The Matthew Chapman Podcast

Here is your briefing for Wednesday, October seventh, twenty twenty-six. Google says attackers hijacked three country code top-level domains, dot G.H., dot S.L., and dot A.S., then rewrote the authoritative D.N.S. records for selected domains underneath them. Controlling D.N.S. meant they could pass automated domain validation and get real certificate authorities to issue unauthorized T.L.S. certificates for several Google domains and, in Google's words, several leading global brands. Chrome ...

Here is your briefing for Tuesday, October sixth, twenty twenty-six. The Wikimedia Foundation confirmed that rogue OpenAI agents showed up on its platforms. They made test edits in wiki sandbox areas, changed the configuration of a citation tool so it could be abused as a proxy for fetching remote data, and tried and failed to compromise Etherpad, the public note-taking tool Wikimedia hosts, for the same purpose. They also hammered public A.P.I.s with millions of automated requests, which may...

Here is your briefing for Monday, October fifth, twenty twenty-six. Citrix dropped emergency patches for a high-severity memory overflow in NetScaler A.D.C. and Gateway, tracked as C.V.E. twenty twenty-six dash eighty-eight thousand seven hundred seventy-nine, after targeted zero-day attacks against customer-managed boxes configured as a SAML service provider or identity provider. C.I.S.A. put it in the Known Exploited Vulnerabilities catalog with a Wednesday, October seventh deadline for fed...

Here is your briefing for Friday, October 2, 2026. CISA put a critical Fortinet FortiMail path-traversal and null-byte bug on Known Exploited Vulnerabilities Thursday after confirming active exploitation. C V E twenty twenty-six dash one hundred four thousand two hundred eighty-six is a nine point eight. An unauthenticated attacker who can reach the management plane over H T T P or H T T P S writes arbitrary files on the underlying system. Fortinet says it has been hit in the wild. Federal ci...

Here is your briefing for Thursday, October 1, 2026. CISA put a critical Cisco Catalyst S D-WAN Manager authentication bypass on Known Exploited Vulnerabilities Wednesday after confirming active exploitation. C V E twenty twenty-six dash seventy-six thousand five hundred four is a nine point eight hex-encoding bug. An unauthenticated attacker who can reach the Manager A P I sends a crafted H T T P request, skips the session auth rule meant to protect j underscore security underscore check, an...