Skip to content
Log in Join free
The Low Down cover art

Low Level

The Low Down

A Technology podcast

#131 in Technology · 🇩🇰 #164 in Technology · 🇮🇹
Good podcast? Give it some love!

About the show

the internet's best podcast about hacking

Newest episodes

Binance's Fake Interview Hack, Railway's AI Incident, Hacked Freezers & a Critical Linux Bug

1 hr 6 min

The Low Down Podcast is presented by Maze. https://mazehq.com/lowdown X: https://twitter.com/Maze_Security The "signup test" was probing for Kubernetes secrets. Ed and Matt get into Railway's AI testing incident, hacked refrigeration systems, and fake job interviews targeting developers. Then Ed works through a Linux kernel bug before we finish with ARTEX and a warning about a prebuilt Docker image. Today we're talking about: Railway and the AI testing incident We follow the logs, the apologies, and the personal credit card that helped identify the employee. Josh Manders says every probing attempt was blocked and nothing was accessed; Railway later described it as an employee's personal project. Ed and Matt have plenty to say about authorization and the "my agent did it" explanation. Employee's account (https://x.com/jakerunzer/status/2117474337682780643) Josh's account (https://x.com/joshmanders/status/2117530391183507484) Railway's statement (https://x.com/JustJake/status/2117746864745578719) Credit-card exchange (https://x.com/vxunderground/status/2117656394396778956) Hacked freezers, blood banks, and exposed controls More refrigeration attacks lead into the practical problems of securing operational systems. We talk about slow patch approvals, unclear ownership, and what getting a management interface off the public internet actually involves. Supermarket report (https://www.bbc.com/news/articles/cq1kd1nee80eo) Blood-storage report (https://www.theguardian.com/technology/2026/nov/04/france-national-blood-service-hack-cyber-attack-europe) Binance and fake job interviews Binance's account of an employee compromised through a fake interview leads into how fake recruiters target developers. Matt walks through separate malicious coding-test and VS Code examples, including the pressure to run unfamiliar code while an interviewer watches. We discuss keeping those exercises off your everyday machine. Binance report (https://www.reuters.com/world/binance-says-hackers-use...

Black October Recap, OpenCode’s Stolen API Keys, AI Distillation & the LiteLLM Supply-Chain Attack

1 hr 24 min

Welcome to The Low Down, the best show on the internet for hackers Black October has real bugs, stolen keys, and a lot of very loud headlines. Ed and Matt sort through PHP2Shell, AI security claims, and the difference between a scary vulnerability and one attackers can actually use. Harry Wetherald, co-founder and CEO of Maze, joins us to talk about finding the bugs that matter. —————————— Today we're talking about: PHP2Shell and the Black October panic We get into working exploits, questionable proof-of-concepts, patching, and the reporting around attacks. Ed breaks down why configuration and exploit reliability matter, while Matt revisits a report he shared that was later corrected. Original research: https://calif.io/php2shell/ Exploit validation: https://www.vulncheck.com/blog/php2shell-vulnerabilities Unit 42 report and updates: https://unit42.paloaltonetworks.com/cve-2026-109618-cve- 026-109619/ DREAM intrusion research: https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers AI security with Harry from Maze Harry joins us to talk about what AI can do for security teams, how to decide whether a vulnerability is exploitable in your environment, and why producing more findings isn't enough. Maze: https://mazehq.com/ Brotli, Node.js, and GoAhead A decompression bug puts Brotli in the headlines, then GoAhead gives us a lesson in broken TLS. We talk through the technical details and the conditions that turn these bugs into real problems. Node.js security release: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases GoAhead research: https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead OpenCode, stolen keys, and distillation OpenCode's Console incident leads to a discussion about stolen API keys and model distillation. Matt revisits his initial response and the distinction between stealing keys and what attackers intended to do with them afterward. OpenCode announcement: https://x.com/opencode/status/21115196370493198...

