Risky Bulletin

In this edition of Between Two Nerds Tom Uren and The Grugq talk about security culture. The PHP foundation seems to have had a change of heart about security, but what are the chances that OpenAI or other frontier AI labs will start to take it seriously?

This episode is also available on YouTube.



Show notes



Today's PHP Security Release, and How We're Strengthening PHP Security


Stefan Esser's month of PHP bugs


Andon cord

While everyone was distracted by PHP, another RCE has been wrecking the internet, Australia’s ABC wipes some staff devices, a third PHP RCE is incoming and researchers discover a new DDoS attack vector in HTTP/3.



Show notes



Risky Bulletin: While everyone was looking at PHP, another RCE is wrecking what's left of the internet

In this Risky Business sponsored interview James Wilson chats to Nebulock’s Head of Detection Strategy Alex Hurtado about the company’s threat hunting evaluation framework, GATES.

The pair talk through the five steps of Nebulock’s new acronym, and how they help remove gut feelings and guesswork when asking the question: “Should this threat hunt find be promoted to a detection rule”?



Show notes



The GATES Method: when a hunt becomes a detection

A ransomware group used a supply chain compromise to hack around 40 shipping companies, the Pentagon assembles a technology sabotage unit, PHP2Shell exploitation gets underway and GoDaddy revokes 400,000 certs.



Show notes



Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies

Tom Uren and Amberleigh Jack talk about the weird bugging incident at OpenAI. It doesn’t look at all like it was normal state-backed espionage, but there are still  good reasons  the frontier labs should ensure that their crown jewels are safe.

They also discuss how cybercriminals are rapidly evolving their use of AI. The technology and harnesses available are getting better and the criminals are also discovering business models where they can sit back while AI automates most of the work.

This episode is also available on YouTube.



Show notes