Risky Business #855 -- ShinyHunters done sowing, enters reaping phase

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Brad Arkin to talk through the week’s cybersecurity news, including:

• Sacré bleu! Hackers turn up the heat at French supermarket freezers
• ShinyHunters enters “find out” stage
• Netscaler, Zimbra, SharePoint, Atlassian…. So many bugs exploited in the wild
• More models “behave badly” (by… doing exactly what we’re telling them to do)
• Ukraine hit another Yandex data centre in Russia and all those Texan patriots with numbers in their usernames have gone super quiet
• Much, much more…

This week’s show is brought to you by Corelight. Co-founder and Chief Strategy Officer Gregory Bell joins James Wilson to chat about the company’s new white paper that looks into whether a sophisticated model or nicely structured data is more important with automated SOC work.

This episode is also available on YouTube

Show notes

• Cyberattack disrupts refrigeration at hundreds of French supermarkets | therecord.media
• Dangerous flaws in refrigeration equipment were disclosed months before retail attacks | Cybersecurity Dive
• Retail giant Ahold Delhaize takes systems offline after cyberattack | BleepingComputer
• Hacked FBI data has sensitive information about employees' intelligence roles | reuters.com
• Hackers stole millions of US military personnel records during months-long data breach | TechCrunch Security
• ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks | BleepingComputer
• Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation | krebsonsecurity.com
• Key ShinyHunters hacker detained in Jordan, is cooperating, sources say | reut.rs
• FBI Arrests Founder of Ransomware Negotiation Firm | krebsonsecurity.com
• Ransomware recovery CEO charged over secret ransom payments | BleepingComputer
• Citrix urges immediate upgrades of NetScaler amid widespread exploitation attempts | Cybersecurity Dive
• Citrix confirms two NetScaler RCE zero-days exploited in attacks | BleepingComputer
• Kiteworks urges customers to stop using platform after warning from federal intelligence agencies | therecord.media
• Attackers have been exploiting critical Zimbra flaw to steal emails | arstechnica.com
• FBI, Secret Service add to warnings of FortiBleed credential stealing campaign | therecord.media
• Check Point warns of hackers exploiting Security Gateway VPN RCE flaw | BleepingComputer
• Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks | securityweek.com
• Hackers exploit critical Atlassian flaw after public PoC release | BleepingComputer
• CISA: Ransomware gangs now exploiting critical TeamCity flaw | BleepingComputer
• Anthropic Agents Tried to Fill Out Visa Forms on State Dept. Website | nytimes.com
• An Anthropic AI model sent a false homicide tip to Philadelphia police | TechCrunch
• OpenAI bots meddled with US government agencies, including SEC and Census | bbc.com
• OpenAI Pauses Training Its Most Powerful Models After Rogue Agents Target Government | wired.com
• Anthropic Says Its A.I. Agents Attempted to Access a Range of Government Sites | nytimes.com
• OpenAI agent breached Australian government health website, Albanese says | therecord.media
• Doubts grow over claims OpenAI agent hacked Australian Medicare portal | therecord.media
• OpenAI agents tried to hack Wikipedia tools and flooded it with traffic | arstechnica.com
• OpenAI Ignored Employees' Warnings About Safely Testing A.I. Models | nytimes.com
• AI models may be capable of self-replicating without access to a datacenter |
• South Korean officials believe AI agents were used to hack several banks | therecord.media
• JadePuffer agentic AI attacks target Azure, destroy cloud resources | BleepingComputer
• GLM-5.3 and the Spread of Advanced Cyber Capabilities | anthropic.com
• New bill would create federal investigative body for AI-driven hacks | cyberscoop.com
• Court rules Trump can blacklist Anthropic for refusing to enable Claude features | Ars Technica
• Apple changes full-disk access permissions to curb abuse from AI agents | arstechnica.com
• Google Gemini could soon get full access to your Mac’s files, apps and the web | BleepingComputer
• Bitget hacked via zero-day in third-party security products | BleepingComputer
• Ledger confirms spy chip implant behind wallet crypto thefts | BleepingComputer
• Who Is Planting Backdoors in Ledger Crypto Wallets? | zetter-zeroday.com
• Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware | zscaler.com
• New Spectre v2 attack variant leaks Linux root password hash in minutes | BleepingComputer
• Data breach at Denmark’s national population register exposes 8.8 million people | therecord.media
• Shares in British clothing company ASOS dive after hackers apparently send push notification | therecord.media
• Google halts open-source bug bounty program amid AI spam surge | BleepingComputer
• International coalition seizes tools used by cyber firm behind Flax Typhoon | therecord.media
• Hackers hijack Google domains after breaching ccTLD registries | BleepingComputer
• GoBalance Flaw Lets Attackers Hijack.onion Addresses by Recovering Tor-Format Keys | The Hacker News
• Ukraine strikes third Yandex data center, disrupting digital services across Russia | therecord.media
• Provably Better Data | Corelight