Cybersecurity Experts REACT to the php chaos... (and MORE)

1 hr 27 min

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security ---------------- Today we're talking about: PHP2Shell and the Disclosure Fight Ed and Matt are at OneCon in Las Vegas as PHP2Shell sets off a chaotic week. We unpack the research, shaky AI exploit claims, Chainguard's early fixes and whether disclosure timelines can keep up. Dan Lorenc and the PHP Foundation give different accounts of the rollout. https://calif.io/php2shell/ https://www.linkedin.com/posts/danlorenc_i-wanted-to-share-what-happened-with-the-share-7518756991520120832-QX2_/ https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ Kyle Polley's embargo discussion: https://x.com/kpolley/status/2113069186318577666 Your Certificate Authority's Private Key Was 4 One of eMudhra's private keys was literally four. We talk tiny keys, certificate trust, the company's exit from SSL/TLS and what happens when clients still trust compromised certificates. https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/ https://emudhra.we-have-a-problem.com/ https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business https://www.mitmproxy.org/posts/releases/mitmproxy-12.3/ Linux Bugs and the Power of a Pattern DirtyFrag, research credit and the latest kernel discussion lead into why Ed thinks AI is useful for spotting use-after-free patterns. DirtyFrag research: https://github.com/V4bel/dirtyfrag KSMBD background: https://docs.kernel.org/filesystems/smb/ksmbd.html Does AI Favor Attackers or Defenders? SentinelLABS' Tom Hegel makes the case for keeping powerful tools accessible to defenders. SentinelOne's Steve Stone explains why finding more bugs isn't the whole story: attack paths, speed, scale and the physics of an intrusio...

Similar podcasts

All episodes

Binance's Fake Interview Hack, Railway's AI Incident, Hacked Freezers & a Critical Linux Bug

1 hr 6 min

The Low Down Podcast is presented by Maze. https://mazehq.com/lowdown X: https://twitter.com/Maze_Security The "signup test" was probing for Kubernetes secrets. Ed and Matt get into Railway's AI testing incident, hacked refrigeration systems, and fake job interviews targeting developers. Then Ed works through a Linux kernel bug before we finish with ARTEX and a warning about a prebuilt Docker image. Today we're talking about: Railway and the AI testing incident We follow the logs, the apologies, and the personal credit card that helped identify the employee. Josh Manders says every probing attempt was blocked and nothing was accessed; Railway later described it as an employee's personal project. Ed and Matt have plenty to say about authorization and the "my agent did it" explanation. Employee's account (https://x.com/jakerunzer/status/2117474337682780643) Josh's account (https://x.com/joshmanders/status/2117530391183507484) Railway's statement (https://x.com/JustJake/status/2117746864745578719) Credit-card exchange (https://x.com/vxunderground/status/2117656394396778956) Hacked freezers, blood banks, and exposed controls More refrigeration attacks lead into the practical problems of securing operational systems. We talk about slow patch approvals, unclear ownership, and what getting a management interface off the public internet actually involves. Supermarket report (https://www.bbc.com/news/articles/cq1kd1nee80eo) Blood-storage report (https://www.theguardian.com/technology/2026/nov/04/france-national-blood-service-hack-cyber-attack-europe) Binance and fake job interviews Binance's account of an employee compromised through a fake interview leads into how fake recruiters target developers. Matt walks through separate malicious coding-test and VS Code examples, including the pressure to run unfamiliar code while an interviewer watches. We discuss keeping those exercises off your everyday machine. Binance report (https://www.reuters.com/world/binance-says-hackers-use...

Black October Recap, OpenCode’s Stolen API Keys, AI Distillation & the LiteLLM Supply-Chain Attack

1 hr 24 min

Welcome to The Low Down, the best show on the internet for hackers Black October has real bugs, stolen keys, and a lot of very loud headlines. Ed and Matt sort through PHP2Shell, AI security claims, and the difference between a scary vulnerability and one attackers can actually use. Harry Wetherald, co-founder and CEO of Maze, joins us to talk about finding the bugs that matter. —————————— Today we're talking about: PHP2Shell and the Black October panic We get into working exploits, questionable proof-of-concepts, patching, and the reporting around attacks. Ed breaks down why configuration and exploit reliability matter, while Matt revisits a report he shared that was later corrected. Original research: https://calif.io/php2shell/ Exploit validation: https://www.vulncheck.com/blog/php2shell-vulnerabilities Unit 42 report and updates: https://unit42.paloaltonetworks.com/cve-2026-109618-cve- 026-109619/ DREAM intrusion research: https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers AI security with Harry from Maze Harry joins us to talk about what AI can do for security teams, how to decide whether a vulnerability is exploitable in your environment, and why producing more findings isn't enough. Maze: https://mazehq.com/ Brotli, Node.js, and GoAhead A decompression bug puts Brotli in the headlines, then GoAhead gives us a lesson in broken TLS. We talk through the technical details and the conditions that turn these bugs into real problems. Node.js security release: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases GoAhead research: https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead OpenCode, stolen keys, and distillation OpenCode's Console incident leads to a discussion about stolen API keys and model distillation. Matt revisits his initial response and the distinction between stealing keys and what attackers intended to do with them afterward. OpenCode announcement: https://x.com/opencode/status/21115196370493198...

