PHP2Shell Breaks the Internet - The 443 Podcast - Episode 393

This week on the podcast, we dive into a pair of PHP vulnerabilities dubbed PHP2Shell and the chaos they caused through uncoordinated disclosure. After that, we discuss a certificate authority who's random number generator only goes to three digits before ending with law enforcement action around ShinyHunters ransomware negotiators.

New Charter Technologies CISO, Ryan Davis joins The 443 to discuss the evolving cybersecurity landscape across different regions, the unique challenges organizations face, and the trends shaping the future of security. Tune in for insights into emerging threats, regional priorities, and how businesses and partners can stay ahead of an ever-changing threat landscape.

In this episode, WatchGuard CSO Corey Nachreiner sits down with Andrew Morgan, founder of Right of Boom, to discuss the evolving role of MSPs in cybersecurity live from Impact Partner Conference in Nashville. From common security gaps and lessons learned from real-world incidents to the impact of AI, Andrew explores what it takes for MSPs to move beyond selling security tools and become true security providers. Tune in to learn how MSPs can better protect themselves and their customers while preparing for the challenges ahead.

This week on the podcast, we cover a few takeaways from Microsoft's recent Digital Defense Report. Before that, we discuss the recent Citrix Netscaler zero-days that were potentially under active exploit for weeks before disclosure before reviewing an interesting a bug bounty report on a Microsoft internal tool that was exposed externally.

This week on the podcast, we cover yet another rogue AI security incident that Australia's Prime Minister disclosed in front of the United Nations last week. Before that, we discuss an FBI alert on WaterPlum, a North Korean threat actor targeting IT professionals. Then, we cover the FBI themselves becoming a victim of cyberattack, this time by ShinyHunters.

This week on the podcast, we break down how a heap overflow in an image-decoding library nobody thinks about became a pull request inside OpenAI's internal monorepo. Three researchers chained it with an OpenAI single sign-on flaw to hijack employee ChatGPT and Codex accounts in under 72 hours; and had an AI write the exploit for them. Before that, we cover the actively exploited maximum-severity authentication bypass in Cisco's Identity Services Engine. Then we close with RatHat, a new Android malware that enables Wireless Debugging, reads its own pairing code from the screen, and asks a commercial AI assistant where to tap.

This week on the podcast, we analyze a set of actively exploited vulnerabilities in Mikrotik's RouteOS followed by a pair of actively exploited vulnerabilities in Cisco's Firewall Management Center. After that, we review a phishing attack against Trezor hardware cryptocurrency wallet users that originated with their third party marketing email provider.

This week, dive into OpenAI's and METR's analysis of the rogue OpenAI agents that hacked Hugging Face back in July. We go over the full attack timeline discussing the multiple message boards the agents created and the ultimate goal of their attack against Hugging Face and trust us, its as crazy as it gets. Before that, we discuss a recent dark web service that popped up selling 153 million stolen drivers licenses before discussing a research post into a malware implant discovered in inexpensive Chinese routers.

This week we sit down with Euler Neto, a cybersecurity analyst at WatchGuard, to discuss his research into the ErrTraffic Malware-as-a-Service loader found targeting Portoguese-speaking users in recent months.

This week on the podcast, we discuss a research post that defines a new attack technique against AI tools called Cryptographic Context Injection. Before that, we cover an authentication bypass vulnerability in CircleCI's MCP server after discussing 3.6 million records stolen from the Azure tenants of several large organziations.