Risky Business #856 -- 8-bit encryption, PHP megabugs and more

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host security engineer Mark El-Khoury to talk through the week’s cybersecurity news, including:

• The PHP foundation is about to release patches for a couple of critical bugs… We’re watching to see if the internet burns down
• 8 private keys underpinning some CA certs got compromised. The keys only had 8 bits of entropy!
• Is the breach-polcalypse upon us?
• OpenAI’s inside spy, Anthropic’s safety bill and election influence campaigns are coming for your chatbots
• Ukraine drone strikes hit more Russian data centres, this time VK’s in the firing line
• Much, much more!

This week’s show is brought to you by Trail of Bits. Principal Security Engineer Anish Naik joins James Wilson to chat about two agent skills plugins, Patching Bugs and Regression Hunt, that the company is releasing off the back of its joint initiative with Open AI, Patch the Planet.

This episode is also available on YouTube

Show notes

• The PHP Foundation (@ThePHPF) on X
• The Internet goes on high alert after discovery of 8 compromised TLS certs
• OpenCode breach exposes users' external AI-provider API keys
• DHS to ban DeepSeek from federal civilian agencies
• Rob Joyce (@RGB_Lights) on X
• OpenAI engineer accused of spying on executives remains in custody
• An OpenAI Employee Allegedly Used a Chatbot to Help Plant a Recording Device at the Office
• Anthropic quietly pitches its own AI safety bill to lawmakers
• The next election influence campaign will target your AI chatbot
• Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
• Thousands of refrigerator devices remain exposed following French cyberattack
• AI agents navigated unfamiliar OT systems and moved equipment within minutes
• Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem
• Feds crack down on North Korean IT-worker schemes with new raids, charges and arrests
• Federal bankruptcy courts dealing with outages after contractor cyberattack
• Russian social media giant VK faces disruptions after data center drone strike
• Data Centers Are War Targets Now
• How a Massive Chinese Crime Ring Hacked Staples to Steal Millions
• Microsoft Patches More Than 1,400 Security Flaws
• GitHub expands malware advisories across eight package ecosystems
• Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
• AdFection: How mercenary spyware invades victims’ devices through targeted advertising
• CISA warns of new Ivanti bug being exploited as latest Patch Tuesday breaks records
• Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
• Drupal patches critical RCE flaws and warns exploits may emerge soon
• Palo Alto Networks patches PAN-OS zero-day exploited for root-level code execution
• Eight US states sue OpenAI over alleged harms to users
• Cyberattack halts work on the Denmark–Germany Fehmarnbelt tunnel
• Ransomware groups expand targeting of Palo Alto Networks vulnerability
• DHS Said They Searched Man Who Wiped GrapheneOS Phone for Child Abuse Material. They Lied
• Trail of Bits skills plugins