Cybersecurity Experts REACT to the php chaos... (and MORE)

1 hr 27 min

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security ---------------- Today we're talking about: PHP2Shell and the Disclosure Fight Ed and Matt are at OneCon in Las Vegas as PHP2Shell sets off a chaotic week. We unpack the research, shaky AI exploit claims, Chainguard's early fixes and whether disclosure timelines can keep up. Dan Lorenc and the PHP Foundation give different accounts of the rollout. https://calif.io/php2shell/ https://www.linkedin.com/posts/danlorenc_i-wanted-to-share-what-happened-with-the-share-7518756991520120832-QX2_/ https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ Kyle Polley's embargo discussion: https://x.com/kpolley/status/2113069186318577666 Your Certificate Authority's Private Key Was 4 One of eMudhra's private keys was literally four. We talk tiny keys, certificate trust, the company's exit from SSL/TLS and what happens when clients still trust compromised certificates. https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/ https://emudhra.we-have-a-problem.com/ https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business https://www.mitmproxy.org/posts/releases/mitmproxy-12.3/ Linux Bugs and the Power of a Pattern DirtyFrag, research credit and the latest kernel discussion lead into why Ed thinks AI is useful for spotting use-after-free patterns. DirtyFrag research: https://github.com/V4bel/dirtyfrag KSMBD background: https://docs.kernel.org/filesystems/smb/ksmbd.html Does AI Favor Attackers or Defenders? SentinelLABS' Tom Hegel makes the case for keeping powerful tools accessible to defenders. SentinelOne's Steve Stone explains why finding more bugs isn't the whole story: attack paths, speed, scale and the physics of an intrusio...

Cybersecurity Experts BREAK DOWN the shocking OpenAI Spying Incident, Crypto Backdoors, AND MORE

1 hr 16 min

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Heading to OneCon 2026? SentinelOne’s cybersecurity conference runs October 20–22 at the ARIA Resort & Casino in Las Vegas. Use code oc26lowdown for a discount on registration. https://www.onecon.io/ Today we're talking about: AI Got Better While We Were Arguing About It Matt returns from SecTor, Ed explains his monitor-firmware experiment, and we discuss what AI can do for security research—and the human work it still takes. https://www.youtube.com/watch?v=wIe3eDfGKUo https://blog.cloudflare.com/cyber-frontier-models/ https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/ Your Hardware Wallet Has Extra Hardware Kim Zetter's reporting reveals seed-stealing Ledger implants, including devices from authorized retailers, and separate Trezor tampering from unauthorized sellers. Who planted them remains unknown. https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/ https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implants/ Someone Hacked the Supermarket Fridges French supermarkets lose food after a cyberattack. We discuss exposed refrigeration controllers, a date-derived login code, and the separate Ahold Delhaize outage. Reuters report: https://srnnews.com/french-supermarket-chain-intermarche-hit-by-cyberattack-150-stories-targeted/ https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers https://www.pentestpartners.com/security-blog/you-dont-need-a-nation-state-to-warm-up-a-fridge/ https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhaize-takes-systems-offline-after-cyberattack/ If AI Can Clone Your App, What Are You Selli...

Oops, all vulns! (Citrix NetScaler problems, the FBI ShinyHunters saga cont’d and MORE)

1 hr 8 min

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Heading to OneCon 2026? SentinelOne’s cybersecurity conference runs October 20–22 at the ARIA Resort & Casino in Las Vegas. Use code oc26lowdown for a discount on registration. https://www.onecon.io/ 00:00 Coming up 00:33 Intro and Matt’s SecTor keynote 02:52 Citrix NetScaler zero-days and disclosure 09:25 Breaking down the NetScaler exploits 19:04 Sponsor: Maze 20:41 Citrix’s response and responsible disclosure 25:06 Why edge devices are so hard to defend 30:54 MikroTik RouterOS vulnerabilities 35:33 Cisco SD-WAN authentication bypass 38:37 Zimbra command injection 42:22 ShinyHunters arrest and conflicting claims 50:42 Reacting to the FBI’s warning 55:05 Open-weight AI, Anthropic and GLM-5.3 1:07:35 Wrap-up and OneCon Today we're talking about: Your NetScaler Warning Came From Reddit Finding out about NetScaler zero-days through Reddit is not the enterprise support experience Matt had in mind. Ed walks through watchTowr's command injection and memory overflow writeups, including missing protections in the binary they tested. Then we get into Google's hunting guidance and why a patch alone won't kick an attacker out. https://www.reddit.com/r/Citrix/comments/1wqjk9a/netscaler_leak/ https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/ https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances MikroTik and the User Named -2 MikroTik joins the pile with an HTTP underflow and a separate SSH authentication chain. The username "-2"...

