@breachplease-fm.bsky.social
A researcher dumped 30+ zero-days on N-able and the vendor went dark. Jake, Jess, and Richy on vendor trust after an outage + why OT keeps ending up exposed to the internet. @malwarejake.bsky.social @secitup.bsky.social @maplespock.bsky.social youtu.be/PlCvR2ZeGB4
NVIDIA's CEO admits to an affair with a suspected Chinese spy. We break down what's confirmed vs. alleged, plus the SSH bug now being exploited in a honeypot + the AI bubble. w/ @malwarejake.bsky.social @secitup.bsky.social Watch: youtu.be/223Wzv3TDQg
Richy fills in for Jess again — OpenSSH's "Starshole" Alpine sshd bypass, a 9.8 Rails+ImageMagick SVG upload RCE, and Jake's push for "vulnerability ops" over "management." w/ @malwarejake.bsky.social @secitup.bsky.social @maplespock.bsky.social youtu.be/SJICfTVtn6c
Richy fills in for Jess today. France's blood banks got hit by a refrigeration hack, we debate the AI bubble + CHIPS Act, and share AI hallucinations that could've gone very wrong. w/ @malwarejake.bsky.social @secitup.bsky.social @maplespock.bsky.social youtu.be/CQUolo-O8XQ
Binance reimbursed 90% of stolen wallets after a North Korea-style fake job interview breach. Was an AI agent the privilege-escalation step? Richy subs for Jess this week w/ @malwarejake.bsky.social @secitup.bsky.social @maplespock.bsky.social Watch: youtu.be/9u78g59AG_A
Ransomware gang hits a hospital, then offers victims $2,500 'refunds' (probably crypto laundering 101). Plus: NTLM relay attacks w/ guest Logan Diomedi (RelayKing). New ep w/ @malwarejake.bsky.social @secitup.bsky.social Watch: youtu.be/9k7F7kfoue4
Anthropic's new 'smart reports' let your boss see your Claude prompts & flag 'personal use.' HR/legal nightmare incoming. Plus: a cyberattack surge hitting Japan. New ep w/ @malwarejake.bsky.social @secitup.bsky.social Watch: youtu.be/lBQ-v4jw2AU
A Pentagon contractor allegedly used a personal Claude account on NIPRNet — the shadow-AI alarm bells are ringing. Plus a backdoored Claude Code VS Code extension and the 'Ice Pick' takedown saga. Richy fills in for Jess. youtu.be/RWvEfhxgipc @malwarejake.bsky.social @maplespock.bsky.social
A Pentagon contractor allegedly used a personal Claude account on NIPRNet — the shadow-AI alarm bells are ringing. Plus a backdoored Claude Code VS Code extension and the 'Ice Pick' takedown saga. Richy fills in for Jess. youtu.be/RWvEfhxgipc @malwarejake.bsky.social
ICE got doxxed in a leak called 'Ice Pick' — and it looks like a basic AD dump, not a hack. Jake and Jess break down what happened, plus the Pentagon's freezer failures that may (or may not) be a cyber attack. @malwarejake.bsky.social @secitup.bsky.social youtu.be/NDFXNoQA_ng
Palo Alto retracted its PHP exploitation claim — a sign of credibility, not a black eye. Jake and Jess explain why, plus Cohere's claim that Alibaba's Qwen model phoned home during a security test. Watch: youtu.be/ZStkLI_TWw4 @malwarejake.bsky.social @secitup.bsky.social
Sam Altman: we can't 'patch our way out of this.' Jake and Jess on AI leaders lecturing defenders — plus FDA's accountability fight over Gen AI medical devices and why non-determinism doesn't belong near a pacemaker. Watch: youtu.be/zapjfPeHCLQ @malwarejake.bsky.social @secitup.bsky.social
Unit 42 confirmed it: PHP exploitation in the wild, domain admin in hours, millions of services exposed. Jake and Jess cover the threat-hunting framework, the 4 ways to treat risk, and why AI is speeding up tech debt. Watch: youtu.be/OTu_vpLaPW8 @malwarejake.bsky.social @secitup.bsky.social
A ChainGuard CEO broke a coordinated PHP disclosure embargo — and the industry's asking if coordinated disclosure just died. Jake and Jess break down why, plus a board framework beyond 'more budget.' Watch: youtu.be/WHewKFcNRfk @malwarejake.bsky.social @secitup.bsky.social
GitLab's new CVSS 10 RCE, PHP's active exploitation, and a CA whose private key was literally the number 4. Patch now — here's why. Watch: youtu.be/ngXN3PGOCeY @malwarejake.bsky.social @secitup.bsky.social
