Talkin' Bout [Infosec] News

The BHIS crew breaks down PHP2Shell, the challenges of emergency patching, and how AI-assisted vulnerability discovery is changing incident response. They discuss weak eMudhra certificate keys, Node2Shell and Brotli vulnerabilities, and security issues involving Plex, LiteLLM, GitLab, Broadcom Wi-Fi, and Popcorn Time. Other topics include AI agent frameworks used in attacks, research into self-propagating agents, context bombing as a defensive tactic, and the security and privacy implications of AI-assisted smart TV hacking.

Join us LIVE on Mondays, 4:30pm ET.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — Ryan Fixes Audio
• (04:57) - PHP2Shell Causes Hell on a Friday 2026-10-26
• (07:12) - PHP2Shell: AI-discovered vulnerabilities and emergency patching
• (16:47) - Azure incident response workshop and Denver training
• (25:19) - Weak eMudhra certificate keys and certificate trust failures
• (31:08) - Doc Blackburn’s encryption fundamentals workshop — December 4
• (37:13) - Rapid-fire roundup: Plex, LiteLLM, and GitLab
• (38:37) - Storm-0940: AI agent frameworks and the ConnectWise compromise
• (40:23) - Research into self-propagating AI agents and botnets
• (42:34) - AI-assisted smart TV hacking and restrictions on security research
• (47:59) - Context bombing: Triggering AI guardrails to disrupt attacks
• (51:46) - John Strand’s Information Security Core Skills in the Era of AI — November 10–11
• (52:02) - December Antisyphon summit: What in the Actual Cyber
• (52:46) - Broadcom Wi-Fi flaw: WPS memory exposure and stolen passwords
• (54:15) - OpenAI agent incidents and containment challenges
• (56:54) - Popcorn Time updater and supply chain attack risks

Links

PHP2Shell: AI-discovered vulnerabilities and emergency patching
Azure incident response workshop
...and Denver training
Weak eMudhra certificate keys and certificate trust failures
Doc Blackburn’s encryption fundamentals workshop — December 4
Node2Shell: Brotli vulnerabilities and downstream patching
Rapid-fire roundup: Plex, LiteLLM, and GitLab
Storm-0940: AI agent frameworks and the ConnectWise compromise
Research into self-propagating AI agents and botnets
People are vibe coding their way to better TVs
Context bombing: Triggering AI guardrails to disrupt attacks
John Strand’s Information Security Core Skills in the Era of AI — November 10–11
December Antisyphon summit: What in the Actual Cyber
Broadcom Wi-Fi flaw: WPS memory exposure and stolen passwords
OpenAI agent incidents and containment challenges
Popcorn Time updater and supply chain attack risks

Creators & Guests

• Corey Ham - Host
• Ched "cheddar" Wiggins - Guest
• Ralph May - Host
• Bronwen Aker - Host
• Doc Blackburn - Guest
• Gerard Johansen - Guest
• Ryan Poirier - Producer

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

The BHIS crew examines the ConnectWise/SkyKick compromise, its implications for Microsoft Entra tenants, and the consequences for MSPs and their customers. They discuss privileged application access, attacker persistence, and why clear incident communication matters. Other stories include the Cairn framework’s use of AI agents against retail websites, research into prompt injection in HTTP headers, exposed MCP servers, Citizen Lab’s reporting on advertising-delivered zero-click spyware, and an alleged listening device installation at OpenAI. Along the way, the team explores deception, proactive security assessments, and reducing attack surface as automated attacks become cheaper and easier to scale.

Join us LIVE on Mondays, 4:30pm ET.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — One decent flying car.
• (06:55) - ConnectWise SkyKick Compromise Causes Panic in MSP Space - 2026-10-19
• (10:22) - ConnectWise/SkyKick Compromise and Microsoft Entra Tenant Access
• (41:23) - Cairn: AI Agents Automating Attacks Against Retail Websites
• (53:41) - Research: Prompt Injection in HTTP Response Headers
• (55:06) - Exposed MCP Servers and the Risk of AI Inference Theft
• (58:09) - Adfection: Zero-Click Spyware Delivered Through Advertisements

Links
ConnectWise/SkyKick Compromise and Microsoft Entra Tenant Access
Cairn: AI Agents Automating Attacks Against Retail Websites
Research: Prompt Injection in HTTP Response Headers
Exposed MCP Servers and the Risk of AI Inference Theft
Adfection: Zero-Click Spyware Delivered Through Advertisements
Alleged Listening Device Installation at OpenAI

Antisyphon Pay What You Can Training: November 10–11
DeathCon Tickets in San Diego

Creators & Guests

• Alex Minster "Belouve" - Guest
• John Strand - Host
• Bronwen Aker - Host
• Wade Wells - Host
• Corey Ham - Host
• Hayden Covington - Host
• Eric Capuano - Guest
• Ryan Poirier - Producer

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

The BHIS crew discusses MonsterCloud’s ransomware decryption fraud, a Canadian cybersecurity executive’s arrest, and strikes on Russian data centers linked to a sharp decline in Yandex bot traffic. AI reverse engineering takes center stage as the team explores game recreations, commercial software clones, Linux vulnerability discovery, and the changing economics of software. They also examine AI-powered threat hunting and deception, a cyberattack on French supermarket refrigeration, fake Claude Code installers, and a controversial critique of passkeys. The episode closes with a preview of questions about AI-generated mathematics and encryption security.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — Less Boty on the Internet
• (08:10) - Russian Data Centers Bombed - 2026-10-12
• (11:05) - MonsterCloud’s Ransomware Decryption Fraud
• (15:24) - Canadian Cybersecurity Executive Arrested in Ransomware Case
• (19:15) - Russian Data Center Strikes and the Drop in Yandex Bot Traffic
• (24:41) - Drone Threats Prompt B-1 Bomber Withdrawal from the UK
• (27:22) - AI Reverse Engineers PlayStation 2 Games
• (28:45) - AI Software Recreations and Linux Zero-Day Discovery
• (57:22) - Kip Boyle’s “Owning AI Risk” Training and Discount Code
• (01:00:36) - Cyberattack Disrupts French Supermarket Refrigeration
• (01:03:17) - ClickFix Campaigns Use Fake Claude Code Installers
• (01:05:32) - Kip Boyle’s New Book: Gears Don’t Guess
• (01:07:08) - “Passkeys Are a Trap”: Examining a Controversial Article
• (01:08:11) - AI Math Breakthroughs and Potential Encryption Risks
• (01:09:48) - Ashley’s October 28 Webcast: Using AI for Research and Learning
• (01:13:13) - BHIS Penetration Testing and Incident Response Services
• (01:14:22) - Bronwen's Proposed Local LLM Workshop

Links
Publix Hurricane cakes are a long-standing tradition of hurricanes
Storm passes as Publix discontinues controversial hurricane cakes