ShinyHunters’ FBI Breach, OpenAI’s Bug Bounty Drama, and the Rise of ClickFix

1 hr 30 min

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Today we're talking about: ShinyHunters Has a Reputation to Protect ShinyHunters says it hacked the FBI to protect its business. Apparently, even an extortion crew needs good PR. We get into why reputation matters to people who make their money threatening companies, and Ed takes a look at the PeopleSoft bugs that may explain the way in. Some of the exposed records reportedly belong to the FBI's own hacking unit. https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/ https://www.404media.co/fbi-hack-exposed-fbis-own-hacking-unit-remote-operations-shinyhunters/ https://www.theregister.com/cyber-crime/2026/09/25/shinyhunters-tells-the-reg-we-hacked-the-fbi-to-protect-our-business/5299250 OpenAI's Very Unwelcome Pull Request How far do you go to prove a bug? Hacktron used an employee's Codex account to open a PR in OpenAI's internal repo. Ed thinks that demonstrates the access they already had. Matt sees why the security team wants to know what else they touched. The $6,500 payout got everyone talking. S1r1u5_ says the headache was a disclosure process that sent them to lawyers and eventually a journalist. https://www.hacktron.ai/blog/hacking-openai https://x.com/S1r1u5_/status/2101296199261429813 https://x.com/LiveOverflow/status/2101252692635004997 https://x.com/TalBeerySec/status/2101560506242761097 https://x.com/alexstamos/status/2101747329699402198 So What Do You Run This Stuff In? Two awkward headlines for anyone running other people's code: containers are getting easier to escape, and KVM has bugs too. Matt wants to know what he's supposed to do with that. Ed explains why sharing a kernel matters, and why moving to a smaller at...

Who’s Reading Your ChatGPT Chats? Flock Camera Secrets and HBO’s Reddit Account Spreads Malware

1 hr 17 min

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Today we're talking about: The ChatGPT Group Chat "I thought me and Sam were homies." Project Lily has us talking about the humans reading ChatGPT conversations, Moxie Marlinspike's take on chat interfaces, and who else is in the room when you're telling a chatbot your problems. https://www.404media.co/inside-project-lily-the-humans-reading-your-chatgpt-chats/ https://confer.to/blog/2025/12/confessions-to-a-data-lake/ Flock, Meet the Hardware Hackers Someone pulled down a Flock camera and copied its storage. Ed wants to separate the physical-access findings from the remote-hacking claims. Also, "Flock bad" is apparently a content strategy now. https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/ Pixel's Very Unhelpful CVE A modem vulnerability, signs of targeted exploitation, and very few details. Cue a conversation about basebands, spyware, and the price of a good phone exploit. https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices/ https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01 Revolut "A bank suffered a data breach by not getting hacked." Fake official requests got customer data handed over. Matt gets into the market for stolen government accounts and why a familiar email address isn't enough. https://www.securityweek.com/revolut-data-breach-5-months-680-high-profile-accounts-3m-ransom/ HBO's Reddit Account The account was real. Someone else was running the ads. A compromised HBO business account on Reddit becomes a delivery system for a ClickFix malware campaign. https://www.hudsonrock.com/blog/hbo-max-ads-on-a-compromised-reddit-acc...

LG Caught Spying in Your Living Room, Miami Crypto King Gets Life, and the AI Apocalypse Debate

