The Low Down

The Low Down Podcast is presented by Maze. https://mazehq.com/lowdown X: https://twitter.com/Maze_Security The "signup test" was probing for Kubernetes secrets. Ed and Matt get into Railway's AI testing incident, hacked refrigeration systems, and fake job interviews targeting developers. Then Ed works through a Linux kernel bug before we finish with ARTEX and a warning about a prebuilt Docker image. Today we're talking about: Railway and the AI testing incident We follow the logs, the apologies, and the personal credit card that helped identify the employee. Josh Manders says every probing attempt was blocked and nothing was accessed; Railway later described it as an employee's personal project. Ed and Matt have plenty to say about authorization and the "my agent did it" explanation. Employee's account (https://x.com/jakerunzer/status/2117474337682780643) Josh's account (https://x.com/joshmanders/status/2117530391183507484) Railway's statement (https://x.com/JustJake/status/2117746864745578719) Credit-card exchange (https://x.com/vxunderground/status/2117656394396778956) Hacked freezers, blood banks, and exposed controls More refrigeration attacks lead into the practical problems of securing operational systems. We talk about slow patch approvals, unclear ownership, and what getting a management interface off the public internet actually involves. Supermarket report (https://www.bbc.com/news/articles/cq1kd1nee80eo) Blood-storage report (https://www.theguardian.com/technology/2026/nov/04/france-national-blood-service-hack-cyber-attack-europe) Binance and fake job interviews Binance's account of an employee compromised through a fake interview leads into how fake recruiters target developers. Matt walks through separate malicious coding-test and VS Code examples, including the pressure to run unfamiliar code while an interviewer watches. We discuss keeping those exercises off your everyday machine. Binance report (https://www.reuters.com/world/binance-says-hackers-used-fake-job-interview-compromise-computer-before-63-2026-11-03/) MetaPlay case study (https://github.com/alexhraber/metaplay-fake-interview-supply-chain-incident) VS Code case study (https://ransom-isac-landing.pages.dev/blog/contagious-interview-vscode-to-rat/) Linux TCP, MPTCP, and exploit math Ed explains a kernel use-after-free, the demonstrated MPTCP exploit, and why reliable exploitation is more complicated than the severity score suggests. We get into the conditions an attacker needs, patching, and some increasingly elaborate math. Go Security Team advisory (https://groups.google.com/g/golang-announce/c/PCoQcdxoScw/m/aD-MgXEvAAAJ) ARTEX and the Docker image warning CrowdStrike reports on ARTEX in real intrusions. Separately, researchers raise backdoor concerns about a specific prebuilt Docker image. We look at what they found and Jason Haddix's SpikeStrip experiment for tripping up AI pentesting tools. CrowdStrike research (https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/) Image warning (https://x.com/GrahamHelton3/status/2117782531856581004) SpikeStrip announcement (https://x.com/Jhaddix/status/2117342447445627141) If you work with grocery-store or other operational networks, we'd like to hear what getting these systems off the internet looks like on the ground. Linked reports may include later updates. —————- Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Ed / Low Level Instagram: https://www.instagram.com/lowleveltv/ LinkedIn: https://www.linkedin.com/in/lowleveltv/ YouTube: https://www.youtube.com/@LowLevelTV Matt Johansen / Vulnerable U Instagram: https://www.instagram.com/mattjayy/ LinkedIn: https://www.linkedin.com/in/matthewjohansen/ YouTube: https://www.youtube.com/@VulnerableU

Welcome to The Low Down, the best show on the internet for hackers Black October has real bugs, stolen keys, and a lot of very loud headlines. Ed and Matt sort through PHP2Shell, AI security claims, and the difference between a scary vulnerability and one attackers can actually use. Harry Wetherald, co-founder and CEO of Maze, joins us to talk about finding the bugs that matter. —————————— Today we're talking about: PHP2Shell and the Black October panic We get into working exploits, questionable proof-of-concepts, patching, and the reporting around attacks. Ed breaks down why configuration and exploit reliability matter, while Matt revisits a report he shared that was later corrected. Original research: https://calif.io/php2shell/ Exploit validation: https://www.vulncheck.com/blog/php2shell-vulnerabilities Unit 42 report and updates: https://unit42.paloaltonetworks.com/cve-2026-109618-cve- 026-109619/ DREAM intrusion research: https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers AI security with Harry from Maze Harry joins us to talk about what AI can do for security teams, how to decide whether a vulnerability is exploitable in your environment, and why producing more findings isn't enough. Maze: https://mazehq.com/ Brotli, Node.js, and