Interviews with security luminaries, technical segments and hacking/security news. Find links to all the news stories we’ve discussed and technical how-to information here!

http://www.securityweekly.com

Paul's Security Weekly

Recent findings of AI ecosystem insecurities and attacks show the importance of needing AI governance in the supply chain. And this supply chain is rapidly expanding to include not only open-source software but also collaborative platforms where custom models, agents, prompts, and other AI resources are used. And with this expansion of third-party AI component and services use comes an expanded security threat often not included in traditional supply chain management processes. It's time to update our supply chain management process to include AI governance. Easier said than done. In this Say Easy, Do Hard segment, we invite three CISOs to discuss the challenges of AI and the supply chain, including:  Data privacy concerns Flaws and malicious code in AI dependencies Lack of security tools to test for AI Vibe coding risks  and more. But we also do the hard part, by discussing the changes needed to your supply chain management process to address these concerns. Visit  for all the latest episodes! Show Notes:

Say Easy, Do Hard - AI Governance in the Supply Chain - Richard Bird, Nick Mistry - BSW #407

This week we have, SonicWall, Confidential Informants Exposed, Cisco Vishing, Perplexity vs robots.txt, Microsoft’s Project Ire, Meta–Flo Jury Verdict, GPT‑5 Lands, TeaOnHer Data Leak, Josh Marpet, and more on the Security Weekly News.. Visit  for all the latest episodes! Show Notes:

SonicWall, Informants Exposed, Cisco Vishing, Perplexity, GPT‑5, Josh Marpet–SWN #501 - SWN #501

Why should hate AI When firmware attacks The 300 second breach Old ways still work, AI might help And so begins the crawler wars Turn off your SonicWall VPN Your Pie may be wrapped in PII Attackers will find a way Signed kernel drivers D-Link on the KEV Rasperry PIs attack Stealthy LoRa LLM's don't commit code, people do Jame's Bond style rescue with drones SRAM has no chill In the full view of the public...  Visit  for all the latest episodes! Show Notes:

Devices Are Attacking - PSW #886

Open source software is a massive contribution that provides everything from foundational frameworks to tiny single-purpose libraries. We walk through the dimensions of trust and provenance in the software supply chain with Janet Worthington. And we discuss how even with new code generated by LLMs and new terms like slopsquatting, a lot of the most effective solutions are old techniques. Resources     Show Notes:

The Future of Supply Chain Security - Janet Worthington - ASW #343

300 Baud, Buddy Hackett Nudes, Dell, badUSB, Exchange, Erlang/OTP, Josh Marpet, and more on the Security Weekly News. Visit  for all the latest episodes! Show Notes:

300 Baud, Buddy Hackett Nudes, Dell, badUSB, Exchange, Erlang/OTP, Josh Marpet... - SWN #502

We kick things off with a deep dive into the Hackberry PI and how to build one. Then in the security news:  Will Perplexity buy Chrome? ESP32 Bus Pirates Poisoned telemetry Docker image security Fully Open Source Quantum Sensors Securing your car, Flippers, and show me the money Bringing your printer and desktop to Starbucks Paying a ransom? You need approval AI: Shield or Spear? No authentication? That's a problem Transient Bugs: A realistic threat? You can run Linux And who still uses AOL dial-up?  Visit  for all the latest episodes! Show Notes:

Hackberry PIs and Other Hacker Things - PSW #887

A smaller attack surface should lead to a smaller list of CVEs to track, which in turn should lead to a smaller set of vulns that you should care about. But in practice, keeping something like a container image small has a lot of challenges in terms of what should be considered minimal. Neil Carpenter shares advice and anecdotes on what it takes to refine a container image and to change an org's expectations that every CVE needs to be fixed. Visit  for all the latest episodes! Show Notes:

Managing the Minimization of a Container Attack Surface - Neil Carpenter - ASW #344