MonsterCloud’s Ransomware Decryption Fraud
Canadian Cybersecurity Executive Arrested in Ransomware Case
Russian Data Center Strikes and the Drop in Yandex Bot Traffic
Drone Threats Prompt B-1 Bomber Withdrawal from the UK
AI Reverse Engineers Classic Games
AI Software Recreations and Linux Zero-Day Discovery
Kip Boyle’s “Owning AI Risk” Training and Discount Code
Cyberattack Disrupts French Supermarket Refrigeration
ClickFix Campaigns Use Fake Claude Code Installers
Kip Boyle’s New Book: Gears Don’t Guess
“Passkeys Are a Trap”: Examining a Controversial Article
AI Math Breakthroughs and Potential Encryption Risks
Ashley’s October 28 Webcast: Using AI for Research and Learning

WWHF Mile High Conference 2027

Creators & Guests

• Kip Boyle - Guest
• Ashley Knowles - Guest
• John Strand - Host
• Ralph May - Host
• Wade Wells - Host
• Ryan Poirier - Producer
• Corey Ham - Host
• Bronwen Aker - Host

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

Recorded live at Wild West Hackin’ Fest, the BHIS crew debates AI agent sandbox escapes, OpenAI’s frontier model decisions, and accountability for the Hugging Face hack. Other stories include the dismissal of OpenAI safety researchers, the FBI–Accenture breach, ShinyHunters arrests, Oracle’s medical records breach, and recurring Citrix vulnerabilities. The panel explores corporate scapegoating, stolen authentication tokens, patching challenges, and Anthropic’s expanding cybersecurity access—asking who takes responsibility when security controls fail.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - Live From WWHF Deadwood '26 - 2026-10-07
• (01:13) - OpenAI’s Frontier Model Pause and AI Sandbox Escapes
• (05:42) - OpenAI Dismisses Three Safety Researchers
• (07:20) - FBI–Accenture Breach and Blaming Individual Employees
• (09:33) - Oracle’s Medical Records Breach and Cloud Responsibility
• (11:12) - ShinyHunters Arrests and the FBI Breach
• (16:54) - Critical Citrix Vulnerabilities and Incomplete Patches
• (19:28) - Selling Stolen VPN Access and Authentication Tokens
• (22:49) - Anthropic Expands Its Cyber Verification Program
• (27:23) - Lawsuit Over the Hugging Face Hack and AI Accountability

Links
OpenAI’s Frontier Model Pause and AI Sandbox Escapes
OpenAI Dismisses Three Safety Researchers
FBI–Accenture Breach and Blaming Individual Employees
Oracle’s Medical Records Breach and Cloud Responsibility
ShinyHunters Arrests and the FBI Breach
Critical Citrix Vulnerabilities and Incomplete Patches
Anthropic Expands Its Cyber Verification Program
Lawsuit Over the Hugging Face Hack and AI Accountability

Creators & Guests

• Jake Williams - Guest
• John Strand - Host
• Ralph May - Host
• Bronwen Aker - Host
• Andy Pettit "Nerf" - Guest
• Corey Ham - Host

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This week, the BHIS crew starts with an Nvidia-branded trailer stolen for its presumed GPUs—only to turn out to be full of sand. They then examine reports of OpenAI agents accessing Australian and U.S. government sites, the unanswered questions about what happened, and Nvidia’s proposed agent safety framework. The conversation moves to the EvilTokens phishing service takedown, recent vulnerability patches, and prompt injection attacks against AI agents handling Salesforce contact forms. The episode closes with a reported F-35 component shipment rerouted to China and concerns about cyber incidents affecting ships and maritime systems.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — Doing Bulldozer Stuff
• (09:05) - AI Agents Go Rogue: Where’s the Accountability? 2026-09-28
• (12:16) - Nvidia-branded trailer stolen—and found full of sand
• (15:09) - OpenAI agents access Australian and U.S. government sites
• (30:55) - Nvidia’s OpenShell agent safety framework
• (37:06) - EvilTokens phishing service disrupted
• (46:16) - Citrix, WordPress, F5, and Roundcube vulnerability roundup
• (47:27) - Prompt injection through Salesforce web-to-lead forms
• (52:45) - F-35 components reportedly rerouted to China
• (55:20) - LNG tanker incident and maritime OT security
• (59:52) - Wild West Hackin’ Fest Deadwood and upcoming classes
• (01:01:00) - Offense for Defense and penetration testing classes
• (01:01:47) - Android pentesting and satellite security classes
• (01:03:26) - DEATHCon: detection engineering and threat hunting
• (01:06:58) - On Logos and Cables

Links

Creators & Guests

• Tim Medin - Guest
• Kent Ickler - Guest
• John Strand - Host
• Ralph May - Host
• Wade Wells - Host
• Corey Ham - Host
• Hayden Covington - Host

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This week, the crew examines Google’s reported Gemini containment failure, Anthropic’s new biology lab, Snickers-branded prompt injection, AI-assisted social engineering, and Claude’s access to financial data. They also cover major Linux, Cisco, Check Point, and Docker vulnerabilities; weak oversight of Flock surveillance searches; privacy concerns surrounding Waymo vehicles; continuing ransomware disruption at an Australian chicken producer; and the escalating conflict between ShinyHunters and Clop.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — Justifying Our Existence
• (03:27) - Google’s Gemini Agent Escapes Containment - 2026-09-21
• (06:45) - Google’s Gemini Hacks 3 Real Companies During Test
• (10:05) - Anthropic Builds a Bay Area Biology Lab
• (13:22) - Snickers Turns Prompt Injection into an Ad Campaign
• (19:41) - Iranian Social Engineering Uses Fake MRI Scans
• (25:10) - Claude Requests Access to Financial Accounts
• (28:50) - Meta’s Agentic AI and Its Personal-Data Advantage
• (30:57) - OpenAI Introduces In-Platform Advertising
• (34:47) - Linux Local Privilege-Escalation Vulnerabilities
• (35:32) - Cisco Secure Email Gateway Exploited by Nation-States
• (37:28) - Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
• (37:53) - Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
• (38:27) - CISA Ends Its Weekly Cybersecurity Bulletin
• (40:53) - Flock Surveillance Searches and Weak Oversight
• (49:10) - Waymo Detects a Firearm and Calls Police
• (57:40) - Upcoming Events, Workshops, and Training
• (57:51) - Alethe's Physical-Assessment Training
• (59:02) - Andy’s XDRCLI Talk at Wild West Hackin’ Fest
• (59:52) - Jake’s Hands-On AI Risk-Assessment Training
• (01:01:27) - Wade’s San Diego AI-Detection Event
• (01:03:00) - Ransomware Continues Disrupting an Australian Chicken Producer
• (01:05:34) - ShinyHunters Compromises Clop’s Dark-Web Site

Links
Google’s Gemini Hacks 3 Real Companies During Test
Anthropic Builds a Bay Area Biology Lab
Snickers Turns Prompt Injection into an Ad Campaign
https://www.snickers.com/digitalsnickers
Iranian Social Engineering Uses Fake MRI Scans
Claude Requests Access to Financial Accounts

OpenAI Introduces In-Platform Advertising
Linux Local Privilege-Escalation Vulnerabilities
Cisco Secure Email Gateway Exploited by Nation-States
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
CISA Ends Its Weekly Cybersecurity Bulletin
Flock Surveillance Searches and Weak Oversight
Waymo Detects a Firearm and Calls Police