GoAhead A decompression bug puts Brotli in the headlines, then GoAhead gives us a lesson in broken TLS. We talk through the technical details and the conditions that turn these bugs into real problems. Node.js security release: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases GoAhead research: https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead OpenCode, stolen keys, and distillation OpenCode's Console incident leads to a discussion about stolen API keys and model distillation. Matt revisits his initial response and the distinction between stealing keys and what attackers intended to do with them afterward. OpenCode announcement: https://x.com/opencode/status/2111519637049319818 Matt's clarification: https://x.com/mattjay/status/2111554937452990593 LiteLLM, Railway, and the update problem More supply-chain trouble raises an uncomfortable question: how quickly should you update when new releases can carry the attack? We get into credential exposure, dependency hygiene, and the tradeoffs of waiting. LiteLLM attack-chain report: https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain Railway incident report: https://blog.railway.com/p/preliminary-report-october-security-incident WPS, pre-boot bugs, and AI bank access We cover Broadcom WPS research, an EDK II PXE vulnerability, and AI agents accessing bank accounts. The banking discussion turns on whose permission was given: the customer's or the bank's. WPSplinter research: https://qkaiser.github.io/broadcom-wps/ EDK II advisory: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m AI banking report: https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access We finish with the noise around security news, incident-response fatigue, and what happens when every week is treated like the end of the internet. Recorded October 28, 2026. Linked reports may include later updates. Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod —————————— Ed / Low Level Instagram: https://www.instagram.com/lowleveltv/ LinkedIn: https://www.linkedin.com/in/lowleveltv/ YouTube: https://www.youtube.com/@LowLevelTV Matt Johansen / Vulnerable U Instagram: https://www.instagram.com/mattjayy/ LinkedIn: https://www.linkedin.com/in/matthewjohansen/ YouTube: https://www.youtube.com/@VulnerableU

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security ---------------- Today we're talking about: PHP2Shell and the Disclosure Fight Ed and Matt are at OneCon in Las Vegas as PHP2Shell sets off a chaotic week. We unpack the research, shaky AI exploit claims, Chainguard's early fixes and whether disclosure timelines can keep up. Dan Lorenc and the PHP Foundation give different accounts of the rollout. https://calif.io/php2shell/ https://www.linkedin.com/posts/danlorenc_i-wanted-to-share-what-happened-with-the-share-7518756991520120832-QX2_/ https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ Kyle Polley's embargo discussion: https://x.com/kpolley/status/2113069186318577666 Your Certificate Authority's Private Key Was 4 One of eMudhra's private keys was literally four. We talk tiny keys, certificate trust, the company's exit from SSL/TLS and what happens when clients still trust compromised certificates. https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/ https://emudhra.we-have-a-problem.com/ https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business https://www.mitmproxy.org/posts/releases/mitmproxy-12.3/ Linux Bugs and the Power of a Pattern DirtyFrag, research credit and the latest kernel discussion lead into why Ed thinks AI is useful for spotting use-after-free patterns. DirtyFrag research: https://github.com/V4bel/dirtyfrag KSMBD background: https://docs.kernel.org/filesystems/smb/ksmbd.html Does AI Favor Attackers or Defenders? SentinelLABS' Tom Hegel makes the case for keeping powerful tools accessible to defenders. SentinelOne's Steve Stone explains why finding more bugs isn't the whole story: attack paths, speed, scale and the physics of an intrusion still matter. Meet the Threat Hunting World Champion Jason Walker joins us straight from his OneCon win. We get into his move from graphic design to security, CTF strategy, AI-assisted detection engineering and why the fundamentals still matter. OneCon: https://www.onecon.io/ ---------------- Follow Us! https://www.instagram.com/lowdown.pod Ed / Low Level Instagram: https://www.instagram.com/lowleveltv/ LinkedIn: https://www.linkedin.com/in/lowleveltv/ YouTube: https://www.youtube.com/@LowLevelTV Matt Johansen / Vulnerable U Instagram: https://www.instagram.com/mattjayy/ LinkedIn: https://www.linkedin.com/in/matthewjohansen/ YouTube: https://www.youtube.com/@VulnerableU Tom Hegel / SentinelLABS LinkedIn: https://www.linkedin.com/in/tom-hegel/ Steve Stone / SentinelOne LinkedIn: https://www.linkedin.com/in/stevenstone618/ Jason Walker / tresscross LinkedIn: https://www.linkedin.com/in/jasonwalker777/ Blog: https://tresscross.blog/

