Talkin' Bout [Infosec] News

Episoder

• 
  Initiative Gold Eagle - 2026-07-20 21.07.2026 1t 11min

  This week, the team discusses the White House's Initiative Gold Eagle and its implications for cybersecurity information sharing, an unexpectedly positive development involving Flock Safety, and the latest wave of AI news. The conversation also explores evolving AI model capabilities, security guardrails, open-weight Chinese models, and how AI is changing offensive and defensive security. Along the way, the hosts examine recent vulnerability research, industry reactions, and other cybersecurity headlines from the week.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — The Two Jokes (01:58) - Initiative Gold Eagle - 2026-07-20 (12:24) - Story #1 - White House Launches Gold Eagle Initiative for Unprecedented Cybersecurity Vulnerability Coordination (18:58) - Story #2 - Microsoft Reins in RoguePlanet Zero-Day Threat (21:48) - Story #3 - Now, defenders are embracing the prompt injection, too (27:45) - Story #4 - Security incident disclosure — July 2026 (33:38) - Story #5 - Chinese AI has leveled up, and brought renewed focus on the open weight model shift (44:25) - Story #6 - LAPD lets contract with surveillance giant Flock expire, citing ‘serious concerns’ over civil liberties and privacy (47:24) - Story #7 - Inside Pegasus: The evolution of the world’s most notorious spyware system (48:38) - Story #8a - WP2SHELL: PRE AUTHENTICATION RCE IN WORDPRESS CORE (51:49) - Story #8b - Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities (53:20) - Story #9 - Cyberattack threatens utterly critical infrastructure in Japan: KFC (58:10) - Paul’s Workshop (01:00:29) - Sign up for the AI Summit to see Matt’s talk (01:02:45) - Bronwen’s Workshop (01:07:10) - Wild West Hackin’ Fest (01:07:25) - DeathCon (01:09:08) - PostShow Banter - Retirement Funds LinksStory #1 - White House Launches Gold Eagle Initiative for Unprecedented Cybersecurity Vulnerability CoordinationStory #2 - Microsoft Reins in RoguePlanet Zero-Day ThreatStory #3 - Now, defenders are embracing the prompt injection, tooStory #4 - [Huggingface] Security incident disclosure — July 2026Story #5 - Chinese AI has leveled up, and brought renewed focus on the open weight model shiftStory #6 - LAPD lets contract with surveillance giant Flock expire, citing ‘serious concerns’ over civil liberties and privacyStory #7 - Inside Pegasus: The evolution of the world’s most notorious spyware systemStory #8a - WP2SHELL: PRE AUTHENTICATION RCE IN WORDPRESS COREStory #8b - Cloudflare WAF protects WordPress applications from two high-severity vulnerabilitiesStory #9 - Cyberattack threatens utterly critical infrastructure in Japan: KFCPaul’s WorkshopSign up for the AI Summit to see Matt’s talkBronwen’s WorkshopWild West Hackin’ FestDeathConCreators & Guests Corey Ham - Host Ralph May - Host John Strand - Host Paul Clark - Guest Wade Wells - Host Meagan Bentley - Producer Bronwen Aker - Host Matt Franz - Guest Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.com☯️ Introducing BHIS Fusion Penetration Testinghttps://www.blackhillsinfosec.com/fusion-penetration-testing/Antisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  OnlyFans Models Are Accidental Blue Team Defenders - 2026-07-13 14.07.2026 1t 7min

  This week, the team unpacks a wide range of cybersecurity news, including a fraudulent offensive security startup tied to cybercriminals, how leaked OnlyFans content is inadvertently helping defenders identify compromised government websites, and new vishing attacks targeting Microsoft Entra passkey enrollment. They also examine AI prompt injection risks in GitHub workflows, malware campaigns abusing hundreds of GitHub repositories and Go packages, Microsoft's latest identity security developments, and the growing push for online age verification through government-issued IDs and selfies.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-event-chatChapters(00:00) - PreShow Banter™ — The New Mainframes (05:24) - OnlyFans Models are Accidental Blue Team Defenders - 2026-07-13 (06:23) - Story #1 - Felons, Fraudsters Flog Offensive Cybersecurity Startup (15:37) - Story #2 - OnlyFans Models Are Accidentally Making Hacked Government Websites Disappear (20:37) - Story #3 - Vishing actors target Entra passkey enrollment (32:44) - Story #4 - GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos (46:32) - Story #5 - Network of 200 GitHub Repositories Used for Malware Infection (48:13) - Story #6 - Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint (53:53) - Story #7 - EU Reddit Users Must Verify Age With Government ID or Selfie (59:39) - Story #8 - Risky Bulletin: All new cars to include a camera aimed at the driver's face LinksStory #1 - Felons, Fraudsters Flog Offensive Cybersecurity StartupStory #2 - OnlyFans Models Are Accidentally Making Hacked Government Websites DisappearStory #3 - Vishing actors target Entra passkey enrollmentStory #4 - GitLost: How We Tricked GitHub’s AI Agent into Leaking Private ReposStory #5 - Network of 200 GitHub Repositories Used for Malware InfectionStory #6 - Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaintStory #7 - EU Reddit Users Must Verify Age With Government ID or SelfieStory #8 - Risky Bulletin: All new cars to include a camera aimed at the driver’s faceCreators & Guests John Strand - Host Mishaal Khan - Guest Ralph May - Host Meagan Bentley - Producer Bronwen Aker - Host Wade Wells - Host Doc Blackburn - Guest Jake Hildreth - Guest Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.com☯️ Introducing BHIS Fusion Penetration Testinghttps://www.blackhillsinfosec.com/fusion-penetration-testing/Antisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  Apple's Hide My Email ... Doesn't! – 2026-07-06 07.07.2026 1t 7min