Alethe’s Physical-Assessment Training
Andy’s XDRCLI Talk at Wild West Hackin’ Fest
Jake’s Hands-On AI Risk-Assessment Training
Wade’s San Diego AI-Detection Event

Ransomware Continues Disrupting an Australian Chicken Producer
ShinyHunters Compromises Clop’s Dark-Web Site

Creators & Guests

• Alethe Denis - Guest
• Corey Ham - Host
• Andy Pettit "Nerf" - Guest
• Wade Wells - Host
• Bronwen Aker - Host
• Ryan Poirier - Producer
• Jake Williams - Guest

Click here to watch this episode on YouTube.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This week, the team examines AI agents targeting RubyGems, Anthropic’s warnings about dangerous AI misuse, human review of ChatGPT conversations, predictive policing, and LG smart-TV privacy. They also cover passkey-themed phishing, ScreenConnect abuse, Microsoft Defender patch bypasses, and upcoming cybersecurity workshops, webcasts, and Wild West Hackin’ Fest training.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — A Protected Class
• (05:20) - World Leaders Reject Calls to Slow Down AI Development - 2026-09-14
• (07:58) - OpenAI Agent Swarm Targets RubyGems
• (16:12) - Anthropic Warns About Claude Misuse and Calls for Slower AI Development
• (31:38) - OpenAI’s Project Lily and Human Review of ChatGPT Conversations
• (38:54) - “Minority Report” Predictive Policing Using Financial Data
• (42:11) - LG Smart TVs Accused of Spying on Viewers
• (46:49) - Passkey-Themed Phishing Campaigns
• (47:20) - ConnectWise Patches ScreenConnect After Worm-Like Abuse
• (47:47) - Microsoft Defender “Shield Break” Patch Bypassed
• (54:19) - News Wrap-Up and Community Discussion
• (01:00:04) - Kip Boyle’s Book, Fire Doesn’t Innovate
• (01:00:27) - “Hunting Shadow AI” Workshop — September 25
• (01:01:05) - “Playbooks for Owning AI Risk” Live Training
• (01:03:01) - Wild West Hackin’ Fest and Karaoke
• (01:03:51) - Webcast: Attacking MCP and N8N Servers
• (01:04:10) - Webcast: Safely Using Offensive AI in Security Assessments
• (01:05:17) - Wild West Hackin’ Fest Satellite and SOC Classes

Links
OpenAI Agent Swarm Targets RubyGems
Anthropic Warns About Claude Misuse and Calls for Slower AI Development
OpenAI’s Project Lily and Human Review of ChatGPT Conversations
“Minority Report” Predictive Policing Using Financial Data
LG Smart TVs Accused of Spying on Viewers
Passkey-Themed Phishing Campaigns
ConnectWise Patches ScreenConnect After Worm-Like AbuseMicrosoft Defender “Shield Break” Patch Bypassed

Kip Boyle’s Book, Fire Doesn’t Innovate
“Hunting Shadow AI” Workshop — September 25
“Playbooks for Owning AI Risk” Live Training
Wild West Hackin’ Fest and Karaoke
Webcast: Attacking MCP and N8N Servers
Webcast: Safely Using Offensive AI in Security Assessments
Wild West Hackin’ Fest Satellite Class
...and SOC Classes

Creators & Guests

• Kip Boyle - Guest
• Corey Ham - Host
• John Strand - Host
• Ralph May - Host
• Bronwen Aker - Host
• Charles "bsdbandit" - Guest
• Ryan Poirier - Producer
• Hayden Covington - Host

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

AI agents take center stage as the team examines OpenAI models using a German forum for private communications, Anthropic’s response to a compromised Claude account, new model releases, and the growing demand for Apple hardware to train computer-using agents. The discussion also covers the sale of stolen driver’s licenses, a claimed Florida DMV breach, and vulnerabilities affecting JFrog Artifactory, Proxmox, Plex, and Langflow. Finally, the panel considers CISA’s decision to discontinue six cybersecurity assessment services, new research into compromising passkeys, and Outflank’s compact NTLMv1 rainbow tables.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — Internet Fall Weather
• (03:17) - Anthropic Warns Users of Infostealer Abuse - 2026-09-08
• (06:59) - OpenAI Agents Exploit a German Forum for Private Communications
• (17:18) - Anthropic Warns a User About Infostealer Abuse of Their Claude Account
• (23:32) - OpenAI’s Latest Model Tops AI Leaderboards and Revives the AGI Debate
• (26:01) - CrowdStrike Releases AI Models Developed with NVIDIA
• (29:12) - FBI Investigates the Sale of 103,000 Stolen Driver’s Licenses
• (32:41) - ShinyHunters Claims a Breach of the Florida DMV
• (35:19) - AI Labs Amass Mac Minis and Mac Studios for Agent Training
• (38:02) - Critical Authentication Bypass Disclosed in JFrog Artifactory
• (39:00) - Proxmox Vulnerability Exposes Internet-Facing Hosts
• (40:17) - New Plex Vulnerability Raises Home-Network Security Concerns
• (41:24) - Langflow Vulnerability Enables Unauthenticated Remote Code Execution
• (47:07) - Thomson Reuters Breach Disrupts State Court Systems
• (47:25) - CISA Cuts Six Free Cybersecurity Assessment Services
• (52:24) - New Research Demonstrates Ways to Compromise Passkeys
• (54:07) - Outflank Publishes a Smaller NTLMv1 Rainbow Table and Cracking Tool
• (56:02) - Dan DeCloss: Turning Pen Tests into Risk Intelligence Anti-Cast
• (56:53) - PlexTrac’s AI-Assisted Reporting and Retesting
• (01:03:44) - Charles Shirer Introduces the FanMeyer Creator Platform
• (01:05:06) - Upcoming AI Browser Research and Wild West Hackin’ Fest Talk
• (01:05:49) - Hacking and Defending Satellite Infrastructure at Wild West
• (01:06:25) - Upcoming AI Core Skills Fundamentals Course

Links
OpenAI Agents Exploit a German Forum for Private Communications
Anthropic Warns a User About Infostealer Abuse of Their Claude Account
OpenAI’s Latest Model Tops AI Leaderboards and Revives the AGI Debate
CrowdStrike Releases AI Models Developed with NVIDIA
FBI Investigates the Sale of 103,000 Stolen Driver’s Licenses
ShinyHunters Claims a Breach of the Florida DMV
AI Labs Amass Mac Minis and Mac Studios for Agent Training
Critical Authentication Bypass Disclosed in JFrog Artifactory
Proxmox Vulnerability Exposes Internet-Facing Hosts
New Plex Vulnerability Raises Home-Network Security Concerns
Langflow Vulnerability Enables Unauthenticated Remote Code Execution
Thomson Reuters Breach Disrupts State Court Systems
CISA Cuts Six Free Cybersecurity Assessment Services
New Research Demonstrates Ways to Compromise Passkeys
Outflank Publishes a Smaller NTLMv1 Rainbow Table and Cracking Tool

Dan DeCloss: Turning Pen Tests into Risk Intelligence Anti-Cast
Charles Shirer Introduces the FanMeyer Creator Platform
Upcoming AI Browser Research and Wild West Hackin’ Fest Talk
Hacking and Defending Satellite Infrastructure at Wild West

Creators & Guests

• Corey Ham - Host
• Bronwen Aker - Host
• Ralph May - Host
• Charles "bsdbandit" - Guest
• Ryan Poirier - Producer
• Dan DeCloss - Guest

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec....

