Talkin' Bout [Infosec] News

The BHIS crew examines the ConnectWise/SkyKick compromise, its implications for Microsoft Entra tenants, and the consequences for MSPs and their customers. They discuss privileged application access, attacker persistence, and why clear incident communication matters. Other stories include the Cairn framework’s use of AI agents against retail websites, research into prompt injection in HTTP headers, exposed MCP servers, Citizen Lab’s reporting on advertising-delivered zero-click spyware, and an alleged listening device installation at OpenAI. Along the way, the team explores deception, proactive security assessments, and reducing attack surface as automated attacks become cheaper and easier to scale. Join us LIVE on Mondays, 4:30pm ET. A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team. https://www.youtube.com/@BlackHillsInformationSecurity Chat with us on Discord! - https://discord.gg/bhis 🔴live-chat Chapters (00:00) - PreShow Banter™ — One decent flying car. (06:55) - ConnectWise SkyKick Compromise Causes Panic in MSP Space - 2026-10-19 (10:22) - ConnectWise/SkyKick Compromise and Microsoft Entra Tenant Access (41:23) - Cairn: AI Agents Automating Attacks Against Retail Websites (53:41) - Research: Prompt Injection in HTTP Response Headers (55:06) - Exposed MCP Servers and the Risk of AI Inference Theft (58:09) - Adfection: Zero-Click Spyware Delivered Through Advertisements Links ConnectWise/SkyKick Compromise and Microsoft Entra Tenant Access Cairn: AI Agents Automating Attacks Against Retail Websites Research: Prompt Injection in HTTP Response Headers Exposed MCP Servers and the Risk of AI Inference Theft Adfection: Zero-Click Spyware Delivered Through Advertisements Alleged Listening Device Installation at OpenAIAntisyphon Pay What You Can Training: November 10–11 DeathCon Tickets in San Diego Creators & Guests Alex Minster "Belouve" - Guest John Strand - Host Bronwen Aker - Host Wade Wells - Host Corey Ham - Host Hayden Covington - Host Eric Capuano - Guest Ryan Poirier - Producer Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com

The BHIS crew discusses MonsterCloud’s ransomware decryption fraud, a Canadian cybersecurity executive’s arrest, and strikes on Russian data centers linked to a sharp decline in Yandex bot traffic. AI reverse engineering takes center stage as the team explores game recreations, commercial software clones, Linux vulnerability discovery, and the changing economics of software. They also examine AI-powered threat hunting and deception, a cyberattack on French supermarket refrigeration, fake Claude Code installers, and a controversial critique of passkeys. The episode closes with a preview of questions about AI-generated mathematics and encryption security. Join us LIVE on Mondays, 4:30pm EST. A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team. https://www.youtube.com/@BlackHillsInformationSecurity Chat with us on Discord! - https://discord.gg/bhis 🔴live-chat Chapters (00:00) - PreShow Banter™ — Less Boty on the Internet (08:10) - Russian Data Centers Bombed - 2026-10-12 (11:05) - MonsterCloud’s Ransomware Decryption Fraud (15:24) - Canadian Cybersecurity Executive Arrested in Ransomware Case (19:15) - Russian Data Center Strikes and the Drop in Yandex Bot Traffic (24:41) - Drone Threats Prompt B-1 Bomber Withdrawal from the UK (27:22) - AI Reverse Engineers PlayStation 2 Games (28:45) - AI Software Recreations and Linux Zero-Day Discovery (57:22) - Kip Boyle’s “Owning AI Risk” Training and Discount Code (01:00:36) - Cyberattack Disrupts French Supermarket Refrigeration (01:03:17) - ClickFix Campaigns Use Fake Claude Code Installers (01:05:32) - Kip Boyle’s New Book: Gears Don’t Guess (01:07:08) - “Passkeys Are a Trap”: Examining a Controversial Article (01:08:11) - AI Math Breakthroughs and Potential Encryption Risks (01:09:48) - Ashley’s October 28 Webcast: Using AI for Research and Learning (01:13:13) - BHIS Penetration Testing and Incident Response Services (01:14:22) - Bronwen's Proposed Local LLM Workshop Links Publix Hurricane cakes are a long-standing tradition of hurricanes Storm passes as Publix discontinues controversial hurricane cakes MonsterCloud’s Ransomware Decryption Fraud Canadian Cybersecurity Executive Arrested in Ransomware Case Russian Data Center Strikes and the Drop in Yandex Bot Traffic Drone Threats Prompt B-1 Bomber Withdrawal from the UK AI Reverse Engineers Classic Games AI Software Recreations and Linux Zero-Day Discovery Kip Boyle’s “Owning AI Risk” Training and Discount Code Cyberattack Disrupts French Supermarket Refrigeration ClickFix Campaigns Use Fake Claude Code Installers Kip Boyle’s New Book: Gears Don’t Guess “Passkeys Are a Trap”: Examining a Controversial Article AI Math Breakthroughs and Potential Encryption Risks Ashley’s October 28 Webcast: Using AI for Research and LearningWWHF Mile High Conference 2027 Creators & Guests Kip Boyle - Guest Ashley Knowles - Guest John Strand - Host Ralph May - Host Wade Wells - Host Ryan Poirier - Producer Corey Ham - Host Bronwen Aker - Host Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com

