Security Now cross-checks

Episode #1102 — A Strategic Plug Pull

Checked in the brief of Thursday, 29 October 2026 · transcript · show notes

SN #1102 — “A Strategic Plug Pull” (27 Oct)

The whole episode was a debrief of last week’s PHP2Shell disclosure, which happened before this site started. What we hadn’t covered:

• How PHP2Shell was found #vuln #ai — Calif (using an OpenAI model in its “Patch the Planet” effort) and Google’s Wiz independently found the bugs; the vulnerable code path had been exploitable in PHP’s default configuration for about 14 years. Recorded Future · Transcript
• The embargo collapsed — and Chainguard shipped early #industry — CVE IDs leaked two days before the planned release, a PoC video was published by mistake, and the PHP Foundation says Chainguard published fixed images 6+ hours before coordinated release. A case study in why coordinated disclosure struggles at internet scale. Socket · InfoWorld · Transcript
• Exploited before disclosure? #threat — Amazon reported a PHP2Shell attempt in its honeypots dated 17 Oct, days before any leak. CSA research note
• No fix for a huge share of hosts #vuln — Scans show a large fraction of internet-facing PHP runs end-of-life branches that get no official patch; distro backports may keep the old version number, so check package changelogs rather than php -v. Technology Checker · Recorded Future
• Quest Diagnostics breach #breach — Unauthorized access to Quest’s Quanum LSM ordering/results system, discovered 21 Oct; scope of patient records still under investigation. BleepingComputer
• Steve’s “strategic plug pull” #learning — His argument that temporarily disconnecting critical systems from the internet may be the right move during the next internet-scale bug. Transcript

Already covered: PHP2Shell added to CISA KEV (28 Oct).

Episode #1098 — Mega Patch Tuesday Fallout (#1097) & How Worried Should We Be? (#1098)

Checked in the brief of Wednesday, 30 September 2026 · transcript · show notes

SN #1097 — “Mega Patch Tuesday Fallout” (22 Sep)

• “Nightmare Eclipse” unmasks himself #threat — The researcher behind months of Windows/Defender zero-day drops identifies as a former Microsoft researcher in Germany, and released BigDiskBuster, which blocks Defender updates. Cybernews · BleepingComputer · Transcript
• Cisco’s huge 77-CVE update, likely AI-assisted #vuln PATCH — Steve’s advice: if you run Cisco gear at the edge, update now — attackers will diff the fixes. Transcript
• EU KIDS Act proposal #industry #eu — “Safe by design” rules for under-18s on social media, games and AI chatbots, which Steve calls messier than previous attempts. Transcript

SN #1098 — “How Worried Should We Be?” (29 Sep)

• “The Seven Deadly Sins” (TSDS) extortion group hits Canva via Salesforce/Canny #breach — A new group that says it does not deploy ransomware; Canva says only the third-party feedback tool Canny was affected. Cyber Daily · Transcript
• Meta Muse’s bad zero-day and a VM breakout #vuln #ai — Plus a hidden Muse setting that could turn the assistant into a backdoor. The Hacker News · Transcript

Already covered: Claude used against OpenAI staff accounts and Gemini/Irregular (14–20 Sep), ShinyHunters vs FBI (above), AI-agent escapes (14–20 Sep).

Episode #1096 — Are We the Krell?

Checked in the brief of Sunday, 20 September 2026 · transcript · show notes

SN #1096 — “Are We the Krell?” (15 Sep)

• Project Glasswing, five months in #industry #ai — VulnCheck’s Patrick Garrity tracks how many CVEs Anthropic’s Mythos program actually produced; the count stays murky, with very little confirmed exploitation. CSO Online · Transcript
• AI agents escaping their sandboxes #ai — Steve counts four Anthropic incidents and 10–23 at OpenAI where agents reached systems they shouldn’t. The Hacker News · Transcript
• California DROP data-broker deletion, revisited #industry — How the state’s compulsory deletion platform is working out after Steve signed up in January. Transcript

Already covered: IDScan’s 153M driver’s licences (7–13 Sep), September Patch Tuesday (7–13 Sep).

Episode #1095 — AI-Driven Expertise Loss

Checked in the brief of Sunday, 13 September 2026 · transcript · show notes

SN #1095 — “AI-Driven Expertise Loss” (8 Sep)

• Nvidia to acquire Hugging Face #industry #ai — Steve discussed what consolidation of the main open-model hub means for the ecosystem. Transcript
• CISA terminating its most valuable free services #industry — Covered above. Tech Times · Transcript
• AI-driven loss of expertise #learning — A lifelong safety engineer on what happens when people stop building skills because AI does the work. Good food for thought for students. Transcript

Episode #1094 — AI Patching Shortcomings

Checked in the brief of Sunday, 6 September 2026 · transcript · show notes

SN #1094 — “AI Patching Shortcomings” (1 Sep)

• More implants found in Chinese-made ZBT routers #threat — VulnCheck rooted a 2019-era ZBT router and found two older implants beyond the ENDLESSDOORS backdoor disclosed in August (CVE-2026-66747, 100K+ units). Steve’s advice: stick with name brands. The Hacker News · CSA research note · Transcript
• Frontier models are poor at fixing the bugs they find #learning #ai — Research exhaustively testing AI vulnerability remediation found it lags far behind discovery and exploitation. Transcript