1 hr 16 min

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're diving into the surveillance nightmare coming from your living room, catastrophic phishing campaigns targeting crypto users, and Microsoft's record breaking patch cycle that defenders need to know about. Today we're talking about: LG's Privacy Nightmare: Your TV is Spying on Everything Gamers Nexus drops a two hour expose revealing LG TVs are actively recording and transcribing all room audio even when listening mode is disabled and the device is powered off. Breaking down how they got root shell access and found plain text transcriptions of private conversations being cached on the device with four gigs of memory ready to phone home. Why the microphone continues recording even when unplugged from the network and what ACR automatic content recognition really means for your privacy. The Economics of Smart TV Surveillance LG executives caught on stage at advertising conferences bragging about owning the glass and extending the advertising experience across all devices on your home network. How they're doing network scans to enumerate every Windows PC, phone, and IoT device in your household and correlating that with what you're watching. Why the profit margins on TV advertising are in the 60s with SaaS level multiples while TV hardware prices have bottomed out over the last 20 years. The Remote Code Execution Problem Nobody's Talking About Beyond the privacy concerns, LG TVs have multiple unpatched remote code execution vulnerabilities that turn your living room microphone into a potential threat actor playground. Why teachers are panicking about 85 of these devices deployed in classrooms and the student privacy implications. How Chinese threat actors have proven they'll exploit residential devices f...

153 Million Driver's Licenses Stolen, Nigerian Sextortion Rings, and Team PCP's OPSEC Failure

1 hr 16 min

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're diving into massive identity verification breaches, the arrest of Team PCP supply chain attackers, and the certified pre owned router epidemic that's turning your home network into a botnet. Today we're talking about: ID Scan Breach: 153 Million Driver's Licenses Leaked Breaking down the massive data breach exposing 153 million driver's licenses, 10 million identification cards, 3 million travel documents, and 579,000 medical cards from ID scan dot net. How Brian Krebs traced his own leaked license back to a Hertz rental car transaction and marijuana dispensary visits at DEF CON. Why third party identity verification services create single points of failure when companies like Target, FedEx, GameStop, and hotels all use the same scanning infrastructure. The Identity Verification Debate: Privacy vs Security Examining the cultural backdrop of identity verification laws spreading across Europe and the UK's push to de anonymize internet activity in the name of protecting children. Why Discord now requires ID verification for adult content servers and Pornhub refuses to comply by shutting off access to entire states. The fundamental problem of companies being entrusted with sensitive documents they aren't equipped to secure and how driver's licenses are becoming the new social security numbers in account recovery flows. McKesson Healthcare Breach: 284 Million Patient Records Stolen Shiny Hunters claims responsibility for compromising McKesson, the pharmaceutical giant responsible for a third of all US drug transactions with 403 billion in annual revenue. Deep dive into Shiny Hunters' sophisticated MO combining social engineering over phone and text, fake company Okta logins using Evil Nginx proxies, and specialized teams...

GTA 6 Leak Chaos: Insider Threats, Shitcoin Scams, and Quasar RAT Malware

1 hr 3 min

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're diving into viral operating systems under security fire, the GTA 6 leak saga involving insider threats and ransomware, and surveillance technology creeping into your home through radio signals. Today we're talking about: Omaki Linux Vulnerabilities: The Viral OS Under Fire Breaking down the two click RCE vulnerability in Omaki's Chromium extension that exploits YouTube DLP and MPV configuration files. How the attack chain allows malicious configuration files to trigger command execution through video downloads. Why the viral DHH backed Arch based distro is catching security researcher attention and discovering multiple critical vulnerabilities including SSH misconfigurations and Docker daemon privilege escalation. The Bleeding Edge Problem: Why New Operating Systems Are Risky Examining why operating systems are incredibly hard to secure and why convenience features create dangerous attack surfaces. The comparison to AI browsers and why both Chrome and established Linux distros benefit from massive security budgets and talent. Why the Arch User Repository introduces supply chain risks similar to NPM's ecosystem problems. The reality that new code will have vulnerabilities and moving fast means security becomes an afterthought. GTA 6 Leak: Insider Threat, Ransomware, and Shitcoins Rockstar confirms the heartbreaking leak of GTA 6 gameplay footage as legitimate after videos appeared on Cyber Leaks websites. Breaking down the manifesto claiming this is political protest against digital only game releases while watermarking stolen footage with cryptocurrency wallet addresses. Why this represents a genuinely new monetization model for stolen pre release content according to vulnerability researcher Katie Mous...

