Security Conversations

Three Buddy Problem

A Tech News , News and Technology podcast

#9 in Tech News · 🇦🇪 #16 in Tech News · 🇸🇪

About the show

The Three Buddy Problem is a popular Security Conversations podcast that goes beyond industry talking points to discuss what others won’t -- nation-state malware, attribution, cyberwar, ethics, privacy, and the messy realities of securing computers and corporate networks. Hosted by three veteran security pros -- journalist Ryan Naraine and malware paleontologists Costin Raiu and Juan Andres Guerrero-Saade -- the weekly show attracts a highly engaged audience of security researchers, corporate defenders, CISOs, and policymakers. Connect with Ryan on Twitter (Open DMs).

Newest episodes

GPT-6 Cyber Sets Price of a Linux Exploit; Europe Silent on Fridge Hacks

Nov 8, 2026 2 hr 28 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 119: We discuss the supermarket fridge hacks rolling across Europe, why no government wants to say the word Russia out loud, active measures and cyber-warfare, and the European silence on attribution. Plus, OpenAI's GPT-6 Cyber and the cost of 948 Linux exploits, the Daybreak Blue training flap, a tough-love pep talk for researchers mourning the loss of the old game and the Binance postmortem the FBI pinned on North Korea's TraderTraitor. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter 3:00 TLP Black and AI agents watching your edge devices 10:21 Supermarket fridge hacks spread across Europe 16:27 How the refrigeration attacks work 18:49 Is this Russia? 21:12 Boundary testing and the Article 5 problem 34:20 Sabotage short of war 40:06 The IOCs nobody is sharing 44:41 Costin's hunting playbook 51:24 Not just a European story 57:25 What do intelligence agencies know? 1:06:22 GPT-6 Cyber and Daybreak Red 1:26:40 948 Linux root exploits for $1.2 million 1:36:48 Daybreak Blue training and the mathematicians 2:09:01 Binance postmortem and TraderTraitor

The Great Binance $6.34 Billion Crypto Heist

Oct 30, 2026 2 hr 50 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 118: On the show this week, the buddies dig into the $6.34 billion Binance heist, the largest crypto hack ever, walking through its multi-chain laundering, the North Korea fingerprints, and whether offensive AI quietly helped pull it off. Plus, thoughts on Sam Altman's swipe at local hardware, the PHP2Shell "cannonball," why defenders keep hitting guardrails while GLM-5.3 happily does the work, a trojanized Claude Code extension, Apple's fresh spyware alerts, and Volt Typhoon's Silent Train. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter 3:46 CTI training & the AI model stack 8:03 The $6.34B Binance hack: the largest crypto heist ever 12:40 Inside the multi-chain laundering 18:23 Sam Altman & the AI hardware crunch 20:44 Root cause: a compromised DevOps laptop 23:43 Did AI help pull it off? 31:22 Who actually loses six billion dollars? 44:00 Crypto as a financial instrument 51:04 Can it get bigger? Hardware-wallet implants 57:04 Attribution, "misalignment" & is Binance Chinese? 1:10:00 Cash, privacy & the Mt. Gox lesson 1:22:12 PHP2Shell: dodging the cannonball 1:30:52 AI for defense & the productization gap 2:09:32 GLM-5.3, the refusal trap & open weights 2:32:26 Apple spyware alerts & Silent Train

Lumen's Michael Horka on China's 'Silent Train' Router Hacking

Oct 28, 2026 35 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) SECURITY CONVERSATIONS: Black Lotus Labs researcher Michael Horka joins the show to discuss Silent Train, a Volt Typhoon framework that spins up four-to-six-hop chains of hijacked SOHO routers in about two minutes and wipes every hop when the day's session ends. We discuss how ORB networks differ from botnets, why Silent Train took over after the FBI's KV-botnet takedown, the zero-days hitting control plane software from Versa, N-able and VeloCloud, and the NetFlow and logging moves defenders can make right now. TIMESTAMPS: 0:00 Intros 0:29 What is an ORB network? 2:34 Silent Train, an operational framework for Volt Typhoon 3:30 Why call it Silent Train? 4:12 Chains that exist for a few hours 6:47 The hijacked routers in the chain 8:16 Burning zero-days on a single hop 9:48 Attribution and the KV-botnet successor 11:02 Crown jewels and NetFlow visibility 14:53 Why network monitoring gets skipped 17:23 Victims in Hawaii, California and Texas 19:23 Four confirmed zero-days, all patched 20:47 Control plane software as the target 26:00 No-brainer defenses: logs and internet exposure 29:41 Threat hunting, agentic AI and where ORBs go next

Similar podcasts

Bloomberg Tech Bloomberg

Big Technology Podcast Alex Kantrowitz

WSJ Tech News Briefing The Wall Street Journal

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast) Johannes B. Ullrich

Software Engineering Daily Software Engineering Daily

The Tech Report Tech Report

برق مع عبدالله السبع ثمَانِيَة /thmanyah

Driven by Data: The Podcast Orbition Group

All episodes

The newest 50 of 253 episodes

GPT-6 Cyber Sets Price of a Linux Exploit; Europe Silent on Fridge Hacks

Nov 8, 2026 2 hr 28 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 119: We discuss the supermarket fridge hacks rolling across Europe, why no government wants to say the word Russia out loud, active measures and cyber-warfare, and the European silence on attribution. Plus, OpenAI's GPT-6 Cyber and the cost of 948 Linux exploits, the Daybreak Blue training flap, a tough-love pep talk for researchers mourning the loss of the old game and the Binance postmortem the FBI pinned on North Korea's TraderTraitor. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter 3:00 TLP Black and AI agents watching your edge devices 10:21 Supermarket fridge hacks spread across Europe 16:27 How the refrigeration attacks work 18:49 Is this Russia? 21:12 Boundary testing and the Article 5 problem 34:20 Sabotage short of war 40:06 The IOCs nobody is sharing 44:41 Costin's hunting playbook 51:24 Not just a European story 57:25 What do intelligence agencies know? 1:06:22 GPT-6 Cyber and Daybreak Red 1:26:40 948 Linux root exploits for $1.2 million 1:36:48 Daybreak Blue training and the mathematicians 2:09:01 Binance postmortem and TraderTraitor

The Great Binance $6.34 Billion Crypto Heist

Oct 30, 2026 2 hr 50 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 118: On the show this week, the buddies dig into the $6.34 billion Binance heist, the largest crypto hack ever, walking through its multi-chain laundering, the North Korea fingerprints, and whether offensive AI quietly helped pull it off. Plus, thoughts on Sam Altman's swipe at local hardware, the PHP2Shell "cannonball," why defenders keep hitting guardrails while GLM-5.3 happily does the work, a trojanized Claude Code extension, Apple's fresh spyware alerts, and Volt Typhoon's Silent Train. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter 3:46 CTI training & the AI model stack 8:03 The $6.34B Binance hack: the largest crypto heist ever 12:40 Inside the multi-chain laundering 18:23 Sam Altman & the AI hardware crunch 20:44 Root cause: a compromised DevOps laptop 23:43 Did AI help pull it off? 31:22 Who actually loses six billion dollars? 44:00 Crypto as a financial instrument 51:04 Can it get bigger? Hardware-wallet implants 57:04 Attribution, "misalignment" & is Binance Chinese? 1:10:00 Cash, privacy & the Mt. Gox lesson 1:22:12 PHP2Shell: dodging the cannonball 1:30:52 AI for defense & the productization gap 2:09:32 GLM-5.3, the refusal trap & open weights 2:32:26 Apple spyware alerts & Silent Train

Lumen's Michael Horka on China's 'Silent Train' Router Hacking

Oct 28, 2026 35 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) SECURITY CONVERSATIONS: Black Lotus Labs researcher Michael Horka joins the show to discuss Silent Train, a Volt Typhoon framework that spins up four-to-six-hop chains of hijacked SOHO routers in about two minutes and wipes every hop when the day's session ends. We discuss how ORB networks differ from botnets, why Silent Train took over after the FBI's KV-botnet takedown, the zero-days hitting control plane software from Versa, N-able and VeloCloud, and the NetFlow and logging moves defenders can make right now. TIMESTAMPS: 0:00 Intros 0:29 What is an ORB network? 2:34 Silent Train, an operational framework for Volt Typhoon 3:30 Why call it Silent Train? 4:12 Chains that exist for a few hours 6:47 The hijacked routers in the chain 8:16 Burning zero-days on a single hop 9:48 Attribution and the KV-botnet successor 11:02 Crown jewels and NetFlow visibility 14:53 Why network monitoring gets skipped 17:23 Victims in Hawaii, California and Texas 19:23 Four confirmed zero-days, all patched 20:47 Control plane software as the target 26:00 No-brainer defenses: logs and internet exposure 29:41 Threat hunting, agentic AI and where ORBs go next

PHP2Shell Meltdown: AI Found It. Who's Going to Patch It?

