Risky Bulletin

Episode

• 
  Srsly Risky Biz: Trump's private hacker memo is the right idea 20.08.2026 31mnt

  Tom Uren and James Wilson talk about President Donald Trump’s memo enlisting the US private sector to tackle cybercriminals. The initiative gets the big idea right: traditional law enforcement approaches have not worked against cybercriminals so the government has turned to disruption operations, but there simply isn’t enough government capacity. So it is time to bring in the private sector. They also discuss Ukraine’s combined cyber and kinetic strikes against Wildberries, the logistics company that is called the Amazon of Russia. These cyber operations didn’t amplify the effects of kinetic strikes, but it is great propaganda to say that they did. This episode is also available on YouTube
• 
  Risky Bulletin: Slovakia finds Russian backdoors on its speed cameras 19.08.2026 7mnt

  Slovakia finds Russian backdoors on its speed cameras, French police used a public exploit to hack EncroChat, Microsoft delays Exchange updates due to a deluge of AI bugs, and a ransomware-affiliate poses as a data recovery firm.
• 
  Between Two Nerds: The eye of Sauron 18.08.2026 32mnt

  In this edition of Between Two Nerds Tom Uren and The Grugq discuss The Offense Death Cycle, a paper looking at how to take advantage of a defender’s ability to control a network to discover intruders. This episode is also available on YouTube.
• 
  Risky Bulletin: The EU publishes its upcoming cybersecurity standards 17.08.2026 8mnt

  The EU publishes its upcoming cybersecurity standards, hackers breach France’s tax agency, threat actors exploit a GeoServer zero-day hours after disclosure, and an exploit unlocks old AMD CPUs with one instruction.
• 
  Sponsored: What npm 12 fixes… and what it doesn’t 17.08.2026 17mnt

  In this Risky Business sponsored interview, Casey Ellis chats with Socket founder Feross Aboukhadijeh about npm 12’s move to disable install scripts by default. Attackers are already shifting payloads into package source code, and Feross explains why teams need to understand what third-party code actually does before allowing it into their environments.
• 
  Risky Bulletin: US will let private companies carry out offensive cyber ops 14.08.2026 11mnt

  The White House will let private companies carry out offensive cyber ops, an AI hacking campaign breached Taiwan’s government, a macOS bug was exploited over the internet to drop cryptominers, and Kenya orders internet cafes to store logs.
• 
  Srsly Risky Biz: Data extortion is booming. Hooray! 13.08.2026 30mnt

  Tom Uren and James Wilson talk about the cybercrime ecosystem shifting towards data theft extortion, stealing sensitive data and extracting ransoms from victims by threatening to leak it. For organisations whose reputation is very important to them, data leaks are a bigger threat than having their files locked up. They also discuss how the rise of AI makes it worth reinvigorating CISA’s Secure by Design initiative.
• 
  Risky Bulletin: Russian hackers jump on the fake job interview train 12.08.2026 9mnt

  Russian state hackers adopt fake job interview tactics, a Portuguese man will face trial for developing a malicious AI chatbot, an AI assistant hacks an Australian gym, and OpenAI releases cyber models for blue teams.
• 
  Between Two Nerds: The cyber resistance! 11.08.2026 29mnt

  In this edition of Between Two Nerds Tom Uren and The Grugq talk about examples of cyber resistance and whether they achieve their goals. This epsiode is also available on YouTube.
• 
  Risky Bulletin: Two law firms pay giant ransoms 10.08.2026 8mnt

  Two American law firms pay multi-million dollar ransoms, a Metabase zero-day is being used in data theft attacks, Russian hackers disrupted a second power plant in Poland, and there’s a remote code execution bug in WordPress… again!
• 
  Sponsored: Island's expansion to SASE and enterprise AI 10.08.2026 16mnt

  In this Risky Business sponsored interview, Catalin Cimpanu talks with Michael Leland, Field CTO at Island, about the company’s seamless expansion into SASE and enterprise AI.
• 
  Risky Bulletin: A Meta AI model also escaped a testing sandbox 07.08.2026 7mnt

  A Meta AI model also escaped a testing sandbox, a cyberattack disrupts ports in North Carolina, the Philippines will establish a cybersecurity agency, and a Ransom Cartel admin gets 16 years in prison.
• 
  Srsly Risky Biz: Being a North Korean hacker is about to be less fun 06.08.2026 22mnt

  Tom Uren and James Wilson talk about North Korea losing control over some of its hacker workforce. Expect some tightening of controls and oversight, and perhaps even a reduction in the country’s ransomware operations. They also discuss escalating attacks on American water infrastructure. Although the impact of these attacks is relatively minor so far, the US government has been slow to respond from a political perspective. This episode is also available on YouTube
• 
  Risky Bulletin: Hacker breaches Hungary's State Treasury 05.08.2026 10mnt

  A hacker breached Hungary’s State Treasury, Russia will mandate 40 apps on all smartphones next year, hackers steal Liechtenstein’s business database, and an AI agent got real CVEs for hallucinated vulnerability reports.
• 
  Between Two Nerds: Hackers vs the state 04.08.2026 25mnt

  In this edition of Between Two Nerds Tom Uren and The Grugq talk about whether hacker culture is inherently anti-authoritarian and how different states get their country’s hackers to work for the state. This episode is also available on YouTube.
• 
  Risky Bulletin: Anthropic models also did the hacky-hacky 03.08.2026 8mnt

  Anthropic models also did the hacky-hacks, Coldcard was hacked for $70 million in Bitcoin, npm adds publish-time malware scanning, and Russia is behind the recent hotel WiFi hacks.
• 
  Sponsored: The intrusion signals hiding in plain sight 03.08.2026 15mnt

  In this sponsored interview James Wilson chats with Permiso CTO Ian Ahl about detecting ShinyHunters-style attackers as they move through cloud and SaaS environments. Ian explains how ordinary-looking events such as a password reset, a new MFA device, unusual searches and a first-time AWS role assumption can combine to reveal an intrusion. Permiso’s platform connects these signals across identity providers, cloud platforms and SaaS applications. They also discuss how AI is helping attackers move from initial access to extortion in just four hours.
• 
  Risky Bulletin: Crime Stoppers puts bounty on INC ransomware group 31.07.2026 8mnt

  A non-profit puts a $22,000 bounty on the INC ransomware group, hackers breach the UK Department for Education, Russia charges Telegram founder Pavel Durov, and the FCC bans foreign robots and power inverters.
• 
  Srsly Risky Biz: Chipping away at Chinese AI risks 30.07.2026 23mnt

  Tom Uren and James Wilson talk about open-weight AI models and distillation. These topics have been subject to a lot of US government attention in recent weeks, but let’s not forget that America’s overriding goal is to remain ahead of China in the AI race. There are better ways to do that than overindexing on distillation. They also discuss Iranian attacks on US critical infrastructure. Given that the war in Iran is unpopular, incidents that make headlines without causing serious impact are perfectly calibrated. This episode is also available on YouTube
• 
  Risky Bulletin: Cyberattack disrupts Minnesota water utilities 29.07.2026 8mnt

  A cyberattack has disrupted water utilities in more than 30 communities in Minnesota, Denmark tests a secondary banking system in case of a cyberattack, North Korea arrests bank hackers, and a new Chinese cyber contractor has been identified.