  This episode of BHIS - Talkin' Bout [infosec] News covers the latest cybersecurity headlines, including debate over the economics of AI infrastructure, updates on the Huntress controversy, new details surrounding Scattered Spider, a critical Microsoft SharePoint vulnerability, and reports of a breach involving a DHS information-sharing network. The discussion also examines Apple's legal battles over alternative app stores, the limitations of Apple's Hide My Email feature, a Medtronic breach, firmware security, Palo Alto Networks attribution disputes, and other notable security stories that didn't make the main rundown.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Ask GPU (02:09) - Story # 0: The memory crisis heads to court as class-action lawsuit filed against Samsung, SK Hynix, and Micron (05:15) - Apple's Hide My Email ... Doesn't! – 2026-07-06 (08:38) - Story #1 - These Recent Insider Threat Allegations (12:53) - Story #2a - Alleged Scattered Spider hacker extradited to the United States (16:40) - Story #3 - US Department of Homeland Security says it is probing a cyber breach at information-sharing network (22:20) - Story #5 - Espionage Against the European Parliament (28:33) - Story #6a - Sony Is Going Disc-Free: What It Means for PS6 and Your Wallet (33:35) - Story #6b - Resetting XBOX (38:51) - Story #7 - Command & Conquer Generals: Zero Hour — macOS, iOS & iPadOS (42:47) - Story #8 - Medtronic notifies customers impacted by ShinyHunters data breach (43:56) - Story #9 - Flipper Zero firmware development continues with community help (55:18) - Story #10 - Amazon will stop accepting new customers for Mechanical Turk (59:06) - Fletus’ YouTube Channel (59:42) - Doc’s Upcoming Workshop (01:03:22) - Story #11 - Apple ‘Hide My Email’ Vulnerability Reveals Peoples’ Real Email Addresses (01:03:56) - Story #12 - Startup sues Palo Alto Networks' Koi Security, saying an AI-hallucinated report falsely linked it to Chinese espionage LinksStory # 0: The memory crisis heads to court as class-action lawsuit filed against Samsung, SK Hynix, and MicronStory #1 - These Recent Insider Threat AllegationsStory #2a - Alleged Scattered Spider hacker extradited to the United StatesStory #3 - US Department of Homeland Security says it is probing a cyber breach at information-sharing networkStory #5 - Espionage Against the European ParliamentStory #6a - Sony Is Going Disc-Free: What It Means for PS6 and Your WalletStory #6b - Resetting XBOXStory #7 - Command & Conquer Generals: Zero Hour — macOS, iOS & iPadOSStory #8 - Medtronic notifies customers impacted by ShinyHunters data breachStory #9 - Flipper Zero firmware development continues with community helpStory #10 - Amazon will stop accepting new customers for Mechanical TurkFletus’ YouTube ChannelDoc’s Upcoming WorkshopStory #11 - Apple ‘Hide My Email’ Vulnerability Reveals Peoples’ Real Email AddressesStory #12 - Startup sues Palo Alto Networks’ Koi Security, saying an AI-hallucinated report falsely linked it to Chinese espionageCreators & Guests Corey Ham - Host John Strand - Host Wade Wells - Host Doc Blackburn - Guest Hayden Covington - Host Ralph May - Host Fletus Poston - Guest Ryan Poirier - Producer Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  Polymarket's Bad Bet with Third-Party Vendors - 2026-06-29 30.06.2026 1t 6min

  This week on BHIS - Talkin' Bout [infosec] News, the team discusses the Polymarket supply chain compromise that led to the theft of millions from a small number of high-value accounts, emerging phishing campaigns abusing OpenAI invitations and Microsoft 365 device code authentication, and recent Oracle security updates. They also cover convictions tied to the Transport for London and U.S. healthcare intrusions, Google's Android earthquake warning system, concerns over MITRE ATT&CK evaluation methodology, and the ongoing debate surrounding threat intelligence researchers interacting with cybercriminals.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — The Next Webcast Thing (00:14) - Polymarket's Bad Bet with Third-Party Vendors - 2026-06-29 (03:56) - Story #1 - It's looking like a hot, messy summer for security teams as AI finds countless previously hidden vulns (07:49) - Story #2 - FBI issues urgent Kali365 security warning for Teams, Outlook, OneDrive users (08:55) - Story #3 - heavener: This is what happens when you can't afford EDR licenses (18:50) - Story #4 - Ex-Huntress analyst claims company insider fed info to a ransomware crim. Social media drama ensues (31:59) - Story #5 - I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID. (36:14) - Story #6 - CISA Adds Four Known Exploited Vulnerabilities to Catalog (37:09) - Story #7 - Victory! 702 has Expired! (37:43) - Story #8 - Scattered Spider Hackers Plead Guilty on Day 1 of Trial (40:52) - Story #9 - Polymarket customers lose $3 million in supply-chain attack (44:56) - Story #10 - Bad cybersecurity by Secret Service agents put US officials at risk, inspector general says (49:31) - Story #11 - How Android Earthquake Alerts System Works (53:47) - Story #12 - Cybersecurity firms targeted by fraudulent OpenAI organization invites (59:34) - Story #13a - The Trojan horse of cybercrime: Weaponizing SaaS notification pipelines (59:59) - Story #13b - Order-tracking app Shop abused to push callback phishing attacks (01:04:29) - Chinese AI vs. Anthropic Mythos | BHIS [In Focus] LinksStory #1 - It’s looking like a hot, messy summer for security teams as AI finds countless previously hidden vulnsStory #2 - FBI issues urgent Kali365 security warning for Teams, Outlook, OneDrive usersStory #3 - heavener: This is what happens when you can’t afford EDR licensesStory #4 - Ex-Huntress analyst claims company insider fed info to a ransomware crim. Social media drama ensuesStory #5 - I Could’ve Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.Story #6 - CISA Adds Four Known Exploited Vulnerabilities to CatalogStory #7 - Victory! 702 has Expired!Story #8 - Scattered Spider Hackers Plead Guilty on Day 1 of TrialStory #9 - Polymarket customers lose $3 million in supply-chain attackStory #10 - Bad cybersecurity by Secret Service agents put US officials at risk, inspector general saysStory #11 - How Android Earthquake Alerts System WorksStory #12 - Cybersecurity firms targeted by fraudulent OpenAI organization invitesStory #13a - The Trojan horse of cybercrime: Weaponizing SaaS notification pipelinesStory #13b - Order-tracking app Shop abused to push callback phishing attacksChinese AI vs. Anthropic Mythos | BHIS [In Focus]Creators & Guests John Strand - Host Bronwen Aker - Host Corey Ham - Host Meagan Bentley - Producer Wade Wells - Host Ralph May - Host Hayden Covington - Host Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  Rickrolling the FIFA World Cup - 2026-06-22 23.06.2026 1t 6min

  This week’s episode covers a series of cybersecurity stories, including a researcher’s discovery of vulnerabilities in FIFA’s World Cup platform that could have enabled unauthorized administrative access and even the ability to alter live broadcasts. The team also discusses the risks of large-scale identity verification data exposure, supply chain attacks impacting the scientific research community, ongoing fallout from Broadcom’s VMware acquisition, and legal challenges from major organizations facing rising VMware costs. Along the way, the hosts share commentary on AI-related security concerns, access control failures, and the broader impact of vendor decisions on enterprise security.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — There's always more suppply chain (04:52) - Rickrolling the FIFA World Cup - 2026-06-22 (07:59) - Story #1 - Texas Government Data Breach Exposes 3 Million Driver’s License Records (10:56) - Story #2 - I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID. (21:00) - Story #3 - FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed – Claim Your Ethical Disclosure (23:58) - Story #4a - Stakeholder-Specific Vulnerability Categorization (SSVC) (25:44) - Story #4b - CVSS Is Officially Dead: What CISA's BOD 26-04 Means for Everyone (37:19) - Story #5 - Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels (43:56) - Story #6 - FBI disrupts massive AI-powered phishing service using a million URLs (46:12) - Story #7 - Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure (47:12) - Story #8 - AI models that can take down governments and business months away, rare Five Eyes statement warns (48:44) - Story #9 - ANTHROPIC’S MYTHOS AI BROKE INTO ALMOST ALL NSA CLASSIFIED SYSTEMS IN HOURS (58:45) - Story #10 - Tesco moving 40,000 server workloads off VMware amid Broadcom’s “abusive conduct” LinksStory #1 - Texas Government Data Breach Exposes 3 Million Driver’s License RecordsStory #2 - I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.Story #3 - FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed – Claim Your Ethical DisclosureStory #4a - Stakeholder-Specific Vulnerability Categorization (SSVC)Story #4b - CVSS Is Officially Dead: What CISA's BOD 26-04 Means for EveryoneStory #5 - Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI WheelsStory #6 - FBI disrupts massive AI-powered phishing service using a million URLsStory #7 - Splunk Enterprise Vulnerability Exploited in Attacks Days After DisclosureStory #8 - AI models that can take down governments and business months away, rare Five Eyes statement warnsStory #9 - ANTHROPIC’S MYTHOS AI BROKE INTO ALMOST ALL NSA CLASSIFIED SYSTEMS IN HOURSStory #10 - Tesco moving 40,000 server workloads off VMware amid Broadcom’s “abusive conduct”Creators & Guests Andy Pettit "Nerf" - Guest Michael "Shecky" Kavka - Guest Ryan Poirier - Producer Corey Ham - Host Ralph May - Host John Strand - Host Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  U.S. Government Effectively Bans Fable 5 and Mythos 5 - 2026-06-15 16.06.2026 1t 7min