Oct 24, 2026 1 hr 52 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 117: This week, we dig into PHP2Shell, the AI-assisted PHP bug that led governments to take websites offline, and the arguments over broken embargoes, who found it first, and the AI doomers taking an "I-told-you-so" victory lap. Plus, why patching hasn't kept up with AI bug finding, a failure of SBOMs, Terence Tao on math after AI, the iPhone Duo jailbreak and the eMudhra certificate authority key leak. Cast: Juan Andres Guerrero-Saade and Ryan Naraine. Costin Raiu is traveling. Timestamps: 0:00 Introductory banter 1:07 Black October's pile of critical bugs 2:34 PHP2Shell and the AI victory lap 8:28 Twenty years of PHP technical debt 16:54 Wiz, Gemini 4 Argon and the credit fight 21:01 Chainguard breaks the embargo 28:42 The doomers' warnings and the patching gap 39:32 Is this an SBOM problem? 55:33 Inside the PHP Foundation's post-mortem 1:03:13 Are bugs sparse or dense? 1:11:24 Should frontier labs fix coding? 1:20:14 Vibe coding and math's industrial era 1:27:26 Who pays to maintain open source? 1:44:59 iPhone Duo hacked already, eMudhra and the news

Who's Hacking Supermarket Fridges in France?

Oct 18, 2026 3 hr 26 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 116: This week, the buddies dig into a mystery hack that cooked French supermarket fridges, cyberattacks against food supply networks, and why this smells like nation-state sabotage in Europe? Plus, a fresh Ivanti zero-day chain, Anthropic's self-replicating IoT research and defender-hostile guardrails, Citizen Lab's AdFection spyware-by-ads exposé, Calif's iPhone exploit drops at Hexacon, Grok's surprising enterprise adoption, and spy chips stuffed inside Ledger wallets. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter 1:35 Virus Bulletin 2026 in Seville 6:13 Conference roundup: State of Statecraft, Countermeasure, RE//verse 10:21 French supermarket fridges hacked 22:53 Hacking food supply and the attribution question 33:23 Who patches the fridge? 45:58 Ivanti Connect Secure zero-day chain 53:00 When an AI agent deletes your databases 1:04:34 NCSC edge-device forensics guidance 1:28:06 Anthropic's self-replicating IoT research 1:52:17 Why guardrails lock out defenders 2:04:57 Grok's enterprise play and agent sprawl 2:16:26 Citizen Lab exposes AdFection spyware via ads 2:57:24 Calif burns iPhone exploits at Hexacon 3:06:55 Ledger wallet implants and the grain of rice

Katie Moussouris on AI-as-malware, the monitoring gap, and an NTSB for AI

Oct 12, 2026 1 hr 5 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem x Offensive AI Con: Luta Security chief Katie Moussouris makes the case for an NTSB-style board for AI incidents, with subpoena power and full-time investigators, after OpenAI's DNS tunneling escape and the 52 days it took to notice a model had wandered into Australian government systems. Along the way, we chat about her work on the Cyber Safety Review Board (CSRB), AI model refusals that leave defenders stuck, and why she still bets on hackers to bend this technology their way. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Katie Moussouris. Timestamps: 0:00 Intros at Offensive AI Con 1:00 OpenAI's DNS tunneling incident and slow monitoring 4:36 Treating AI like malware in a sandbox 9:01 The business model is the misalignment 13:37 Log4j, SBOMs and an NTSB for AI 18:00 Trading liability protection for honest disclosure 22:13 Accountability and "once you become aware" 26:18 The Australia notification timeline 28:19 A blank-check administration and the Anthropic phaseout 34:35 Powerful models in the right hands 38:42 Kill switch bills and regulatory capture 42:36 EU fines as a tariff on American tech 48:03 Reasons for optimism 54:13 Bring back "information security" 1:01:57 Katie's last word

NCSC's Ollie Whitehouse: 'The Biggest Correction of Technical Debt Ever'

Oct 12, 2026 54 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem x Offensive AI Con: Ollie Whitehouse, CTO of the UK's National Cyber Security Centre, joins us to explain how Britain is preparing for an AI-driven patch wave and why the NCSC is pressing edge-device vendors to finally ship real telemetry. Plus, we dig into rogue AI agents wandering into a Five Eyes network, along with his forecast that small, capable models could revive self-spreading worms around 2030, all part of what he calls the biggest forced correction of technical debt the industry will ever see. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Ollie Whitehouse. Timestamps: 0:00 Live from Offensive AI Con: meet Ollie Whitehouse 2:46 Why the NCSC is a model for the US 6:48 What a "national technical authority" does 7:49 The Huawei analysis and the push for passkeys 10:50 Independent AI model testing 13:12 Open-weight vs. closed models and AI sovereignty 19:02 Capability density and AI worms by 2030 23:09 Robotics security and lessons from Japan 26:49 Preparing for the patch wave 31:06 Architecture fixes: OT, cross domain, privileged access 32:28 Telecoms security and Salt Typhoon 38:59 Minimum telemetry standards for edge devices 41:55 Market incentives and the EU Cyber Resilience Act 46:05 Rogue agents and the forced correction of technical debt

Aaron Grattafiori Explains How LLMs Hunt Patch Variants at Scale

Oct 9, 2026 54 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem x Offensive AI Con: Umbriel AI's Aaron Grattafiori breaks down the new offensive-security playbook, using LLMs for patch variant analysis, why the vuln apocalypse hasn't become an exploit apocalypse, and how the death of security through obscurity puts closed-source binaries and firmware within reach. Plus, we discuss rogue agents escaping sandboxes, the eval-driven loop behind recursive self-improvement, and the brutal cost asymmetry that makes offense cheap and defense almost unaffordable. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Aaron Grattafiori. Timestamps: 0:00 Introductory banter 1:12 Umbriel AI pitch: "Smart people in a place to cook” 3:08 Weird, exhausting, exciting time in security 4:00 What AI really changed: speed (and a 30-minute reimplementation) 6:36 Incomplete fixes and the variant-analysis pipeline 9:21 Uplifting, abstraction, and representing vulnerabilities 11:48 Experimentation and the new shape of security companies 14:46 The vuln apocalypse vs. the exploit apocalypse 16:36 Triage, verification, and reward hacking 18:08 Do models reintroduce bugs? Is vuln-free code possible? 24:22 Specialized models and the rise of Jev-style classifiers 26:47 Binaries, firmware, and the death of security through obscurity 31:15 Open source as a requirement and corporate contracting 33:54 Rogue agents: Hugging Face, OpenAI, and lab escapes 39:17 Why defense is so expensive, and running the rig

Joel Todoroff on How Offensive AI Is Rewiring Western Government Ops

Oct 9, 2026 1 hr 37 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem x Offensive AI Con: Former US intelligence and national security official Joel Todoroff joins us live from OffensiveAIcon to explain why his new startup Phyle is building AI for the recon and targeting work that happens long before anyone fires an exploit. We get into bribable sysadmins, the military framing that boxes in Western cyber operations, letters of marque, AI doomerism, and what happens when a frontier model decides mid-project that your use case is off-limits. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Joel Todoroff. Timestamps: 0:00 Live from OffensiveAIcon in Oceanside 1:23 What Phyle builds for governments 3:02 Skepticism of the AI 0-day factory 5:57 Paying a sysadmin vs. burning tokens 9:30 Recon gets less love than weaponization 12:41 Exploit shelf life and target No. 1,000 17:30 Why attacker costs will keep rising 22:23 What HUMINT looks like in 2026 27:06 Why intelligence stovepipes persist 32:16 Cyber as statecraft beyond the military frame 41:23 People will keep making dumb mistakes 48:03 The White House memo and letters of marque 54:06 Doomerism vs. near-term AI harms 1:04:20 PSOA concerns and building guardrails in 1:26:03 Open models, guardrails and zero data retention

Valentina Palmiotti (chompie) on Vulnpocalypse, Matching Mythos on a Budget

Oct 7, 2026 1 hr 8 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem x Offensive AI Con: Live from OAIC, IBM X-Force's Valentina Palmiotti (chompie) walks us through the autonomous Windows kernel exploit pipeline she built on older Claude models, which landed within a hair of Mythos for about $180 a chain. Plus, the Pwn2Own bug Claude called unexploitable, why her Pwn2Own bugs still sit unpatched, disappearing exploit techniques, the dread of being a defender, and how Phrack found its way back into print. Timestamps: 0:00 Intro and Pwn2Own war stories 3:46 What vibe hacking means 8:16 When long agent runs go sideways 10:31 Self-verification in an n-day kernel pipeline 16:11 Matching Mythos for $180 a chain 18:42 The bug Claude called unexploitable 21:49 Unpatched bugs and the defender gap 25:37 Mythos arrives through CVP 27:00 Models only know public techniques 32:01 Testing models on held-back bugs 37:45 Inside chompie's daily workflow 46:07 Where's the exploitpocalypse? 50:07 Pixel drops MTE 53:40 Advice for defenders: design for containment 58:34 Phrack is back

Why is Anthropic Afraid of GLM 5.3?

