Cybersecurity Today

Jim Love
  • 4.9 (72)
  • TECH NEWS
  • UPDATED DAILY

Updates on the latest cybersecurity threats to businesses, data breach disclosures, and how you can secure your firm in an increasingly risky time.

  1. 13 HRS AGO

    Agentic AI Security Is Broken and How To Fix It: Ido Shlomo, Co-founder and CTO of Token Security

    Jim Love discusses how rapid adoption of agentic AI is repeating the industry pattern of shipping technology without security, citing issues like vulnerabilities in Anthropic's MCP and insecure open-source agent tools. He interviews Ido Shlomo, co-founder and CTO of Token Security, who argues AI agents are fundamentally hard to secure because they are non-deterministic, have infinite input/output space, and often require broad permissions to be useful.  Cybersecurity Today  would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale.  You can find them at Meter.com/cst Shlomo proposes focusing security on access, identity, attribution, least privilege, and auditability rather than trying to filter prompts and outputs, and describes Token's "intent-based permission management" approach that maps agents and sub-agents as non-human identities tied to their purpose and allowed actions. The conversation covers real-world risks such as developer tools like Claude Code running with extensive access, widespread over-provisioning of admin permissions and API keys, exposure of unencrypted local token files, and misconfigurations that leak data publicly. Shlomo recommends organizations build governance processes for agents—discovery/inventory, boundary setting, continuous monitoring, and secure decommissioning—and says AI is needed to help police AI. He also highlights emerging trends like agent teams and multi-day autonomous tasks, and notes Token Security is a top-10 finalist in the RSA Innovation Sandbox 2026, planning to present an intent-and-access-focused security model for AI agents. 00:00 Sponsor: Meter's integrated networking stack 00:19 Why agentic AI security is breaking (MCP & open-source chaos) 02:53 Meet Token Security: practical guardrails for AI agents 04:57 Why you can't just ban agents at work (shadow AI reality) 06:24 Tel Aviv's cybersecurity pipeline: gaming, military, and startups 08:57 Why AI/agents are fundamentally hard to secure (new OS + 'human spirit') 13:44 Trust, autonomy, and permissions: managing the blast radius 18:17 Real-world exposure: Claude Code and the developer identity attack surface 20:16 A workable approach: treat agents as untrusted processes with identity + least privilege 22:33 Zero Trust for Agents: Access ≠ Permission to Act 23:27 Token's "Intent-Based Permission Management" Explained 25:29 Building the Identity Map: Tracing What Agents Touch 26:52 The Secret Sauce: Using AI to Secure AI in Real Time 28:10 Real-World Case: 1,500 Agents and Wildly Over-Provisioned Access 30:57 CUA 'Computer-Use' Agents: Exciting, Personal… and Terrifying 34:44 Secure-by-Default & Sandboxing: Fixing 'Always Allow' Dark Patterns 35:36 What Security Teams Should Do Now: Inventory, Boundaries, Governance 37:59 What's Next: Agent Teams and Multi-Day Autonomous Work 40:10 Tony Stark Vision: Agents That Improve the Human Experience 41:02 RSA Innovation Sandbox: Token's Big Bet on Intent + Access 43:01 Wrap-Up, Audience Q&A, and Sponsor Message

