Agents, Train Robberies, Jazz, Microsoft, Elvis Gyrates, Aaran Leyland, and More - SWN #628
Summary
Security Weekly News episode 628 covers the active exploitation of critical PHP vulnerabilities and a University of Copenhagen data breach affecting 525,000 individuals. The show also discusses a new indirect prompt injection attack targeting AI agents via malicious Markdown files and a flaw in Microsoft Authenticator that allows Android apps to steal work tokens. Guest Aaron Lealand analyzes recent MFA bypass techniques and token spraying attacks, while the segment concludes with reports on highway thieves spoofing GPS to steal millions in data center cargo.
Topics discussed
Episode 628 Introduction and Halloween banter
PHP-to-Shell vulnerabilities and active exploitation
Sponsors: ThreatLocker and Network Security Summit
University of Copenhagen data breach and test environments
Indirect prompt injection via malicious Markdown files
Microsoft Authenticator flaw and MFA app fatigue
Management culture and bypassing security controls
Elvis copyright lawsuit against Anthropic
Meta's Muse agent and agentic AI risks
Aaron Leeland: MFA bypass and token spraying attack
GPS spoofing and data center cargo theft
Listen ad-free on Castria