Oct 2, 2026 2 hr 33 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 115: We into Anthropic's Frontier Red Team fear-mongering on Zhipu's open-weight GLM 5.3 model and wonder why the AI labs' cyber programs do so little for defenders. Plus, Citrix NetScaler zero-days, a new iOS zero-day tied to WhatsApp, AI agents that act on your behalf, and whether security teams should buy DGX Sparks to run models locally. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter, TLPBLACK 3:38 OffensiveAI Con and the missing defensive con 9:28 Anthropic's GLM 5.3 post 23:21 What do defensive AI coalitions do? 29:08 Inside Glasswing 36:01 Why can't vuln-finding models patch? 42:44 Gemini for Argon and Grok's CVE-Bench tie 47:54 Is hallucination a solved problem? 57:41 Zhipu's program and 4,000 zero-days 1:02:32 Citrix NetScaler zero-days 1:10:42 Half-days and automated patching 1:26:45 iOS 27.0.1 zero-day and WhatsApp 1:32:36 Dots, Instinct and agent monetization 1:52:06 DGX Spark 64GB and local AI hardware 2:18:38 Anthropic visits the Pope, then UFOs

Kernel Exploits in the iOS App Store, ShinyHunters Inside the FBI

Sep 25, 2026 2 hr 16 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 114: We dig into TypeSafe AI's Jev and the new class of System One models, a new Transluce report on rogue OpenAI agents probing an Australian Medicare portal, Irregular's role in the latest Gemini test breakout, Hacktron's takeover of OpenAI employee accounts and the messy disclosure fight that followed, and what Costin would fix first as OpenAI's CISO for a day. Plus, the soaring price of DGX Sparks and home AI rigs, the White House pressing labs to hold models back from the UK AI Security Institute, Anthropic bringing in Accenture as an evaluator, the FomoPeek App Store app hiding iOS kernel exploits, ShinyHunters' claimed FBI breach, and Nightmare Eclipse going public with identity and a CrowdStrike exploit. Cast: Ryan Naraine, Juan Andres Guerrero-Saade and Costin Raiu. Timestamps: 0:00 Introductory banter 1:57 The Last LABScon wrap-up 9:35 TypeSafe AI's Jev and System One models 26:18 Step-down transformers and lab economics 30:58 Rogue OpenAI agents and the Transluce report 41:40 Irregular and Gemini's test breakout 49:28 Hacktron's OpenAI hack and the disclosure fight 54:57 Costin as OpenAI CISO for a day 1:05:44 Hugging Face defends itself with GLM 5.2 1:17:08 What a home AI rig costs now 1:30:02 White House vs. UK AISI pre-release testing 1:36:52 FomoPeek kernel exploits in the App Store 1:51:19 ShinyHunters claims an FBI breach 2:02:40 Nightmare Eclipse unmasked

AI Doomers, Death Cults, and a Million-Dollar WeChat Worm Exploit

Sep 11, 2026 2 hr 37 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 113: On the show this week, the buddies dig into an Anthropic researcher quitting with a warning that AI could kill us all, the San Francisco "death cult" and their motives, and agent swarms leaving junk on public wikis and university URL shorteners. Plus, a high-quality Anthropic's threat report and the claim that Moonshot was quietly serving Claude tokens as Kimi K3, live MikroTik and Chrome zero-days that landed a day ahead of the patches, and a WeChat worm that hijacks an account via phone calls. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter, TLP Black 5:05 LabsCon, the last one, and JAGS on his keynote 8:24 Costin's agentic CTI training and what old-school CTI is missing 16:27 Anthropic's threat-intel report + IOCs 20:00 APT29 and DarkSword on hotel Wi-Fi 23:34 Bioweapons, guardrails, and what got shut down 28:07 Why is anyone running these attacks on Claude at all? 35:53 Distillation at industrial scale and the Kimi K3 fraud claim 48:43 Chinese models, Americanized, running on DGX Spark 55:00 Mr. America: local AI and the seven-layer cake 1:04:34 Should frontier AI labs poison the distillers? 1:27:05 What the frontier labs did to the security ecosystem 1:34:22 Jacob Coxon quits, and the doomer argument falls apart 1:59:13 Agent swarms littering the internet 2:07:29 Chrome zero-days, MikroTik, patch-gaps

Three Secret AI Civilizations Rose and Fell. Nobody Checked the Logs.

Sep 4, 2026 2 hr 7 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 112: The 'OpenAI hacks Hugging Face' fallout has turned into a story about AI civilizations rising from the ashes, politicians calling for super-intelligence bans, and the emergence of well-funding non-profits doing AI safety work. Who are these people and what's their security expertise? Plus, GPT-6 Astra lands in a trusted-access program nobody can get into, Costin ranks the local models he runs next to his desk, and CrowdStrike sinkholes a botnet that's been alive since 2003. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter 1:02 Conference season: LabsCon, Offensive AI Con, Countermeasure 5:40 The Hugging Face story hits the front page 7:04 Dwarkesh, Greenblatt, and the AI-pilled framing 11:51 Swap "agents" for "Python" and the panic goes away 16:34 Does anyone actually know what happened? 21:18 Bernie Sanders wants to ban superintelligence 34:03 Defending against swarms: the 2026 SOC 39:15 Logs, Splunk, and the business model in the way 44:11 What EDR vendors are actually building with AI 56:16 The security poverty line and the endgame 1:07:53 GPT-6 Astra, Fable 5.1, and local model rankings 1:27:25 Google's Fairwind, CodeMender, and agents running Linux 1:45:31 Apple's bet on local inference 1:53:21 The Sality takedown and endgame advice

A Thousand Agents Walk Into Hugging Face

Aug 28, 2026 2 hr 27 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 111: OpenAI finally published a technical Hugging Face post-mortem, and Costin's verdict is blunt. He reads it as a document written for policymakers rather than for the blue teams who have to survive a thousand-agent swarm. We also dig into NVIDIA's $12.9 billion acquisition of Hugging Face, why JAGS thinks a frontier lab standing against open-source looks weak, and what that new industry open letter on cyber defense actually asks anyone to do. Plus, hotel Wi-Fi tradecraft after CaptiveCrunch, the FBI's ORB network takedown with Lumen, Chinese routers that ship backdoored from the factory, and the TeamPCP arrests in Australia. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter 1:11 TLPBlack, incident response, and why it starts at the router 4:11 CaptiveCrunch and Juanito's travel router kit 7:59 Costin's VPN/hotel WiFi stack 12:36 State of Statecraft, LABScon, and Offensive AI Con 17:16 OpenAI's Hugging Face post-mortem technical report 21:43 A swarm of a thousand agents 27:35 Who was OpenAI’s report written for? 33:05 Fail2ban, canaries, and catching agents in your logs 40:34 NVIDIA buys Hugging Face for $12.9 billion 44:42 The open weights fight and rooting for China 52:47 Nemotron, DGX Spark, and the RAM price spiral 1:03:26 Open letter on collective AI-powered cyber defense 1:30:21 Lumen's Quartermaster and the FBI ORB takedown 1:59:05 Backdoored ZBT routers, Chinese phones, and the TeamPCP arrests

