Mastering Incident Response: A Guide To Building A Resilient Plan Daily Security Review podcast

55:25

In this episode, we dissect Google's recent and upcoming decisions to distrust several Certificate Authorities (CAs) within the Chrome Root Store, including Entrust, Chunghwa Telecom, and Netlock. These high-impact moves are rooted in Chrome's strict enforcement of compliance, transparency, and security standards for public trust. We explore the role of the Chrome Root Store and Certificate Verifier, the timeline and technical specifics of the CA distrust actions taking effect in November 2024 and August 2025, and the broader implications for enterprises and the Web Public Key Infrastructure (WebPKI). You'll hear how these changes affect certificate validation, enterprise overrides, and post-quantum cryptographic readiness. We also examine what these actions signal for the future of digital trust, CA accountability, and browser power dynamics. Tune in to understand how Chrome’s decisions are reshaping the rules of HTTPS trust and what enterprises must do now to stay ahead of disruptions.…

Daily Security Review

1
CVE-2025-48827 & 48828: How vBulletin’s API and Template Engine Got Weaponized 1:35:55

12 hours ago1:35:55

1:35:55

Two critical, actively exploited vulnerabilities in vBulletin forum software— CVE-2025-48827 and CVE-2025-48828 —have put thousands of websites at immediate risk of full system compromise. In this episode, we dissect how these flaws, triggered by insecure usage of PHP’s Reflection API and abuse of vBulletin’s template engine, allow unauthenticated attackers to execute arbitrary PHP code and gain remote shell access. We’ll break down the exploit chain, from protected method invocation via malformed API calls to injection of malicious conditionals, enabling full Remote Code Execution (RCE) in vulnerable versions of vBulletin running PHP 8.1 or later. You’ll learn how attackers are currently weaponizing these bugs in the wild—leveraging public exploit code and scanning endpoints like /ajax/api/ad/replaceAdTemplate to plant backdoors. We also cover: Patch levels and which versions are safe (hint: upgrade to v6.1.1 now) Temporary mitigations for legacy vBulletin deployments IOC monitoring, containment strategies, and threat hunting advice Why dynamic method invocation should never be your access control boundary Lessons for developers and sysadmins on avoiding similar reflection-based pitfalls Whether you run a vBulletin forum or just want to understand the anatomy of a modern web RCE exploit, this episode is your front-row seat to one of 2025’s most serious application-layer vulnerabilities.…

Daily Security Review

1
JINX-0132: How Cryptojackers Hijacked DevOps Infrastructure via Nomad and Docker 1:07:22

15 hours ago1:07:22

1:07:22

In this episode, we dissect the JINX-0132 cryptojacking campaign — a real-world example of how threat actors are exploiting cloud and DevOps environments to mine cryptocurrency at scale. We unpack how cybercriminals targeted misconfigured Docker APIs, publicly exposed HashiCorp Nomad and Consul servers, and vulnerable Gitea instances — turning enterprise-grade compute resources into crypto-mining farms, all while staying under the radar. This campaign marks the first publicly documented exploitation of HashiCorp Nomad in the wild. We discuss: How attackers used XMRig, cron jobs, and process-hiding tools to persist and evade detection The impact of misconfiguration and unpatched vulnerabilities in fast-moving DevOps workflows The financial and operational cost of unauthorized crypto mining in the cloud The role of DevSecOps in preventing these attacks, with actionable recommendations for securing your containers and runtimes Key practices to “shift left” and catch security flaws early in the software development lifecycle Why Cloud Workload Protection Platforms (CWPP) are becoming essential in defending modern cloud-native environments We also highlight best practices for hardening Docker images, avoiding privileged containers, monitoring system behavior, and responding to incidents with speed and precision.…