This episode of BHIS - Talkin' Bout [infosec] News covers South Korea’s free government AI services, new efforts to secure the U.S. power grid from foreign-made components, and the use of SS7 and fitness-tracking data in military operations. The panel also discusses the FBI’s disruption of Chinese botnets targeting critical infrastructure, the alleged McKesson patient-data breach, arrests connected to Team PCP, and reports of NVIDIA acquiring Hugging Face. Additional topics include competition among AI coding platforms, critical vulnerabilities affecting Ubiquiti, Gitea, NetScaler, WebLogic, and PaperCut, and calls for an AI-powered surge in cyber defense.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — What is the whole point of RAM?
• (07:47) - South Korea Offers Free AI Services – 2026-08-31
• (08:44) - South Korea Offers Free Government AI Services
• (18:38) - White House Targets Foreign Components in the U.S. Power Grid
• (24:11) - How Tehran’s Use of Cyber Operations in the U.S.-Iran Conflict Has Evolved
• (25:15) - Iranian Cyberattackers Tracked Phones of U.S. Military Personnel, Data Suggests
• (27:44) - The Strava Heat Map and the End of Secrets
• (29:37) - Officer reportedly leaks location of French aircraft carrier with Strava run
• (30:09) - FBI Disrupts Chinese Botnets Targeting Critical Infrastructure
• (32:31) - ShinyHunters Claims Theft of 284 Million McKesson Records
• (37:23) - Alleged Team PCP Hackers Arrested in Australia
• (39:08) - Rumored NVIDIA Acquisition of Hugging Face
• (49:48) - OpenAI, Cursor, and Competition Between AI Coding Platforms
• (53:11) - Critical Vulnerabilities in Ubiquiti, Gitea, NetScaler, and More
• (55:51) - PaperCut warns of NG, MF flaw exploited in zero-day attacks
• (56:20) - Technology Companies Call for an AI Defensive Surge
• (57:42) - 58 arrested in international cybercrime crackdown
• (58:48) - How to start the AI-accelerated defense
• (01:02:21) - TRAINING: Fundamentals of Cybersecurity: Threats and Defenses
• (01:07:07) - TRAINING: Hacking and Defending Satellite Infrastructure

Links
South Korea Offers Free Government AI Services
White House Targets Foreign Components in the U.S. Power Grid
How Tehran’s Use of Cyber Operations in the U.S.-Iran Conflict Has Evolved
Iranian Cyberattackers Tracked Phones of U.S. Military Personnel, Data Suggests
The Strava Heat Map and the End of Secrets
Officer reportedly leaks location of French aircraft carrier with Strava run
FBI Disrupts Chinese Botnets Targeting Critical Infrastructure
ShinyHunters Claims Theft of 284 Million McKesson Records
Alleged Team PCP Hackers Arrested in Australia
Rumored NVIDIA Acquisition of Hugging Face
OpenAI, Cursor, and Competition Between AI Coding Platforms
Critical Vulnerabilities in Ubiquiti, Gitea, NetScaler, and More
PaperCut warns of NG, MF flaw exploited in zero-day attacks
Technology Companies Call for an AI Defensive Surge
58 arrested in international cybercrime crackdown
How to start the AI-accelerated defense
TRAINING: Fundamentals of Cybersecurity: Threats and Defenses
TRAINING: Hacking and Defending Satellite Infrastructure

Creators & Guests

• Corey Ham - Host
• John Strand - Host
• Bronwen Aker - Host
• Ryan Poirier - Producer
• Ralph May - Host
• Michael "Shecky" Kavka - Guest
• Doc Blackburn - Guest
• Hayden Covington - Host
• Wade Wells - Host

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

This episode examines the alleged GTA 6 leak and Rockstar’s efforts to identify the leaker, a Flock Safety critic’s unconventional response to being barred from its conference, and Linus Torvalds’ use of AI to debug Linux. The discussion also covers ShinyHunters targeting ReliaQuest, “security through antiquity,” AliExpress using silent audio for browser fingerprinting, and invisible watermarks in Microsoft Paint’s AI-generated images. Additional stories include an Iran-linked cyberattack that disrupted a UK power plant, prompt injection hidden in a legal filing, and a cyberattack against an Australian chicken-processing facility.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — String Cheese and Security
• (04:29) - Using AI to Debug the Linux Kernel - 2026-08-24
• (06:50) - Story # 1 : Rockstar Pursues GTA 6 Leaker Through Microsoft and Discord
• (12:47) - Story # 2: Flock Conference Bars Critic Who Then Intercepts Its Wireless Audio
• (16:58) - Story # 3: Linus Torvalds Uses AI to Debug the Linux Kernel
• (29:40) - Story # 4: ShinyHunters Targets ReliaQuest Employees with Social Engineering
• (31:07) - Story # 5: Can Obsolete Technology Provide “Security Through Antiquity”?
• (37:44) - Story # 6: AliExpress Uses Silent Audio for Browser Fingerprinting
• (41:30) - Story # 7: Darth Vader defends Flock cameras to San Diego City Council
• (42:44) - Story # 8: Microsoft Paint Embeds Watermarks in AI-Generated Images
• (44:45) - Story # 9: Iran-Linked Cyberattack Shuts Down a UK Power Plant
• (50:04) - Story # 10: Hidden AI Prompt Injection Discovered in a Legal Filing
• (57:56) - Story # 11: Australian Chicken Processing Plant Taken Offline by Cyberattack

Links

Story # 1 : Rockstar Pursues GTA 6 Leaker Through Microsoft and Discord
Story # 2: Flock Conference Bars Critic Who Then Intercepts Its Wireless Audio
Story # 3: Linus Torvalds Uses AI to Debug the Linux Kernel
Story # 4: ShinyHunters Targets ReliaQuest Employees with Social Engineering
Story # 5: Can Obsolete Technology Provide “Security Through Antiquity”?
Story # 6: AliExpress Uses Silent Audio for Browser Fingerprinting
Story # 7: Darth Vader defends Flock cameras to San Diego City Council
Story # 8: Microsoft Paint Embeds Watermarks in AI-Generated Images
Story # 9: Iran-Linked Cyberattack Shuts Down a UK Power Plant
Story # 10: Hidden AI Prompt Injection Discovered in a Legal Filing
Story # 12: Australian Chicken Processing Plant Taken Offline by Cyberattack

Fundamentals of Cybersecurity: Threats and Defenses
Course Authored by Doc Blackburn.

Practical iOS Application Security Testing
Course Authored by Cameron Cartier and David Blandford.