Inside the EncroChat law-enforcement implant, Irregular's AI sandbox failure

Aug 21, 2026 2 hr 11 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 110: We dig into Computer Weekly's scoop on the EncroChat hack and news that the French law enforcement implant was cobbled together from GitHub. Plus, Irregular, the $450M startup running sandboxes for OpenAI, Anthropic and Meta, drones over Romania's gas platforms, OpenAI's two-week training pause, and T-Mobile taking scissors to a cable during Salt Typhoon incident response. Stick around for a UFO segment that somehow involves Dr. Phil. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter; LabsCon speakers announced 9:06 A naval drone reaches the Neptun Deep gas platform 17:38 OpenAI pauses RL training: what "slowing the pace of scaling" costs 24:34 Guardrails vs refusals vs alignment. 33:54 Irregular, formerly Pattern Labs: $80M, $450M valuation, one job 46:11 JAGS on why security needs a new batch of startups right now 1:06:52 EncroChat revealed: a GitHub-sourced implant, IOCs 1:15:12 Law enforcement malware vs intelligence malware 1:21:07 T-Mobile, Salt Typhoon, and cutting the cable with a pair of scissors 1:32:06 Captive Crunch: hotel Wi-Fi, OAuth token theft, and the MSP supply chain 1:47:00 ICE RELIC, UNC6293, and the trouble with subcluster naming 2:00:39 UFO corner: David Grusch, Dr. Phil, and the Skywatcher Project 2:05:44 Shout outs, the Costin Challenge

A tiny 12 KB Windows backdoor, one victim, and a dead domain

Aug 17, 2026 2 hr 23 min

(Presented by State of Statecraft: A security and intelligence conference that brings together multiple disciplines, backgrounds, and nationalities to share research into the covert activities of nation-states and other malign actors.) Three Buddy Problem - Episode 109: The buddies dig into a new White House memo handing vetted private companies real offensive cyber authorities, and Costin explains why a stack of ransomware takedown cases has been sitting on a shelf waiting for exactly this. Plus, a tiny 12 KB Windows backdoor found on one machine with a dead C2, the mercenary outfits quietly living inside telcos, and why Google continues to flounder in the race for AI dominance. Cast: Costin Raiu, Ryan Naraine and Juan Andres Guerrero-Saade Timestamps: 0:00 Introductory banter 0:58 State of Statecraft, and a late CFP window 3:24 The White House offensive hacking memo 6:37 "Hack back" is the wrong frame for what's being authorized 11:20 Ransomware cases sitting on the shelf 17:01 The million-dollar bond and who can realistically play 22:29 Where DPRK crypto theft falls under the new definitions 28:15 Would TLP Black take a contract? 36:55 Gen Digital's 12 KB backdoor hiding its C2 in desktop.ini whitespace 46:57 Passive DNS, registration patterns, and pivoting on a dead domain 57:32 Feeding a one-off find back into detection engineering 1:02:14 Metador, Mafalda, and the mercenaries who love telcos 1:17:07 Armored Likho and what "Western APT" really means 1:28:16 The IOC market, private reporting, and CTI’s matching problem 1:58:10 Google's culture problem, the weekly model churn, and Patch Tuesday math

Inside OpenAI's Black Hat Confession

Aug 8, 2026 2 hr 14 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 108: OpenAI got on the Black Hat stage and walked through how its own agent swarm hacked Hugging Face. We discuss and struggle to decide whether to clap or panic. Plus, why only the attacker can do forensics now, frontier models being built as cyber-weapons on purpose, APT29's "Dark Hotel" comeback in luxury hotels, China's swipe at Palo Alto, the Iran-water-system FUD, and an eye-opening Liechtenstein money-laundering hack. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter - Black Hat went full RSA 1:11 TLP Black sponsor read 3:58 A deflated, AI-pilled show floor 8:31 AI stunt hacking and AI slop 16:20 The OpenAI–Hugging Face talk 21:00 Not all the same incident: OpenAI vs. Meta, Anthropic, and Irregular 25:49 Swarms of agents, Artifactory message boards, and the defense gap 32:26 Offense vs. defense: what's really in the training data? 41:22 Guardrails, KYC, and "too dangerous to release" 48:07 JAGS's unpublished Opus 5 benchmark — grinding to 25% and stuck 59:30 AISI, recklessness, and the OpenAI Frontier Risk Council 1:06:27 Stronger models everywhere: Qwen, Sol, Astra, rushing off the cliff 1:18:32 APT29 / "Dark Hotel" reborn + travel OPSEC 1:39:56 China's Palo Alto review, spy-agency rankings, Iran/water FUD 1:57:28 Liechtenstein AML hack, JAGS's promotion, mental health

Proofpoint's Greg Lesnewich on Laundry Bear, ‘Half-Click’ Exploits, and Magnets of Threats

Jul 31, 2026 3 hr 26 min

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.) Three Buddy Problem - Episode 107: Proofpoint's Greg Lesnewich joins the show to break down Laundry Bear, the "half-click" webmail exploits that let a Russian GRU cluster hack inboxes the moment an email was opened, and what it took to publish alongside the NSA, FBI and sixteen allied agencies. Plus, Anthropic and OpenAI both admit their models escaped test sandboxes and popped real companies, why JAGS wants the CFAA burned down and vulnerable devices bricked, and a heartfelt detour into how threat hunters actually build intuition and skills. Cast: Greg Lesnewich, Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Sponsor - Thinkst Canary 1:34 Greg Lesnewich introduces the Proofpoint threat-hunting team 5:23 Inside the NSA ‘Laundry Bear’ advisory 7:15 What does "half-click" mean? 9:58 Laundry Bear's Zimbra exploit: DNS exfil and app-specific password persistence 12:59 Ferrari model numbers, F1 UNC names, and ESET's Operation RoundPress 17:05 Targeting Ukraine, US universities, and magnetic fusion research 19:34 How threat hunters actually build intuition 32:35 Systems thinking, Donella Meadows, and Costin's laptop under the dinner table 54:48 The dopamine hit of a real find and the deleted "never mind" messages 1:00:42 Magnets of threats: under 1% of customers ever see an APT 1:25:21 Getting detections into the product, and coordinating a release with NSA 1:53:22 Anthropic and OpenAI models breaking out of the eval sandbox 2:17:45 The case for killing the CFAA and bricking vulnerable devices 2:43:44 AI in the lab, malware paleontology, Google's new name...

Validin's Kenneth Kinion on What Separates Useful Threat Intel From Noise

Jul 28, 2026 34 min

Security Conversations: Kenneth Kinion, founder and CEO of Validin, joins Ryan Naraine on the show to unpack what "internet intelligence" really means for the analysts and responders chasing malicious infrastructure. We trace his path from Georgia Tech through Microsoft and Amazon to the frustrations that led to the creation of Validin, the competition from big AI, the value of AI-powered tools to speed up infrastructure hunting, and why defenders keep falling further behind fast-moving attackers. Timestamps: 0:00 – Intro: What does Validin do? 0:51 – Who uses Validin: CTI teams, SOCs, incident responders 2:19 – Atlanta and Georgia Tech's cybersecurity pipeline 5:31 – Lessons from Microsoft and Amazon: waterfall vs. agile 8:29 – Filling gaps in passive DNS data 9:57 – Misunderstood things about threat intelligence 14:17 – The value of "cyber paleontology" 16:00 – What makes one data set better than another? 19:39 – How Validin works: from one suspicious domain to a full pivot 21:27 – AI as existential threat or force multiplier for Validin 26:55 – Dual-use AI: are defenders losing ground to attackers? 31:11 – Closing: the next hard problem Validin wants to solve

OpenAI's models breached Hugging Face, reward hacking ethics, benchmarking fast16

