Risky Business

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Chris Krebs to talk through the week’s cybersecurity news, including:

Everyone’s using the ARTEX pentesting framework to hack the planet and it has the makings of an actual crisis

The French government attributes freezer hacks to Iran’s IRGC

Rob Joyce was right and the breachpocalypse has exhausted global IR resources

The White House has nominated Palintir’s CISO to lead CISA. It’s certainly a choice!

Much, much more!

This week’s show is brought to you by SpecterOps. Consultant Raj Patel joins Patrick Gray to talk through his work in finding some serious weaknesses that made NTLM relay attacks practical again. Raj used OpenAI LLMs to bypass that SMB signing and come up with some unnatural ldap tricks as well. Those techniques are now patched, but Raj learned a lot about parallel discovery in the AI age.

This episode is also available on YouTube



Show notes



WorkOS says attacker used ARTEX AI to breach internal sales app


Russia's AI-powered hacks are causing chaos in Ukraine


Microsoft November 2026 Patch Tuesday


OpenAI says GPT-6 Cyber found 81 Firefox flaws and 948 Linux bugs


Attacker abuses Microsoft Entra ID to target downstream MSP clients


Pat Opet (@patopet) on X


Hackers enlist Artex to scan GitHub repositories for exposed secrets


Nearly 1.5 million exposed secrets targeted in new revocation program


ARTEX exposed hosts


Claude Code settings files expose thousands of secrets on GitHub


Chainalysis breach


AI-fueled hacking is getting worse — top cyber companies are turning away some victims


SI impersonation fraud indictment (Soall, Hazan, Sheetrit)


Cyberattack disrupts blood-storage refrigeration systems in France


FBI and CISA warn of cyberattacks targeting refrigeration systems


France blames Iran for fridge cyberattacks, says some caused fires


Lesley Carhart - Let’s Talk About Why all This OT Stuff is Connected


OpenSSH flaw lets attackers log into password-disabled Linux accounts


GhostMap: The Android flaw that crashes your phone before you open the app Labs


Want to Rent an Internet Address at the White House?


French bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million


GOPAX suspends withdrawals and trading following hacking threats


FBI agent pleads guilty to stealing $2.4 million in crypto from nation-state hackers


What Democratic control of Congress means for cybersecurity


Palantir exec nominated to lead CISA; lame-duck Senate vote is uncertain


Japan announces emergency cybersecurity package following a wave of attacks


Iris Ohyama data cloud breach exposes info of 7.7 million customers


APT29 watering hole (Plerdy, America250)


Pro-Russian hackers target European officials, offer rewards for personal information


Nvidia probes whether Chinese intelligence targeted its CEO


The Babylon Bee (@TheBabylonBee) on X


NTLM relay made new again!

In this Soap Box episode Patrick Gray chats to Push Security co-founder and CEO Adam Bateman about the benefits of taking a browser-centric approach to security.

By now most Risky Business listeners know that Push sells a browser extension-based product that can reliably prevent phishing, ClickFix and ConsentFix. But what’s next? Where to from here once you’re already in the browser?

Well, Push is expanding into the data loss prevention and secure web gateway product space. Why use a SWG based on 15-year-old technology when an extension can give you an even better security result? Especially when you can drop the drawbacks, like tromboning all your traffic into a random data centre…

This episode is also available on YouTube.



Show notes

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Ciaran Martin, former CEO of the UK’s National Cyber Security Centre (NCSC), to talk through the week’s cybersecurity news, including:

The $6.3 billion dollar Binance hack turned out to be pretty clunky, but it ain’t dumb if it works we guess

Meanwhile Brazil’s Mercado Bitcoin loses “millions”. Cute!

A bit late to make the Word of the Year shortlist, but Google’s coined a new term with “LLMjacking”

An infosec guy’s clankers hacked another infosec guy, everyone’s arguing about it, it’s funny
Much, much more!

This week’s show is brought to you by runZero. VP of Security Research Tod Beardsley joins Patrick Gray to chat about fear around the looming post-quantum cryptography crisis, and how CISOs can use it as an opportunity to clean up house and finally take all the end-of-life products out to pasture.