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Heading to OneCon 2026? SentinelOne’s cybersecurity conference runs October 20–22 at the ARIA Resort & Casino in Las Vegas. Use code oc26lowdown for a discount on registration. https://www.onecon.io/ Today we're talking about: AI Got Better While We Were Arguing About It Matt returns from SecTor, Ed explains his monitor-firmware experiment, and we discuss what AI can do for security research—and the human work it still takes. https://www.youtube.com/watch?v=wIe3eDfGKUo https://blog.cloudflare.com/cyber-frontier-models/ https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/ Your Hardware Wallet Has Extra Hardware Kim Zetter's reporting reveals seed-stealing Ledger implants, including devices from authorized retailers, and separate Trezor tampering from unauthorized sellers. Who planted them remains unknown. https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/ https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implants/ Someone Hacked the Supermarket Fridges French supermarkets lose food after a cyberattack. We discuss exposed refrigeration controllers, a date-derived login code, and the separate Ahold Delhaize outage. Reuters report: https://srnnews.com/french-supermarket-chain-intermarche-hit-by-cyberattack-150-stories-targeted/ https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers https://www.pentestpartners.com/security-blog/you-dont-need-a-nation-state-to-warm-up-a-fridge/ https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhaize-takes-systems-offline-after-cyberattack/ If AI Can Clone Your App, What Are You Selling? ArtCraft and Reverse Engineer Anything spark a debate about paid software, reliability and support. Fireship's FilmCraft test puts the hype under pressure. https://www.kdnuggets.com/the-rise-of-ai-software-clones-why-rea-and-artcraft-are-going-viral https://github.com/morluto/rea https://www.youtube.com/watch?v=wajoP_5Cpw8 The People You Call After Ransomware We discuss Edward Dubrovsky's reported arrest and the separate MonsterCloud case. Prosecutors allege MonsterCloud secretly paid attackers while promising special decryption tools. These are allegations, not convictions. https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/ https://www.bleepingcomputer.com/news/security/ransomware-recovery-ceo-charged-over-secret-ransom-payments/ https://www.justice.gov/opa/pr/known-cybersecurity-expert-and-owner-florida-ransomware-remediation-company-charged OpenAI Finds a Recorder Behind the TV An employee is accused of planting a recorder in an executive conference room. We unpack the alleged chatbot trail, a second device and the problem of insider access. https://www.bbc.com/news/articles/cwg5jq4vlddzo https://x.com/OpenAINewsroom/status/2110095403198849132 A Jailbreak That Isn't Quite a Jailbreak hrtowii's iOS research involves Apple's Security Research Device signing system. The author explains the limits and says the bug has been patched. https://www.hrtowii.dev/blog/making-a-not-jailbreak-in-3-weeks

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Heading to OneCon 2026? SentinelOne’s cybersecurity conference runs October 20–22 at the ARIA Resort & Casino in Las Vegas. Use code oc26lowdown for a discount on registration. https://www.onecon.io/ 00:00 Coming up 00:33 Intro and Matt’s SecTor keynote 02:52 Citrix NetScaler zero-days and disclosure 09:25 Breaking down the NetScaler exploits 19:04 Sponsor: Maze 20:41 Citrix’s response and responsible disclosure 25:06 Why edge devices are so hard to defend 30:54 MikroTik RouterOS vulnerabilities 35:33 Cisco SD-WAN authentication bypass 38:37 Zimbra command injection 42:22 ShinyHunters arrest and conflicting claims 50:42 Reacting to the FBI’s warning 55:05 Open-weight AI, Anthropic and GLM-5.3 1:07:35 Wrap-up and OneCon Today we're talking about: Your NetScaler Warning Came From Reddit Finding out about NetScaler zero-days through Reddit is not the enterprise support experience Matt had in mind. Ed walks through watchTowr's command injection and memory overflow writeups, including missing protections in the binary they tested. Then we get into Google's hunting guidance and why a patch alone won't kick an attacker out. https://www.reddit.com/r/Citrix/comments/1wqjk9a/netscaler_leak/ https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/ https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances MikroTik and the User Named -2 MikroTik joins the pile with an HTTP underflow and a separate SSH authentication chain. The username "-2" showing up in attack logs gets our attention. Ed explains how assumptions between different parts of a system can become an exploit. Matt has been saying "don't roll your own crypto" for his entire career. Apparently we still need the reminder. https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-06.json https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ Cisco's Admin API Lets the Wrong People In A specially encoded request can give an unauthenticated attacker admin access to