Recorded live at Wild West Hackin’ Fest, the BHIS crew debates AI agent sandbox escapes, OpenAI’s frontier model decisions, and accountability for the Hugging Face hack. Other stories include the dismissal of OpenAI safety researchers, the FBI–Accenture breach, ShinyHunters arrests, Oracle’s medical records breach, and recurring Citrix vulnerabilities. The panel explores corporate scapegoating, stolen authentication tokens, patching challenges, and Anthropic’s expanding cybersecurity access—asking who takes responsibility when security controls fail. Join us LIVE on Mondays, 4:30pm EST. A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team. https://www.youtube.com/@BlackHillsInformationSecurity Chat with us on Discord! - https://discord.gg/bhis 🔴live-chat Chapters (00:00) - Live From WWHF Deadwood '26 - 2026-10-07 (01:13) - OpenAI’s Frontier Model Pause and AI Sandbox Escapes (05:42) - OpenAI Dismisses Three Safety Researchers (07:20) - FBI–Accenture Breach and Blaming Individual Employees (09:33) - Oracle’s Medical Records Breach and Cloud Responsibility (11:12) - ShinyHunters Arrests and the FBI Breach (16:54) - Critical Citrix Vulnerabilities and Incomplete Patches (19:28) - Selling Stolen VPN Access and Authentication Tokens (22:49) - Anthropic Expands Its Cyber Verification Program (27:23) - Lawsuit Over the Hugging Face Hack and AI Accountability Links OpenAI’s Frontier Model Pause and AI Sandbox Escapes OpenAI Dismisses Three Safety Researchers FBI–Accenture Breach and Blaming Individual Employees Oracle’s Medical Records Breach and Cloud Responsibility ShinyHunters Arrests and the FBI Breach Critical Citrix Vulnerabilities and Incomplete Patches Anthropic Expands Its Cyber Verification Program Lawsuit Over the Hugging Face Hack and AI Accountability Creators & Guests Jake Williams - Guest John Strand - Host Ralph May - Host Bronwen Aker - Host Andy Pettit "Nerf" - Guest Corey Ham - Host Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com

This week, the BHIS crew starts with an Nvidia-branded trailer stolen for its presumed GPUs—only to turn out to be full of sand. They then examine reports of OpenAI agents accessing Australian and U.S. government sites, the unanswered questions about what happened, and Nvidia’s proposed agent safety framework. The conversation moves to the EvilTokens phishing service takedown, recent vulnerability patches, and prompt injection attacks against AI agents handling Salesforce contact forms. The episode closes with a reported F-35 component shipment rerouted to China and concerns about cyber incidents affecting ships and maritime systems. Join us LIVE on Mondays, 4:30pm EST. A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team. https://www.youtube.com/@BlackHillsInformationSecurity Chat with us on Discord! - https://discord.gg/bhis 🔴live-chat Chapters (00:00) - PreShow Banter™ — Doing Bulldozer Stuff (09:05) - AI Agents Go Rogue: Where’s the Accountability? 2026-09-28 (12:16) - Nvidia-branded trailer stolen—and found full of sand (15:09) - OpenAI agents access Australian and U.S. government sites (30:55) - Nvidia’s OpenShell agent safety framework (37:06) - EvilTokens phishing service disrupted (46:16) - Citrix, WordPress, F5, and Roundcube vulnerability roundup (47:27) - Prompt injection through Salesforce web-to-lead forms (52:45) - F-35 components reportedly rerouted to China (55:20) - LNG tanker incident and maritime OT security (59:52) - Wild West Hackin’ Fest Deadwood and upcoming classes (01:01:00) - Offense for Defense and penetration testing classes (01:01:47) - Android pentesting and satellite security classes (01:03:26) - DEATHCon: detection engineering and threat hunting (01:06:58) - On Logos and Cables LinksCreators & Guests Tim Medin - Guest Kent Ickler - Guest John Strand - Host Ralph May - Host Wade Wells - Host Corey Ham - Host Hayden Covington - Host Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com