    45 min
  2. You Might Also Like: Science Will Win

    13 HRS AGO · BONUS

    You Might Also Like: Science Will Win

    Introducing The Alarming Rise of Early-Onset Cancers from Science Will Win. Follow the show: Science Will Win Why are more young adults getting cancer? That's one of the most pressing questions facing the scientific community today. Traditionally thought of as a disease that affects aging populations, recent data shows that cancer diagnoses for people under the age of 50 are increasing. To tackle this problem, it’ll take a global effort. In this episode you’ll hear from patients, oncologists, researchers and health care providers who are coming together to address this issue head on.  Featured guests: – Dr. Marshall Anthony Jr., social scientist and colorectal cancer patient – Dr. Johanna Bendell, Chief Development Officer of Oncology, Pfizer – Dr. Yin Cao, molecular cancer epidemiologist; Cao Lab leader, Washington University – Dr. Beatrice Dionigi, colorectal cancer surgeon; founder & co‑director, Early Onset Colon and Rectal Cancer Project, Columbia Research Cancer Center – Dr. Susan Zhang, Global Development Lead, Pfizer Oncology Dive into the episode here: 00:00 – A patient story reveals an alarming new trend 6:30 – The data behind the rise of early-onset cancer  10:39 – The global search for a cause   14:13 – The unique challenges facing young people with cancer  20:28 – Screening guidelines and what to expect from a colonoscopy   25:17 – The importance of early detection   27:59 – The conclusion of Marshall's cancer journey  30:23 – What's next, and closing thoughts  Check out our YouTube channel (@Pfizer) to watch the full interview with Raven & Dr. Marshall Anthony Jr. on his colorectal cancer journey. Season 6 of Science Will Win is created by Pfizer and hosted by Dr. Raven Baxter. It’s produced by Acast Creative Studios. Hosts in this podcast series were compensated for their time. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising. DISCLAIMER: Please note, this is an independent podcast episode not affiliated with, endorsed by, or produced in conjunction with the host podcast feed or any of its media entities. The views and opinions expressed in this episode are solely those of the creators and guests. For any concerns, please reach out to team@podroll.fm.

  3. 1D AGO

    CISA Orders Emergency Patch for Actively Exploited Dell Flaw;

    CISA Orders Emergency Patch for Actively Exploited Dell Flaw; Texas Sues TP-Link; Massive ID Verification Data Leak; SSA Database Leak Allegations Host Jim Love covers four cybersecurity stories:  Cybersecurity Today  would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale.  You can find them at Meter.com/cst CISA ordered federal civilian agencies to patch an actively exploited critical Dell RecoverPoint for Virtual Machines vulnerability (CVE-2026-2769) within three days, citing hard-coded credentials that allow unauthenticated root access and links to a China-aligned threat cluster; Texas Attorney General filed suit against TP-Link alleging deceptive security and origin claims and risks tied to Chinese state-linked threats, while TP-Link denies the allegations and says it operates independently, stores U.S. user data on AWS, and bases core operations in the U.S.; researchers found an unsecured MongoDB database tied to AI-powered identity verification provider ID Merit exposing nearly 1 billion records with sensitive personal data, attributed to misconfiguration rather than compromise of the AI systems; and a MarketWatch report describes whistleblower Chuck Borges alleging SSA master data was copied to a cloud environment without oversight, contrasted by the Social Security Commissioner stating the core Numident database remained secure, with Love noting no confirmed public evidence but expressing concern about the implications if such foundational data were compromised. 00:00 Sponsor Message: Meter's Full-Stack Networking 00:19 Headlines: Dell Exploit, TP-Link Lawsuit, Massive Data Leak, SSA Claims 00:45 Urgent Patch Order: Actively Exploited Dell RecoverPoint CVE 02:19 Texas Sues TP-Link Over Router Security & China-Ties Allegations 03:31 AI Identity Verification Leak: Nearly 1 Billion Records Exposed 05:07 Did SSA Data Leak? Whistleblower vs. Official Denial 06:54 Host Take: What If the "Foundational" Database Was Compromised? 07:37 Wrap-Up + Sponsor Thanks and Where to Book a Demo