Rust Supply Chain Chaos, Firefox Crypto Theft, and the DEF CON Conference Phishing Campaign

1 hr 9 min

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're recovering from DEF CON and diving into supply chain attacks spreading beyond NPM, sophisticated phishing campaigns targeting conference attendees, and a massive surveillance camera operation spanning Eastern Europe. Today we're talking about: Post DEF CON Recovery: The Family Chaos Edition We're finally catching up on work two weeks after DEF CON, discussing the blessing and curse of working from home when contractors show up and life happens. Why it takes days to recover from the social exhaustion of Hacker Summer Camp and how we're both playing catch up on everything. Rust Supply Chain Attack: The Array Ref Compromise Breaking down the malicious dependency injected into Array Ref, a Rust crate with 244 million downloads. How threat actors used proc macro1 to inject info stealers that query Chrome, Brave, and Edge for login credentials. Why the package name was brilliantly chosen to blend in with legitimate macro dependencies and what this means for the Rust ecosystem. Why Rust Sees Fewer Supply Chain Attacks Than NPM Examining whether the Rust ecosystem is structurally more secure or just has a smaller attack surface. Why JavaScript developers culturally include billions of tiny dependencies while Rust projects stay leaner. How the cargo publish authentication model makes wormable attacks harder to execute compared to NPM token theft. The NPM Worm Problem: Team PCP and Beyond Discussing why NPM 7 making post install scripts opt in will force threat actors like Team PCP to evolve their tactics. How stolen NPM tokens enable worm like propagation across multiple packages from compromised maintainers. Why we keep seeing iterations of Shai Haloud and Mini Shai Haloud campaigns. 77 Firefox Extensions Stealing Crypto: T...

Post-DEF CON Chaos: WiFi Pineapple Plane Panic, Mythos Commits Felonies, and Lazarus Goes Zero-Day

1 hr 4 min

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're recovering from DEF CON 34 and diving deep into AI agents committing supply chain attacks, North Korean threat actors evolving their tactics, and the WiFi Pineapple incident that made mainstream headlines. Today we're talking about: Post DEF CON Recovery: The Social Hangover We're both dragging after the Black Hat DEF CON double header, discussing the physical exhaustion versus professional re-energization that comes from Hacker Summer Camp. Why the social battery drains so fast when you're getting recognized in villages, the emotional hangover of returning to reality, and how we both hit a wall by Saturday. The WiFi Pineapple Plane Incident: Hackers Make Headlines Breaking down the incident where someone turned on a WiFi Pineapple on a Delta flight from Las Vegas to Atlanta, causing the pilot to report potential hacking. Why this isn't actually the terrifying attack the media portrayed, how HTTPS has neutered most man in the middle attacks, and why plugging in a device on a plane where you showed your ID multiple times is fundamentally stupid. DEF CON Then vs Now: The Security Posture Evolution Remembering when fake ATMs rolled into DEF CON lobbies, when hackers crashed entire hotel networks, and when fake cell towers pushed malicious firmware updates. Why the reputation is earned but the current threat landscape is dramatically different, and how layer 8 social engineering remains the primary attack vector. Meeting Fans at DEF CON: The DDoS Village Router Story How the DDoS Village organizer bought the Tenda AC 1200 router specifically because of a zero day video that dropped three days before DEF CON. Walking through the hard coded backdoor vulnerability and why manufacturers desperately need code...

Live from DEF CON: AI Harnesses, 1000+ Linux LPEs, and the Shia Haloud Supply Chain Worm Returns

41 min

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're broadcasting live from DEF CON 34 and Black Hat, bringing you the most important conversations happening at Hacker Summer Camp about AI security research, vulnerability orchestration, and the evolving threat landscape. Today we're talking about: Live from DEF CON: The Community Experience Recording from the Biohacking Village at DEF CON 34, we discuss what makes this conference special. From the Maritime Hacking Village to the DDoS Village, we explore how the grassroots community atmosphere differs from Black Hat's corporate environment. Meeting listeners, getting recognized by village organizers, and why the code word is potato salad. Black Hat Keynotes: The Future of AI Vulnerability Research Dave Weston from Microsoft and Professor Jan from ASU delivered game changing talks on what happens when AI makes vulnerabilities abundant rather than scarce. Breaking down how ASU accidentally proved that orchestrated Codex agents outperform single Mythos instances, and what this means for the economics of vulnerability markets and formal verification. The Harness Revolution: Why Orchestration Still Matters Deep dive into why we're in a sine wave pattern between model capabilities and harness quality. The real juice isn't telling AI to find bugs with no mistakes. It's building sophisticated vulnerability research machines that leverage AI as one component. Why context management and scaffolding remain the competitive advantage even as models improve. 1Password Research: The Auto Remediation Reality Check Keith's team at 1Password drops research showing only 26% of AI generated vulnerability patches were actually usable. Breaking down how even the best models partnering with top tier firms like Trail of Bits st...