  This episode dives into the fallout from new restrictions on Anthropic’s cybersecurity-focused AI models, Mythos and Fable, and the debate over whether government pressure has effectively blocked security researchers from using advanced AI for vulnerability discovery and code analysis. The panel discusses AI “jailbreaking” claims, export-control comparisons, the impact on penetration testing and bug hunting, and how AI is accelerating vulnerability research. Other topics include responsible disclosure challenges, the growing volume of AI-assisted security findings, and what these developments mean for researchers, vendors, and the future of offensive security.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — A Banned Phrase (04:56) - U.S. Government Effectively Bans Fable 5 and Mythos 5 - 2026-06-15 (06:29) - Story #1 - Statement on the US government directive to suspend access to Fable 5 and Mythos 5 (21:15) - Story #2 - ServiceNow discloses security incident exposing customer data (41:45) - Story #3 - Introducing Claude Corps (52:11) - Story #4 - SHINYHUNTERS HITS 100+ UNIVERSITIES WITH ORACLE ZERO-DAY (52:39) - Story #5 - Arch Linux AUR Hit By Another Wave Of Now More Sophisticated Malware Attack (59:00) - Story # - This Company Will Add Phone, AirPod, and Smartwatch Trackers to License Plate Readers Links06:30 - Story #1 - Statement on the US government directive to suspend access to Fable 5 and Mythos 521:16 - Story #2 - ServiceNow discloses security incident exposing customer data41:46 - Story #3 - Introducing Claude Corps52:12 - Story #4 - SHINYHUNTERS HITS 100+ UNIVERSITIES WITH ORACLE ZERO-DAY52:40 - Story #5 - Arch Linux AUR Hit By Another Wave Of Now More Sophisticated Malware Attack59:00 - Story # - This Company Will Add Phone, AirPod, and Smartwatch Trackers to License Plate ReadersCreators & Guests Corey Ham - Host John Strand - Host Bronwen Aker - Host Wade Wells - Host Alex Minster "Belouve" - Guest Ralph May - Host Ryan Poirier - Producer Jason Haddix - Guest Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  Breach Disclosure Lag is Worse Than Ever – 2026-06-08 09.06.2026 1t 9min

  This episode covers the rising costs and restrictions surrounding AI agents, including token consumption, model access policies, and the growing dependence on AI tools for security work. The hosts discuss Troy Hunt’s retrospective on Have I Been Pwned reaching its 1,000th tracked breach, examining why breach disclosures appear to be slowing and how GDPR and CCPA requirements affect notification practices. Additional topics include password and email hygiene, the value of breach-notification services, AI infrastructure and data center costs, and new research mapping AI-enabled cyber threats to the MITRE ATT&CK framework.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Token Love (05:11) - Breach Disclosure is Lag Worse Than Ever – 2026-06-08 (11:25) - Story #1 - Anthropic ‘plants’ engineers at NSA despite facing ban by Pentagon (20:59) - Story #2 - A new service branch could be joining the U.S. Armed Forces family (25:47) - Story #3 - Websites have a new way to spy on visitors: Analyzing their SSD activity (31:11) - Story #4 - The Quiet Numbers Station: Decoding Nineteen Years of GPS Cryptography (37:21) - Story #5 - 1,000 Data Breaches Later, the Disclosure Lag is Worse Than Ever (43:23) - Story #6 - Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator (48:00) - Story #7 - Anthropic confidentially files IPO prospectus with SEC, prepping Wall Street for landmark AI deal (01:02:26) - Story #8 - Microsoft Wants to 'Make People Addicted' to its New AI Assistant, Internal Documents Reveal (01:03:29) - Story #9 - Amazon Shuts Down Internal AI Leaderboard After Employees Cheated (01:04:57) - ANTI-CAST : RF Attacks Every InfoSec Pro Should Know with Paul Clark (01:05:54) - Workshop: Build Your Own AI Security Agent (01:06:43) - Training: Agentic AI for Threat Hunting (01:07:16) - Training: Cyber Threat Intelligence 101 2-Day Version (01:08:58) - ANTI-CAST: Prompt Engineering 201: The Context Stack w/ Bronwen Aker LinksStory #1 - Anthropic ‘plants’ engineers at NSA despite facing ban by PentagonStory #2 - A new service branch could be joining the U.S. Armed Forces familyStory #3 - Websites have a new way to spy on visitors: Analyzing their SSD activityStory #4 - The Quiet Numbers Station: Decoding Nineteen Years of GPS CryptographyStory #5 - Russia Has Been Jamming GPS from Space Since 2019Story #6 - Mapping AI-enabled cyber threats: Insights from the LLM AT&T&CK NavigatorStory #7 - Anthropic confidentially files IPO prospectus with SEC, prepping Wall Street for landmark AI dealStory #8 - Microsoft Wants to ‘Make People Addicted’ to its New AI Assistant, Internal Documents RevealStory #9 - Amazon Shuts Down Internal AI Leaderboard After Employees CheatedANTI-CAST : RF Attacks Every InfoSec Pro Should Know with Paul ClarkWorkshop: Build Your Own AI Security AgentWorkshop: Intro to SDR Hacking: Capture, Decode, Take OverTraining: Agentic AI for Threat HuntingTraining: Cyber Threat Intelligence 101 2-Day VersionANTI-CAST: Prompt Engineering 201: The Context Stack w/ Bronwen AkerCreators & Guests John Strand - Host Ralph May - Host Corey Ham - Host Bronwen Aker - Host Faan Rossouw - Guest Ryan Poirier - Producer Paul Clark - Guest Wade Wells - Host Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  Anti-Tech Extremism - 2026-06-01 03.06.2026 1t 13min

