Security Weekly Podcast Network (Audio) Security Weekly Podcast Network (Audio)

Vulnpocalypse Continues Until Defense Improves - PSW #950

Oct 29, 2026 · 2h 8m

Summary

Episode 950 of Paul's Security Weekly covers a packed news week, including the "math apocalypse" where AI solved 372 math problems and identified the origin of a mysterious NIST elliptic curve parameter. The hosts also discuss the long-term impact of the Emudra TLS vulnerability on unpatchable IoT devices, a new UEFI bootkit exploiting secure boot, and a critical Pixie Boot vulnerability. Additionally, the episode addresses DHS banning DeepSeek, AI agents writing riskier code for U.S. contractors, and how AI is reshaping roles in SOC and penetration testing.

Topics discussed

Intro: Cisco patching, AI refusals, and Bratley vulnerabilities Show introduction and host welcome Nation-state actors and compliance gaps AI discovering NSA cryptographic backdoors Math community reaction to AI findings NSA cryptography history and random number generators Speculation on 90s RNG standards Clarifying cryptographic parameter lengths Long-tail impact on IoT and network appliances Device trust roots and certificate management Post-quantum cryptography and device upgrades PHP server scan results and device focus Device integrity and root of trust discussion Network segmentation and access control for devices MQTT monitoring tools and capabilities AI vulnerabilities and terminology corrections Microsoft certificate detection logic complexity Malware exploiting incomplete mitigation updates Risk-based decisions on pre-OS infections Signed drivers and UEFI exploitation vectors UEFI vulnerability landscape and boot kits Pixie Boot ICMP vulnerability disclosure UEFI customization and exploit tuning challenges UEFI hardening and network restrictions DHS ban on DeepSeek for federal use Open-source Chinese AI models in US companies Local AI models for exploit validation AI replacing middle managers and decision support Impact of AI on pen testing jobs Necessity of expert-level AI skills in security Defining AI tool requirements AI decision quality and prompting improvements Prompting tips: asking AI to clarify decisions Anecdote: Peanut butter sandwich instructions Adding variation to AI outputs AI interaction analogies: fishing and teaching Multi-agent systems to prevent context tunnel vision Mitigating AI bias and blinders LLMs enabling large-scale formal verification AI discovering bugs during new feature creation Vibe-coded UIs and bug discovery Guaranteeing bug-free software via formal methods New philosophy of code scanning for bugs Impact of AI on secure development education Prioritizing AI tools over manual coding skills Auditing AI hallucinations and improving accuracy PHP to Shell on internet-facing firewalls Using AI to identify affected firewall vendors Defining hunting requirements for PHP shells List of affected firewall and network vendors Data freshness and vendor vulnerability status Risk decision: patching vs. downtime Response strategies for PHP on network appliances Battle scars from managing WordPress and CMS Broccoli to Shell vulnerability naming Library vulnerabilities in Python and Node Bratley vulnerability fix and Samsung implementation React security and framework comparisons JWT usage and common misconfigurations Predictable JWTs in DICE device reference code Common JWT exploits and session handling LibHEIF library vulnerability pronunciation LibHEIF impact on WordPress and other apps Fortinet undisclosed vulnerabilities and patching Customer trust and operational risk in updates Attackers using AI to find vulnerabilities Threat actor strategies for Fortinet persistence Nation-state front companies for software access Game theory of access vs. resilience Reverse engineering exploits from limited info Cisco live patching and kernel access Selling patching time and Cisco-specific limits Realistic patch management and hosted GitLab Privilege escalation and monitoring access trust Trust issues with Cisco as a PE firm Attacker vs. defender patching timelines WAFs as mitigation vs. permanent fix Pen testing around WAFs and auditor practices Authentication bypass vs. code execution Vendor solutions for their own vulnerabilities Customer ratios and article data verification AI refusal to explain vulnerable C function Heuristics for detecting AI refusal signals Using AI for vulnerability discovery Home improvement: Beer tap in electrical box Age anecdotes and kitchen renovation Family history: Cinder block gun safe Snowman hitting and concrete reconstruction Lego story: Wireless hacking gadgets HackerF Portapak and Mayhem device features Travel kit and scratched screen anecdote RTL SDR availability and stock issues Tariffs, supply chain, and LilyGo T-embeds Vendor giveaways and project comparisons CYD GBL display and ShmooCon presentations RXX Laura receiver and winding down topics Company failure to acknowledge security bugs PlayStation 5 jailbreak disclosure debacle Community backlash over burned zero-day GTA 6 update and jailbreak exposure timing Ethics of disclosing DRM bypasses Hacker motivations: IP theft vs. ransomware TVs using Bluetooth speakers as microphones Hacking TV firmware to disable features Cost trade-offs for cheap smart TVs HDMI content telemetry and privacy risks Collaborating on making TVs just displays Roku and Kindle Fire privacy questions
Listen ad-free on Castria

Episode summaries and topics are generated from the audio by Castria — a free podcast app that skips ads automatically. IP Geolocation by DB-IP