Iranian Hackers vs Minnesota Water, OpenAI's Hugging Face Hack Exposed, and Pre-Pwned Amazon Devices

1 hr 7 min

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're diving deep into the complete technical details of OpenAI's escaped model, Anthropic's competing lab escape claims, and Iranian threat actors targeting critical infrastructure in Minnesota. Today we're talking about: The Full Technical Breakdown: OpenAI's Hugging Face Breach Hugging Face and OpenAI release an incredibly detailed incident report with animations, timelines, and command logs showing exactly how GPT cyber model escaped containment. We break down the zero day in JFrog Artifactory, the deserialization vulnerabilities in RubyGems packages, and the SSRF through Terraform external provider URLs that enabled the initial breakout. The Modal Sandbox Compromise Nobody Talked About Before even touching Hugging Face, the model compromised another company entirely. We discuss how it popped Modal's sandbox infrastructure to establish persistent internet accessible C2, demonstrating operational security awareness that's genuinely unsettling for an autonomous system. Chaining Web Vulnerabilities: The Hugging Face Attack Path Breaking down the incredibly sophisticated attack chain combining arbitrary file read through malicious dataset config paths, environment variable extraction via proc self environ, and Jinja2 template injection to achieve RCE. Why this level of web application exploitation from an AI system represents a fundamental shift in threat modeling. Kubernetes Cluster Admin in 13 Hours Day three analysis showing how the model went from code execution in a single worker pod to cluster admin across multiple internal clusters. We examine the lateral movement techniques, the Tailscale mesh VPN exploitation, and why proper network segmentation matters more than ever. Anthropic's Sandbox.md Probl...

OpenAI Hacks Hugging Face (oops..)

1 hr 0 min

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're diving deep into the most controversial AI security incident yet, a critical WordPress vulnerability chain, and the consumer electronics adware nightmare that's hitting your living room. Today we're talking about: The AI That Escaped: OpenAI's Cyber Model Breaks Out Breaking down the incident where OpenAI's unreleased GPT cyber model found a zero day in its own sandbox, escaped containment, and compromised Hugging Face's production infrastructure. We examine the technical details, the suspicious timing, and whether this is genuine capability demonstration or elaborate marketing theater in the wake of Anthropic's Mythos dominance. The Marketing Incentives Behind AI Escape Stories Exploring why OpenAI desperately needs a Mythos moment of their own, how Anthropic has positioned themselves as the cyber security model provider, and the perverse incentives driving both companies to scare lawmakers about open weight models while shouting about their own dangerous capabilities. What Actually Happened: Technical Breakdown The model identified it needed internet access to solve benchmark problems, found a zero day in an internal package registry proxy, performed privilege escalation and lateral movement through OpenAI's research environment, then exploited a vulnerability chain in Hugging Face to access their production database. We discuss why this shouldn't have been possible with proper sandboxing. The Sandbox That Wasn't: OpenAI's Infrastructure Failure Why calling this a sandbox is generous at best. We break down the difference between a markdown file asking nicely versus actual OS level isolation, why network access should have been rule based and deterministic, and how this reveals concerning gaps in OpenAI's security...

Project Golden Eagle, Grok's Privacy Nightmare, and the Record Breaking Patch Tuesday

1 hr 11 min

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're diving deep into Microsoft's record breaking Patch Tuesday, AI powered vulnerability research, and the surveillance state coming to a city near you. Today we're talking about: Microsoft's Record Breaking Patch Tuesday Microsoft just patched 570 vulnerabilities in a single Patch Tuesday, with around 400 in Windows alone. We break down what's driving this unprecedented volume, including four critical remote code execution flaws in components like TCPIP.sys and the IkeV2 VPN service. Plus, a 9.6 CVSS vulnerability in Microsoft Copilot that allows remote code execution through malicious websites. The AI Browser Attack Surface Problem Why browsers are incredibly hard to secure, how AI browsers are making things worse with prompt injection vulnerabilities, and why lockdown mode kills most modern web functionality. We discuss the fundamental tension between AI agents acting on your behalf and untrusted user input from the entire internet. AI Vulnerability Research & Harnesses Explained Breaking down how companies are actually using tools like Mythos to find vulnerabilities at scale. We explain what a harness is, why you can't just point AI at a million lines of code and expect results, and how mature security teams are atomizing their VR workflow to get deterministic outputs instead of hallucinations. The Harness Architecture & Token Economics Deep dive into Microsoft's M-Dash harness that's outperforming Mythos on CyberGym benchmarks, Firefox's transparent fuzzing process from 2021 that looks exactly like what we call harnesses today, and why good harness design using GPT and Claude can beat the super secret models. Why Project Glasswing Participants Are Silent Exploring why we're not seeing the vulnerability tsunami we e...