The industry is obsessed with vulnerabilities. From vulnerability assessment to vulnerability management to exposure management and even zero days, we love to talk about vulnerabilities. But what about misconfiguration? By definition it's a vulnerability or weakness, but it doesn't have a CVE (common vulnerability enumeration). Should we ignore it? Danny Jenkins, CEO and Founder at ThreatLocker, joins BSW to discuss why misconfigurations matter. Simply, you can prevent many cyberattacks by eliminating your misconfigurations. That's why ThreatLocker released Defense Against Configurations (DAC). Danny will discuss the benefits of DAC, including:  Immediate visibility into system misconfigurations before they become vulnerabilities Compliance transparency, showing exactly where systems fall short of industry standards One unified view, with filters by criticality, system, and framework Actionable insights, updated weekly and delivered straight to customers’ inboxes  Segment Resources:     This segment is sponsored by ThreatLocker. Visit  to learn more about them! In the leadership and communications segment, CEO Blind Spots That Put Your Company at Risk, The CISO Mindset Shift: From Risk Defender to Business Accelerator in the Age of AI, When “Yes, and…” Backfires, and more! Visit  for all the latest episodes! Show Notes:

Misconfiguration, The Forgotten Vulnerability and the Power and Failure of "Yes" - Danny Jenkins - BSW #409

This segment is sponsored by Flashpoint. Visit  to learn more about them! Recent leaks tied to LockBit and Black Basta have exposed the inner workings of two of the most notorious ransomware groups—revealing their tactics, negotiation strategies, and operational infrastructure. For defenders, this rare window into adversary behavior offers critical intelligence to strengthen incident response and prevention strategies. In this interview, we'll break down what these leaks reveal and how security teams can use this intelligence to proactively harden their defenses, including:  Key takeaways from the LockBit and Black Basta leaks—and what they confirm about ransomware operations How leaked playbooks, chats, and toolkits can inform detection and response Practical steps to defend against modern ransomware tactics in 2025  In the security news:  Practical exploit code Old vulnerabilities, new attackers AI and web scraping - the battle continues 0-Days: You gotta prove it WinRAR 0-Day LLM patch diffing $20 million bug bounty Your APT is showing Hacking from the routers Its that easy eh? NIST guidance on AI Words have meaning Developers knowingly push vulnerable code My Hackberry PI post is live:   Resources:  Inside the LockBit Leak: Rare Insights Into Their Operations:  2025 Ransomware Survival Guide:  AI and Threat Intelligence: The Defenders’ Guide   Visit  for all the latest episodes! Show Notes:

What We’ve Learned from LockBit and Black Basta Leaks (and News) - Ian Gray - PSW #888

Humans wiped out by 2040, Okta, Elastic, Bad Bots, Berserk Bear, Siemens, Philip K. Dick, Aaran Leyland, and More, on this edition of the Security Weekly News. Visit  for all the latest episodes! Show Notes:

Humans extinct: 2040, Okta, Elastic, Bad Bots, Berserk Bear, Siemens, Aaran Leyland.. - SWN #505

This week, we talk Security News, how Turkey fines Facebook $282,000 over privacy breach, why the FBI is encouraging not to pay ransomware demands, the top 10 cybersecurity myths that criminals love, Doordash third-party breach hits 4.9 Million users, and how a "Bulletproof" Dark Web data center was seized by German police! In our second segment, we air a pre-recorded interview with Stewart Room, Partner at PwC, to talk about Data Privacy and The Journey to Code! In our final segment, we air a show trailer of our brand new podcast, Security &amp; Compliance Weekly w/ Jeff Man, Matt Alderman, Scott Lyons, and Josh Marpet! &nbsp; Show Notes: https://wiki.securityweekly.com/Episode622 Visit https://www.securityweekly.com/psw for all the latest episodes! &nbsp; Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly &nbsp;

