you are not at summer camp you can't read about it The Fettle continues Using the CFAA against AI Social contracts are not security models VSCode extentions, again Bugtraq is back! NVIDA, LVFS, and unraveling AI infrastructure More routers that come with backdoors Do we care about LPE? Even more AI that finds vulnerabilities When AI breaks its own guardtails Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-938
July 30 · 2 hr 5 min
Sandwich Hats - PSW #937
In the security news: 2.2 million cars, one shared Bluetooth key JFrog tries to spin an AI 0-day into a win Sextortion scammers recycling ShinyHunters' leaks The first hack ever, from 1966 Prompt injection as a service, $150 a month Cisco's mystery "static credential" BMCs still on the internet, still handing out hashes Scattered Spider duo sentenced over the TfL hack Air-gapped data sneaking out over the video cable A ghost in the network DNS poisoning checks into hotel WiFi Microsoft's cut-rate cybersecurity AI Learning to trust USB drives again Agentic pentesting shows up just in time for Black Hat Microsoft rethinks security for the AI age, again Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-937
July 23 · 2 hr 2 min
Fixing Vulns Is Harder Than Finding Them - PSW #936
In the news this week: InfraTrust and knowing what to patch Adversary in the middle triggered command injection Exploitarium again FreeRDP comes with free vulnerabilities AI breaking out of sandboxes on its own Wordpress RCE DMA dangers Nightmware eclypse is at it again Fortisandbox Turning AI to the dark side more prompt injection Secure boot is broken, still and again... Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-936
July 16 · 2 hr 11 min
1999 Called and It Wants It's Exploits Back - PSW #935
This week, our technical segment covers a new open-source tool written by Paul (and Claude) that helps you keep your Linux systems up to date and assess supply chain risks. It's called "fettle" and is a pure Python implementation that gives you even more features than previously discussed! Then in the security news: The GodDamn Ransomware CMMC suspended Holy Microsoft Tuesday! Lessons learned Without the Internet, do we still get water? The forgotten shims More than two BIOS passwords Cracking firmware encryption with Claude 1999 called, and it wants its "Exploits" back Prompt injection for defenders Grok has your repo You're not going to outpatch AI Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-935
July 9 · 2 hr 5 min
AI Is Annoying & IoT Devices Still Get Hacked - PSW #934
In the security news: Son of Anton strikes again! HalluSquatting and using Claude to defend itself CISA KEV's Revolving Door LLM's hallucinate and companies get sued Additionally - GitLost Yet even more Linux vulnerabilities Citrix just keeps bleeding Old hardware is new again A sneak peak into next week's tech segment Tenda hidden backdoors We're still talking about Mirai Today was not a good day for Roundcube Canada is hacking criminals AI safeguards are still annnoying All cars will spy on you The FatFs unpatched vulnerability in millions of embedded devices Windows OS market share drops below 60% (Paul uses Arch) 'We Cannot Choose to Become Idiots' - or can we? Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-934
July 2 · 2 hr 9 min
Linux Tech Segment & Vulnerabilities Galore - PSW #933
This week we have a technical segment based on the response to "Atomic Arch", an updated open-source tool to help you catch malicious packages. In the security news: Exploitarium A hot messy summer of vulnerabilities AI Squatting Linux LPE - no shortage of those Fingerprinting Favicons Windows 10 extended Can Clothes Make You Invisible to Facial Recognition? Fable and Mythos for All Do we care about Quantum? Execs have AI risk under control Biological warefare in Spyware The scripts in-scope for PCI We don't have privacy, but we may get age restrictions Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-933

Showing 1–20 of 33 episodes