This episode is also available on YouTube



Show notes



Binance hot wallet heist (Oct 2026) | therecord.media


Binance on X: "29 October Binance Security Incident: Initial Findings and Response Update" / X | X (formerly Twitter)


Largest crypto exchange in Brazil confirms cyberattack as millions flow out of platform | therecord.media


Polymarket DebugBear script compromise | The Hacker News


Chainalysis "offensive agentic techniques" breach | BleepingComputer


Trezor warns of suspected crypto-theft implant in hardware wallet | BleepingComputer


Second wave of suspected cyberattacks hits supermarket freezers across Europe | The Record


Amadeus booking data breach | "Data breach" – Google Alert


DHS Icepick personnel data leak | "Data breach" – Google Alert


Google says LLMjacking attacks can rack up $1 million in cloud AI charges | BleepingComputer


Northflank security breach leads to abuse of customers' AI API keys | BleepingComputer


Rikiya Takehi (@rikiyatakehi) on X | X (formerly Twitter)


Russia's AI-powered hacks are causing chaos in Ukraine - Risky Business Media |


Volt Typhoon "Silent Train" network | zetter-zeroday.com


Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware | BleepingComputer


PHP2Shell (CVE-2026-109618/109619) | Cybersecurity Dive


GitLab CVE-2026-97229 CI/CD regex RCE | BleepingComputer


CISA warns of hackers now exploiting critical Node2Shell flaw | BleepingComputer


Critical Linux kernel flaw allows remote root attacks on MPTCP servers | BleepingComputer


Marcus Hutchins (@MalwareTechBlog) on X | X (formerly Twitter)


New Android "SMS of Death" exploit can remotely crash unpatched phones | BleepingComputer


Hackers now scanning systems for recently patched Oracle flaw | BleepingComputer


Ivanti patches two more Connect Secure zero-days chained in attacks | BleepingComputer


Trojanized Claude Code extension (v2.1.313) | Step Security Blog


Germany says lawmakers' iPhones may have been hacked with spyware | TechCrunch Security


Google disrupts million-device XCPE Android malware botnet, bans TV box maker | BleepingComputer


vx-underground (@vxunderground) on X | X (formerly Twitter)

In this edition of the Snake Oilers podcast, three vendors drop by to pitch their products.

Minimal.dev: A sandbox for AI agents! Co-Founder and CEO Jake King explains what the company is and how it works.

Request Rocket: Runtime access control for AI agents and APIs. Founder and CTO Alex Ferguson drops by to talk about the problem the company is trying to solve.

TRM Labs: All-source threat intelligence. Global Strategic Accounts Director Simon Warren talks about the company’s platform Ardence.

This episode is also available on YouTube.



Show notes

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Alex Stamos to talk through the week’s cybersecurity news, including:

Everyone’s still panicking about “misbehaving” AI models that are pretty much just doing what they’re being told to do

Americans are giving AI agents unfettered access to their bank accounts. What could go wrong?

Last week’s PHP meteor seems to have missed Earth

This week’s Brotli HTTP/2 critical flaw is this week’s meteor

The private key is always 4. This time it’s TLS bugs in GoAhead

Much, much more!

This week’s show is brought to you by Truffle Security. Co-founder and CEO Dylan Ayrey joins James Wilson to chat about scanning GitHub repos and finding more than half a million unique credentials that were never revoked. As Dylan explains, the problem of exposed keys exists everywhere and is only getting worse.

This episode is also available on YouTube



Show notes



OpenAI AI agents demonstrate VM escapes and secret cross-sandbox communication


OpenAi agents disabled safety monitoring, one lied about it


solst/ICE of Astarte (@IceSolst) on X


What I learned from cheating clankers


Unvetted AI agents are accessing US bank accounts


Hiding Capabilities in AI Models


AI is finding bugs faster. Let the market find the fixes


AI Guardrails Aren’t Stopping Criminal Hackers


Andromeda October 2026 Security Incident


Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack


Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber


Hackers got a four-day head start on the PHP2Shell vulnerabilities


Critical HTTP2Shell flaw in Brotli triggers emergency patches


Senators say targeted ads are a security risk. Ad groups say the critics are off base


Alleged Israeli spy company heavily targeted Starlink users, sources say


LiteLLM release pipeline hacked to distribute info-stealer malware


CISA warns attackers are chaining Plex flaws in active Plex2Shell attacks


Abandoned Popcorn Time app exposed millions of devices to RCE attacks


Chrome adds Gemini-powered scam detection and ClickFix warnings


Microsoft Teams is getting context-aware phishing detection


China-nexus actor linked to attack on ConnectWise cloud backup


University of New Mexico hospital diverts ambulances after cyberattack


solst/ICE of Astarte (@IceSolst) on X


GitHub Repos Exposed 543,699 Credentials. Nobody Revoked Them