Creators & Guests

• Corey Ham - Host
• John Strand - Host
• Wade Wells - Host
• Aisling nic Lynne "siriciryel" - Guest
• Doc Blackburn - Guest
• Ralph May - Host
• Cameron Cartier - Guest
• Ryan Poirier - Producer

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This episode covers computer hardware shortages and chip-manufacturing bottlenecks, digital “letters of marque” for private cyber operations, and New Orleans’ use of AI for 911 calls. The panel also examines the LiteLLM supply-chain attack, Roblox safety concerns, attacks on on-premises SharePoint, AI agents escaping test environments, and vulnerabilities affecting Zoom and Microsoft Defender. Other topics include a post-DEF CON in-flight Wi-Fi incident, Signal’s automatic key verification, airport phone searches, and a PBS broadcaster’s loss of access to 70 years of archived television.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — Making Investments
• (04:59) - Airport phone searches, “kill codes,” and border privacy
• (09:12) - White House Announces "Digital Letters of Marque" - 2026-08-17
• (11:29) - Story # 1: Digital letters of marque and private-sector “hack back”
• (18:45) - Story # 2: New Orleans adopts AI for 911 calls
• (25:10) - Story # 3: LiteLLM supply-chain attack
• (28:32) - Story # 4: Chris Hansen banned from Roblox during a safety demonstration
• (32:34) - Story # 5: On-premises Microsoft SharePoint under attack
• (34:18) - Story # 6: AI agents escape testing sandboxes and hack real targets
• (42:05) - Story # 7: “Zoomsday” — AI discovers a Zoom remote-code-execution flaw
• (44:54) - Story # 8: Post-DEF CON Delta flight Wi-Fi incident
• (52:44) - Story # 9: ShieldBreak exploit abuses Microsoft Defender
• (56:55) - Story # 10: Signal introduces automatic key verification
• (58:32) - Story # 11: PBS broadcaster loses access to 70 years of archived television
• (01:03:02) - Upcoming webcasts and training

Links
Story # 1: Digital letters of marque and private-sector “hack back”
Story # 2: New Orleans adopts AI for 911 calls
Story # 3: LiteLLM supply-chain attack
Story # 4: Chris Hansen banned from Roblox during a safety demonstration
Story # 5: On-premises Microsoft SharePoint under attack
Story # 6: AI agents escape testing sandboxes and hack real targets
Story # 7: “Zoomsday” — AI discovers a Zoom remote-code-execution flaw
Story # 8: Post-DEF CON Delta flight Wi-Fi incident
Story # 9: ShieldBreak exploit abuses Microsoft Defender
Story # 10: Signal introduces automatic key verification
Story # 11: PBS broadcaster loses access to 70 years of archived television

ANTICAST - Your Cheap IoT Devices Are Hiding Secrets. Let's Find Them
Training by Jake Williams – Assessing AI Security: Model Context Protocol

Creators & Guests

• Alex Minster "Belouve" - Guest
• Wade Wells - Host
• Ralph May - Host
• Hayden Covington - Host
• Derek Banks - Guest
• Ryan Poirier - Producer
• Adrien Lasalle - Guest
• Jake Williams - Guest

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This episode explores an AI agent that canceled someone else’s gym reservation, the growing offensive and defensive roles of AI, and a sharp rise in ransomware attacks. The panel also discusses privacy concerns surrounding Meta smart glasses, new passkey-theft and MFA-bypass research, the Snowflake hacker’s guilty plea, backdoors in ZBT-Link routers, compromised cameras aboard UK Navy drones, reports of AI models hacking real targets, and research into the reliability of AI-generated security patches.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — The Old Jerks
• (08:30) - OpenClaw Cancels a Stranger's Gym Reservation - 2026-08-10
• (12:00) - Story # 1: OpenClaw cancels another person’s gym reservation
• (27:43) - Story # 2: Ransomware attacks surge 20% amid the AI distraction
• (39:08) - Story # 3: Backlash grows against Meta’s AI smart glasses
• (46:28) - Story # 4: Passkey theft and MFA-bypass research
• (49:19) - Story # 5: Canadian Snowflake hacker pleads guilty
• (51:16) - Story # 6: ZBT-Link routers found with a China-linked backdoor
• (53:06) - Story # 7: UK Navy drone cameras reportedly transmitted data to China
• (56:19) - Story # 8: Meta reports AI models hacking real targets
• (01:02:44) - Story # 9: AI-generated security patches succeed only about half the time

Links
Story # 1: OpenClaw cancels another person’s gym reservation
Story # 2: Ransomware attacks surge 20% amid the AI distraction
Story # 3: Backlash grows against Meta’s AI smart glasses
Story # 4: Passkey theft and MFA-bypass research
Story # 5: Canadian Snowflake hacker pleads guilty
Story # 6: ZBT-Link routers found with a China-linked backdoor
Story # 7: UK Navy drone cameras reportedly transmitted data to China
Story # 8: Meta reports AI models hacking real targets
Story # 9: AI-generated security patches succeed only about half the time

Infosec: Age of AI Summit

Creators & Guests

• Wade Wells - Host
• Ralph May - Host
• John Strand - Host
• Bronwen Aker - Host
• Corey Ham - Host
• Ryan Poirier - Producer
• Kip Boyle - Guest

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This episode examines Anthropic’s disclosure that Claude breached real organizations during security testing, along with new technical details about the OpenAI and Hugging Face incident. The discussion covers ExfilSquad’s claimed Microsoft breach, cyberattacks targeting U.S. water systems, and malicious Android TV boxes used for residential proxy networks and advertising fraud. The hosts also explore Google’s Android age-verification plans, Chrome protections against hijacking extensions, Microsoft Teams impersonation attacks deploying Chaos ransomware, and Bank of America’s acquisition of MDSec. Additional topics include the GrapheneOS duress-password court case, a DEF CON prediction market, continued Kali365 phishing activity, and credential-stuffing attacks against Chick-fil-A loyalty accounts.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — Zuckers
• (03:43) - Iranian Cyberattacks on U.S. Water Systems - 2026-08-03
• (07:00) - Story # 1: Anthropic’s Claude Breaches Companies During Security Testing
• (11:35) - Story # 2: Hugging Face Publishes Technical Details of the OpenAI Incident
• (13:37) - Story # 3: ExfilSquad Claims a Microsoft Cloud Breach
• (19:34) - Story # 4: Iranian Cyberattacks Target U.S. Water Systems
• (28:27) - Story # 5: Malicious Android TV Boxes Fuel Proxy Networks and Ad Fraud
• (40:51) - Story # 6: Google Introduces Android Age Verification
• (43:26) - Story # 7: Chrome Targets Tab- and Homepage-Hijacking Extensions
• (47:02) - Story # 8: Fake Microsoft Teams Support Calls Deploy Chaos Ransomware
• (48:38) - Story # 9: Bank of America Acquires MDSec
• (51:15) - Story # 10: GrapheneOS Duress Password Wipes Phone During Border Search
• (55:25) - Story # 11: Pony Market Takes Bets on DEF CON and Black Hat
• (58:06) - Story # 12: Kali365 Phishing Platform Remains Active
• (01:02:26) - ChickenSec : Chick-fil-A Loyalty Accounts Hit by Credential Stuffing