  This episode covers a Wired report on the rise of “anti-tech extremism” and growing public opposition to AI infrastructure projects, including debates over data centers, resource consumption, local communities, and government responses. The hosts also discuss AI coding assistants, model safety restrictions, and the evolving capabilities of large language models. Additional topics include Anthropic’s reported IPO plans and valuation, AI’s impact on the tech industry, and a conversation with David Bianco about AI-generated threat-hunting datasets and cybersecurity training.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Solving this thing (03:52) - Anti-Tech Extremism - 2026-06-01 (08:08) - Threat Hunter Summit | June 17th 2026 (12:11) - Story # 1: US Law Enforcement Warns of ‘Anti-Tech Extremism’ as AI Hatred Grows (20:54) - Story # 2: Anthropic files for its IPO (23:35) - Story # 3: FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data (29:41) - Story # 4: Microsoft Defender can now automatically isolate hacked endpoints (30:45) - Story # 5: Microsoft's GitHub bans security researcher who posted zero-day Windows exploits because company 'ruined their life' (36:54) - Story # 6: Cyber Force? Senator pushes to create service branch under the Army (42:10) - Story # 7: Are you ready? Anthropic preparing to release Mythos publicly (46:38) - Story # 8: Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark (49:12) - Story # 9: Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit (50:43) - Story # 10: Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked (56:02) - Story # 11: Kali365 phishing kit bypasses MFA and steals Microsoft logins (58:02) - Story # 12: Botnet of more than 17 million devices dismantled (01:01:13) - Story # 13: United flight returns midair after Bluetooth device name reportedly sparks security scare (01:03:49) - Story # 14: Inside the Charter data breach: hackers leak 13M+ customer data (01:04:37) - Introducing EvidenceForge: Synthetic security logs that don’t look (as) fake (01:10:04) - Threat Hunter Summit | June 17th 2026 (01:10:57) - Anti-Cast : How Hackers Attack CI/CD Pipelines w/ Phil Miller (01:11:36) - Cyber Threat Intelligence 101 2-Day Version (01:11:57) - Ralph's Practical Physical Exploitation Training & Tool Bundle Links00:00:00 - PreShow Banter™ — Solving this thing00:03:52 - Anti-Tech Extremism - 2026-06-0100:08:08 - Threat Hunter Summit | June 17th 202600:12:11 - Story # 1: US Law Enforcement Warns of ‘Anti-Tech Extremism’ as AI Hatred Grows00:20:54 - Story # 2: Anthropic files for its IPO00:23:36 - Story # 3: FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data00:29:41 - Story # 4: Microsoft Defender can now automatically isolate hacked endpoints00:30:46 - Story # 5: Microsoft’s GitHub bans security researcher who posted zero-day Windows exploits because company ‘ruined their life’00:36:54 - Story # 6: Cyber Force? Senator pushes to create service branch under the Army00:42:11 - Story # 7: Are you ready? Anthropic preparing to release Mythos publicly00:46:39 - Story # 8: Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark00:49:12 - Story # 9: Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit00:50:44 - Story # 10: Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked00:56:03 - Story # 11: Kali365 phishing kit bypasses MFA and steals Microsoft logins00:58:02 - Story # 12: Botnet of more than 17 million devices dismantled01:01:13 - Story # 13: United flight returns midair after Bluetooth device name reportedly sparks security scare01:03:50 - Story # 14: Inside the Charter data breach: hackers leak 13M+ customer data01:04:38 - Introducing EvidenceForge: Synthetic security logs that don’t look (as) fake01:10:05 - Threat Hunter Summit | June 17th 202601:10:57 - Anti-Cast : How Hackers Attack CI/CD Pipelines w/ Phil Miller01:11:37 - Cyber Threat Intelligence 101 2-Day Version01:11:58 - Ralph’s Practical Physical Exploitation Training & Tool BundleCreators & Guests Corey Ham - Host Ralph May - Host Shane Hartman - Guest Wade Wells - Host Ryan Poirier - Producer David Bianco - Guest Phil Miller - Guest Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  GitHub bans vindictive security researcher - 2026-05-26 30.05.2026 1t 2min

  This episode covers a CISA contractor’s accidental exposure of AWS GovCloud credentials and internal system details on GitHub, the FBI’s efforts to patch vulnerable routers, and a critical NGINX vulnerability with public proof-of-concept code. The team also discusses Microsoft’s handling of a disputed Azure Backup security finding, the challenges of vulnerability disclosure and CVE assignment, and GitHub’s ban of security researcher Nightmare Eclipse following the publication of unpatched Windows vulnerability research.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Getting to Chili's (05:45) - GitHub bans vindictive security researcher - 2026-05-26 (07:09) - Story # 1: CISA Admin Leaked AWS GovCloud Keys on Github (10:45) - Story # 2 - PoC Code Published for Critical NGINX Vulnerability (12:53) - Story # 3 - Anthropic’s restricted Claude Mythos model may be coming to Claude Code (16:16) - Story # 4 - The FBI just remotely reset thousands of home and small office routers – and your TP-Link could be on the hitlist (22:37) - Story # 5 - Drupal to Release Emergency Core Security Updates Amid Fears of Rapid Exploitation (25:52) - Story # 6 - Microsoft rejects critical Azure vulnerability report, no CVE issued (28:09) - Story # 7 - GitHub bans vindictive security researcher dropping Windows zero-days: “I will make sure your bones are shattered” (30:41) - Story # 8a - A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale (32:16) - Story # 8b - TeamPCP breached GitHub’s internal codebase via poisoned VS Code extension (35:21) - Story # 10 - Ubiquiti patches three max severity UniFi OS vulnerabilities (37:51) - Story # 11 - Pizza Hut's AI system caused 'cascading' problems and $100M in damages, franchisee alleges in new suit (43:55) - Story # 12 - Data Leak at German Hospital (45:00) - Story # 13 - Microsoft shuts down illegal code-signing operation used by ransomware crims to mask their malware (47:50) - Story # 14 - Chicken News (50:07) - Story # 15 - New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released (51:04) - Story # 15b - Might someone pass along that Crowdstrike and Nessus are having a moment? LinksStory # 1 - CISA Admin Leaked AWS GovCloud Keys on GithubStory # 2 - PoC Code Published for Critical NGINX VulnerabilityStory # 3 - Anthropic’s restricted Claude Mythos model may be coming to Claude CodeStory # 4 - The FBI just remotely reset thousands of home and small office routers – and your TP-Link could be on the hitlistStory # 5 - Drupal to Release Emergency Core Security Updates Amid Fears of Rapid ExploitationStory # 6 - Microsoft rejects critical Azure vulnerability report, no CVE issuedStory # 7 - GitHub bans vindictive security researcher dropping Windows zero-days: “I will make sure your bones are shattered”Story # 8a - A Hacker Group Is Poisoning Open Source Code at an Unprecedented ScaleStory # 8b - TeamPCP breached GitHub’s internal codebase via poisoned VS Code extensionStory # 10 - Ubiquiti patches three max severity UniFi OS vulnerabilitiesStory # 11 - Pizza Hut’s AI system caused ‘cascading’ problems and $100M in damages, franchisee alleges in new suitStory # 12 - Data Leak at German HospitalStory # 13 - Microsoft shuts down illegal code-signing operation used by ransomware crims to mask their malwareStory # 14 - Chicken NewsStory # 15 - New Windows ‘MiniPlasma’ zero-day exploit gives SYSTEM access, PoC releasedStory # 15b - Might someone pass along that Crowdstrike and Nessus are having a moment?Creators & Guests Alethe Denis - Guest Corey Ham - Host Wade Wells - Host Bronwen Aker - Host Meagan Bentley - Producer Hayden Covington - Host Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  Mythos finds a curl vulnerability - 2026-05-18 22.05.2026 1t 6min