This week, the crew examines Google’s reported Gemini containment failure, Anthropic’s new biology lab, Snickers-branded prompt injection, AI-assisted social engineering, and Claude’s access to financial data. They also cover major Linux, Cisco, Check Point, and Docker vulnerabilities; weak oversight of Flock surveillance searches; privacy concerns surrounding Waymo vehicles; continuing ransomware disruption at an Australian chicken producer; and the escalating conflict between ShinyHunters and Clop. Join us LIVE on Mondays, 4:30pm EST. A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team. https://www.youtube.com/@BlackHillsInformationSecurity Chat with us on Discord! - https://discord.gg/bhis 🔴live-chat Chapters (00:00) - PreShow Banter™ — Justifying Our Existence (03:27) - Google’s Gemini Agent Escapes Containment - 2026-09-21 (06:45) - Google’s Gemini Hacks 3 Real Companies During Test (10:05) - Anthropic Builds a Bay Area Biology Lab (13:22) - Snickers Turns Prompt Injection into an Ad Campaign (19:41) - Iranian Social Engineering Uses Fake MRI Scans (25:10) - Claude Requests Access to Financial Accounts (28:50) - Meta’s Agentic AI and Its Personal-Data Advantage (30:57) - OpenAI Introduces In-Platform Advertising (34:47) - Linux Local Privilege-Escalation Vulnerabilities (35:32) - Cisco Secure Email Gateway Exploited by Nation-States (37:28) - Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root (37:53) - Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files (38:27) - CISA Ends Its Weekly Cybersecurity Bulletin (40:53) - Flock Surveillance Searches and Weak Oversight (49:10) - Waymo Detects a Firearm and Calls Police (57:40) - Upcoming Events, Workshops, and Training (57:51) - Alethe's Physical-Assessment Training (59:02) - Andy’s XDRCLI Talk at Wild West Hackin’ Fest (59:52) - Jake’s Hands-On AI Risk-Assessment Training (01:01:27) - Wade’s San Diego AI-Detection Event (01:03:00) - Ransomware Continues Disrupting an Australian Chicken Producer (01:05:34) - ShinyHunters Compromises Clop’s Dark-Web Site Links Google’s Gemini Hacks 3 Real Companies During Test Anthropic Builds a Bay Area Biology Lab Snickers Turns Prompt Injection into an Ad Campaign https://www.snickers.com/digitalsnickers Iranian Social Engineering Uses Fake MRI Scans Claude Requests Access to Financial AccountsOpenAI Introduces In-Platform Advertising Linux Local Privilege-Escalation Vulnerabilities Cisco Secure Email Gateway Exploited by Nation-States Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files CISA Ends Its Weekly Cybersecurity Bulletin Flock Surveillance Searches and Weak Oversight Waymo Detects a Firearm and Calls Police Alethe’s Physical-Assessment Training Andy’s XDRCLI Talk at Wild West Hackin’ Fest Jake’s Hands-On AI Risk-Assessment Training Wade’s San Diego AI-Detection Event Ransomware Continues Disrupting an Australian Chicken Producer ShinyHunters Compromises Clop’s Dark-Web Site Creators & Guests Alethe Denis - Guest Corey Ham - Host Andy Pettit "Nerf" - Guest Wade Wells - Host Bronwen Aker - Host Ryan Poirier - Producer Jake Williams - Guest Click here to watch this episode on YouTube. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com