Holes In Everything, Even SSH - PSW #952

In the security news this week: SSH in Shambles Santa steals your podcast setup SAP’s double feature Terminal2Shell is CVSS 11 Dormant neurons, active backdoor Patched, but still exploitable 948 paths to root Barracuda serves root Node-RED, now with shell access The secret cigar recipe FBI agent, crypto thief Another AI agent identity mess 7.7 million reasons to care Reddit asks the breach question Who’s accountable when AI breaks? Espionage, chips, geopolitics Don’t ask again, leak forever AI catches cheating, flags everyone 1.4 million keys need revocation RSA, now with a countdown Fingerprint security, SD card reality Proving Signal’s machine code Thirty zero-days, one offline switch Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-952

Managing a cyber crisis extends far beyond the initial breach, tossing leadership into a chaotic fog where security teams, legal counsels, and executives must make high-stakes choices under extreme duress. When a catastrophic security event occurs, organizations struggle against a predictable set of systemic, technical, and operational roadblocks. How can organizations transition from a reactive state to a controlled recovery, successful crisis management state? Mone' Ross, Vice President, Cyber Operations at JPMorganChase, joins Business Security Weekly to discuss Cyber Resilience and the leadership behaviors that determine what happens under pressure. Mone' will discuss why preparation and communication are imperative to a successful response. She has also identified the five Crisis Archetypes and how each type should or should not lead during a crisis. In the leadership and communications segment, AI Security Now Tops Every CISO Priority for 2027, What a security strategy that survives 2027 looks like, Leaders Need to Grapple with Employee Ambivalence on AI, and more! Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://securityweekly.com/bsw-473

Bad Claude, Bad, French Fridge Fiasco Fries Fromage, Teenage Mutant Ninja AI, SonicWALL, Aaran Leyland, and More, on the Security Weekly News. Visit https://www.securityweekly.com/swn for all the latest episodes! Show Notes: https://securityweekly.com/swn-632

AI-enabled cyber attackers will check every third-party path into an application at scale and speed. The same process can help defenders just as much, but it’s only as effective as the human expertise guiding it. Andrew Wesie, Xint co-founder and CTO. explains how human engineering in harness construction is the determining factor between real, autonomous exploit discovery and validation versus a machine that just generates more noise. Segment Resources: Business logic vulns, https://xint.io/blog/compaction-smuggling-reasoning-traces and https://xint.io/blog/openai-compaction-inference Securing apps and their third-party access, https://xint.io/resources/the-side-door-problem-what-the-korean-bank-breaches-mean-for-us-banks Working with DARPA to test the infrastructure surrounding messaging apps, https://xint.io/blog/darpa-selects-xint-to-research-source-code-vulnerabilities-in-critical-messaging-applications-used-in-military-communications-330339 This segment is sponsored by Xint. To learn more, visit https://securityweekly.com/xint! Visit https://www.securityweekly.com/asw for all the latest episodes! Show Notes: https://securityweekly.com/asw-408

Interview - Danielle Russell - The Attack Surface Changed: Who Reassesses Risk After the Approval? The attack surface now changes faster than any team can reassess it, as employees add integrations, grants, and agents to apps long after they were approved. Danielle Russell, VP of Product at Nudge Security, explains what continuous reassessment looks like in practice: which changes deserve a response, which work agentic AI can take on, and where analysts still make the call. She also makes the case that security still owns the risk after approval, even when it never saw the change that created it. Segment Resources: Modernize your TPRM program with adaptive risk management for SaaS and AI Nudge Security Unveils Adaptive Risk Management press release The security work nobody wants to do is the risk nobody’s watching OAuth grants pile up faster than you can review them BleepingComputer This segment is sponsored by Nudge Security. Visit https://securityweekly.com/nudge to learn more about them! Topic Segment - Coordinated Disclosure An AI-found PHP flaw sat unfixed since 2024, a PoC video leaked, and a vendor broke the embargo early, citing active exploits. Coordinated disclosure in 2026 is: 75% - Too slow for AI world 13% - Vendor Credit Race 13% - This is fine ????????️???? 0% - Working as designed 0% - Other (tell me) Mike's thoughts: Only a few folks think coordinated disclosure is working as designed, based on last week’s vibe check. Everyone else lands somewhere between "too slow" and the dog sitting in the burning room. I think the old disclosure window was built for a world where a human found the bug, a human wrote the fix, and disclosed it responsibly (most of the time). Now AI finds flaws faster than vendors can ship patches, so any kind of embargo stops being a grace period. It becomes a head start for whoever else found the same bug. I don't think shorter deadlines fix this. The fix side has to get as fast as the find side, which is actually the hardest part of the puzzle to solve in cyber. Enterprise Security News Finally, in the enterprise security news, A little funding making software liable for cyber breaches we have a new biggest bank heist ever! more freezers defrosted a company builds malware into their product on purpose AI pentesting frameworks are lowering the script kiddy bar AI hosting company hacks their competitor there’s a new SSH bug that could be very, very bad even MSPaint gets a vulnerability All that and more, on this episode of Enterprise Security Weekly. Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw-484