  This episode covers Mythos uncovering a vulnerability in cURL, a recent Google Threat Intelligence report on a zero-day exploit, and the growing impact of AI on capture-the-flag competitions and bug bounty programs. The hosts also discuss the economics of AI platforms like OpenAI, security research trends, and broader concerns around software vulnerabilities, automation, and defensive tooling.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Token CTFs (03:18) - Story # 1: Mythos finds a curl vulnerability (06:36) - Story # 2: Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation (14:47) - Story # 3: The down fall of bug bounties (15:34) - Story # 3: Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’ (40:52) - Story # 4: Germany to Flood Ukraine’s Front Lines With Hundreds of New GEREON Combat Robots (43:51) - Story # 4b: Wild Video Shows Delivery Robots Causing Havoc, Getting Obliterated (49:35) - Story # 5: Windows BitLocker zero-day gives access to protected drives, PoC released (56:09) - Story # 6: Deal reached with hackers to delete data stolen from the Canvas educational platform (58:07) - Story # 7: Celebrities’ and influencers’ private communications exposed in stalkerware data breach (58:54) - Story # 8: Exclusive: Hackers have breached tank readers at US gas stations; officials suspect Iran is responsible (01:00:29) - Threat Hunting Summit Talk: Threat Hunting in the Dark: A Practical Approach (01:04:47) - WEBCAST: Looking at A.I. Wrong with John Strand, BB King and Derek Banks LinksStory # 1: Mythos finds a curl vulnerabilityStory # 2: Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass ExploitationStory # 3: The down fall of bug bountiesStory # 3: Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’Story # 4: Germany to Flood Ukraine’s Front Lines With Hundreds of New GEREON Combat RobotsStory # 4b: Wild Video Shows Delivery Robots Causing Havoc, Getting ObliteratedStory # 5: Windows BitLocker zero-day gives access to protected drives, PoC releasedStory # 6: Deal reached with hackers to delete data stolen from the Canvas educational platformStory # 7: Celebrities’ and influencers’ private communications exposed in stalkerware data breachStory # 8: Exclusive: Hackers have breached tank readers at US gas stations; officials suspect Iran is responsibleThreat Hunting Summit Talk: Threat Hunting in the Dark: A Practical ApproachWEBCAST: Looking at A.I. Wrong with John Strand, BB King and Derek BanksCreators & Guests John Strand - Host Corey Ham - Host Wade Wells - Host Bronwen Aker - Host Ralph May - Host Shane Hartman - Guest Meagan Bentley - Producer Hayden Covington - Host Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  The Canvas / Instructure Breach – 2026-05-11 11.05.2026 1t 3min

  Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatThis episode of Talking About News focuses on the reported Canvas/Instructure breach, including discussion around ShinyHunters, transparency concerns, higher education security challenges, and possible attack paths involving phishing and tenant compromise. The team also explores broader cybersecurity trends such as social engineering, ransomware pressure tactics, and the growing role of AI and platform security in modern enterprise environments.Chapters(00:00) - PreShow Banter™ — Californian Problems (02:25) - The Canvas / Instructure Breach – 2026-05-11 (10:23) - Story # 1: Canvas Breach Disrupts Schools & Colleges Nationwide (13:45) - Story # 1b: Security Incident Update & FAQs (43:14) - Story # 2: Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer (47:34) - Story # 3: Google Chrome silently installs a 4 GB AI model on your device without consent. (52:19) - Story # 4: Trellix source code breach claimed by RansomHouse hackers (58:12) - Story # 5: Rose Acre Farms Targeted in Alleged Lynx Ransomware Attack - Cybersecurity LinksStory # 1: Canvas Breach Disrupts Schools & Colleges NationwideStory # 1b: Security Incident Update & FAQsStory # 2: Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peerStory # 3: Google Chrome silently installs a 4 GB AI model on your device without consent.Story # 4: Trellix source code breach claimed by RansomHouse hackersStory # 5: Rose Acre Farms Targeted in Alleged Lynx Ransomware Attack - CybersecurityWade's Workshop: Threat Actor Profiling: Know Your EnemyAlethe Denis' Webcast: How to Build a Bulletproof PretextAlethe Denis' Workshop: How to Build Pressure-Proof PretextsCreators & Guests John Strand - Host Corey Ham - Host Wade Wells - Host Ched "cheddar" Wiggins - Guest Bronwen Aker - Host Hayden Covington - Host Ryan Poirier - Producer Alethe Denis - Guest Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  Utah Bans VPN Age Bypass - 2026-05-04 10.05.2026 1t 10min

  Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatThis episode covers several major cybersecurity and technology news stories, including Utah’s proposed crackdown on VPNs used to bypass online age-verification systems and the privacy and enforcement concerns surrounding those laws. The hosts also discuss newly disclosed MOVEit Transfer vulnerabilities and patching guidance, software trust and code-signing weaknesses, and broader issues around internet regulation and digital identity verification. Additional discussion touches on AI, science-fiction-inspired technology concepts, relativity and time dilation, and other notable developments from the week in cybersecurity and tech news.Chapters(00:00) - PreShow Banter™ — Alien Communications 101 (03:38) - Utah Bans VPN Age Bypass - 2026-05-04 (09:13) - Story #1 - DigiCert Revokes Certificates After Support Portal Hack (15:25) - Story #2 - Progress warns of critical MOVEit Automation auth bypass flaw (16:44) - Story #3 - Critical cPanel and WHM bug exploited as a zero-day, PoC now available (23:33) - Story #4 - Copy Fail (26:17) - Story #5 - Claude-powered AI coding agent deletes entire company database in 9 seconds — backups zapped, after Cursor tool powered by Anthropic's Claude goes rogue (33:42) - Story #6 - Elon Musk testifies that xAI trained Grok on OpenAI models (38:51) - Story #7 - Utah first state to hold websites liable for users who mask their location with VPNs — law goes into effect, designed to prevent bypassing age checks (51:23) - Story #8 - Why you should refuse to let your doctor record you (56:19) - Story #9 - Technique Change Type: How the ATT&CK Object Changed LinksCreators & Guests Corey Ham - Host Wade Wells - Host Ralph May - Host Tim Medin - Guest Patrick Gorman - Guest Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  NASA Gets Phished by Chinese - 2026-04-27 28.04.2026 1t 10min