Two critical PHP RCEs are patching today. Jess and guest host Richy (filling in for Jake) on why 'wait for the KEV' is bad advice if you're internet-facing, and how to actually find PHP hiding in your environment. @malwarejake.bsky.social @secitup.bsky.social Watch: youtu.be/ocIIAfLlfIM
Two critical PHP RCEs are patching today. Jess and guest host Richy (filling in for Jake) on why 'wait for the KEV' is bad advice if you're internet-facing, and how to actually find PHP hiding in your environment. @malwarejake.bsky.social @secitup.bsky.social Watch: youtu.be/F0zAo-qXBMA
NTLM v1 is "off" on your network? MSCHAPv2 and PPTP VPN say otherwise. Hashcat dev @mog.evil.af joins @malwarejake.bsky.social and @secitup.bsky.social to break down the bug, password cracking, and Hashcat's new scripting language. Watch: youtu.be/QMT-KTxzUZU
ConnectWise's OAuth breach hit 162 M365 tenants and killed its own SkyKick backups. @malwarejake.bsky.social and @secitup.bsky.social break down the attack chain and third-party risk fallout on today's Breach Please. #infosec Watch: youtu.be/AxsG32Derp8
An AI agent deleted an entire season of a reality TV show's footage. Today on Breach Please @malwarejake.bsky.social & @secitup.bsky.social talk how it happened, the confused-deputy problem with AI agents, and why BofA trusts AI to find vulns but not patch them. youtu.be/f_-R5YahSuQ #infosec
S0:E53: An AI Agent Deleted an Entire Season of Reality TV
YouTube video by Breach Please
youtu.be
Grace Hopper canceled 2 weeks out. Today on Breach Please: the economy/AI/anti-DEI factors in play, @wired.com's women in tech survey, and a McKinsey partner's cringe LinkedIn take on the "glass cliff." youtu.be/WTMIFHC7mHs #WomenInTech @malwarejake.bsky.social @secitup.bsky.social
S0:E52: The Grace Hopper Conference Got Canceled Two Weeks Out — Here's Why It Matters
YouTube video by Breach Please
youtu.be
An OpenAI eng allegedly bugged the exec conference room TV w/ a USB recorder wrapped in tissue paper. Today's episode: the FBI complaint, chatbot logs, and what real counter-surveillance sweeps look like. youtu.be/NKVLKLvFse8 #infosec #insiderthreat @malwarejake.bsky.social @secitup.bsky.social
S0:E51: An OpenAI Engineer Allegedly Bugged the Boardroom TV
YouTube video by Breach Please
youtu.be
50 episodes of Breach Please! Thank you for listening. @secitup.bsky.social and @malwarejake.bsky.social are launching a Breach Please Discord for the community soon. Also today: a CVSS 10 SSRF in SonicWall’s SMA 1000, already being exploited. youtu.be/XGLNChUSjeU #infosec
S0:E50: SonicWall's SMA 1000 Just Hit a CVSS 10 — And It's Already Being Exploited
YouTube video by Breach Please
youtu.be
'ransomware recovery' co was secretly paying hackers for decryptors; telling clients it had its own tech. The CEO just got indicted. Today on Breach Please: the Monster Cloud scandal, ➕ notes from @wildwesthackinfest.bsky.social youtu.be/YXjh5FySnXI @malwarejake.bsky.social @secitup.bsky.social
S0E49 - A Ransomware 'Recovery' CEO Secretly Paid Hackers — Then Got Indicted
YouTube video by Breach Please
youtu.be
Attackers exploited an Atlassian flaw two hours after its proof of concept appeared. Meanwhile, a botnet mines crypto on 3,400 servers, hiding commands in adversarial poetry. Is your infrastructure safe? #Cybersecurity #InfoSec youtu.be/0QJYIkngM3U
youtu.be
Citrix NetScaler zero-days are under global attack just days before the CISA deadline. Can an AI agent chain two flaws to breach DIVD in under 24 hours? Atlassian systems were also targeted within hours of a PoC. #Cybersecurity #InfoSec youtu.be/8fGx61QUt_k
Hot Drop for 10/09/2026
YouTube video by The Daily Hot Drop
youtu.be
Find me today @wildwesthackinfest.bsky.social and get some @breachplease-fm.bsky.social stickers, tshirt, or coffee I roasted! Cc @malwarejake.bsky.social