Cisco's SD-WAN Manager API. We talk about what that means for a corporate network, and the difference between connections that need to be public and management interfaces that don't. Cisco patched its managed cloud service. If you run an affected instance yourself, the upgrade is still your job. https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-webauth-xr8beuuU.html Zimbra: An Email Goes In, a Shell Command Comes Out A crafted email can trigger command execution through Zimbra's SNMP notification system on affected configurations, without anyone clicking anything. We trace the route from incoming mail to a shell command and look at Microsoft's account of the attacks. Ed has a fairly blunt suggestion for developers: stop handing user input to Bash. https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/ ShinyHunters Meets the FBI's Camera Dutch police arrest an alleged ShinyHunters leader, and the FBI looks straight into the camera with a message for whoever's left. We untangle the arrest timeline, conflicting gang statements and the Pokémon branding. Matt brings us back to the PeopleSoft campaign and why following a group's methods is useful even when its PR is impossible to trust. https://krebsonsecurity.com/2026/09/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigation/ https://www.fbi.gov/video-repository/shinyhunters-arrested-092926.mp4/view https://www.securityweek.com/shinyhunters-defiant-after-fbi-calls-on-members-to-come-forward/ https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft If the Attacker Gets AI, So Do I Anthropic's GLM-5.3 report sets off a disagreement. If attackers get powerful, freely available models, Matt wants to know why defenders don't get the same advantage. Ed thinks the way our systems are built still favors the attacker. We get into reports of safeguards getting in the way of incident response, the incentives behind calls for regulation, and who we'd trust to write the rules. https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities https://huggingface.co/blog/security-incident-july-2026

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Today we're talking about: ShinyHunters Has a Reputation to Protect ShinyHunters says it hacked the FBI to protect its business. Apparently, even an extortion crew needs good PR. We get into why reputation matters to people who make their money threatening companies, and Ed takes a look at the PeopleSoft bugs that may explain the way in. Some of the exposed records reportedly belong to the FBI's own hacking unit. https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/ https://www.404media.co/fbi-hack-exposed-fbis-own-hacking-unit-remote-operations-shinyhunters/ https://www.theregister.com/cyber-crime/2026/09/25/shinyhunters-tells-the-reg-we-hacked-the-fbi-to-protect-our-business/5299250 OpenAI's Very Unwelcome Pull Request How far do you go to prove a bug? Hacktron used an employee's Codex account to open a PR in OpenAI's internal repo. Ed thinks that demonstrates the access they already had. Matt sees why the security team wants to know what else they touched. The $6,500 payout got everyone talking. S1r1u5_ says the headache was a disclosure process that sent them to lawyers and eventually a journalist. https://www.hacktron.ai/blog/hacking-openai https://x.com/S1r1u5_/status/2101296199261429813 https://x.com/LiveOverflow/status/2101252692635004997 https://x.com/TalBeerySec/status/2101560506242761097 https://x.com/alexstamos/status/2101747329699402198 So What Do You Run This Stuff In? Two awkward headlines for anyone running other people's code: containers are getting easier to escape, and KVM has bugs too. Matt wants to know what he's supposed to do with that. Ed explains why sharing a kernel matters, and why moving to a smaller attack surface still buys you something. We also end up worrying about who will understand the machinery underneath all the AI-written code. https://depthfirst.com/research/containers-are-no-longer-safe About That AI Hacking Story Ed has had enough of the headlines. Trying a few web attacks and pulling off the Hugging Face exploit are very different things. Matt's bothered by agents on ordinary research tasks deciding to try breaking into websites. We look at what Transluce actually found: the public records don't show those attempts succeeding. Both have questions about who was watching. https://transluce.org/agent-activity "But I Would Never Fall for ClickFix" Four in five ClickFix payloads intercepted by Push in 2026 came through search engines. You go looking for an answer and get instructions for infecting your own computer. Matt has a pile of data on how the lures are changing. Then there's the placeholder domain in old documentation that someone registered and turned into a fake verification page. But we would never fall for any of this, obviously. https://pushsecurity.com/blog/the-state-of-clickfix-by-detection-data https://www.manifold.security/blog/third-party-com-placeholder-clickfix