  This episode dives into the economics and competitive dynamics of the AI industry, including discussions on profitability, pricing strategies, monopolization, and the rise of open and distilled models—particularly concerns around Chinese AI competition. The hosts also cover a reported long-running phishing campaign linked to Chinese actors targeting NASA-affiliated researchers and engineers, highlighting how social engineering was used to extract sensitive aerospace information.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Making More Money than OpenAI (04:58) - NASA Gets Phished by Chinese - 2026-04-27 (07:22) - Story # 1: ‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty (13:07) - Story # 2: A Mexican surveillance giant you’ve never heard of is now watching the U.S. border (19:59) - Story # 3: Scam messages offering ships safe transit through Hormuz, security firm warns (24:24) - Story # 4: Apple fixes bug that let the FBI recover deleted Signal messages (27:49) - Story # 5: Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign (30:28) - Story # 6: cDc communications | CULT OF THE DEAD COW | The Hacktivismo Declaration: Rebooted 2026-04-21 (34:07) - Story # 7: NASA Employees Duped in Chinese Phishing Scheme Targeting U.S. Defense Software (36:29) - Story # 8: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite (41:34) - Story # 9: Discord group says it accessed Claude Mythos by guessing location (44:19) - Story # 10: Introducing GPT‑5.5 (46:46) - Story # 11: CERT-In Advisory CIAD-2026-0020 (50:47) - Story # 12: pro j e c t d e a l LinksStory # 1: ‘Scattered Spider’ Member ‘Tylerb’ Pleads GuiltyStory # 2: A Mexican surveillance giant you’ve never heard of is now watching the U.S. borderStory # 3: Scam messages offering ships safe transit through Hormuz, security firm warnsStory # 4: Apple fixes bug that let the FBI recover deleted Signal messagesStory # 5: Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain CampaignStory # 6: cDc communications | CULT OF THE DEAD COW | The Hacktivismo Declaration: Rebooted 2026-04-21Story # 7: NASA Employees Duped in Chinese Phishing Scheme Targeting U.S. Defense SoftwareStory # 8: How UNC6692 Employed Social Engineering to Deploy a Custom Malware SuiteStory # 9: Discord group says it accessed Claude Mythos by guessing locationStory # 10: Introducing GPT‑5.5Story # 11: CERT-In Advisory CIAD-2026-0020Story # 12: pro j e c t d e a lCreators & Guests Aisling nic Lynne "siriciryel" - Guest Corey Ham - Host John Strand - Host Ralph May - Host Hayden Covington - Host Wade Wells - Host Ryan Poirier - Producer Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  Tim Cook Announces Apple CEO Exit - 2026-04-20 22.04.2026 1t 4min

  This episode covers several major cybersecurity and tech news stories, including a supply chain–related breach at Vercel involving exposed environment variables and compromised third-party AI tooling. The hosts also discuss concerns around AI-driven data risks, including browser extensions and large-scale data collection. Additional topics include a service scraping and republishing Zoom webinar recordings, evolving issues with web cookies and tracking, and industry news such as reports of Apple CEO Tim Cook stepping down.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Watch Out for the Brownies (04:35) - Tim Cook Announces Apple CEO Exit - 2026-04-20 (05:57) - Story # 1: Vercel April 2026 security incident (19:00) - Story # 2: 'Addicted to hacking': Young hacker behind historic breach speaks out for 1st time, before reporting to prison (27:19) - Story # 3: Mythos And The CVSS Problem No One Wants to Talk About (But We Need To) (28:49) - Story # 4: Introducing Claude Opus 4.7 (32:14) - Story # 4b: Identity verification on Claude (36:00) - Story # 5: Tim Cook to become Apple Executive Chairman John Ternus to become Apple CEO (40:18) - Story # 6: Microsoft faces fresh Windows Recall security concerns (44:12) - Story # 7: WebinarTV Secretly Scraped Zoom Meetings of Anonymous Recovery Programs (48:20) - Story # 8: Google, Microsoft, Meta All Tracking You Even When You Opt Out, According to an Independent Audit (51:12) - Story # 9: Little Caesars Wants ChatGPT to Order Your Pizza for You (53:35) - Story # 10: NIST Updates NVD Operations to Address Record CVE Growth (01:00:08) - Workshop: Rapid Endpoint Investigations for Linux and Mac (01:01:20) - Cyber Threat Intelligence 101 2 Day Version (01:02:24) - ANTI-CAST: How to Break Free from the Cybersecurity Burnout Trap w/ Natalia Samman LinksStory # 1: Vercel April 2026 security incidentStory # 2: ‘Addicted to hacking’: Young hacker behind historic breach speaks out for 1st time, before reporting to prisonStory # 3: Mythos And The CVSS Problem No One Wants to Talk About (But We Need To)Story # 4: Introducing Claude Opus 4.7Story # 4b: Identity verification on ClaudeStory # 5: Tim Cook to become Apple Executive Chairman John Ternus to become Apple CEOStory # 6: Microsoft faces fresh Windows Recall security concernsStory # 7: WebinarTV Secretly Scraped Zoom Meetings of Anonymous Recovery ProgramsStory # 8: Google, Microsoft, Meta All Tracking You Even When You Opt Out, According to an Independent AuditStory # 9: Little Caesars Wants ChatGPT to Order Your Pizza for YouStory # 10: NIST Updates NVD Operations to Address Record CVE GrowthWorkshop: Rapid Endpoint Investigations for Linux and MacCyber Threat Intelligence 101 2 Day VersionANTI-CAST: How to Break Free from the Cybersecurity Burnout Trap w/ Natalia SammanCreators & Guests Corey Ham - Host Ralph May - Host Patterson Cake - Guest Wade Wells - Host Bronwen Aker - Host Meagan Bentley - Producer Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  Anthropic’s Project Glasswing is an Infosec Turning Point – 2026-04-13 14.04.2026 1t 6min

  This episode dives into Anthropic’s “Project Glasswing” and the broader implications of AI-driven offensive security, including models autonomously discovering vulnerabilities and attempting sandbox escapes. The hosts discuss how agentic AI testing approaches could reshape vulnerability research, while also raising concerns about AI safety, regulation, and real-world risk. Additional topics include the growing impact of AI on security workflows, rising infrastructure costs tied to AI demand, a new infostealer ecosystem overview, and ongoing debates about data collection practices and platform privacy.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — A Real Studio (03:43) - Anthropic’s Project Glasswing is an Infosec Turning Point – 2026-04-13 (05:39) - Story # 1: Project Glasswing (22:20) - Story # 2: AI-Led Remediation Crisis Prompts HackerOne to Pause Bug Bounties (30:36) - Story # 3: Disgruntled researcher leaks “BlueHammer” Windows zero-day exploit (32:39) - WEBCAST: Proxy Execution with Microsoft Edge WebView2 w/ Matthew Eidelberg (51:47) - Story # 4: New "BrowserGate" report claims LinkedIn secretly scans user browsers for installed extensions and collects device data (56:32) - Story # 5: The silent “Storm”: New infostealer hijacks sessions, decrypts server-side (58:46) - ChickenSec: the Chicken Accords of 2026 (01:00:27) - Story # 6: EFF is Leaving X (01:03:01) - Workshop: How to Think Like a Cybersecurity Defender (01:05:49) - AI Security Ops Podcast LinksStory # 1: Project GlasswingStory # 2: AI-Led Remediation Crisis Prompts HackerOne to Pause Bug BountiesStory # 3: Disgruntled researcher leaks “BlueHammer” Windows zero-day exploitWEBCAST: Proxy Execution with Microsoft Edge WebView2 w/ Matthew EidelbergStory # 4: New “BrowserGate” report claims LinkedIn secretly scans user browsers for installed extensions and collects device dataStory # 5: The silent “Storm”: New infostealer hijacks sessions, decrypts server-sideChickenSec: the Chicken Accords of 2026Story # 6: EFF is Leaving XWorkshop: How to Think Like a Cybersecurity DefenderAI Security Ops PodcastCreators & Guests Corey Ham - Host Wade Wells - Host Alex Minster "Belouve" - Guest Bronwen Aker - Host Ralph May - Host John Strand - Host Doc Blackburn - Guest Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  Artemis Astronaut's Bad Outlooks - 2026-04-06 09.04.2026 1t 6min