Daily Security Review

1
Password Hashes Leaked via Linux Crash Handlers: The Truth Behind CVE-2025-5054 & 4598 16:11

1 day ago16:11

16:11

In this episode, we unpack two newly disclosed Linux vulnerabilities—CVE-2025-5054 and CVE-2025-4598—discovered by the Qualys Threat Research Unit (TRU). These race condition flaws impact Ubuntu’s apport and Red Hat/Fedora’s systemd-coredump , exposing a little-known but critical attack vector: core dumps from crashed SUID programs. We dive into how these TOCTOU (Time-of-Check to Time-of-Use) race conditions let local attackers manipulate system timing to trick crash handlers into leaking sensitive data. While the CVSS score is a moderate 4.7, the implications are serious—core dumps can contain password hashes, encryption keys, or proprietary data from privileged processes. Join us as we discuss how the vulnerabilities work, which Linux distributions are affected, and how administrators can apply patches or disable SUID core dumps as a temporary fix. We also explore what this means for system hardening, local threat models, and the often-overlooked risk posed by debugging and crash-reporting tools.…

Daily Security Review

1
Multi-Stage Phishing Attacks Now Use Google Infrastructure—Here’s How 13:51

1 day ago13:51

13:51

Recent phishing campaigns have entered a new phase—one where trust is weaponized. In this episode, we break down how cybercriminals are exploiting legitimate services like Google Apps Script and Google Firebase Storage to host phishing pages, evade detection, and steal credentials. Using cleverly crafted lures such as fake DocuSign notifications, invoice alerts, and even deceptive CAPTCHA prompts, these attackers are bypassing traditional email and web filters by operating under the guise of reputable platforms. We’ll dive into specific attack techniques, including multi-stage payload delivery using VBScript, clipboard hijacking with fake MP3 files, and the deployment of tools like NetBird and OpenSSH for persistent access. We’ll also explore the rise of Phishing-as-a-Service kits like Haozi that lower the barrier for launching these sophisticated campaigns. Finally, we cover key mitigation strategies—from detection platforms to user education—that organizations can adopt to stay ahead of these evolving threats. This episode is a must-listen for IT professionals, CISOs, and anyone tasked with defending against phishing and social engineering attacks in today’s high-trust, high-risk digital landscape.…

Daily Security Review

1
Inside the AVCheck Takedown: How Law Enforcement Disrupted a Key Cybercrime Tool 17:34

1 day ago17:34

17:34

In this episode, we unpack the international takedown of AVCheck, one of the largest counter antivirus (CAV) services used by cybercriminals to test and fine-tune malware before deployment. Led by Dutch authorities and supported by agencies from the U.S., Germany, France, and others, this operation marks a major win in Operation Endgame—a sweeping initiative targeting malware infrastructure, ransomware syndicates, and initial access brokers. AVCheck enabled attackers to simulate antivirus scans and ensure their payloads were virtually undetectable, making it a cornerstone of the modern malware development cycle. Authorities seized domains, servers, and a rich database of user information, some of which links AVCheck directly to notorious ransomware groups. The same investigation also exposed ties between AVCheck and crypting services like Cryptor.biz and Crypt.guru, underscoring how deeply integrated these dark web services are. We also explore the implications of this crackdown: how disrupting enabler services like AVCheck may prevent future cyberattacks, why ransomware groups are now shifting tactics—including potentially more violent threats—and what comes next as cybercriminals adapt. From undercover ops to fake login traps and forensic analysis, this episode covers the full scope of the AVCheck takedown and its impact on global cybercrime.…

Daily Security Review

1
ConnectWise Breach: Nation-State Exploits CVE-2025-3935 in ScreenConnect 15:06

4 days ago15:06

15:06

ConnectWise has confirmed a cyberattack targeting ScreenConnect, its remote access solution used by thousands of Managed Service Providers (MSPs). The breach is reportedly tied to a sophisticated nation-state actor and linked to CVE-2025-3935, a critical ViewState code injection vulnerability that could allow Remote Code Execution (RCE). In this episode, we dissect what happened, why it matters, and what MSPs need to do right now. We cover the technical details behind CVE-2025-3935, including how attackers exploit machine keys to execute malicious payloads on vulnerable servers. You'll hear what ConnectWise has—and hasn't—shared publicly, why their communication is frustrating some users, and why many believe the impact might be broader than officially stated. We also examine the bigger picture: What does this mean for cybersecurity in the MSP ecosystem? How prepared are we for nation-state-level threats? And how can organizations improve patch management and incident response before the next zero-day is weaponized? Whether you're an MSP, a CISO, or an IT admin responsible for remote access tools, this is a breach you can’t afford to ignore. Tune in for expert analysis, community reactions, and actionable insights on securing your infrastructure.…

