Paul's Security Weekly (Audio)

Oct 29, 20262h 8m

In the security news this week: In the security news this week: Cisco says patch faster, then sells you time Turning AI refusals into vulnerability signals Brotli's are hiding WordPress image upload exploit Fortinet ship

Oct 22, 20262h 9m

Special guest Joshua Wright joins us for a timely incident-response discussion! Then, in the security news this week: Have you heard about PHP2Shell? Certificates with keys small enough to guess Tor exit nodes turn into

Oct 15, 20262h 0m

In the security news this week: Convert this router into an SDR Ivanti straight to root Anthropic's AI worm FUD A kernel exploit to fix downloads Supermarket refrigeration attacks 400 mystery Java vulnerabilities Authent

Oct 8, 20262h 1m

In the security news this week: BPFDoor OpenSSH compresses a little too much AI can find bugs. Who gets them fixed? TP-Link and the courts Cisco NX-API ClingSTUN LineageOS, Android TV, and a Raspberry PI Dell's updater h

Oct 1, 20262h 1m

First up we talk with Threatlocker CTO Michael Jenkins about threat actors use of AI and keeping the bad things out with Zero Trust. Then in the security news: Compiling spreadsheets, because that's why Nvidia wants to p

Sep 24, 20262h 3m

In the security news this week: Build your own router, or just buy one What to patch first But maybe don't buy D-Link AI nearly starts a war Flock cameras lose their keys The AI slowdown won't save bad security Opus at h

Sep 17, 20262h 4m

In the security news this week: UK government rolls out passkeys to 20 million users Phishing-resistant authentication and replay resistance Passkey adoption, device security, and user acceptance EU Cyber Resilience Act

Sep 10, 20262h 2m

In the security news this week: Microsoft patches all the things Commissary freezers enter cyberwar Fake AV, real Defender nap Rowhammer comes for the GPU BIOS updates are no longer optional CVSS is not a crystal ball Kw

Sep 3, 20262h 12m

First up: a technical segment on Linux threat hunting. We'll start this series by covering the best places to look for IoCs on Linux systems and devices, starting with startup services and scheduled tasks. Then, in the s

Aug 27, 20262h 6m

Rob Allen from ThreatLocker joins us to discuss securing agentic AI with zero-trust controls, least privilege, and access controls to limit what agents can access and do. This segment is sponsored by ThreatLocker. Visit

Aug 20, 20262h 8m

In the security news this week: Cursor opens your repo, the repo opens you If you want the good model I'm going to need to see your ID Flock's a Flocking mess Defender was supposed to be the chosen one Side stepping Secu

Aug 13, 20262h 4m

In the security news this week: North Carolina ports and contingency plans Back to paper and pencils Midnight Blizzard compromises hotel Wi-Fi DNS strikes again Captive portals, stolen credentials, and nation-state scale

Aug 6, 20261h 58m

This week: When you are not at summer camp you can't read about it The Fettle continues Using the CFAA against AI Social contracts are not security models VSCode extentions, again Bugtraq is back! NVIDA, LVFS, and unrave

Jul 30, 20262h 5m

In the security news: 2.2 million cars, one shared Bluetooth key JFrog tries to spin an AI 0-day into a win Sextortion scammers recycling ShinyHunters' leaks The first hack ever, from 1966 Prompt injection as a service,

Jul 23, 20262h 2m

In the news this week: InfraTrust and knowing what to patch Adversary in the middle triggered command injection Exploitarium again FreeRDP comes with free vulnerabilities AI breaking out of sandboxes on its own Wordpress

Jul 16, 20262h 11m

This week, our technical segment covers a new open-source tool written by Paul (and Claude) that helps you keep your Linux systems up to date and assess supply chain risks. It's called "fettle" and is a pure Python imple

Jul 9, 20262h 5m

In the security news: Son of Anton strikes again! HalluSquatting and using Claude to defend itself CISA KEV's Revolving Door LLM's hallucinate and companies get sued Additionally - GitLost Yet even more Linux vulnerabili

Jul 2, 20262h 9m

This week we have a technical segment based on the response to "Atomic Arch", an updated open-source tool to help you catch malicious packages. In the security news: Exploitarium A hot messy summer of vulnerabilities AI

Jun 25, 20262h 13m

First up is Sandy Bird from Sonrai discussing how to protect our cloud infrastructure! This segment is sponsored by Sonrai Security. Visit https://securityweekly.com/sonrai to learn more about them! Next up in the securi

Jun 18, 20262h 6m

In the security news this week: GPS spoofing and satellite jamming are getting way too accessible Rekeying satellites in orbit sounds terrifying Cyber extortion and whether criminals still have ethics AI helping cybersec

Jun 11, 20262h 2m

In the security news: Trolling Microsoft With Vulnerabilities Fable 5 loves guardrails Binwalk vulnerability EMBA and local models EDRChoker AI worms Interesting Arista vulnerability added to KEV BOD 26-04 and stakeholde

Jun 4, 20262h 1m

This week in the security news: Security Researchers Are Threat Actors according to Microsoft Hands-free malicious firmware If you've ever typed "ls" in Windows, this is for you Cisco makes more patches, wants you to pay

May 28, 20262h 4m

This week we have a technical segment focused on Linux! Paul released a script that helps you get a handle on Linux supply chain security, and new features allow you to assess the state of Secure Boot on your Linux syste

May 21, 20262h 2m

In the security news this week: FCC router bans and the hidden firmware update problem Why extending support timelines actually improves security Github supply chain concerns and the evolving SBOM ecosystem CRA and NIS2

May 14, 20262h 2m

This week: New Yellowkey bitlocker bypass and what it means for you Hackers can run you over with a robot lawnmower FCC says new things about routers, again Glitching with AI almost no false positives AI thought it was e