  This episode covers several major cybersecurity and tech news stories, including a sophisticated NPM supply chain attack that compromised the widely used Axios library through advanced social engineering, and the broader implications for software security. The hosts also discuss the accidental leak of Anthropic’s Claude codebase, what it reveals about AI development practices, and the risks of misconfigurations exposing sensitive systems. Additional conversation touches on AI reliability, “vibe-coded” software, and the growing role of AI in both development and attack techniques.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Professional Sitters (04:36) - Artemis Astronaut's Bad Outlooks - 2026-04-06 (07:12) - The Absolute Truths of Cybersecurity with Doc Blackburn (08:52) - Professionally Evil API Testing: AAA and Keys are Not Just for Cars (09:35) - Story # 1: Post Mortem: axios npm supply chain compromise (19:54) - Story # 2: Artemis II astronaut: 'I have two Microsoft Outlooks, and neither one of those are working' (26:02) - Story # 3: Microsoft Copilot Terms of Service Label Copilot is for Entertainment Purposes Only (30:13) - Story # 4: Here’s what that Claude Code source leak reveals about Anthropic’s plans (35:03) - Story # 4b: https://neuromatch.social/@jonny/116325123136895805 (37:57) - Story # 5: Meta freezes AI data work after breach puts training secrets at risk (41:40) - Story # 6: Possible US Government iPhone Hacking Tool Leaked (44:32) - Story # 7: FBI labels data breach ‘major incident,’ notifies Congress (46:58) - Story # 8: vSphere and BRICKSTORM Malware: A Defender's Guide (52:12) - Story # 9: CBP Facility Codes Sure Seem to Have Leaked Via Online Flashcards (01:04:26) - ChickenSec: Why did the chicken wear a reflective vest? To cross the road of course LinksThe Absolute Truths of Cybersecurity with Doc BlackburnProfessionally Evil API Testing: AAA and Keys are Not Just for CarsStory # 1: Post Mortem: axios npm supply chain compromiseStory # 2: Artemis II astronaut: ‘I have two Microsoft Outlooks, and neither one of those are working’Story # 3: Microsoft Copilot Terms of Service Label Copilot is for Entertainment Purposes OnlyStory # 4: Here’s what that Claude Code source leak reveals about Anthropic’s plansStory # 4b: https://neuromatch.social/@jonny/116325123136895805Story # 5: Meta freezes AI data work after breach puts training secrets at riskStory # 6: Possible US Government iPhone Hacking Tool LeakedStory # 7: FBI labels data breach ‘major incident,’ notifies CongressStory # 8: vSphere and BRICKSTORM Malware: A Defender’s GuideStory # 9: CBP Facility Codes Sure Seem to Have Leaked Via Online FlashcardsChickenSec: Why did the chicken wear a reflective vest? To cross the road of courseCreators & Guests Jennifer Shannon - Guest Wade Wells - Host Corey Ham - Host Ralph May - Host Ryan Poirier - Producer Bronwen Aker - Host Doc Blackburn - Guest Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  FCC Blocks Foreign-Made Routers – 2026-03-30 01.04.2026 1t 7min

  This episode covers the FCC’s move to restrict or ban certain foreign-made networking equipment—especially routers tied to Chinese manufacturers—highlighting the potential cybersecurity risks, supply chain implications, and how the rule could affect ISPs and consumers. The hosts also discuss broader concerns around hardware trust, existing infrastructure, and what qualifies as “approved” devices under FCC guidelines, along with a brief, lighter mention of a viral robot incident making the rounds online.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Robot Handlers (05:11) - FCC Blocks Foreign-Made Routers – 2026-03-30 (06:44) - Story # 1: FCC moves to block new foreign-made routers (17:00) - Story # 2: FBI Chief Kash Patel’s Gmail Account was Hacked by Iranian Hackers (20:07) - Story # 3: FancyBear Exposed: Major OPSEC Blunder Inside Russian Espionage Ops (24:18) - Story # 4: LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP supply chain campaign (27:49) - Story # 4b: TeamPCP Supply Chain Campaign (42:45) - Story # 5: Spylandia: How a Stretch of Florida Real Estate Has Become a Covert Corridor for Chinese and Russian Spies (45:51) - Story # 6: Anthropic readies Mythos model with high cybersecurity risk (57:31) - Story # 7: Google Ships WebMCP, The Browser-Based Backbone For The Agentic Web (01:02:24) - Story # 8: DDR5 Memory Prices Just Took a Noticeable Dive for the First Time in Months, and Google’s TurboQuant Might Be Behind It (01:04:03) - Securing the Cloud: Foundations by Andrew Krug (01:04:47) - Incident Response Simplified by Patterson Cake News LinksStory # 1: FCC moves to block new foreign-made routersStory # 2: FBI Chief Kash Patel’s Gmail Account was Hacked by Iranian HackersStory # 3: FancyBear Exposed: Major OPSEC Blunder Inside Russian Espionage OpsStory # 4: LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP supply chain campaignStory # 4b: TeamPCP Supply Chain CampaignStory # 5: Spylandia: How a Stretch of Florida Real Estate Has Become a Covert Corridor for Chinese and Russian SpiesStory # 6: Anthropic readies Mythos model with high cybersecurity riskStory # 7: Google Ships WebMCP, The Browser-Based Backbone For The Agentic WebStory # 8: DDR5 Memory Prices Just Took a Noticeable Dive for the First Time in Months, and Google’s TurboQuant Might Be Behind ItSecuring the Cloud: Foundations by Andrew KrugIncident Response Simplified by Patterson CakeCreators & Guests Andy Pettit "Nerf" - Guest Andrew Krug - Guest Wade Wells - Host Corey Ham - Host Bronwen Aker - Host Patterson Cake - Guest Ryan Poirier - Producer Ralph May - Host Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  Pentagon Plans to Train AI With Classified Data – 2026-03-23 27.03.2026 1t 4min