Daily Security Review

1
Browser vs. GPU: Firefox 139 Collides with NVIDIA Drivers 14:10

5 days ago14:10

14:10

In this episode, we dive into the graphical corruption saga triggered by Firefox version 139, released on May 27, 2025. Aimed at uncovering what went wrong, we review reports from across the web detailing how the update wreaked havoc for Windows users running NVIDIA graphics cards—particularly those with multi-monitor setups using mixed refresh rates. We discuss the symptoms users experienced: severe flickering, video playback issues, and flashing web pages that rendered the browser unusable for many. We explore the underlying technical culprit—Firefox’s use of Windows DirectComposition surfaces instead of swapchains—and how this specific implementation conflicted with certain NVIDIA driver configurations. You'll also hear how Mozilla responded, from recommending a manual workaround through about:config, to issuing a rapid emergency update (version 139.0.1) that restored a blocklist to prevent the artifacts. We reflect on how this incident highlights the fragile intersection of GPU drivers, OS-level composition tools, and browser rendering pipelines. If you're running a multi-monitor rig with NVIDIA GPUs—or just interested in how complex modern browser rendering really is—this episode breaks it all down and explains how Mozilla handled a potentially reputation-damaging bug with transparency and speed.…

Daily Security Review

1
Unbound Raises $4M to Secure Generative AI in the Enterprise 20:08

5 days ago20:08

20:08

In this episode, we break down the recent $4 million seed funding round for Unbound, a startup tackling one of the biggest unsolved problems in enterprise AI: how to stop employees from leaking sensitive data through ungoverned use of Generative AI tools. Unbound’s AI Gateway aims to be the missing link between rapid AI adoption and responsible usage—offering real-time redaction of sensitive prompts, intelligent model routing, and deep usage analytics. With early adopters already preventing thousands of data leaks and cutting AI costs by up to 70%, investors are betting big on governance infrastructure as the next AI gold rush. We discuss why Unbound’s funding isn’t just another startup headline—it’s a signal that AI governance is no longer optional. As companies like Sony suffer from preventable data exposures and shadow AI runs rampant inside enterprises, this episode explores how and why AI Gateways are poised to become a foundational layer of enterprise architecture.…

Daily Security Review

1
Windows Updates, Reimagined: Inside Microsoft’s Unified Orchestration Push 16:18

5 days ago16:18

16:18

Microsoft is taking direct aim at one of the biggest pain points in the Windows ecosystem: update fragmentation. In this episode, we dive deep into the details of Microsoft’s newly announced Windows-native update orchestration platform , currently in private preview. We explore how this unified infrastructure aims to centralize updates for all apps, drivers, and core OS components under the familiar Windows Update umbrella—bringing it more in line with the seamless update experiences of Android and macOS. We’ll discuss the root of the fragmentation problem, how third-party apps currently operate in silos, and the operational headaches this causes for end-users and IT administrators alike. You'll learn how the new platform works, how developers can integrate with it using WinRT APIs and PowerShell, and what benefits it promises—from better reliability and performance optimization to unified logging and smarter scheduling. We also cover critical challenges ahead, including developer adoption, concerns over user control, potential security risks, and the implications of centralizing such a crucial system function. Plus, we touch on current tools like the PSWindowsUpdate PowerShell module and platforms like Action1 that are helping bridge the update management gap today—until Microsoft’s new platform becomes mainstream. Whether you're a sysadmin, a developer, or just someone tired of juggling app update popups, this episode breaks down what’s coming and why it matters.…

Daily Security Review

1
Systemd as a Weapon: How PumaBot Exploits Linux Persistence 18:38

6 days ago18:38

18:38

Linux systems are under siege—particularly in the world of IoT and internet-exposed servers. In this episode, we dissect PumaBot, a new GoLang-based botnet that's turning Linux IoT devices into cryptomining workhorses. We’ll break down how attackers brute-force SSH credentials, install malware disguised as legitimate services, and use systemd for stealthy persistence. We dive deep into ATT&CK technique T1501, where systemd services like redis.service or mysqI.service are hijacked or maliciously created to ensure malware survives system reboots. You'll learn how adversaries leverage GoLang’s cross-platform strengths and embed rootkits like pam_unix.so to capture credentials, all while evading detection with environment fingerprinting. We also explore the broader implications: how cryptojacking continues to rise, what SSH brute-forcing says about current security hygiene, and why IoT devices remain a weak link in enterprise infrastructure. If you manage Linux systems or deploy connected devices, this episode is your tactical briefing on the latest threats—and what to look out for before your CPU cycles are stolen for someone else's crypto wallet.…