Jul 23, 2026 2 hr 16 min

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.) Three Buddy Problem - Episode 106: We dig into the news that OpenAI's models were the "autonomous agent" that breached Hugging Face, escaping a sandbox through a zero-day to cheat on a cyber benchmark, then getting spun into a partnership announcement. We argue about the implications of the incident, the PR masterclass, the absence of ethics and human oversight, and calls for "kill switches" to mitigate "AI lab leaks." Plus, SentinelLabs' new fast16 reverse-engineering benchmark, where GPT-5.6 Sol was the only public model to go the distance. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter 5:24 OpenAI admits it was the Hugging Face "hacker" 10:06 What’s ExploitGym and who's on top of the leaderboard 12:59 Reward hacking: Did anyone train this thing not to cheat? 19:35 Marketing stunt or real incident? The zero-day in the package proxy 26:43 Was OpenAI already plugged into Hugging Face? 29:17 Paperclips, kill switches, and "going rogue" 34:49 Crisis comms, regulatory capture, and the second Cold War 43:02 Approve every action? Auto mode and swarms 50:10 "Lab leak" and calls for biosafety levels 1:00:31 The missing models: no Mythos, no Kimi, no independent referee 1:07:04 Costin's prediction: owning frontier-class hardware will require a license 1:13:41 fast16 as a benchmark: Inside the Sol Searching research 1:26:51 Compression and altitude: are reverse engineers being replaced? 1:41:24 Finding the gem in 100 samples, and the swarm frontier 2:00:41 Claude Opus 5 drops, Gemini 3.5 Flash Cyber

Hugging Face Just Got Hit by the First Fully Autonomous AI Attack

Jul 18, 2026 2 hr 7 min

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.) Three Buddy Problem - Episode 105: We discuss a fascinating Hugging Face breach, where an autonomous AI agent broke out of the sandboxes, moved laterally through production, and generated 17,000 alerts before anyone caught it, and how frontier model guardrails locked the defenders out of their own investigation. Plus, China's big AI showcase, Xi's pitch for open models and global distribution, a record 622-CVE Microsoft Patch Tuesday, and 13 years of dwell time in the Daxin backdoor. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter 3:51 Hugging Face discloses end-to-end agentic hack 9:42 Why Hugging Face couldn't use frontier models 13:28 AI guardrails hampering defenders 16:22 Codex vs Claude for real malware work 23:43 Flash attacks vs. going low and slow 30:27 Was it targeted, or did Hugging Face pwn itself? 38:11 Long-horizon coherence: what GLM 5.2 still can't do 41:27 Kimi K3 leapfrogs, and Xi's AI speech 52:15 Exceptionalism vs. distribution 1:11:05 Gold Eagle: the White House vulnerability clearinghouse 1:15:05 Microsoft patches 622 CVEs — a record 1:20:29 APT corner: Daxin resurfaces after 13 years of dwell time 1:29:45 Balochistan police, and Microsoft's attribution-free wiper 1:34:26 Denis Obrezkov, leaked Kaspersky records, and the wrong questions 1:46:01 Magnet Forensics sues over a burned iPhone bug 1:57:57 Shout-outs

Microsoft's Secret Weapon: The GDID That Caught 'Scattered Spider' Teen

Jul 4, 2026 1 hr 36 min

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.) Three Buddy Problem - Episode 104: We discuss the return of Anthropic's Fable 5 from export-control suspension with guardrails so aggressive that spelling "exploit" gets you downgraded. Plus, a debate on AI frontier labs killing businesses at scale, and OpenAI offering equity to the US government. Also, buried on page nine of a 'Scattered Spider' arrest indictment: Microsoft's never-before-detailed GDID device identifier, a persistent Windows fingerprint with massive implications for OPSEC, privacy, and APT tracking. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Cold open: Heat wave in Washington DC 3:45 Fable 5 returns after the 15-day timeout 5:21 "Refined classifiers" and the downgrade-to-Opus mess 8:23 Codex vs. Claude: real-world malware analysis test 12:41 Who are the guardrails for? Defenders locked out 19:13 What even is a "jailbreak assessment framework"? 21:37 Two theories: failed PR vs. killing a thousand startups 24:59 Could the labs build kernels or a whole OS? 31:38 Bureaucracy is the moat 36:09 Can AI actually run an attack? (Spoiler: 14 detections) 47:01 OpenAI offers the US government a 5% stake 58:16 Scattered Spider arrest and Microsoft's GDID revelation 1:12:02 OPSEC fallout: how APT groups adapt to device telemetry 1:27:18 UFO update, shout-outs from Seoul

US Gov Takes the Wheel: Who Gets to Use the Best AI?

Jun 29, 2026 1 hr 53 min

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.) Three Buddy Problem - Episode 103: We dive into the U.S. government's takeover of frontier-model rollouts (Mythos, Fable, and OpenAI's Sol/Terra/Luna) and what it means when intelligence gets commoditized but access gets rationed. Plus, Costin's all-Chinese open-weight stack, the economics of burning tokens, a fresh Salesforce OAuth breach, and jellyfish UFOs over Iran. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 — Introductory banter, Thinkst Canary sponsorship 2:55 — Why threat intel analysts are built for the AI moment 11:09 — Government takes the wheel: Mythos, Fable & the frontier labs 16:15 — Did the government go too far/not far enough? 25:42 — Anthropic's "best PR campaign in history" 31:52 — Alibaba, distillation & the model-router cartel 40:58 — Costin's stack: Chinese open-weight models & token economics 46:12 — Dumping, evals & the real work of AI engineering 1:04:32 — Soft power: how the world gets pushed toward China 1:14:43 — "The b******t": over-refusal & the Opus 4.8 regression 1:32:03 — The trillion-dollar IPO endgame 1:35:49 — The Klue OAuth breach and secure-by-default 1:45:32 — Shout-outs: UAP jellyfish, LABScon 2026

Katie Moussouris on the Anthropic Export-Control Mess

Jun 19, 2026 1 hr 38 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 102: Software export controls expert Katie Moussouris joins the show to unpack the US government's abrupt move to suspend access to Anthropic's most powerful models over a so-called "jailbreak" that, on reading the paper, turned out to be a model doing exactly what defenders are supposed to do. We dig into the export-control chaos, the chemical-weapons framing of cybersecurity, the China question, and why Microsoft just resurrected a disclosure term the industry buried fifteen years ago. Cast: Katie Moussouris, Juan Andres Guerrero-Saade and Ryan Naraine. Costin is traveling. Timestamps: 0:00 - Introductory banter 1:00 - Export Controls: Fable 5 and Mythos 5 suspended 3:40 - The Anthropic–USG relationship and USG’s surveillance claim 9:40 - Self-owns, doomsday cults, and why the guardrails are "so broad" 12:42 - What the Amazon paper actually says ("fix this code") 20:33 - The chemical-weapons framing problem 23:39 - The China question and the SK Telecom angle 41:17 - Why hasn't the paper been published? 57:01 - "Free Fable": are Chinese models only months behind? 1:00:13 - The unforgiving internet and the security poverty line 1:11:18 - Microsoft brings back "responsible disclosure" (and threatens researchers) 1:29:04 - Luta Security, the AI bug flood, and shout-outs

Mythos, Fable, and Anthropic's Big Trust Problem

Jun 12, 2026 1 hr 59 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 101: We discuss Anthropic's Mythos 5 and Claude Fable 5 release and the bombshell that the company was silently downgrading paid users' results, sparking a heated debate over guardrails, gatekeeping, and whether elite AI reasoning is becoming a privilege for the few. Plus, AI-generated N-day exploits killing the patch window, a record-shattering Patch Tuesday, Meta's latest court filing against spyware maker NSO Group, the return of cyber paleontology, and a detour into the new government UFO drops. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 - Introductory banter 3:22 - The Mythos 5 / Claude Fable 5 release 14:42 - Anthropic’s silent downgrade trust problem 26:18 - Anti-competitive behavior & the AV "stealing detection" parallel 32:29 - Distillation, China & the real motive 38:04 - "Too dangerous to release" & gatekeeping vs. guardrailing 45:53 - Is Mythos a threat to malware-analysis startups? 48:20 - Dario's AI regulation essay 56:48 - N-day exploits and death of the patch window 1:07:18 - Patch Tuesday and 10x vulnerability surge 1:10:34 - Meta catches NSO Group 1:14:45 - Cyber paleontology, Shadow Brokers leaks 1:28:29 - Moonlight Maze and learning from history 1:34:22 - UFOs, UAPs and Disclosure Day

