You're not going to patch your way out of this - PSW #926
Paul's Security Weekly (Audio)
This week: New Yellowkey bitlocker bypass and what it means for you Hackers can run you over with a robot lawnmower FCC says new things about routers, again Glitching with AI almost no false positives AI thought it was evil DirtyFrag and the sad state of Linux LPEs You can buy better tools, perfect security, and other lies The Canvas breach Hackers can still take over trains Baby monitors, on the Internet! dnsmasq flaws I am now paying attention to Swordfish A neat vulnerability for ransomware Mythos, Curl, and how to do secure software Various ways to use AI to find bugs, spoiler, you don't...
info_outline
Getting Rid of Your VPN - Rob Allen - PSW #925
Paul's Security Weekly (Audio)
Rob Allen from Threatlocker joins us to discuss the risks associated with VPN appliances and how to implement better security solutions that don't leave you hanging out on the open Internet. The interview segment is sponsored by ThreatLocker. Visit to learn more about them! In the Security News: Less details about the FCC router ban Canary traps that work Hacking trains and getting arrested You can be an adult if you have a mustache cPanel is being exploited Pro-Iran group takes down Ubuntu Anthropic's new security solution Safe AI Agents and other lies People still use screensavers? CISA...
info_outline
FIRESTARTER - PSW #924
Paul's Security Weekly (Audio)
This week in the security news: Are you a FIRESTARTER? Eavesdropping via fiber-optic cables Copy Fail - more Linux LPE Github RCE Running Linux on a PS5 BadUSB tricks SilentGlass and HDMI threats Sonicwall and vague details Universities are for porn? The Banshee Before CVEs comes scanning Vendor addresses AirSnitch GitHub and not serious work Routers have country-specific backdoors Phones with Hotspot are fine Visit for all the latest episodes! Show Notes:
info_outline
Back to (or Start) Fundamentals? - Rajesh Khazanchi - PSW #923
Paul's Security Weekly (Audio)
This week: Larry’s in the host seat and chaos ensues. We dig into: A very questionable story about tracking a warship with a $5 Bluetooth tracker Serial-to-IP devices quietly sitting in critical infrastructure… and full of holes New York regulators mandating MFA and asset inventory—aka CIS Control #1 is now breaking news A ransomware negotiator who decided to double-dip (and landed in prison) “Brand new” hard drives that come preloaded… with someone else’s data The Vercel breach: no zero-day, just shadow IT, stolen tokens, and bad decisions AI-driven vulnerability discovery and...
info_outline
The AI "Vulnpocolypse" Is Real? - PSW #922
Paul's Security Weekly (Audio)
This week: CSA issues guidance to CISOs on Mythos Vuln management woes Windows tells you about Secure Boot AI-assisted firmware vuln hunting The dumbest hack Edge decay and the failing perimeter Mac OS X on a Wii Little snitch comes to Linux CPUID served malware Buying plugins to backdoor them Addicted to hacking Is Mythos just a sales pitch? We are still talking about Adobe Acrobat vulns A single line AI jailbreak Hacking Apple Intelligence Don't leave your ICS device or RDP exposed to the Internet! Visit for all the latest episodes! Show Notes:
info_outline
AI Makes All Bug Shallow? - PSW #921
Paul's Security Weekly (Audio)
This week: Rage dropping 0-Day Claude Mythos, things are different now From UART to root, on a device made in China, where's the FCC? More CUPS vulnerabilities Russians are hacking routers, FCC ban doesn't stop them Mongoose vulnerabilities, and FCC still does nothing Renting virtual phones Iran's cyber attacks SHA-256 almost broken? Catching Axios New Rowhammer, dubbed GPUBreach, gives you root Windows 11 has sudo! (And SSH...) And Inside a Kubernetes Scanning Fleet Visit for all the latest episodes! Show Notes:
info_outline
What Is A Router? (And all things AI) - PSW #920
Paul's Security Weekly (Audio)
In the Security News: Claude leaks source code and new models Two really smart people say AI is finding vulnerabilities better than ever Windows is using your internet to send updates to strangers BIG-IP APM vulnerability - all you need to know Linux KVM for the win The bus factor and open source Axios supply chain breach Trimming Grub Depotting and hacking e-Motorcycles Trivy and Cisco source code leaks The FCC ban and What is a router? Visit for all the latest episodes! Show Notes:
info_outline
Scanning The Internet with Linux Tools - PSW #919
Paul's Security Weekly (Audio)
In this segment, we will explore some pretty awesome tools for scanning the Internet, with a focus on network edge devices. We'll bring it all together with Claude Code and look at some sample results. Tools include: Shodan | Passive recon — query existing scan data for exposed devices, services, and vulns | Passive (API) | Instant (no packets sent) ZMap | Host discovery — find live hosts with open ports | L4 (TCP SYN, UDP, ICMP) | Millions of packets/sec ZGrab2 | Application-layer handshakes — grab banners, certs, headers | L7 (30+ protocol modules) | Thousands of hosts/sec Nerva |...
info_outline
Hacking IP KVMs & Reversing with Radare2 - Sergi Àlvarez - PSW #918
Paul's Security Weekly (Audio)
In this episode, we sit down with the Radare community leader, Pancake, the creator of the Radare2 reverse engineering framework. Whether you’ve never heard of Radare, already use it daily, or are thinking about contributing to its development, this conversation will demystify what makes Radare unique, why thousands of engineers rely on it, and how you can step into the community. This segment is sponsored by NowSecure. Discover how AI-powered mobile app security testing finds hidden vulns and leaks at . In the security news: The US national cyber strategy in the category of dumb laws and...
info_outline
Vulnerability Mis-Management - PSW #917
Paul's Security Weekly (Audio)
In the security news this week: The XZ backdoor documentary Zero days - the clock isn't ticking Vulnerability Mis-Management Reversing traffic light controllers Reversing with Claude Don't curl to bash! Reading CVEs makes my head hurt Dumping browser secrets I open-sourced a new(ish) tool D-LINK exploits There is no password I control the building When old vulnerabilities become new Tile is for stalkers Hacking AI Iran War: What cybersecurity needs to know National cyber strategy Coruna I got phished and I want a refund Visit for all the latest episodes! Show Notes:
info_outlineFirst up is a technical segment called "Paul's Linux Hacks". I finally got around to releasing a bunch of scripts and tutorials for Linux that I've created over the years. We'll go over scripts that can give you a supply chain security report and help you update your Arch-based Linux systems and the tutorial for using Linux KVM/Qemu/Libvirt. Repo is here: https://github.com/pasadoorian/Linux_Hacks
Next up is the security news:
- Controlling 7,000 robot vacuums
- Curl finds not all AI is bad
- Palo Alto says "These are not the ties to China you were looking for"
- Bloomberg writes an article that sheds light on Ivanti
- Looking for BLE is a trend
- Don't use AI to generate you passwords
- New research on hacking Samsung TVs
- Its not all about gadgets
- Ring's new bug bounty
- Paul will be voted in as Prime Minister of Denmark?
- Hacking AI, AI does some hacking, and hackers are talking about AI
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-915