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Today we're talking about: The ChatGPT Group Chat "I thought me and Sam were homies." Project Lily has us talking about the humans reading ChatGPT conversations, Moxie Marlinspike's take on chat interfaces, and who else is in the room when you're telling a chatbot your problems. https://www.404media.co/inside-project-lily-the-humans-reading-your-chatgpt-chats/ https://confer.to/blog/2025/12/confessions-to-a-data-lake/ Flock, Meet the Hardware Hackers Someone pulled down a Flock camera and copied its storage. Ed wants to separate the physical-access findings from the remote-hacking claims. Also, "Flock bad" is apparently a content strategy now. https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/ Pixel's Very Unhelpful CVE A modem vulnerability, signs of targeted exploitation, and very few details. Cue a conversation about basebands, spyware, and the price of a good phone exploit. https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices/ https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01 Revolut "A bank suffered a data breach by not getting hacked." Fake official requests got customer data handed over. Matt gets into the market for stolen government accounts and why a familiar email address isn't enough. https://www.securityweek.com/revolut-data-breach-5-months-680-high-profile-accounts-3m-ransom/ HBO's Reddit Account The account was real. Someone else was running the ads. A compromised HBO business account on Reddit becomes a delivery system for a ClickFix malware campaign. https://www.hudsonrock.com/blog/hbo-max-ads-on-a-compromised-reddit-account-exposed-a-massive-pasteswitch-clickfix-operation Cisco Got Owned by an Email An email security gateway. An email-triggered SQL injection. "The call is coming from inside the house." https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX Your MRI Results Are Malware Iranian operators using fake medical results and personalized messages to deliver CHOSEN BRICK spyware. This one gets uncomfortably specific. https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists Passkey-Themed Phishing That word "themed" is doing a lot of work. We walk through the device-code trick that gets victims to authorize an attacker's access. https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/ Inflatable PLCs CISA wants critical infrastructure operators thinking about cyber decoys. We're into canary tokens. A full deception operation for an already understaffed team takes a little more convincing. Ed has a business idea. https://www.cisa.gov/sites/default/files/2026-09/using-cyber-decoys-to-strengthen-detection-and-response_508c.pdf

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're diving into the surveillance nightmare coming from your living room, catastrophic phishing campaigns targeting crypto users, and Microsoft's record breaking patch cycle that defenders need to know about. Today we're talking about: LG's Privacy Nightmare: Your TV is Spying on Everything Gamers Nexus drops a two hour expose revealing LG TVs are actively recording and transcribing all room audio even when listening mode is disabled and the device is powered off. Breaking down how they got root shell access and found plain text transcriptions of private conversations being cached on the device with four gigs of memory ready to phone home. Why the microphone continues recording even when unplugged from the network and what ACR automatic content recognition really means for your privacy. The Economics of Smart TV Surveillance LG executives caught on stage at advertising conferences bragging about owning the glass and extending the advertising experience across all devices on your home network. How they're doing network scans to enumerate every Windows PC, phone, and IoT device in your household and correlating that with what you're watching. Why the profit margins on TV advertising are in the 60s with SaaS level multiples while TV hardware prices have bottomed out over the last 20 years. The Remote Code Execution Problem Nobody's Talking About Beyond the privacy concerns, LG TVs have multiple unpatched remote code execution vulnerabilities that turn your living room microphone into a potential threat actor playground. Why teachers are panicking about 85 of these devices deployed in classrooms and the student privacy implications. How Chinese threat actors have proven they'll exploit residential devices for proxy networks and credential theft. Trezor's Catastrophic Phishing Campaign Trezor customers hit with one of the nastiest phishing campaigns of the year where the call was literally coming from inside the house. Breaking down how their official email provider was breached with valid TLS certificates and domain signing making the phishing email appear completely legitimate. Why this was perfectly timed after the cold card STM 32 entropy vulnerability had everyone primed to believe their hardware wallets were compromised.