Fast16, Fanny, and Stuxnet: Cyber Paleontology Redux

Jun 5, 2026 2 hr 24 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 100: We cover AI eating reverse engineering, the death of the malware report, running local models on the DGX Spark, where Google DeepMind stands, and whether the frontier labs will stay in cybersecurity. Plus, more on Anthropic's Mythos rollout and the thinly sourced Anthropic-NSA reports, the Fast16 sabotage of physics calculations, what researchers choose not to publish, Microsoft's bad Black Hat email, and Costin's Friday UFO files. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 - JAGS at InfoSecurity Europe 3:40 - Sponsor: TLPBLACK 5:54 - A roadmap for security after the AI revolution 11:01 - Stripe Atlas and how easy it is to start a company 15:00 - If anyone could reverse engineer anything for $5 19:49 - Layoffs at Google's Threat Intelligence Group 21:06 - The death of reading the report 27:53 - Pitting the AI models against each other 32:07 - Grok, local models, and the DGX Spark 39:27 - Where is Google DeepMind? 45:29 - Will the frontier labs stay in cybersecurity? 52:41 - Mythos, Project Glasswing, and the NSA deal 1:16:33 - FAST16, Stuxnet, and sabotaging Iran's bomb 1:57:52 - Microsoft, Black Hat, and the chilling effect 2:14:14 - Shout-outs, UFO files, and 100 episodes

Microsoft Threatens Vuln Researchers; Shadow Brokers Revisited

May 30, 2026 1 hr 59 min

(Presented by Ent.ai: Ent delivers intent-aware security that protects every action, adapts to every workflow, and works for every user. Enterprise threat detection, reimagined.) Three Buddy Problem - Episode 99: Microsoft is now threatening legal action against researchers who drop zero-days. We debate whether it's a fair line against extortion, or amateur-hour PR from a company that already torched its own research community? Costin plays reluctant defender, JAGS says the damage was done years ago, and Ryan reopens the long history of silent fixes and stolen bounties. Plus, on the 10th anniversary of the Shadow Brokers leak, we discuss some enduring mysteries, theories on attribution and an interesting trail that leads to Edward Snowden. We also unpack Rob Joyce's warning that China's cyber explosives are already planted in US infrastructure, and the Pope's warnings about around artificial intelligence. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 - Introductory banter 2:03 - The Pope's AI paper 3:35 - New sponsor: Brandon Dixon's Ent Security 9:34 - Costin's Chinese-model OSINT rabbit hole 13:34 - Codex, GPT-5.5, and the "American AI welfare state" 23:20 - Microsoft threatens vulnerability researchers 27:06 - Is it extortion or retribution? The disclosure fight 40:48 - How Microsoft's consultant class broke MSRC and MSTIC 48:42 - Silent fixes, stolen bounties, and the marketing machine 1:02:29 - Ten years of the Shadow Brokers 1:14:20 - The Snowden theory 1:32:34 - Rob Joyce: China's cyber explosives are in place 1:53:26 - Shout-outs

Aaron Portnoy on Pwn2Own, the End of Easy Bugs, and AI-Fueled Offense

May 27, 2026 40 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem x Ekoparty Miami: Aaron Portnoy (Zero Day Initiative alum, early Pwn2Own organizer, and now at Mindgard) joins us at Ekoparty Miami to reminisce on the early days of the hacking contest, where vulnerabilities actually live (the boundaries between systems, not inside them), why LLMs will take out the trash but can't dream up the next speculative-execution-class bug, and the coming patching apocalypse when discovery 10x's overnight. Plus, why your SOC is a forensic historian, the promise of hijacking an attacker's reward loop with deception tech, and the legendary story of carrying a Walmart "fat stack" of cash to bootstrap Ekoparty in Buenos Aires. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Aaron Portnoy. Timestamps: 0:00 — Introductory banter 1:17 — Dropping out, iDefense, and getting good at reversing everything 2:19 — How Pwn2Own got started 4:15 — The most impressive Pwn2Own ever: Nils, VUPEN, and exploit "art" 5:59 — "iPhone hacked in 30 seconds" — and the 18 months behind it 6:41 — Does Pwn2Own still have a place in the AI era? 9:16 — Why LLMs take out the trash but can't invent the next bug class 12:48 — Will LLMs deliver new mitigation classes? Aaron's skeptical 18:34 — The place of the human when the easy bugs run dry 21:08 — Cognitive offloading, Halvar's warning, and skill rot 22:39 — Decompiling 800k functions: Aaron's LLM "holy shit" moment 25:26 — The patching apocalypse and why "assume breach" breaks 28:15 — Compounding asymmetries: why offense just transcended defense

Perri Adams on Proof Engines, LLMs, and the New Era of Verifiable Code

May 26, 2026 40 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem x Ekoparty Miami: Perri Adams of DARPA AIxCC fame joins the show to chat about proof engines, formal methods, and why LLMs just made a once-niche corner of computer science suddenly essential. We get into why verifiers and proof engines are the key to effective AI, why vulnerability research is so far ahead of threat intel, and the case for baking security checks directly into code generation tools like Claude Code and Codex. Plus, designing a multi-million dollar challenge that's allowed to fail, the Mythos "too dangerous to release" debate, and musings on every LLM-discovered bug being a public bug by default. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Perri Adams. Timestamps: 0:00 — Introductory banter 1:09 — Why LLMs just made formal methods relevant again 4:03 — Proof engines, explained 8:43 — Can a layman grab this fire? The calculus problem 11:58 — Vuln researchers are scrappy kids with a trust fund 14:55 — Pitching AIxCC inside DARPA: hard sell or easy sell? 18:00 — Designing a challenge that's allowed to fail 22:06 — Inside Team Atlanta's 150-page winning system 24:00 — Why this is bigger for defense than for offense 31:49 — Mythos, safeguards, and "every LLM bug is a public bug"

Find 50,000 Bugs, Fix Zero: Gabriel Bernadett-Shapiro on the AI Vuln Trap

May 26, 2026 49 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem x Ekoparty Miami: SentinelLabs researcher Gabriel Bernadett-Shapiro hops on the mic to unpack who gets to define what "security" even means in the age of AI, why venture capital keeps funding the wrong things, and how the frontier labs quietly ate everyone's coding harness. Plus, how AI actually contributed to cracking the FAST 16 research, overcoming the guardrails, and why your domain expertise is the only thing keeping you out of full-blown rabbit-hole psychosis. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Gabriel Bernadett-Shapiro. Timestamps: 0:00 Introductory banter 4:55 Gabe returns: how the models got scary-good at code 8:45 Bay Area short-termism and the "10x in 18 months" trap 11:35 VCs as tastemakers, and why that's broken 13:00 The unpaid-labor pipeline into the AI labs 18:00 The real misunderstanding about security's moat 20:18 Bug bounties: a net negative for the industry? 22:20 The great vuln fire sale — find 50,000, fix zero 27:28 Who will maintain vetted open-source libraries? 29:29 FAST 16: how AI actually broke the case open 35:05 The rabbit-holing machine and the path to "AI psychosis" 41:05 Stuxnet, Kim Zetter, and the story we'll never be told

Federico Kirschbaum on XBOW, AI Hackers, and the Future of Pen Testing

May 25, 2026 58 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem x Ekoparty Miami: Federico Kirschbaum, founder of Ekoparty and now head of Security Lab at XBOW, talks about what happens to offensive security when an autonomous AI hacker can find and exploit real vulnerabilities. Fede walks through XBOW's "Tales from the Trace," the surreal experience of watching a non-human adversary reason its way to an ASLR bypass, and why he believes pen-testing isn't dying but finally becoming accessible to far more than the world's biggest companies. Plus, where humans still matter in the loop, whether an LLM-discovered bug is public by definition, the looming reckoning over software liability, and Halvar Flake's very honest fear of getting lazy. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Federico Kirschbaum. Timestamps: 0:00 Fede's move to XBOW 2:20 What's XBOW building? An AI hacker for real vulnerabilities 5:53 Where the human stays in the loop 6:35 The Exim bug: a craftsman races the LLM to an ASLR bypass 10:49 Does bug discovery still need a human asking the right question? 16:24 A short history: Satan, CORE, Metasploit, bug bounties 18:48 An LLM-discovered bug is public by definition 24:12 Halvar Flake's laziness worry & the assembly-to-C parallel 29:47 Rising tides: script kiddies get the full gamut 41:02 The economics: does pentesting get cheap? 43:18 Argentina, Ekoparty, and an untapped talent pipeline

Jordan Wiens on AI, Offense vs. Defense, and the Dying CTF Pipeline

May 24, 2026 44 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem x Ekoparty Miami: Jordan Wiens, co-founder of Vector 35 and creator of Binary Ninja, talks about a decade spent building a decompiler in a market everyone told him not to enter. He walks through why accessibility drove the whole project, how Binja's intermediate-language system stacks up against IDA, Ghidra, and Radare, and why language-specific decompilation for Rust, C++, and Go is the next real frontier. Plus, thoughts on AI disruption and why "the model can do it" misses the point that the model is just driving the tool, what verifiability really means, whether AI tilts the field toward offense or defense, and questions around subsidized tokens, the collapse of the CTF talent pipeline, and what happens to a craft when the shortcut is always one prompt away. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Jordan Wiens. Timestamps: 0:00 Introductory banter 1:22 Vector 35 and the origin of Binary Ninja 2:32 From CTFs and SCIFs to building a decompiler 3:27 Before Ghidra: when an IDA license was out of reach 9:47 Language-specific decompilation: Rust, C++, and Go 12:47 Running a 17-person bootstrapped shop with no org chart 13:50 DARPA money, In-Q-Tel, and staying independent 15:23 AI as disruptor: the model drives the tool 18:06 Verifiability and the Fast16 reversing story 25:10 How AI actually gets used inside the company 28:52 Frontier models and guardrails 33:30 Will AI favor offense or defense? 40:51 Shrinking CTF talent pipelines

The AI-powered 10x patch tsunami has arrived. Now what?