AI hates us all, Binance, OpenSSH, Apple, WordPress, DNS, Scams, Josh Marpet, and More, on this episode of the Security Weekly News. Visit https://www.securityweekly.com/swn for all the latest episodes! Show Notes: https://securityweekly.com/swn-631

In the security news: Supermarket refrigeration attacks, again! Rapid7’s Ivanti findings and why we can’t have “nice” things Google’s massive Android TV botnet takedown Linux TCP kernel flaw that no one is patching The Binance theft APT flaw gives out root PHP security debt The porn and Digital billboard problem Your own phone system to pwn From PoC to weaponized exploit Hacking to change time Rooting an Echo Dot Firmware should just work AI chained bugs into working exploits USB power states leak data across an air gap AI-assisted vulnerability finding GoAhead’s TLS handling Hackers hijack emergency alert apps Taiwan’s emergency services become an AI-agent target CUI exposed through GSA’s Google Drive GCHQ can’t account for thousands of storage devices Railway employee blames an attempted intrusion on AI VulnCheck opens its initial-access playground to the public Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-951

As the prevalence of AI continues to grow, more and more people are worried about their online safety. New scams seem to be popping up every day, packaged in creative and terrifying ways. How do you protect yourself? Frank Riccardi, Author of CTRL+ALT+PWN: The Hacker’s Playbook (And How to Beat It), joins Business Security Weekly to discuss why it’s not the technology that PWNs you, it’s the trickery. Rather than resign yourself to an inevitable fate or remove yourself from the online world entirely, learn the tricks of the trade to avoid being just another pwned noob. Frank exposes the secret weapons, sneaky tactics, and psychological tricks used by hackers today—and discusses how to stop them. Segment Resources: https://www.amazon.com/CTRL-ALT-PWN-Hackers-Playbook/dp/B0F8GP89NL In the leadership and communications segment, CISO Problems That Can't Be Solved With Technology, When Being Authentic Undermines Your Leadership, Empower Your Most Curious Employees to Drive Your Digital Transformation, and more! Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://securityweekly.com/bsw-472

Patrick Stewart, Videostrong, C3RB3R, GitLab, VMware, BTCPay, Binance, Aaran Leyland, and More, on the Security Weekly News. Visit https://www.securityweekly.com/swn for all the latest episodes! Show Notes: https://securityweekly.com/swn-630

Following the catalog of CVEs is great for enumeration, but chasing those CVEs for patching is terrible for strategy. Jeremiah Grossman shows what breach data tells us about the differences between having over 400,000 CVEs, a few thousand KEVs, and a few hundred ways that attackers compromise orgs. We go into the importance of distinguishing vulns from exploits and where we see agents making a meaningful impact. Then we touch on some history of appsec and why the trajectory of vulns like SQL injection and XSS, along with well-known security controls, point to a more secure future -- or even possibly a pretty secure present. Resources https://www.rootevidence.com/blog-posts/stop-chasing-cves/ https://www.rootevidence.com/blog-posts/the-defender-window-is-longer-than-you-think/ Visit https://www.securityweekly.com/asw for all the latest episodes! Show Notes: https://securityweekly.com/asw-407