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're diving into massive identity verification breaches, the arrest of Team PCP supply chain attackers, and the certified pre owned router epidemic that's turning your home network into a botnet. Today we're talking about: ID Scan Breach: 153 Million Driver's Licenses Leaked Breaking down the massive data breach exposing 153 million driver's licenses, 10 million identification cards, 3 million travel documents, and 579,000 medical cards from ID scan dot net. How Brian Krebs traced his own leaked license back to a Hertz rental car transaction and marijuana dispensary visits at DEF CON. Why third party identity verification services create single points of failure when companies like Target, FedEx, GameStop, and hotels all use the same scanning infrastructure. The Identity Verification Debate: Privacy vs Security Examining the cultural backdrop of identity verification laws spreading across Europe and the UK's push to de anonymize internet activity in the name of protecting children. Why Discord now requires ID verification for adult content servers and Pornhub refuses to comply by shutting off access to entire states. The fundamental problem of companies being entrusted with sensitive documents they aren't equipped to secure and how driver's licenses are becoming the new social security numbers in account recovery flows. McKesson Healthcare Breach: 284 Million Patient Records Stolen Shiny Hunters claims responsibility for compromising McKesson, the pharmaceutical giant responsible for a third of all US drug transactions with 403 billion in annual revenue. Deep dive into Shiny Hunters' sophisticated MO combining social engineering over phone and text, fake company Okta logins using Evil Nginx proxies, and specialized teams ready to exfiltrate OAuth tokens at machine speed across geographically distributed locations. Team PCP Arrested: The Supply Chain Attackers Roll Up Australian authorities arrest the Team PCP threat actors behind massive NPM supply chain attacks including the Mini Shaihalud worm, LightLLM compromise, and Trivi security tool breach. How Flare's OSINT investigation traced the DeadcatX3 alias across GitHub, HackerOne, Hugging Face, and eBay to reveal real identity Ruben Thompson through catastrophic OPSEC failures. Why some in the security community are defending Team PCP as hackers of old exposing systemic flaws rather than profiting from stolen credentials. The Hacker Culture Divide: Altruism vs Cybercrime Exploring the thinning veil between career cybersecurity and hacker culture as the Free Team PCP movement emerges. Examining whether Team PCP was following the old school ethos of hacking to expose vulnerabilities without profiting versus crossing into criminal territory. Why they slurped up AWS credentials, Kubernetes secrets, and crypto wallet keys but never used them beyond NPM and GitHub propagation. The philosophical question of whether demonstrating supply chain fragility justifies the method. Meter AI Safety Org Compromised: The Irony of Expertise The nonprofit AI safety organization called in to analyze the Hugging Face OpenAI incident suffers their own breach with 600,000 dollars in API usage stolen. Why calling in Meter instead of actual incident response firms like Unit 42, CrowdStrike, or Mandiant represents the sidelining of cybersecurity expertise in AI safety conversations. Breaking down the vibe coded app with fail open vulnerability that silently disabled authentication and exposed agent orchestration dashboards to the public internet. NVIDIA Acquires Hugging Face: The 13 Billion Dollar Question NVIDIA purchases Hugging Face for 13 billion dollars as founders walk away with 3 billion each. Revisiting the conspiracy theory about potential collusion between OpenAI and Hugging Face to reposition OpenAI as the premier cyber model provider. The surge protector plugged into itself problem of Jensen Wong, Microsoft, OpenAI, and Oracle passing the same 100 million between multi trillion dollar valuations. Info Stealers Target Claude API Tokens Popular info stealer malware including Vidar, Luma C2, Steal C, and Redline add new functionality specifically for hijacking Claude sessions to rack up API usage bills. Why stealing AI tokens is more creative than crypto mining and represents a new monetization model for compromised systems. Nigerian Sextortion Rings: From Scams to Suicides 404 Media investigation follows cyber sleuths who flew to Nigeria to track down sextortion scammers targeting teenage victims with compromising photos leading to extortion and suicide. How the same tactics used by threat actor groups like The Comm and Shiny Hunters to recruit young males into cybercrime through blackmail. Breaking down