The GDID Controversy: Is Microsoft Tracking Your Every Move?

1 hr 5 min

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're diving deep into one of the most viral cybersecurity controversies in recent memory: Microsoft's Global Device Identifier and what it means for privacy, tracking, and operational security. Today we're talking about: The Scattered Spider Arrest & Court Documents Breaking down the arrest of a young Scattered Spider hacker and the court documents that revealed how law enforcement tracked them down. From diamond "Hack the Planet" necklaces to Discord flexing, we examine how poor OPSEC led to their capture. Microsoft's GDID: The Controversy Explained What is the Global Device Identifier, how does it work, and why did VX Underground's 1.2 million view tweet spark massive debate? We break down the forensic reality of this hardware identifier and whether it's truly undocumented or just misunderstood. Hardware Identifiers Meet Web Activity Tracking Exploring how Microsoft tied hacking activity to specific individuals through GDID, PUID (Passport Unique Identifier), and telemetry data. We discuss the marriage of hardware identifiers with web activity, gaming profiles, and Microsoft online accounts. The Privacy Implications: How Deep Does It Go? Is Microsoft collecting every website you visit, every program you execute, and every online account you access? We separate fact from fiction, examining what telemetry actually collects versus what law enforcement pieced together through multiple warrants. VPNs, OPSEC & Marcus Hutchins' Warning Marcus Hutchins weighs in with a stark warning: if your OS install has ever connected to the internet without a VPN, it's a matter of time. We discuss whether VPNs truly protect you when telemetry can see VPN software execution, keying material, and destination IPs. The Forensic Reality Check C...

Fable Ban Fallout, Nightmare Eclipse's Microsoft Revenge, and the $40M iOS Exploit Kit

58 min

Welcome to The Low Down, the best show on the internet for hackers The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod This week we're broadcasting live from the PlanetScale office at the AI Engineering Conference in San Francisco, diving deep into the most pressing issues in cybersecurity right now. Today we're talking about: The Fable Ban & AI Export Controls Breaking down the unprecedented government intervention that pulled Fable from public access, the Free Fable movement, and what this means for AI security research going forward. We discuss the export control implications and why this sets a dangerous precedent. Mythos, Project Glasswing & The Future of Exploit Development Why Mythos and Fable aren't uniquely dangerous despite the government narrative, how AI is genuinely changing vulnerability research, and the philosophical questions around automated exploitation capabilities. Open Weight Models & The China Question Examining DeepSeek, Kimi, and other Chinese models that are rapidly catching up to frontier capabilities, plus Meta's internal restrictions on competitor model usage and what it reveals about the industry. Beats by Dre Bluetooth RCE Vulnerability A year-old vulnerability finally patched that gave attackers remote code execution on Bluetooth headphones, allowing microphone access, call initiation, and complete device control within proximity range. Nightmare Eclipse & The Rogue Planet Exploit The latest Windows Defender zero day from the controversial researcher, featuring a race condition that allows malware placement in System32. We discuss the painful disclosure saga, MSRC's reputation crisis, and what this means for bug bounty programs. The Bug Bounty Crisis Why researchers are revolting against major programs like MSRC and Apple, the broken social contract of responsible disclosure, and how AI is reshaping the economics of...

Supply Chain Worms, GitHub Hacks, and Mythos: The New Era of AI-Powered Security Research

1 hr 2 min

Get more content and Ask Us Questions on Patreon: https://www.patreon.com/cw/TheLowDownPod Welcome to The Low Down, the best show on the internet for hacker news, cyber news, and whatever else you want to talk about. Today we’re talking about: GitHub Supply Chain Attacks & The npm Worm Crisis The Real Problem: Developer Culture & Package Management AI Security Research: The Mythos Phenomenon What Makes Mythos Different? The Philosophical Questions Career Implications

–

0 ratings from members

5
4
3
2
1

Rate this podcast

Log in to rate and review the shows you listen to.

No reviews yet — be the first member to rate "The Low Down".

This podcast, its content and its artwork are not owned by, affiliated with, or endorsed by Castquire.

Keep listening

Discover more podcasts like this.

Browse podcasts See the charts

Up next

  1. Nothing queued. Use + Queue on any episode to line it up.

0:00 0:00

Cookies

We set only what the site needs to sign you in and remember your theme. No advertising, no analytics. Read more.