Unit 42 confirmed it: PHP exploitation in the wild, domain admin in hours, millions of services exposed. Jake and Jess cover the threat-hunting framework, the 4 ways to treat risk, and why AI is speeding up tech debt. Watch: youtu.be/OTu_vpLaPW8 @malwarejake.bsky.social @secitup.bsky.social
Lady Secitup
@secitup.bsky.social
Breach Please podcast AND Security, blue team, blue hair, liberal, vaxxed, resist
This is BY FAR the spiciest episode we've ever recorded. We agree a lot and disagree a lot too. @secitup.bsky.social was on FIRE. The one thing we agree on 100% is that if Chainguard's actions aren't met with some significant blowback, coordinated disclosure as we know it is dead.
A ChainGuard CEO broke a coordinated PHP disclosure embargo — and the industry's asking if coordinated disclosure just died. Jake and Jess break down why, plus a board framework beyond 'more budget.' Watch: youtu.be/WHewKFcNRfk @malwarejake.bsky.social @secitup.bsky.social
Elon Musk boosted the lie that James Talarico stayed at a mental hospital. Meta suspended No Kings’ Instagram account during nationwide actions. Staff at the Ellison-owned CBS News were reportedly told to tie Abdul El-Sayed to the Muslim Brotherhood and 9/11. Democracy dies in billionaire hands.
Patches are out! Go do the thing ya'll
Two critical PHP RCEs are patching today. Jess and guest host Richy (filling in for Jake) on why 'wait for the KEV' is bad advice if you're internet-facing, and how to actually find PHP hiding in your environment. @malwarejake.bsky.social @secitup.bsky.social Watch: youtu.be/F0zAo-qXBMA
We had @mog.evil.af to talk about Hashcat's new scripting language and ended up learning so much more!
NTLM v1 is "off" on your network? MSCHAPv2 and PPTP VPN say otherwise. Hashcat dev @mog.evil.af joins @malwarejake.bsky.social and @secitup.bsky.social to break down the bug, password cracking, and Hashcat's new scripting language. Watch: youtu.be/QMT-KTxzUZU
ConnectWise's OAuth breach hit 162 M365 tenants and killed its own SkyKick backups. @malwarejake.bsky.social and @secitup.bsky.social break down the attack chain and third-party risk fallout on today's Breach Please. #infosec Watch: youtu.be/AxsG32Derp8
An AI agent deleted an entire season of a reality TV show's footage. Today on Breach Please @malwarejake.bsky.social & @secitup.bsky.social talk how it happened, the confused-deputy problem with AI agents, and why BofA trusts AI to find vulns but not patch them. youtu.be/f_-R5YahSuQ #infosec
S0:E53: An AI Agent Deleted an Entire Season of Reality TV
YouTube video by Breach Please
youtu.be
For those that don't know, @secitup.bsky.social has previous experience organizing conferences (and a women's security conference no less). She brings some real insights into what might have happened here and what it means for women in the tech industry.
Grace Hopper canceled 2 weeks out. Today on Breach Please: the economy/AI/anti-DEI factors in play, @wired.com's women in tech survey, and a McKinsey partner's cringe LinkedIn take on the "glass cliff." youtu.be/WTMIFHC7mHs #WomenInTech @malwarejake.bsky.social @secitup.bsky.social
An OpenAI eng allegedly bugged the exec conference room TV w/ a USB recorder wrapped in tissue paper. Today's episode: the FBI complaint, chatbot logs, and what real counter-surveillance sweeps look like. youtu.be/NKVLKLvFse8 #infosec #insiderthreat @malwarejake.bsky.social @secitup.bsky.social
S0:E51: An OpenAI Engineer Allegedly Bugged the Boardroom TV
YouTube video by Breach Please
youtu.be
50 episodes of Breach Please! Thank you for listening. @secitup.bsky.social and @malwarejake.bsky.social are launching a Breach Please Discord for the community soon. Also today: a CVSS 10 SSRF in SonicWall’s SMA 1000, already being exploited. youtu.be/XGLNChUSjeU #infosec
S0:E50: SonicWall's SMA 1000 Just Hit a CVSS 10 — And It's Already Being Exploited
YouTube video by Breach Please
youtu.be
We just recorded episode 50 of @breachplease-fm.bsky.social !! It'll be out tomorrow morning and it's a great one! @malwarejake.bsky.social I love working on this project with you! 💖💖💖
@breachplease-fm.bsky.social only needs 7 more subscribers on YouTube to hit 400! It would be so exciting to surpass 400 this week. Check us out and consider subscribing! www.youtube.com/@BreachPleas... @malwarejake.bsky.social #breach #podcast #cybersecurity
Breach Please
Cybersecurity has a nonsense problem. Vendors overpromise, headlines overhype, and half the "experts" in your feed have never actually responded to an incident at 3 a.m. Breach Please is the antidote...
youtube.com
'ransomware recovery' co was secretly paying hackers for decryptors; telling clients it had its own tech. The CEO just got indicted. Today on Breach Please: the Monster Cloud scandal, ➕ notes from @wildwesthackinfest.bsky.social youtu.be/YXjh5FySnXI @malwarejake.bsky.social @secitup.bsky.social
S0E49 - A Ransomware 'Recovery' CEO Secretly Paid Hackers — Then Got Indicted
YouTube video by Breach Please
youtu.be
This is apparently happening in multiple areas in the capital. The DC board of elections has been made aware of it and have been in touch with the National Guard to address it. It’s no accident.
Pete Hegseth wants you to watch a snuff film. www.thebulwark.com/p/hegseth-wa...
Hegseth Wants You to Watch a Snuff Film
Neo-fascism as spectacles of violence.
thebulwark.com
Find me today @wildwesthackinfest.bsky.social and get some @breachplease-fm.bsky.social stickers, tshirt, or coffee I roasted! Cc @malwarejake.bsky.social
no new episode today. @secitup.bsky.social and @malwarejake.bsky.social were busy working on their RSAC submission. Later today we're talking to @grifter801.bsky.social about his CFP Review App he announced @wildwesthackinfest.bsky.social yesterday
Today's @breachplease-fm.bsky.social is out. Me and @secitup.bsky.social talked about Google pausing its Open Source bug bounty and sentencing in an insider extortion case. youtu.be/me3D6ONsfQU
S0:E48: Google Pauses Open-Source Bug Bounties Over 'AI Slop,' Plus a $750K Hidden-VM Extortion Case
YouTube video by Breach Please
youtu.be