  This episode covers a range of cybersecurity and AI-related news, including how Pokémon Go players may have unknowingly helped train delivery robots using massive image datasets. The hosts also discuss the Pentagon’s reported plans to train AI systems on classified data and the potential risks of exposing sensitive information. Additional topics include major data breaches (such as a third-party breach impacting Crunchyroll user data), ongoing challenges in cybersecurity practices, evolving AI security concerns, and real-world examples of exploits and vulnerabilities affecting mobile devices and organizations.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Easier Than Printers (05:20) - Pentagon Plans to Train AI With Classified Data – BHIS - Talkin' Bout [infosec] News 2026-03-23 (06:38) - Story # 1: Sears Exposed AI Chatbot Phone Calls and Text Chats to Anyone on the Web (07:38) - Story # 1b: ALT Link - Sears Exposed AI Chatbot Phone Calls and Text Chats to Anyone on the Web (15:35) - Story # 2: Federal cyber experts called Microsoft’s cloud a “pile of shit,” approved it anyway (24:31) - Story # 3: The Pentagon is planning for AI companies to train on classified data, defense official says (34:04) - Story # 4: CISA Urges Endpoint Management System Hardening After Cyberattack Against US Organization (37:50) - Story # 5: Warning: Your AI-Generated Password Is a Major Security Risk. Here’s What to Use Instead (42:21) - Story # 6: CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE-2026-20963) (49:57) - Story # 7: Massive China Data Leak: Hackers Access 10 Petabytes of Weapons Testing Data (51:28) - Story # 8: Anime fans' credit cards might be stolen from Sony streamer Crunchyroll (55:03) - Story # 9: The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors LinksStory # 1: Sears Exposed AI Chatbot Phone Calls and Text Chats to Anyone on the WebStory # 1b: ALT Link - Sears Exposed AI Chatbot Phone Calls and Text Chats to Anyone on the WebStory # 2: Federal cyber experts called Microsoft’s cloud a “pile of shit,” approved it anywayStory # 3: The Pentagon is planning for AI companies to train on classified data, defense official saysStory # 4: CISA Urges Endpoint Management System Hardening After Cyberattack Against US OrganizationStory # 5: Warning: Your AI-Generated Password Is a Major Security Risk. Here’s What to Use InsteadStory # 6: CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE-2026-20963)Story # 7: Massive China Data Leak: Hackers Access 10 Petabytes of Weapons Testing DataStory # 8: Anime fans’ credit cards might be stolen from Sony streamer CrunchyrollStory # 9: The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat ActorsCreators & Guests John Strand - Host Ralph May - Host Chadd Watson - Guest Wade Wells - Host Alex Minster "Belouve" - Guest Hayden Covington - Host Bruce Potter - Guest Ryan Poirier - Producer Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  Iranian Hackers Claim Responsibility for Stryker Attack - 2026-03-16 17.03.2026 1t 1min

  This episode covers multiple cybersecurity news stories, including Iranian hackers claiming responsibility for a cyberattack on Stryker, ongoing challenges in attributing nation-state cyber operations, and broader trends in global cyber conflict. The hosts also discuss the reliability of public breach claims, emerging threats targeting critical industries, and how organizations are responding to an increasingly complex threat landscape.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Organizing Family Beets (04:02) - Iranian Hackers Claim Responsibility for Stryker Attack - 2026-03-16 (08:56) - Story # 1: Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker (23:38) - Story # 2: How We Hacked McKinsey's AI Platform (32:30) - Story # 3: Amazon holds engineering meeting following AI-related outages (39:11) - Story # 4: Meta gets into social networks for AI agents with acquisition of viral Moltbook platform (45:24) - Story # 5: Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026 (50:45) - Story # 6: Michelin Confirms Data Breach Linked to Oracle EBS Attack (51:08) - Story # 7: New Dohdoor malware campaign targets education and health care (58:10) - Story # 8: Man's dog was riddled with tumors and dying. He used ChatGPT to design a custom cancer vaccine, stunning researchers LinksStory # 1: Iran-Backed Hackers Claim Wiper Attack on Medtech Firm StrykerStory # 2: How We Hacked McKinsey’s AI PlatformStory # 3: Amazon holds engineering meeting following AI-related outagesStory # 4: Meta gets into social networks for AI agents with acquisition of viral Moltbook platformStory # 5: Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026Story # 6: Michelin Confirms Data Breach Linked to Oracle EBS AttackStory # 7: New Dohdoor malware campaign targets education and health careStory # 8: Man’s dog was riddled with tumors and dying. He used ChatGPT to design a custom cancer vaccine, stunning researchersCreators & Guests Dan Rearden (Haircutfish) - Guest Bronwen Aker - Host Ralph May - Host John Strand - Host Troy Wojewoda - Guest Corey Ham - Host Hayden Covington - Host Wade Wells - Host Meagan Bentley - Producer Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com
• 
  A Nightmare of Vibeware - 2026-03-09 10.03.2026 1t

  Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — That's Not How It Works (03:40) - A Nightmare of Vibeware – 2026-03-09 (04:54) - Story # 1: APT36: A Nightmare of Vibeware (13:56) - Story # 2: Oracle Layoffs: Tech giant to slash 30,000 jobs as banks pull out from financing AI data centres (16:28) - Story # 3: Iran-linked hacktivist groups target US infrastructure after Feb 28 strikes, cyber activity surges: Report (24:28) - Story # 4: Introducing the First Frontier Suite built on Intelligence + Trust (28:59) - Story # 5: Motorola partners with GrapheneOS for future phones (29:13) - Story # 5b: GrapheneOS: Microsoft Authenticator does not support secure Android OS (29:53) - Story # 6: Western allies form 6G security coalition amid tech rivalry with China (34:01) - Story # 7: ShinyHunters claims ongoing Salesforce Aura data theft attacks (35:47) - Story # 8: Doppelgänger / RRN Disinformation Infrastructure Ecosystem 2026 (44:33) - Story # 9: LexisNexis confirms data breach as hackers leak stolen files (49:10) - Story # 10: Google urges Supreme Court to strike down geofence warrants as unconstitutional (55:59) - ANTI-CAST : How to Detect Malicious Remote Workers w/ James McQuiggan (56:47) - SOC Summit 2026 LinksStory # 1: APT36: A Nightmare of VibewareStory # 2: Oracle Layoffs: Tech giant to slash 30,000 jobs as banks pull out from financing AI data centresStory # 3: Iran-linked hacktivist groups target US infrastructure after Feb 28 strikes, cyber activity surges: ReportStory # 4: Introducing the First Frontier Suite built on Intelligence + TrustStory # 5: Motorola partners with GrapheneOS for future phonesStory # 5b: GrapheneOS: Microsoft Authenticator does not support secure Android OSStory # 6: Western allies form 6G security coalition amid tech rivalry with ChinaStory # 7: ShinyHunters claims ongoing Salesforce Aura data theft attacksStory # 8: Doppelgänger / RRN Disinformation Infrastructure Ecosystem 2026Story # 9: LexisNexis confirms data breach as hackers leak stolen filesStory # 10: Google urges Supreme Court to strike down geofence warrants as unconstitutionalANTI-CAST : How to Detect Malicious Remote Workers w/ James McQuigganTroy & Wade’s Upcoming Things:– Antisyphon Training SOC Summit 2026– Breach Assessment - The Curious Case of the Comburglar w/ Troy Wojewoda– Network Forensics and Incident Response with Troy Wojewoda🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com