May 15, 2026 1 hr 50 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 98: We dive back into the fast16 malware discovery with fresh speculation that it's targeting spherical implosion simulations for Iran's nuclear program, and wonder who on earth is qualified to confirm this. Plus, thoughts on OpenAI's new three-tier cyber access program, Microsoft's MDASH harness, the 10x Patch Tuesday tsunami, Cloudflare's 1,100 layoffs blamed on AI, and why frontier-lab guardrails may just be elaborate security theater. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 - Introductory banter 3:19 - fast16 update: spherical implosion simulations? 9:01 - Manhattan Project precedent — why this matches Iran 12:28 - Who can actually reproduce the FAST 16 attack? 19:32 - Google GTIG's "AI-written" zero-day 22:13 - The rise of AI-backend "silent detections" 25:54 - Guardrails as security theater 38:47 - Are the 10x patch numbers real defense? 43:48 - OpenAI's Trusted Access tiers + Microsoft MDASH 53:35 - End of the ‘patch-and-pray’ model 57:50 - Sean Heelan: strict harnesses can make models worse 1:03:51 - Pwn2Own Berlin overflow and bug-density debate 1:12:24 - Cloudflare's 1,100 layoffs and AI as scapegoat 1:27:42 - RCS encryption, Android Intrusion Logging, Seedworm & Kazuar

The disappointing death of big-game APT reporting

May 10, 2026 2 hr 2 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 97: We discuss the disappearing art of Windows APT paleontology, the absence of complex malware documentation, and why so much threat-intel research has slipped behind paywalls and into private rooms. Plus, a surge in AI-discovered bugs in Firefox and Chrome, a rough week for Linux security flaw disclosures, and the usual Ivanti and Palo Alto zero-day bulletins that ship without a single IOC. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 - Introductory banter 1:17 - Inside TLP-Red: writing hashes by hand 3:57- fast16 fallout and the threat intel trust collapse 9:17 - The death of cyber paleontology on Windows 14:49 - Mobile is the new paleontology frontier 15:48 - When threat intel went private: the CrowdStrike effect 23:29 - Falling sideways into intelligence brokerage 36:05 -- AI, Easter eggs, and the loss of malware artistry 47:22 -- Will the Frontier Labs publish threat intel? 51:43 -- fast16 follow-up reports coming 1:09:38 - Mythos, Aardvark, and the patch tsunami 1:15:33 - CopyFail and the Linux reboot crisis 1:51:05 - UAPs, Pulitzers, last-ever LabsCon, and shoutouts

Cracking the Fast16 sabotage malware mystery

May 1, 2026 1 hr 47 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 96: We're joined by WIRED writer Andy Greenberg to dig into SentinelLabs' bombshell FAST16 research, a newly deciphered piece of sabotage malware that predates Stuxnet by five years and quietly tampered with physics modeling software likely tied to Iran's nuclear program. We discuss the attribution rabbit hole (NSA? Israel? someone else?), the eerie "spiritual warfare" implications of corrupting scientific calculations, and Antiy Labs' very dialectical Chinese rebuttal. Plus, what AI reverse-engineering means for the next decade of cyber paleontology. Cast: Andy Greenberg, Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 - WIRED’s Andy Greenberg joins the show 1:53 - How the FAST16 scoop landed in Andy's lap 6:45 - JAGS sat on this sample for 7 years 10:33 - How Costin and the Kaspersky team missed the sabotage routine 15:20 - The "holy moly" moment: what FAST16 actually does 18:26 - Territorial Dispute, Shadow Brokers, and the driver list 24:11 - The targets: MOHID, PKPM, and LS-DYNA's link to Iran 28:13 - No C&C, no victims: a worm built for air-gapped networks 34:45 - Was this part of a larger anti-Iran toolkit? 37:55 - Attribution: NSA, Israel, or someone else entirely? 51:39 - What was the actual sabotage? Unanswered questions 55:48 - "Spiritual warfare": the psychological angle and trust in computers 1:20:05 - Equities, going public, and the case for AI-powered reversing 1:32:19 - Antiy Labs' Chinese rebuttal and the apparatchik tone 1:43:04 - Shoutouts: Sergey Mineev, LabsCon CFP, PivotCon, and Ekoparty

Mark Dowd on AI hacking, exploit chains, zero-day sales

Apr 24, 2026 2 hr 2 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 95: Vigilant Labs director Mark Dowd joins the show to shed light on the state of offensive research, the economics of the exploit market, and why "Mark Dowd in a box" isn't quite the threat the AI hype machine suggests. He talks through the daily stresses of running an offensive shop, how AI is reshaping vulnerability discovery, exploit development, and the pricing of full exploit chains. Plus, thoughts on Lockdown Mode and Apple's MIE, whether mitigations actually work or just push attackers toward less access, the rise of HarmonyOS and the Balkanization of device security, persistence, baseband attacks, GrapheneOS, and Samsung Knox. We discuss customer vetting and OpSec fears, policymakers who've never written an exploit, and the strange afterlife of The Art of Software Security Assessment, the 20-year-old book now possibly training data for the very tools coming for his job. Cast: Mark Dowd, Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductions 4:28 The origin story of Azimuth: why go offensive? 6:26 Stresses of running an offensive research business 12:10 "Mark Dowd in a box" — is AI an existential threat to vuln research? 16:13 Using AI in workflow: frontier models vs. local models 22:05 AI in bug-finding vs. exploit implementation 30:30 Watching AI tear through a firmware backdoor 38:23 Artificial guardrails and the "POC" wall 43:25 Will AI commoditize 0days? The high-end vs. low-end vendor split 57:30 How AI disrupts exploit chain pricing 1:05:18 Does persistence still matter? Should you reboot your phone? 1:09:33 Lockdown Mode, MIE, and Apple's "never been compromised" claim 1:14:25 Do mitigations really work, or are we stuck in an endless loop? 1:23:25 Android vs. iOS vs. Huawei's HarmonyOS Next 1:34:44 Exploit lea...

The Angry Spark APT Mystery: A Year-Long Backdoor, One Victim, Zero Attribution

Apr 18, 2026 2 hr 35 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 94: We discuss a mysterious, VM-obfuscated backdoor that lived undetected on a single U.K. machine for a year before disappearing, finding clues pointing to an elite-level APT intrusion that still evades broader industry coverage. Plus, connecting the dots across AI-driven vulnerability discovery, Microsoft’s massive Patch Tuesday, Jensen Huang talks cybersecurity, Mythos dangers and Chinese chips, and the quiet erosion of CVE enrichment at NIST. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 – Intros + AI news whiplash 5:10 – Patch Tuesday breakdown: Microsoft's second-largest CVE release ever 7:32 – AI accelerating vulnerability discovery at record pace 10:00 – Frontier lab cyber models, fine-tuning, guardrail removal & KYC 12:37 – FreeBSD NFS bug: Opus 4.6 was already finding critical vulns 14:26 – Anthropic's infrastructure strain: Is Opus being nerfed? 21:05 – OpenAI's Trusted Access for Cyber vs. Anthropic's Mythos cabal 28:45 – SharePoint zero-day CVE-2026-32201: The endless Microsoft tax 34:36 – Adobe Acrobat zero-day: A rare, real, Russia-linked exploit in the wild 41:36 – VirusTotal mining: The golden age of threat intel hunting 50:03 – ZionSiphon: Vibe-coded OT malware targeting Israeli water infrastructure 55:04 – Paleontology of threat research: When do you publish? Who do you trust? 1:13:53 – Angry Spark: A one-machine, one-year backdoor raises eyebrows 1:49:25 – Jensen Huang vs. Dwarkesh Patel on Mythos, China and chips 2:14:32 – Chinese AI distillation: 24,000 fake Anthropic accounts, DeepSeek & the catch-up question