Links
Story # 1: Anthropic’s Claude Breaches Companies During Security Testing
Story # 2: Hugging Face Publishes Technical Details of the OpenAI Incident
Story # 3: ExfilSquad Claims a Microsoft Cloud Breach
Story # 4: Iranian Cyberattacks Target U.S. Water Systems
Story # 5: Malicious Android TV Boxes Fuel Proxy Networks and Ad Fraud
Story # 6: Google Introduces Android Age Verification
Story # 7: Chrome Targets Tab- and Homepage-Hijacking Extensions
Story # 8: Fake Microsoft Teams Support Calls Deploy Chaos Ransomware
Story # 9: Bank of America Acquires MDSec
Story # 10: GrapheneOS Duress Password Wipes Phone During Border Search
Story # 11: Pony Market Takes Bets on DEF CON and Black Hat
Story # 12: Kali365 Phishing Platform Remains Active
ChickenSec : Chick-fil-A Loyalty Accounts Hit by Credential Stuffing
Infosec: Age of AI Summit

DEATHcon
- November 13 - 14, 2026
- Univeristy of San Diego
5998 Alcala Park Way
San Diego, California 92110

Creators & Guests

• Ralph May - Host
• Wade Wells - Host
• Bronwen Aker - Host
• Corey Ham - Host
• Nick Ascoli - Guest

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This week, the crew digs into one of the biggest AI security stories of the year: how an OpenAI autonomous agent accidentally compromised a Hugging Face environment during testing and what the incident reveals about the growing risks of agentic AI. They examine how AI models behave in offensive security scenarios, discuss emerging attack surfaces around MCPs and AI agents, explore the challenges of AI red teaming, and debate what organizations should be doing today to secure AI-powered workflows. The episode also covers AI safety initiatives, model behavior, and where defensive security is struggling to keep pace with rapidly evolving AI capabilities.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴event-live-chat

Chapters

• (00:00) - PreShow Banter™ — Sol with a Goal
• (06:33) - OpenAI accidentally Hacked Hugging Face - 2026-07-27
• (09:18) - Story #1 - OpenAI says it accidentally hacked Hugging Face with a new AI system
• (18:33) - Story #2 - Lapsus is shutting down
• (24:21) - Story #3 - AgentForger, Part 1: ChatGPT Cross-Site Agent Forgery
• (31:47) - Story #4 - Beyond the Terminal: Offensive Security Evals for Embodied Reasoning
• (44:00) - Story #5 - EXPLOIT BROKERS PAY $500,000 FOR A WORDPRESS RCE. I FOUND ONE WITH GPT5.6 SOL ULTRA AND $25
• (52:43) - Story #6 - DNS Poisoning Tactics Expand to Hospitality Wi-Fi
• (55:51) - Ads and Mike at the AI Summit
• (59:54) - Story #7 - Golden Chickens Resurfaces With Four New Malware Families and Modular Implants

Links

Story #1 - OpenAI says it accidentally hacked Hugging Face with a new AI system
Story #2 - Lapsus is shutting down
Story #3 - AgentForger, Part 1: ChatGPT Cross-Site Agent Forgery
AgentForger, Part 2: The Autonomous Insider
Story #4 - Beyond the Terminal: Offensive Security Evals for Embodied Reasoning
Story #5 - EXPLOIT BROKERS PAY $500,000 FOR A WORDPRESS RCE. I FOUND ONE WITH GPT5.6 SOL ULTRA AND $25
Story #6 - DNS Poisoning Tactics Expand to Hospitality Wi-Fi
Ads and Mike at the AI Summit
Story #7 - Golden Chickens Resurfaces With Four New Malware Families and Modular Implants

Creators & Guests

• Ads Dawson - Guest
• Mike Takahashi - Guest
• Corey Ham - Host
• John Strand - Host
• Bronwen Aker - Host
• Hayden Covington - Host
• Ralph May - Host

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This week, the team discusses the White House's Initiative Gold Eagle and its implications for cybersecurity information sharing, an unexpectedly positive development involving Flock Safety, and the latest wave of AI news. The conversation also explores evolving AI model capabilities, security guardrails, open-weight Chinese models, and how AI is changing offensive and defensive security. Along the way, the hosts examine recent vulnerability research, industry reactions, and other cybersecurity headlines from the week.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — The Two Jokes
• (01:58) - Initiative Gold Eagle - 2026-07-20
• (12:24) - Story #1 - White House Launches Gold Eagle Initiative for Unprecedented Cybersecurity Vulnerability Coordination
• (18:58) - Story #2 - Microsoft Reins in RoguePlanet Zero-Day Threat
• (21:48) - Story #3 - Now, defenders are embracing the prompt injection, too
• (27:45) - Story #4 - Security incident disclosure — July 2026
• (33:38) - Story #5 - Chinese AI has leveled up, and brought renewed focus on the open weight model shift
• (44:25) - Story #6 - LAPD lets contract with surveillance giant Flock expire, citing ‘serious concerns’ over civil liberties and privacy
• (47:24) - Story #7 - Inside Pegasus: The evolution of the world’s most notorious spyware system
• (48:38) - Story #8a - WP2SHELL: PRE AUTHENTICATION RCE IN WORDPRESS CORE
• (51:49) - Story #8b - Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities
• (53:20) - Story #9 - Cyberattack threatens utterly critical infrastructure in Japan: KFC
• (58:10) - Paul’s Workshop
• (01:00:29) - Sign up for the AI Summit to see Matt’s talk
• (01:02:45) - Bronwen’s Workshop
• (01:07:10) - Wild West Hackin’ Fest
• (01:07:25) - DeathCon
• (01:09:08) - PostShow Banter - Retirement Funds

Links

Story #1 - White House Launches Gold Eagle Initiative for Unprecedented Cybersecurity Vulnerability Coordination
Story #2 - Microsoft Reins in RoguePlanet Zero-Day Threat
Story #3 - Now, defenders are embracing the prompt injection, too
Story #4 - [Huggingface] Security incident disclosure — July 2026
Story #5 - Chinese AI has leveled up, and brought renewed focus on the open weight model shift
Story #6 - LAPD lets contract with surveillance giant Flock expire, citing ‘serious concerns’ over civil liberties and privacy
Story #7 - Inside Pegasus: The evolution of the world’s most notorious spyware system
Story #8a - WP2SHELL: PRE AUTHENTICATION RCE IN WORDPRESS CORE
Story #8b - Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities
Story #9 - Cyberattack threatens utterly critical infrastructure in Japan: KFC
Paul’s Workshop
Sign up for the AI Summit to see Matt’s talk
Bronwen’s Workshop
Wild West Hackin’ Fest
DeathCon

Creators & Guests

• Corey Ham - Host
• Ralph May - Host
• John Strand - Host
• Paul Clark - Guest
• Wade Wells - Host
• Meagan Bentley - Producer
• Bronwen Aker - Host
• Matt Franz - Guest