Daily Security Review

1
The LexisNexis Breach: 364,000 Records Exposed via GitHub 17:22

6 days ago17:22

17:22

On December 25, 2024, while most businesses were offline, a serious data breach struck LexisNexis Risk Solutions—exposing the personal data of over 360,000 individuals. The twist? The attack vector wasn’t a direct hack, but an indirect compromise through a third-party GitHub repository. Even more concerning, the breach went undetected until April 1, 2025. In this episode, we break down the timeline, scope, and implications of the LexisNexis incident. We examine how the company’s own privacy principles—centered on accountability, security, and privacy-by-design—stack up against what actually happened. We’ll also explore: The role of third-party platforms in modern breaches Why detection delays remain a persistent issue How this breach compares with past major incidents, like Equifax and Yahoo What this means for the future of privacy frameworks and enterprise security postures As data breaches become increasingly common and complex, this case raises critical questions: Are published privacy principles enough? And what can companies do to truly align policy with practice? 🔐 Tune in to find out—and what enterprises must do to avoid being next.…

Daily Security Review

1
Ransomware Hits MathWorks: Week-Long Outage Disrupts Millions 12:30

6 days ago12:30

12:30

On this episode, we dissect the ransomware attack that brought MathWorks—a cornerstone software provider for engineers, scientists, and educators—to a grinding halt. The attack, which began on May 18, 2025, and was officially confirmed on May 26, crippled a wide range of customer-facing and internal systems, from MATLAB Online and ThingSpeak to license distribution and downloads. We examine the timeline of the incident, MathWorks’ response, and what services remain down or degraded even as restoration efforts continue. With over 5 million users and customers across 100,000 organizations, the outage has triggered a wave of disruptions—especially for students relying on MATLAB Online during finals week. We also explore the silence from ransomware groups, speculate on whether a ransom was paid, and discuss why this significant attack has received surprisingly little media coverage. Is MathWorks buying time behind closed doors, or is this another sign of growing sophistication among ransomware gangs? Tune in for a comprehensive breakdown of the incident, the user impact, and the broader implications in today’s escalating ransomware threat landscape.…

Daily Security Review

1
Zscaler Acquires Red Canary: What It Means for AI-Powered Security Operations 14:27

7 days ago14:27

14:27

The cybersecurity market is booming, projected to triple in size from $215 billion in 2025 to $697 billion by 2035. This explosive growth is being fueled by rising cyber threats, the digital transformation of global businesses, and an urgent need for advanced security operations. One of the clearest signals of this momentum? Zscaler’s acquisition of Red Canary—a leading Managed Detection and Response (MDR) provider. In this episode, we unpack Zscaler’s strategic decision to acquire Red Canary and what it reveals about the evolving cybersecurity landscape. We explore how this move reflects a broader M&A trend in the sector, where large players are aggressively acquiring innovative startups to enhance their detection capabilities and talent pool. With access to 500 billion daily data transactions via Zscaler’s Zero Trust Exchange, Red Canary is poised to supercharge its threat detection accuracy and speed. We’ll break down how MDR differs from traditional MSSPs and EDR, why it's now considered a critical service for enterprises, and how AI-driven security operations are becoming the new normal. Plus, we dive into how Zscaler’s zero trust architecture is simplifying post-acquisition integration, allowing for faster value realization with less risk. Tune in for a deep-dive look at one of the most significant cybersecurity deals of 2025—and what it means for the future of AI, MDR, and the multi-billion-dollar battle to secure the digital world.…

Daily Security Review

1
DragonForce Breaches MSPs via SimpleHelp Flaws: Inside CVE-2024-57726 16:47

7 days ago16:47