The Last Cigar - PSW #622

This week, we welcome Dug Song, Co-Founder and General Manager of Duo Security at Cisco, to discuss the vision and culture behind Duo Security, and talk about his journey from when he began his start in Information Security! In our second segment, we welcome Mike Godwin, Distinguished Senior Fellow at R Street Institute, to talk about Digital Rights and Privacy! In the Security News, Microsoft Security Shocker As 250 Million Customer Records Exposed Online, the NSA Offers Guidance on Mitigating Cloud Flaws, Multiple Vulnerabilities Found in AMD ATI Radeon Graphics Cards, Brazil prosecutes Glenn Greenwald in an attack on press freedom, and Cybersecurity Lessons Learned from 'The Rise of Skywalker'! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Visit  to sign up for a demo or buy our AI Hunter! Follow us on Twitter:  Like us on Facebook:

Something Sanitary - PSW #636

This week, we welcome Gene Kim, Founder, Researcher, and Author of the Phoenix Project and The Unicorn Project, to talk about his goals and aspirations in The Unicorn Project, take a deep dive into the Five Ideals, and how DevOps will be a major player for decades to come! In our second segment, we welcome back Peter Smith, CEO, and Co-Founder of Edgewise, to talk about Stopping Python Backdoor Attacks, and how similar attacks have managed to evade traditional network security defenses and propagate inside their target environments! In the Security News, NHS alerted to severe vulns in GE health equipment, Ragnarok Ransomware targets Citrix ADC &amp; disables Windows Defender, suspected Magecart hackers arrested in Indonesia, Wawa breach data was found for sale, and a mega-breach that exposed more than 250 million users! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; To learn more about Edgewise, visit:  Visit https://securit Visit  for all the latest episodes! Visit  to sign up for a demo or buy our AI Hunter!

What Could Go Wrong - PSW #637

This week, we welcome Katelyn Bowden, CEO of BADASS, (Battling Against Demeaning and Abusive Selfie Sharing), to talk about her journey, and how she started BADASS! In our second segment, we present you with a Technical Segment to talk about Adventures in AWS Computing! In the Security News, Google shares private videos with the wrong users, how to get hacked through a Philips Hue smart hub, Buggy Iowa Caucus App is actually Buggy? No way!, how US cities have handled their fight against cybercrime attacks, and how someone sabotaged their boss with ransomware from the dark web! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Visit  to sign up for a demo or buy our AI Hunter! Follow us on Twitter:  Like us on Facebook:

Come Hang Out! - PSW #638

This week, we welcome Oshea Bowens, Founder &amp; Chief Janitor at Null Hat Security, to talk about Living in Blue Team Land and Skicon, a conference Founded by Oshea himself! In our second segment, we welcome John Loucaides, VP of Research &amp; Development at Eclypsium, to talk about Hacking Firmware: The Unprotected Attack Surface of the Enterprise! In the Security News, Misconfigured Docker Registries Expose Thousands of Repositories, a Forgotten motherboard driver turns out to be perfect for slipping Windows ransomware past antivirus checks, Jail Software Left Inmate Data Exposed Online, Adobe patches 42 vulnerabilities across 5 products, and how the CIA Secretly Owned Global Encryption Provider, Built Backdoors,&amp; Spied On 100+ Foreign Governments! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Visit  to sign up for a demo or buy our AI Hunter! Follow us on Twitter:  Like us on Facebook:  &nbsp;

Leaky Secrets - PSW #639

This week, we welcome Mike Nichols, Head of Product at Elastic Security, to talk about how Elastic Security is unifying SIEM and Endpoint Security! In our second segment, we welcome Ian Coldwater, Lead Platform Security Engineer at Heroku, to talk bout Kubernetes and Container Security! In the Security News, Iranian Hackers are targeting Dutch Universities, how electrical tape can fool Tesla sensors, Ransomware attack forces 2-day shutdown of a natural gas pipeline, Ring Rolls Out Mandatory 2FA &amp; New Privacy Controls, and 7 Ways to Improve the Security of Mobile Banking Apps! &nbsp; Show Notes:  Visit  for all the latest episodes! &nbsp; Visit  to sign up for a demo or buy our AI Hunter! Follow us on Twitter:  Like us on Facebook:

Hacking Back - PSW #640

Information security news, hacking, interviews, podcasts, live Internet TV, cocktails, and more!

Hack naked.

The Last Cigar - PSW #622

Security Weekly

Related tracks