    9 min

  4. 3D AGO

    OpenClaw: Info Stealers Take Your Soul

    Info Stealers Target OpenClaw, a Robot Vacuum API Flaw Exposes Thousands, Best Buy Fraud Shows Zero Trust Context, and Canada Goose Data Leaked via Supplier The episode covers multiple security incidents and lessons. Hudson Rock details how an info stealer malware infection can vacuum OpenClaw data, including authentication tokens, master keys, device private cryptographic keys, and the agent-defining soul.md file that can reveal a "mirror" of a user's life; the attack was not targeted, raising concerns about upcoming dedicated OpenClaw-stealing modules. A hobbyist coder using an AI coding tool to reverse-engineer DJI Romo communications unintentionally accessed roughly 7,000 robot vacuums in 24 countries, enabling live camera and microphone access and floor-plan generation due to missing messaging-level access controls; DJI also shares infrastructure with portable home battery stations and initially claimed the flaw was fixed before a live demonstration showed it was not. Two Best Buy cases illustrate that Zero Trust must consider behavior and context: a Florida employee allegedly used a manager override code 149 times from March–December 2024 to buy discounted electronics, costing about $120,000, while a Georgia case involved over $40,000 in merchandise leaving a store over two weeks amid claims of blackmail. Finally, ShinyHunters leaked about 600,000 Canada Goose customer records, but Canada Goose found no breach in its systems; the data was attributed to a third-party payment processor breach from August 2025, with records largely dating from 2021–2023, underscoring supply-chain risk and ongoing fraud/phishing potential. The episode is sponsored by Meter, which provides an integrated wired, wireless, and cellular networking stack for enterprises. 00:00 Sponsor: Meter + Today's Cybersecurity Headlines 00:44 Info-Stealer Jackpot: OpenClaw Tokens, Keys & 'soul.md' Exposed 03:17 DIY App, Real-World Disaster: 7,000 Robot Vacuums Exposed via DJI Servers 05:34 Best Buy Insider Fraud: Why Zero Trust Needs Behavior Monitoring 07:36 Canada Goose Leak: When a Third-Party Payment Processor Gets Breached 09:28 Wrap-Up + Sponsor Message (Meter)

    11 min

  5. 5D AGO

    BeyondTrust Zero-Day Exploited,

    This episode covers multiple active threats and security changes. It warns of an actively exploited critical BeyondTrust remote access vulnerability (CVE-2026-1731, CVSS 9.9) enabling pre-authentication remote code execution in Remote Support and Privileged Remote Access, noting SaaS was patched while on-prem deployments require urgent manual updates and may already be compromised. Microsoft details an evolution of the ClickFix social engineering technique where victims are tricked into running NSLookup commands that use attacker-controlled DNS responses as a malware staging channel, leading to payload delivery (including a Python-based RAT) and persistence via startup shortcuts, alongside increased Lumma Stealer activity.  Cybersecurity Today  would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale.  You can find them at Meter.com/cst Researchers also report Mac-focused campaigns abusing AI-generated content and malicious search ads to push copy-paste terminal commands that install an info stealer (MaxSync) targeting Keychain, browsers, and crypto wallets. T The show describes fake recruiter campaigns targeting developers with coding tests containing malicious dependencies on repositories like NPM and PyPI, linked to the "Gala" operation and nearly 200 packages. Finally, it reviews NPM's authentication overhaul after a supply-chain worm incident—revoking classic long-lived tokens, moving to short-lived session credentials, encouraging MFA and OIDC trusted publishing—while noting remaining risks such as MFA phishing, non-mandatory MFA for unpublish, and the continued ability to create long-lived tokens. 00:00 Sponsor: Meter + Today's Cybersecurity Headlines 00:48 Urgent Patch: BeyondTrust Remote Access RCE (CVE-2026-1731) Actively Exploited 02:45 ClickFix Evolves: DNS Lookups (nslookup) Used as Malware Staging 04:34 Mac Malware via AI Search Results: Fake Terminal Commands Deliver Info-Stealer 06:08 Fake Recruiters, Real Malware: Coding Tests Poison Dev Environments 07:19 NPM Security Overhaul After Supply-Chain Worm—What's Better, What Still Risks 09:11 Wrap-Up, Thanks, and Sponsor Message