The Claude Mythos, Project Glasswing Shockwave

Apr 10, 2026 2 hr 34 min

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 93: We discuss Anthropic's release of Claude Mythos Preview (an AI model so capable and dangerous they won't release it publicly) and debate the looming patching crisis, bug bounty extinction, possible US government nationalization of frontier labs, and why the NSA might not be thrilled about all this bug-fixing. Plus, North Korea's six-month Drift Protocol con job, APT28's retro DNS hijacking campaign, and Microsoft's driver signing mess hitting WireGuard and VeraCrypt. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. 00:00 — Opening banter 01:36 — Anthropic Mythos Preview + Project Glasswing 06:17 — USG reaction + Wall Street emergency meeting 10:54 — Mythos capabilities vs hype (technical reality check) 13:44 — PR stunt? Skepticism of Anthropic narrative 20:42 — The patching crisis + “defender advantage” 27:41 — Bug bounty model under threat from AI 33:37 — Mythos practical workflows 45:09 — Geopolitics, NSA angle, and nationalization discussion 01:40:18 — Fortinet zero-day + ongoing failures 01:42:39 — Drift Protocol heist ($285M) + long-term social engineering 01:44:07 — Revisiting XZ Utils / Jia Tan attribution 01:54:07 — Crypto security gaps + need for real CTI in blockchain 02:04:22 — APT28 DNS hijacking + router compromise campaign 02:18:57 — Microsoft driver signing meltdown + ecosystem impact

LLMs writing exploits, engineers losing skills, and a case for the generative OS

Apr 3, 2026 2 hr 19 min

(Presented by TLPBLACK: High-fidelity threat intelligence and research tools for modern security teams. From curated Passive DNS and real-time C2 monitoring to actionable IOC feeds and daily malware samples, we help defenders detect, hunt, and disrupt threats faster, with seamless integration into SIEM and SOAR workflows.) Three Buddy Problem - Episode 92: Costin walks through real-world ransomware incident response while Juanito makes the case for AI-generated operating systems that never run anyone else's code. Plus, debates on whether vulnerability research is cooked, why nobody should pay ransoms, and what the security industry looks like after the massive AI flood. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. 0:00 – Introductory banter 2:00 – Costin's ransomware incident response work 3:30 – How attackers break in: Fortinet vulnerabilities everywhere 6:30 – Hunting for ransomware decryption keys 9:00 – Breaking into ransomware C2s and monitoring leak sites 12:00 – The ransom payment debate: should you ever pay? 16:00 – Why "don't pay the ransom" is overgeneralized 21:00 – How ransomware gangs price their demands 24:00 – The AI-pilling of the security industry 28:30 – Nicholas Carlini, Ptacek, and "vulnerability research is cooked" 35:00 – Towards a generative-first operating system 41:00 – Code factories, trusted computing, and killing dependencies 48:00 – Microsoft and Apple's AI positioning 56:00 – Chris St. Myers' "Cognitive Rust Belt" essay 1:18:00 – Choice, The Matrix, and the illusion of control 1:38:00 – Supply chain attacks, North Korea, and dependency sprawl

Jeremy Banon: Personal Exec Compromise as Corporate Incident

Apr 1, 2026 36 min

(Presented by TLPBLACK: High-fidelity threat intelligence and research tools for modern security teams. From curated Passive DNS and real-time C2 monitoring to actionable IOC feeds and daily malware samples, we help defenders detect, hunt, and disrupt threats faster, with seamless integration into SIEM and SOAR workflows.) Security Conversations: Jeremy Bannon, founder/CEO of The Cyber Health Company, joins Ryan Naraine to discuss why executive personal cybersecurity is a growing blind spot for organizations, and real-world incidents where personal compromises became corporate crises. Plus, why CISOs struggle to secure the C-suite's personal lives, and how a healthcare-inspired model (complete with risk scores, care plans, and concierge support) can help companies close the gap. 0:00 — Introduction to The Cyber Health Company 1:00 — Why personal security is a blind spot for organizations 2:00 — Real examples: Disney hack, Instagram compromise, productivity loss 6:50 — Executives circumventing IT policy and Shadow-AI 8:43 — Digital immunity: resilience and incident response readiness 10:25 — The healthcare model for cybersecurity communication 12:14 — How the Cyber Health Score and risk coefficient work 15:34 — OSINT intake: why your social security number isn't private 17:26 — The state of executive security hygiene and the concierge model 35:00 — AI, deepfakes, and the scaling of commodity attacks

Google's Cyber Disruption Unit; Coruna is Triangulation, US Bans Foreign-Made Routers

Mar 28, 2026 2 hr 32 min

(Presented by TLPBLACK: High-fidelity threat intelligence and research tools for modern security teams. From curated Passive DNS and real-time C2 monitoring to actionable IOC feeds and daily malware samples, we help defenders detect, hunt, and disrupt threats faster, with seamless integration into SIEM and SOAR workflows.) Three Buddy Problem - Episode 91: This week we dig into Google's new cyber threat disruption unit announced at RSAC, Kaspersky confirming Coruna is a direct evolution of Operation Triangulation, and a cascading supply chain compromise that chained through LiteLLM, Trivy, and Checkmarx into thousands of software pipelines. Plus, VCs and the breathless AI hype, Apple's iOS 26.4 and silent patches, the FCC's ban on foreign-made routers, and Symantec catching an APT looking for Chinese military data. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. 0:00 Intro & Pre-Show Banter 3:08 JAGS in San Francisco: RSAC week recap 6:05 Google Launches Cyber Disruption Unit — What's Actually New? 13:43 Why Separate Disruption Units Matter: ROI & Budget Justification 29:11 Haroon Meer's RSA Reality Check: The AI Hype Machine 32:37 The VC Ponzi Cycle & How Easy Money Hollowed Out Cybersecurity 47:32 ENT.ai & Tenex AI Hackathon at RSAC 53:08 Kaspersky Links Corona Exploit Kit to Operation Triangulation 1:08:09 Trenchant Cleanup & Lessons from Equation Group Burns 1:19:31 Apple iOS Patches, Hong Kong Device Passcode Law 1:27:53 Handala Hacks FBI Director Kash Patel's Personal Gmail 1:37:32 LeakBase Admin "Chucky" Arrested in Russia — FSB Gets the Data 1:45:38 Supply Chain Attacks: TeamPCP Hits LiteLLM & Trivy 2:04:34 FCC Bans Foreign-Made Routers — But What Do We Buy?

The greatest APT hunter of all time, Apple's exploit kit problem, Microsoft FedRAMP mess

Mar 20, 2026 2 hr 27 min

Handala wiper attacks, APT28 implant devs are back, Signal's verification problems

Mar 14, 2026 1 hr 44 min

Trenchant, Peter Williams, and the proliferation of a Shadow Brokers-level iOS exploit framework

Mar 6, 2026 1 hr 59 min

Matthias Frielingsdorf on the mysterious Coruna iOS exploit kit discovery

Mar 5, 2026 39 min

(Presented by TLPBLACK: High-fidelity threat intelligence and research tools for modern security teams. From curated Passive DNS and real-time C2 monitoring to actionable IOC feeds and daily malware samples, we help defenders detect, hunt, and disrupt threats faster, with seamless integration into SIEM and SOAR workflows.) Matthias Frielingsdorf (co-founder and VP of Research at iVerify) joins the show to discuss the mysterious US government connection to 'Coruna', an iOS exploit kit fitted with 23 exploits across five full chains targeting iPhones iOS 13 through 17.2.1. We talk about a "gut feeling" connecting this to the L3 Trenchant/Peter Williams exploit sale scandal, how a nation-state-grade exploit kit ended up in the hands of a Chinese cybercrime group chasing crypto wallets, and what it means that criminal organizations are now deploying iPhone zero-days at scale. Matthias walks through what iVerify can and can't do on Apple's locked-down platform, why he thinks Apple needs to give defenders more access, the Lockdown Mode debate, the thorny issue of sample sharing in the research community, and practical advice for everyday iPhone users facing a threat landscape that just got a lot more complicated.