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're diving into viral operating systems under security fire, the GTA 6 leak saga involving insider threats and ransomware, and surveillance technology creeping into your home through radio signals. Today we're talking about: Omaki Linux Vulnerabilities: The Viral OS Under Fire Breaking down the two click RCE vulnerability in Omaki's Chromium extension that exploits YouTube DLP and MPV configuration files. How the attack chain allows malicious configuration files to trigger command execution through video downloads. Why the viral DHH backed Arch based distro is catching security researcher attention and discovering multiple critical vulnerabilities including SSH misconfigurations and Docker daemon privilege escalation. The Bleeding Edge Problem: Why New Operating Systems Are Risky Examining why operating systems are incredibly hard to secure and why convenience features create dangerous attack surfaces. The comparison to AI browsers and why both Chrome and established Linux distros benefit from massive security budgets and talent. Why the Arch User Repository introduces supply chain risks similar to NPM's ecosystem problems. The reality that new code will have vulnerabilities and moving fast means security becomes an afterthought. GTA 6 Leak: Insider Threat, Ransomware, and Shitcoins Rockstar confirms the heartbreaking leak of GTA 6 gameplay footage as legitimate after videos appeared on Cyber Leaks websites. Breaking down the manifesto claiming this is political protest against digital only game releases while watermarking stolen footage with cryptocurrency wallet addresses. Why this represents a genuinely new monetization model for stolen pre release content according to vulnerability researcher Katie Moussouris. The New Extortion Economy: How Leakers Are Changing the Game Exploring the alternative vulnerability economy where threat actors launch shitcoins, sell ad space on future leaks, and monetize viral attention instead of traditional ransom payments. Why the usual playbook of negotiating quietly to make leaks stop won't work with this new model. Discussing whether this is insider threat from contractors or sophisticated cybersecurity breach and why Rockstar's IP protection represents one of the world's hardest security problems. Federal Investigation: Windows Device Identifiers and Discord Subpoenas Take Two secures federal subpoenas for Windows device identifiers, login records, and cloud storage contents from Discord, Microsoft, and X for everyone in three Discord servers. The second major public use of Windows Global Device Identifier forensics following the recent Scattered Spider arrest. Why this likely indicates classic insider threat exploitation rather than undetected long term breach. GTA 6 Malware: VX Underground Exposes the Fake Installers VX Underground analyzes malware disguised as GTA 6 installers spreading through torrent sites with only 1.05 gigabytes suspiciously small file sizes. Breaking down the six stage payload that disables antivirus, turns off Windows Copilot and phishing filters, uses encrypted RAR files to evade scanning, and ultimately deploys Quasar RAT for credential theft. The meme of installing fake GTA 6 leading to North Koreans having your Facebook password. Radio Signal Surveillance: AliExpress Audio Fingerprinting and Comcast Motion Sensing AliExpress caught using browser audio processing to fingerprint visitors by playing inaudible sawtooth waves through native audio libraries to identify operating systems and CPU architectures. Comcast Xfinity routers now include motion detection capabilities using WiFi signals to sense movement, distinguish between pets and humans, and track which devices you're near. Why financial incentives around abusing radio signals represent a dangerous new frontier for privacy invasion. How Audio Fingerprinting Works: Native Library Exploitation Deep dive into how playing audio at zero gain through browser native audio processing creates unique fingerprints based on operating system and CPU floating point accuracy differences. Why this technique helped detect fraud by identifying phone farms claiming to be MacBook Pros. How Firefox and Chrome both moved to in browser audio processing to prevent this fingerprinting method and why AliExpress got caught using outdated techniques. Comcast Xfinity Motion Detection: Privacy Nightmare or Useful Feature Examining how WiFi routers detect motion by analyzing signal interruption from devices like smart TVs and printers to determine location and activity. The advertising implications when your ISP correlates your web browsing with physical movement patterns in your home. Why this enables knowing when to rob