    11 min

  6. 6D AGO

    The Dark Side of Valentine's Day: AI Romance Scams | Cybersecurity Today

    This special Valentine's Day episode of Cybersecurity Today examines romance scams (often called pig butchering) and how fraudsters exploit trust, vulnerability, and loneliness.  Host Jim Love speaks with McAfee Head of Threat Research Abhishek Karnik  about new findings showing the scale and demographics of these scams, including widespread encounters with fake or AI-generated profiles, frequent financial solicitations, and that men are also heavily impacted.  Cybersecurity Today  would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale.  You can find them at Meter.com/cst The episode features survivor Beth Highland's detailed account of being manipulated via Tinder through long-term messaging, an AI video call, forged documents, and a crypto payout scheme that led her to send about $26,000 via Bitcoin ATMs before her financial advisor—trained in romance fraud—helped her recognize the scam and stop further losses, including a demanded $50,000 "activation fee." Beth discusses emotional aftereffects, stigma, reporting, red flags, and her book, "Diary of a Romance Scam:  When Swiping Right Goes Wrong," along with her advocacy work. The conversation broadens to the role of AI in making scams more realistic (deepfakes, voice/video, document generation), the importance of privacy and not overposting, involving trusted family/advisors, institutional training and intervention points along the fraud "kill chain," and using technology and education to detect and reduce scams. LINKS  Beth Hyland's Book - Diary of a Romance Scam: When Swiping Right Goes Wrong https://www.amazon.com/Diary-Romance-Scam-Swiping-Right/dp/1662962843 00:00 Sponsor: Meter's all-in-one networking stack 00:18 Valentine's Day on the dark side: heartbreak meets cybercrime 02:15 Romance scams ("pig butchering") are everywhere—who gets targeted 04:15 McAfee research: fake profiles, AI, and the real victim demographics 07:07 How scammers hook you: profiling, psychology, and long-game manipulation 09:01 Beth's story begins: post-divorce, isolation, and trying Tinder 10:36 The perfect match: mirroring, fast intimacy, and early red flags 14:32 AI video call + the push-pull breakup: emotional control tactics 17:09 The money trap: Qatar story, bank access, and Bitcoin ATM payments 23:34 The $50K "activation fee" and the wake-up call from a financial advisor 26:25 Cutting him off—and getting pulled back in by guilt and gaslighting 30:18 How to help victims: listening, tools, and where to get support 33:17 Turning pain into purpose: Beth's book and grieving a romance scam 34:47 Turning Pain Into Purpose: Supporting Romance-Scam Survivors 35:56 Stop Blaming Victims: Changing the Language Around Scams 38:38 "It Can Happen to Anybody": Why Smart People Get Hooked 40:58 Social Engineering 101: How Scams Exploit Different Emotions 42:14 Why McAfee Is Focusing on Consumer Scams (and the AI Factor) 45:43 AI Deepfakes & Low-Cost Tools: The New Scam Industrialization 49:19 Oversharing, Spearphishing & Replay Attacks: How Victims Get Retargeted 53:24 Practical Red Flags: Meeting in Person, Isolation Tactics, Family Checks 57:08 Training the "Kill Chain": Banks, Cashiers, Advisors & Early Intervention 01:00:33 Tech Fighting Tech: Detection, Identity Protection & Digital Assistants 01:02:57 What's Next: Agentic AI, Bigger Attack Surfaces & Trust-and-Safety by Design 01:08:03 Wrap-Up: Start the Conversation, Resources, and Final Thanks

