AI: No One Is Safe - PSW #912
Paul's Security Weekly (Audio)
In the security news this week: Residential proxy abuse is everywhere this week: from Google’s takedown of IPIDEA to massive Citrix NetScaler scanning and the Badbox 2.0 botnet Supply chain fun time: Notepad++ updates were hijacked Attackers set their sights on: Ivanti EPMM, Dell Unity storage, Fortinet VPNs/firewalls, and ASUSTOR NAS devices Russian state hackers went after Poland’s grid Is ICE on a surveillance shopping spree and into hacking anti-ICE apps? Ukraine’s war-time Starlink problem is turning into a policy and controls experiment The AI security theme is alive and well with...
info_outline
To curmudgeon or not to curmudgeon, that is the question. - PSW #911
Paul's Security Weekly (Audio)
This week, we get un-curmudgeoned by Mandy, spending a bunch of time talking about regulations, compliance, and even the US federal government's commitment to cybersecurity internally and with the community at large. We even dive into some Microsoft patches, hacking defunct eScooters, and a lively discussion on ADS-B spoofing! Visit for all the latest episodes! Show Notes:
info_outline
We Left It Vulnerable On Purpose - Rob Allen - PSW #910
Paul's Security Weekly (Audio)
In the security news: Rainbow tables for everyone Lilygo releases a new T-Display that looks awesome AI generated malware for real Detecting BadUSB when its not a dongle A telnetd vulnerability Google Fast Pair and how I took control of your headset Should we make CVE noise? Exploiting the Fortinet patch DIY data diode Bambu NFC reader for your Flipper Payloads in PNG files Don't leave the lab door open - amazing research and new tool release Fixing your breadboards Finding vulnerabilities in AI using AI Then, Rob Allen from ThreatLocker joins us to discuss default allow, and why that is...
info_outline
Digging For Vulnerability Gold - PSW #909
Paul's Security Weekly (Audio)
In the security news: KVMs are a hacker's dream Hacking an e-scooter Flipper Zero alternatives The best authentication bypass Pwning Claude Code ForiSIEM, vulnerabilities, and exploits Microsoft patches and Secure Boot fun Making Windows great, again? Breaching the Breach Forum Congressional Emails unsolicited Instagram password reset requests - Is Meta doing enough to secure the platform? LLMs are HIPAA compliant? Threat actors target LLM honeypots Visit for all the latest episodes! Show Notes:
info_outline
No FlipperZeros Allowed - PSW #908
Paul's Security Weekly (Audio)
This week in the security news: Supply chain attacks and XSS PS5 leaked keys Claude tips for security pros No Flipper Zeros allowed, or Raspberry PIs for that matter Kimwolf and your local network Linux is good now Removing unremovable apps without root Detecting lag catches infiltrators Defending your KVM Fixing some of the oldest code Deleting websites live on stage in costume It was a honeypot FCC is letting telecoms off easy Don't buy a Haribo power bank Ransomeware scum Fortinet vulns CISA warns about NVRs Patching MongoDB Visit for all the latest episodes! Show Notes:
info_outline
Breaking Into Cybersecurity - PSW #907
Paul's Security Weekly (Audio)
Our field is booming! Cybersecurity jobs are projected to grow 33 percent through 2033, far outpacing the average 4 percent growth across all jobs. (And yes, those stats could be made up, but they sound nice, eh?) Yet newcomers often feel paralyzed by where to start. The truth? There's no single "right path," but there are proven strategies that work. The field needs people at all levels, and you don't need a four-year degree to break in. We'll discuss all the details, including a list of projects for beginners in Cybersecurity, plus plenty of non-technical suggestions! Visit for all the...
info_outline
Building a Hacking Lab in 2025 - PSW #906
Paul's Security Weekly (Audio)
The crew makes suggestions for building a hacking lab today! We will tackle: What is recommended today to build a lab, given the latest advancements in tech Hardware hacking devices and gadgets that are a must-have Which operating systems should you learn Virtualization technology that works well for a lab build Using AI to help build your lab Visit for all the latest episodes! Show Notes:
info_outline
With AI Nothing Is Safe - PSW #905
Paul's Security Weekly (Audio)
This week in the security news: Linux process injection Threat actors need training too A Linux device "capable of practically anything" The Internet of webcams Hacking cheap devices Automating exploitation with local AI models Lame C2 Smallest SSH backdoor Your RDP is on the Internet These are not the high severity bugs you were looking for Low hanging fruit Your TV is spying on you, again no such thing as "offensive security" MCPs and RCEs Browser extensions collecting your AI chats And flooding TikTok with AI influencers Visit for all the latest episodes! Show Notes:
info_outline
Tech Segment: MITM Automation + Security News - Josh Bressers - PSW #904
Paul's Security Weekly (Audio)
This week in our technical segment, you will learn how to build a MITM proxy device using Kali Linux, some custom scripts, and a Raspberry PI! In the security news: Hacking Smart BBQ Probes China uses us as a proxy LOLPROX and living off the Hypervisor Are we overreating to React4Shell? Prolific Spyware vendors EDR evaluations and tin foil hats Compiling to Bash! How e-waste became a conference badge Overflows via underflows and reporting to CERT Users are using AI to complete mandatory infosec training! AI in your IDE is not a good idea Cybercrime is on the rise, and its the kids AI can...
info_outline
Holiday Hack Challenge, AI, Internet of Trash - Ed Skoudis - PSW #903
Paul's Security Weekly (Audio)
This week we welcome Ed Skoudis to talk about the holiday hack challenge (https://sans.org/HolidayHack). In the security news: Oh Asus Dashcam botnets Weird CVEs being issued CodeRED, but not the worm Free IP checking Internet space junk and IoT Decade old Linux kernel vulnerabilities Breaking out of Claude code Malicious LLMs Hacker on a plan gets 7 years Putting passwords into random websites NPM supply chains strike again LLMs will never be intelligent Visit for all the latest episodes! Show Notes:
info_outlineIn the security news this week:
- Residential proxy abuse is everywhere this week: from Google’s takedown of IPIDEA to massive Citrix NetScaler scanning and the Badbox 2.0 botnet
- Supply chain fun time: Notepad++ updates were hijacked
- Attackers set their sights on: Ivanti EPMM, Dell Unity storage, Fortinet VPNs/firewalls, and ASUSTOR NAS devices
- Russian state hackers went after Poland’s grid
- Is ICE on a surveillance shopping spree and into hacking anti-ICE apps?
- Ukraine’s war-time Starlink problem is turning into a policy and controls experiment
- The AI security theme is alive and well with exposed LLM endpoints, OpenClaw/Moltbot/Moltbook fiasco, and letting anyone hijack agents
- Signed forensic driver for Windows is still an EDR killer
- The Trump administration’s rollback of software security attestation
- National Cyber Director Sean Cairncross says: “less regulation, more cooperation.”
- Finally, there are some “only in infosec” human stories: * pen testers arrested in Iowa now getting a settlement, * a Google engineer convicted over stolen AI IP, * Booz Allen losing Treasury work over intentional insider leaks, * and an “AI psychosis” saga at an adult-content platform.
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-912