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This week, the team unpacks a wide range of cybersecurity news, including a fraudulent offensive security startup tied to cybercriminals, how leaked OnlyFans content is inadvertently helping defenders identify compromised government websites, and new vishing attacks targeting Microsoft Entra passkey enrollment. They also examine AI prompt injection risks in GitHub workflows, malware campaigns abusing hundreds of GitHub repositories and Go packages, Microsoft's latest identity security developments, and the growing push for online age verification through government-issued IDs and selfies.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-event-chat

Chapters

• (00:00) - PreShow Banter™ — The New Mainframes
• (05:24) - OnlyFans Models are Accidental Blue Team Defenders - 2026-07-13
• (06:23) - Story #1 - Felons, Fraudsters Flog Offensive Cybersecurity Startup
• (15:37) - Story #2 - OnlyFans Models Are Accidentally Making Hacked Government Websites Disappear
• (20:37) - Story #3 - Vishing actors target Entra passkey enrollment
• (32:44) - Story #4 - GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos
• (46:32) - Story #5 - Network of 200 GitHub Repositories Used for Malware Infection
• (48:13) - Story #6 - Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint
• (53:53) - Story #7 - EU Reddit Users Must Verify Age With Government ID or Selfie
• (59:39) - Story #8 - Risky Bulletin: All new cars to include a camera aimed at the driver's face

Links
Story #1 - Felons, Fraudsters Flog Offensive Cybersecurity Startup
Story #2 - OnlyFans Models Are Accidentally Making Hacked Government Websites Disappear
Story #3 - Vishing actors target Entra passkey enrollment
Story #4 - GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos
Story #5 - Network of 200 GitHub Repositories Used for Malware Infection
Story #6 - Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint
Story #7 - EU Reddit Users Must Verify Age With Government ID or Selfie
Story #8 - Risky Bulletin: All new cars to include a camera aimed at the driver’s face

Creators & Guests

• John Strand - Host
• Mishaal Khan - Guest
• Ralph May - Host
• Meagan Bentley - Producer
• Bronwen Aker - Host
• Wade Wells - Host
• Doc Blackburn - Guest
• Jake Hildreth - Guest

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This episode of BHIS - Talkin' Bout [infosec] News covers the latest cybersecurity headlines, including debate over the economics of AI infrastructure, updates on the Huntress controversy, new details surrounding Scattered Spider, a critical Microsoft SharePoint vulnerability, and reports of a breach involving a DHS information-sharing network. The discussion also examines Apple's legal battles over alternative app stores, the limitations of Apple's Hide My Email feature, a Medtronic breach, firmware security, Palo Alto Networks attribution disputes, and other notable security stories that didn't make the main rundown.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — Ask GPU
• (02:09) - Story # 0: The memory crisis heads to court as class-action lawsuit filed against Samsung, SK Hynix, and Micron
• (05:15) - Apple's Hide My Email ... Doesn't! – 2026-07-06
• (08:38) - Story #1 - These Recent Insider Threat Allegations
• (12:53) - Story #2a - Alleged Scattered Spider hacker extradited to the United States
• (16:40) - Story #3 - US Department of Homeland Security says it is probing a cyber breach at information-sharing network
• (22:20) - Story #5 - Espionage Against the European Parliament
• (28:33) - Story #6a - Sony Is Going Disc-Free: What It Means for PS6 and Your Wallet
• (33:35) - Story #6b - Resetting XBOX
• (38:51) - Story #7 - Command & Conquer Generals: Zero Hour — macOS, iOS & iPadOS
• (42:47) - Story #8 - Medtronic notifies customers impacted by ShinyHunters data breach
• (43:56) - Story #9 - Flipper Zero firmware development continues with community help
• (55:18) - Story #10 - Amazon will stop accepting new customers for Mechanical Turk
• (59:06) - Fletus’ YouTube Channel
• (59:42) - Doc’s Upcoming Workshop
• (01:03:22) - Story #11 - Apple ‘Hide My Email’ Vulnerability Reveals Peoples’ Real Email Addresses
• (01:03:56) - Story #12 - Startup sues Palo Alto Networks' Koi Security, saying an AI-hallucinated report falsely linked it to Chinese espionage

Links
Story # 0: The memory crisis heads to court as class-action lawsuit filed against Samsung, SK Hynix, and Micron
Story #1 - These Recent Insider Threat Allegations
Story #2a - Alleged Scattered Spider hacker extradited to the United States
Story #3 - US Department of Homeland Security says it is probing a cyber breach at information-sharing network
Story #5 - Espionage Against the European Parliament
Story #6a - Sony Is Going Disc-Free: What It Means for PS6 and Your Wallet
Story #6b - Resetting XBOX
Story #7 - Command & Conquer Generals: Zero Hour — macOS, iOS & iPadOS
Story #8 - Medtronic notifies customers impacted by ShinyHunters data breach
Story #9 - Flipper Zero firmware development continues with community help
Story #10 - Amazon will stop accepting new customers for Mechanical Turk
Fletus’ YouTube Channel
Doc’s Upcoming Workshop
Story #11 - Apple ‘Hide My Email’ Vulnerability Reveals Peoples’ Real Email Addresses
Story #12 - Startup sues Palo Alto Networks’ Koi Security, saying an AI-hallucinated report falsely linked it to Chinese espionage

Creators & Guests

• Corey Ham - Host
• John Strand - Host
• Wade Wells - Host
• Doc Blackburn - Guest
• Hayden Covington - Host
• Ralph May - Host
• Fletus Poston - Guest
• Ryan Poirier - Producer

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This week on BHIS - Talkin' Bout [infosec] News, the team discusses the Polymarket supply chain compromise that led to the theft of millions from a small number of high-value accounts, emerging phishing campaigns abusing OpenAI invitations and Microsoft 365 device code authentication, and recent Oracle security updates. They also cover convictions tied to the Transport for London and U.S. healthcare intrusions, Google's Android earthquake warning system, concerns over MITRE ATT&CK evaluation methodology, and the ongoing debate surrounding threat intelligence researchers interacting with cybercriminals.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — The Next Webcast Thing
• (00:14) - Polymarket's Bad Bet with Third-Party Vendors - 2026-06-29
• (03:56) - Story #1 - It's looking like a hot, messy summer for security teams as AI finds countless previously hidden vulns
• (07:49) - Story #2 - FBI issues urgent Kali365 security warning for Teams, Outlook, OneDrive users
• (08:55) - Story #3 - heavener: This is what happens when you can't afford EDR licenses
• (18:50) - Story #4 - Ex-Huntress analyst claims company insider fed info to a ransomware crim. Social media drama ensues
• (31:59) - Story #5 - I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.
• (36:14) - Story #6 - CISA Adds Four Known Exploited Vulnerabilities to Catalog
• (37:09) - Story #7 - Victory! 702 has Expired!
• (37:43) - Story #8 - Scattered Spider Hackers Plead Guilty on Day 1 of Trial
• (40:52) - Story #9 - Polymarket customers lose $3 million in supply-chain attack
• (44:56) - Story #10 - Bad cybersecurity by Secret Service agents put US officials at risk, inspector general says
• (49:31) - Story #11 - How Android Earthquake Alerts System Works
• (53:47) - Story #12 - Cybersecurity firms targeted by fraudulent OpenAI organization invites
• (59:34) - Story #13a - The Trojan horse of cybercrime: Weaponizing SaaS notification pipelines
• (59:59) - Story #13b - Order-tracking app Shop abused to push callback phishing attacks
• (01:04:29) - Chinese AI vs. Anthropic Mythos | BHIS [In Focus]

