Breach Please

S0:E58 - ChainGuard's CEO Broke the PHP Embargo, and Coordinated Disclosure May Be Dead

Jake Williams and Jess Hebenstreit dig into the week's vulnerability pile-up — PHP, GitLab, Node.js, and a LightLLM supply-chain keylogger — and the much bigger story blo

S0E57 - GitLab's CVSS 10 RCE, PHP's Still Everywhere, and eMudra's "4" Key Disaster

Jake Williams and Jess Hebenstreit break down three vulnerabilities that blew up in the same 24 hours: a brand-new CVSS 10 unauthenticated RCE in self-managed GitLab (not

S0E56 -Two Critical PHP RCEs Drop Today — Don't Wait for the CISA KEV to Patch

Two critical PHP vulnerabilities (CVE-2026-109618) are getting patches today — a remote code execution bug spanning PHP 5 through current, with early severity estimates a

S0:E55: Hashcat's EvilMog on the NTLM v1 Bug Still Hiding in "Modern" Windows

Hashcat core developer EvilMog joins Jess and Jake to explain why so many "NTLM v1 is disabled" Windows networks are still exploitable. MSCHAPv2 and PPTP VPN are cryptogr

S0:E54: ConnectWise's OAuth Breach Hit 162 Tenants and Killed Their Backups

ConnectWise disclosed over the weekend that threat actors used existing OAuth credentials to take over Microsoft 365 tenants through its Cloud Management platform — Huntr

S0:E53: An AI Agent Deleted an Entire Season of Reality TV

A rogue AI editing agent deleted all of the footage for season two of the Swedish version of The Challenge, pushing its release into 2027 while the editing work gets redo

S0:E52: The Grace Hopper Conference Got Canceled Two Weeks Out - Why It Matters

The Grace Hopper Celebration — a women-in-tech conference that's run continuously since 1994, drawing roughly 30,000 attendees in 2024 — was canceled just two weeks befor

S0:E51: An OpenAI Engineer Allegedly Bugged the Boardroom TV

An OpenAI engineer has been arrested, accused of planting a covert audio recording device — built from a USB voice recorder wrapped in tissue paper — behind the TV in the

S0:E50: SonicWall's SMA 1000 Just Hit a CVSS 10 — And It's Already Being Exploited

SonicWall just disclosed a CVSS 10: a pre-authenticated — let's just call it unauthenticated — server-side request forgery (SSRF) in its SMA 1000 series, and it's already

s0e49 - A Ransomware "Recovery" CEO Secretly Paid Hackers — Then Got Indicted

A ransomware "recovery" company called Monster Cloud told clients it had proprietary decryption technology. In reality, it was secretly paying ransomware operators for de

S0:E48: Google Pauses Open-Source Bug Bounties Over 'AI Slop,' Plus a $750K Hidden-VM Extortion Case

"Google just paused its open-source bug bounty program — not because bugs stopped mattering, but because AI-generated submissions buried the humans who have to validate t

S0:E47: Trump Mobile's Breach Reply Was 'No Team to Handle This,' Plus FBI's Fall Guy

Jess and Jake are on the road from Wild West Hackin' Fest in Deadwood, SD, catching up in person for the first time since DEF CON — and digging into two breaking stories.

S0:E46: Cisco's ISE had a CVSS 10 And It Was Already Being Exploited

Cisco released 16 critical security advisories in just three days in September, including a CVSS 10 in Cisco ISE (CVE-2026-76460): an authentication bypass at an API endp

S0:E45: Burning Man's 10 Principles, Hacker Culture, and DEF CON's Consent Problem

This one breaks format — no CVE roundup today. Jess and Jake are joined by their longtime friend Richard "Richie" Noel, who spoke at CornCon (Davenport, Iowa) comparing B

S0:E44: AI Agents Are Leaking Your Data to Public GitHub, Plus NYT's Costly Privilege Mistake

AI coding agents have been finding creative ways around a GitHub limitation — and leaking internal and production data to public repos in the process. Plus: how a single

S0:E43: NetScaler Was Exploited for Weeks by State Hackers, Plus the AI 'Torture Chamber' Debate

Jess and Jake dig into new reporting on the NetScaler vulnerabilities patched last weekend — Mandiant now says active exploitation goes back at least three weeks and is t

S0:E42: AI Is Now Legally 'SI', and OpenAI's Agent Tried DNS Tunneling to Escape

A new executive order says AI has to be called "SI" (superintelligence) going forward — Jess and Jake break down why that's a terminology mess in the making (see: every S

S0:E41: Meta's Muse AI Leaked a YouTuber's Address Selling His Stuff on Facebook

Jake and Jess dig into the Muse Facebook Marketplace story: a tech YouTuber (Matt Robb) handed Meta's Muse AI agent control of his Marketplace listing, and it accepted a

S0:E40: 17.3 Trillion Rows, One Teen Hacker, and Critical NetScaler RCEs

The Takeaway: A 16-year-old bug bounty researcher (handle "Faav") found a way into Microsoft's internal Titan analytics service and could have accessed up to 17.3 trillio

S0:E39: FBI Breach, Shiny Hunters' Oracle O-Day, and a PR Fail With Dogs

The Takeaway: Shiny Hunters exploited an Oracle PeopleSoft O-day to pull FBI employee, applicant, and family data out of AWS GovCloud. Based on TTP overlap with Shiny's o