    1h 10m

  7. FEB 14

    The Dark Side of Valentine's Day: AI Romance Scams | Cybersecurity Today

    This special Valentine's Day episode of Cybersecurity Today examines romance scams (often called pig butchering) and how fraudsters exploit trust, vulnerability, and loneliness.  Host Jim Love speaks with McAfee Head of Threat Research Abhishek Karnik  about new findings showing the scale and demographics of these scams, including widespread encounters with fake or AI-generated profiles, frequent financial solicitations, and that men are also heavily impacted.  Cybersecurity Today  would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale.  You can find them at Meter.com/cst The episode features survivor Beth Highland's detailed account of being manipulated via Tinder through long-term messaging, an AI video call, forged documents, and a crypto payout scheme that led her to send about $26,000 via Bitcoin ATMs before her financial advisor—trained in romance fraud—helped her recognize the scam and stop further losses, including a demanded $50,000 "activation fee." Beth discusses emotional aftereffects, stigma, reporting, red flags, and her book, "Diary of a Romance Scam:  When Swiping Right Goes Wrong," along with her advocacy work. The conversation broadens to the role of AI in making scams more realistic (deepfakes, voice/video, document generation), the importance of privacy and not overposting, involving trusted family/advisors, institutional training and intervention points along the fraud "kill chain," and using technology and education to detect and reduce scams. LINKS  Beth Hyland's Book - Diary of a Romance Scam: When Swiping Right Goes Wrong https://www.amazon.com/Diary-Romance-Scam-Swiping-Right/dp/1662962843 00:00 Sponsor: Meter's all-in-one networking stack 00:18 Valentine's Day on the dark side: heartbreak meets cybercrime 02:15 Romance scams ("pig butchering") are everywhere—who gets targeted 04:15 McAfee research: fake profiles, AI, and the real victim demographics 07:07 How scammers hook you: profiling, psychology, and long-game manipulation 09:01 Beth's story begins: post-divorce, isolation, and trying Tinder 10:36 The perfect match: mirroring, fast intimacy, and early red flags 14:32 AI video call + the push-pull breakup: emotional control tactics 17:09 The money trap: Qatar story, bank access, and Bitcoin ATM payments 23:34 The $50K "activation fee" and the wake-up call from a financial advisor 26:25 Cutting him off—and getting pulled back in by guilt and gaslighting 30:18 How to help victims: listening, tools, and where to get support 33:17 Turning pain into purpose: Beth's book and grieving a romance scam 34:47 Turning Pain Into Purpose: Supporting Romance-Scam Survivors 35:56 Stop Blaming Victims: Changing the Language Around Scams 38:38 "It Can Happen to Anybody": Why Smart People Get Hooked 40:58 Social Engineering 101: How Scams Exploit Different Emotions 42:14 Why McAfee Is Focusing on Consumer Scams (and the AI Factor) 45:43 AI Deepfakes & Low-Cost Tools: The New Scam Industrialization 49:19 Oversharing, Spearphishing & Replay Attacks: How Victims Get Retargeted 53:24 Practical Red Flags: Meeting in Person, Isolation Tactics, Family Checks 57:08 Training the "Kill Chain": Banks, Cashiers, Advisors & Early Intervention 01:00:33 Tech Fighting Tech: Detection, Identity Protection & Digital Assistants 01:02:57 What's Next: Agentic AI, Bigger Attack Surfaces & Trust-and-Safety by Design 01:08:03 Wrap-Up: Start the Conversation, Resources, and Final Thanks

    1h 10m

  8. FEB 13

    Exploited Microsoft Vulnerabilities, Phishing Tactics & Romance Scams: Cybersecurity Today

    In this episode of Cybersecurity Today with host Jim Love, we discuss six critical exploited Microsoft vulnerabilities, new phishing tactics using your own servers, and a zero-click vulnerability in Claude's code desktop extensions. We also explore trends in modern romance scams highlighting the younger, tech-savvy adult targets. Tune in for expert insights and practical tips to stay secure. Special thanks to Meter for their support. Hashtag Trending would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at Meter.com/htt 00:00 Introduction and Sponsor Message 00:45 Microsoft Vulnerabilities: A Growing Concern 02:38 Phishing Attacks Using Your Own Servers 04:16 Zero-Click Vulnerability in Claude AI 06:25 Romance Scams: Not Just Targeting the Elderly 09:14 Conclusion and Weekend Edition Teaser

    10 min
See All (106)

Hosts & Guests

4.9
out of 5
72 Ratings

About

Updates on the latest cybersecurity threats to businesses, data breach disclosures, and how you can secure your firm in an increasingly risky time.

Information

You Might Also Like