Links
Story #1 - It’s looking like a hot, messy summer for security teams as AI finds countless previously hidden vulns
Story #2 - FBI issues urgent Kali365 security warning for Teams, Outlook, OneDrive users
Story #3 - heavener: This is what happens when you can’t afford EDR licenses
Story #4 - Ex-Huntress analyst claims company insider fed info to a ransomware crim. Social media drama ensues
Story #5 - I Could’ve Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.
Story #6 - CISA Adds Four Known Exploited Vulnerabilities to Catalog
Story #7 - Victory! 702 has Expired!
Story #8 - Scattered Spider Hackers Plead Guilty on Day 1 of Trial
Story #9 - Polymarket customers lose $3 million in supply-chain attack
Story #10 - Bad cybersecurity by Secret Service agents put US officials at risk, inspector general saysStory #11 - How Android Earthquake Alerts System Works
Story #12 - Cybersecurity firms targeted by fraudulent OpenAI organization invites
Story #13a - The Trojan horse of cybercrime: Weaponizing SaaS notification pipelines
Story #13b - Order-tracking app Shop abused to push callback phishing attacksChinese AI vs. Anthropic Mythos | BHIS [In Focus]
Creators & Guests

• John Strand - Host
• Bronwen Aker - Host
• Corey Ham - Host
• Meagan Bentley - Producer
• Wade Wells - Host
• Ralph May - Host
• Hayden Covington - Host

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This week’s episode covers a series of cybersecurity stories, including a researcher’s discovery of vulnerabilities in FIFA’s World Cup platform that could have enabled unauthorized administrative access and even the ability to alter live broadcasts. The team also discusses the risks of large-scale identity verification data exposure, supply chain attacks impacting the scientific research community, ongoing fallout from Broadcom’s VMware acquisition, and legal challenges from major organizations facing rising VMware costs. Along the way, the hosts share commentary on AI-related security concerns, access control failures, and the broader impact of vendor decisions on enterprise security.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — There's always more suppply chain
• (04:52) - Rickrolling the FIFA World Cup - 2026-06-22
• (07:59) - Story #1 - Texas Government Data Breach Exposes 3 Million Driver’s License Records
• (10:56) - Story #2 - I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.
• (21:00) - Story #3 - FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed – Claim Your Ethical Disclosure
• (23:58) - Story #4a - Stakeholder-Specific Vulnerability Categorization (SSVC)
• (25:44) - Story #4b - CVSS Is Officially Dead: What CISA's BOD 26-04 Means for Everyone
• (37:19) - Story #5 - Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels
• (43:56) - Story #6 - FBI disrupts massive AI-powered phishing service using a million URLs
• (46:12) - Story #7 - Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure
• (47:12) - Story #8 - AI models that can take down governments and business months away, rare Five Eyes statement warns
• (48:44) - Story #9 - ANTHROPIC’S MYTHOS AI BROKE INTO ALMOST ALL NSA CLASSIFIED SYSTEMS IN HOURS
• (58:45) - Story #10 - Tesco moving 40,000 server workloads off VMware amid Broadcom’s “abusive conduct”

Links
Story #1 - Texas Government Data Breach Exposes 3 Million Driver’s License Records
Story #2 - I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.
Story #3 - FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed – Claim Your Ethical Disclosure
Story #4a - Stakeholder-Specific Vulnerability Categorization (SSVC)
Story #4b - CVSS Is Officially Dead: What CISA's BOD 26-04 Means for Everyone
Story #5 - Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels
Story #6 - FBI disrupts massive AI-powered phishing service using a million URLs
Story #7 - Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure
Story #8 - AI models that can take down governments and business months away, rare Five Eyes statement warns
Story #9 - ANTHROPIC’S MYTHOS AI BROKE INTO ALMOST ALL NSA CLASSIFIED SYSTEMS IN HOURS
Story #10 - Tesco moving 40,000 server workloads off VMware amid Broadcom’s “abusive conduct”

Creators & Guests

• Andy Pettit "Nerf" - Guest
• Michael "Shecky" Kavka - Guest
• Ryan Poirier - Producer
• Corey Ham - Host
• Ralph May - Host
• John Strand - Host

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/

This episode dives into the fallout from new restrictions on Anthropic’s cybersecurity-focused AI models, Mythos and Fable, and the debate over whether government pressure has effectively blocked security researchers from using advanced AI for vulnerability discovery and code analysis. The panel discusses AI “jailbreaking” claims, export-control comparisons, the impact on penetration testing and bug hunting, and how AI is accelerating vulnerability research. Other topics include responsible disclosure challenges, the growing volume of AI-assisted security findings, and what these developments mean for researchers, vendors, and the future of offensive security.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

• (00:00) - PreShow Banter™ — A Banned Phrase
• (04:56) - U.S. Government Effectively Bans Fable 5 and Mythos 5 - 2026-06-15
• (06:29) - Story #1 - Statement on the US government directive to suspend access to Fable 5 and Mythos 5
• (21:15) - Story #2 - ServiceNow discloses security incident exposing customer data
• (41:45) - Story #3 - Introducing Claude Corps
• (52:11) - Story #4 - SHINYHUNTERS HITS 100+ UNIVERSITIES WITH ORACLE ZERO-DAY
• (52:39) - Story #5 - Arch Linux AUR Hit By Another Wave Of Now More Sophisticated Malware Attack
• (59:00) - Story # - This Company Will Add Phone, AirPod, and Smartwatch Trackers to License Plate Readers

Links
06:30 - Story #1 - Statement on the US government directive to suspend access to Fable 5 and Mythos 5
21:16 - Story #2 - ServiceNow discloses security incident exposing customer data
41:46 - Story #3 - Introducing Claude Corps
52:12 - Story #4 - SHINYHUNTERS HITS 100+ UNIVERSITIES WITH ORACLE ZERO-DAY
52:40 - Story #5 - Arch Linux AUR Hit By Another Wave Of Now More Sophisticated Malware Attack
59:00 - Story # - This Company Will Add Phone, AirPod, and Smartwatch Trackers to License Plate Readers

Creators & Guests

• Corey Ham - Host
• John Strand - Host
• Bronwen Aker - Host
• Wade Wells - Host
• Alex Minster "Belouve" - Guest
• Ralph May - Host
• Ryan Poirier - Producer
• Jason Haddix - Guest

Click here to watch this episode on YouTube.

Click here to view the episode transcript.

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits

https://poweredbybhis.com/

Brought to you by:

Black Hills Information Security

https://www.blackhillsinfosec.com/

Antisyphon Training

https://www.antisyphontraining.com/

Active Countermeasures

https://www.activecountermeasures.com/

Wild West Hackin Fest

https://wildwesthackinfest.com/