Breach Please

Breach Please Team

Cybersecurity has a nonsense problem. Vendors overpromise, headlines overhype, and half the "experts" in your feed have never actually responded to an incident at 3 a.m. Breach Please is the antidote — cybersecurity news, analysis, and unfiltered commentary from two people who have actually done the work: breaking into networks, defending them, and cleaning up after the breaches everyone else only tweets about. Every episode, Jake Williams and Jess Hebenstreit break down the stories that matter, call out the nonsense that doesn't, and translate the never-ending chaos into something you can actually use — whether you're in the SOC, the boardroom, or somewhere pretending to understand both. No fear-mongering. No vendor scripts. No "synergizing our threat posture." Just two seasoned practitioners, the news that matters, and the takes your CISO wishes they could say out loud. Breach? Please. Pull up a chair.

  1. 7 hr ago

    S0:E68: Alpine's SSH 'Starshole' Bug and Rails' SVG Code-Execution Flaw w/ Richy

    Jake is on the beach in Miami and Richy's filling in for Jess again - and they're digging into two vulnerabilities that actually matter this week. First: OpenSSH's emergency patch for an SSH authentication bypass in Alpine Linux's sshd, nicknamed "Starshole." It takes four separate misconfigurations lining up before it's exploitable - Jake and Richy break down why that makes it more of a fire-drill-worthy test of your container resilience than a five-alarm fire, and why embedded/OpenWRT-based appliances are the bigger worry than enterprise containers. Then: a 9.8-severity flaw in Ruby on Rails + ImageMagick that lets a malicious SVG file upload turn into remote code execution - because an SVG isn't really an image, it's a set of drawing instructions (and ImageMagick's MSL scripting language can be hijacked). They talk through why allow-listing file types, not block-listing, should have caught this from the start. Plus: budgeting-season war stories (bronze/silver/gold package tricks), and why Jake thinks "vulnerability prioritization" needs to become "vulnerability operations." Sources: The Hacker News (OpenSSH "Starshole" Alpine sshd bypass): https://thehackernews.com/2026/11/openssh-issues-emergency-fix-for-flaw.html?m=1 The Hacker News (Rails + ImageMagick SVG upload RCE): https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html Join the conversation on Discord: https://discord.gg/wYJnTpczV #cybersecurity #vulnerabilitymanagement #infosec #openssh #rubyonrails

  2. 1 day ago

    S0:E67: France's Blood Bank Hack, the AI Bubble, and Cybersecurity's Player-Coach Problem

    Richy fills in for Jess (on vacation) as Jake and Richy dig into a wave of refrigeration-system attacks in France that have moved from spoiling supermarket food to spoiling blood bank supplies -- and ask why critical cold-chain systems are still sitting exposed on the internet. From there: whether the CHIPS Act did enough to hedge a Taiwan-invasion scenario, whether we're in an AI bubble (and why cheap tokens might push companies back on-prem), the case for cybersecurity's "player coach" role, why politics and cybersecurity can't actually be separated, and a round of real AI-hallucination near-misses that could have gone very wrong without a human expert checking the work. Topics discussed: - French refrigeration/blood-bank cyberattacks and cold-chain security - The CHIPS Act and the Taiwan chip-supply risk - The AI bubble and the economics of running local LLMs - Cybersecurity's "player coach" staffing model - Why technology -- and cybersecurity -- is inherently political - Real-world AI hallucination near-misses in IT and security work Breach Please is a production of and copyright of JWGH Media, all rights reserved. The opinions of our hosts are their own and don't represent their employers, clients, or official positions. None of this is legal, financial, or security advice. Sources: Reuters: https://www.reuters.com/business/healthcare-pharmaceuticals/several-french-blood-banks-hit-by-cyberattack-nov-2-health-ministry-says-2026-11-04/ https://discord.gg/wYJnTpczV

  3. 2 days ago

    S0:E66: Binance's AI Agent Got Hijacked — Plus North Korea's Fake Job Interview Malware w/ Richy

    A gang reportedly used a fake North Korean-style job interview to plant malicious software on two Binance engineers' computers — and walked away with enough that the exchange had to reimburse 90% of the stolen wallets out of its own reserve fund. Jess is out this week (and for a few more), so Richy's back in the chair with Jake to dig into the New York Times' Binance postmortem: how threat attribution actually works when everyone's pointing at North Korea, why Binance's own SAFU fund raises more questions than it answers, and whether an AI tool was the privilege-escalation step that got attackers onto a developer's machine. Then: North Korea's classic fake-job-interview malware playbook, why 'if it sounds too good to be true, it is' still works on smart people, and why almost nobody is seriously testing their AI agents for prompt injection yet. Did we make you smarter? Tell a friend. Did we make you mad? Tell your CISO. Sources: Binance hack postmortem (New York Times): https://www.nytimes.com/2026/11/03/technology/binance-hack-report.html join our discord: https://discord.gg/wYJnTpczV

  4. 3 days ago

    S0:E65: Ransomware Gang Offers Refunds? + NTLM Relay Attacks w/ Guest Logan Diomedi

    A ransomware gang hit the only level-one trauma center in New Mexico — then tried to buy goodwill by offering victims $2,500 each out of pocket. Jess and Jake break down why "ransomware" and "extortion" aren't the same thing, what this unprecedented payback move might really be covering (hint: crypto laundering), and why this threat group's rebrand should worry you more than its ransom notes. Then: Logan Diomedi — penetration tester, red teamer, and creator of the NTLM relay auditing tool RelayKing — joins the show straight from Wild West Hackin' Fest. Logan walks through how Microsoft downplayed a critical NTLM reflection vulnerability (CVE-2025-33073), why coordinated disclosure keeps failing researchers, how AI-generated "this CVE doesn't exist" bot replies are poisoning bug bounty programs, and how RelayKing helps blue teams actually prove their GPO fixes stuck — instead of just hoping they did. Did we make you smarter? Tell a friend. Did we make you mad? Tell the ransomware gang that gave refunds. https://discord.gg/wYJnTpczV DRAFT HASHTAGS #CyberSecurity #InfoSec #Ransomware #NTLM #ActiveDirectory #RedTeam #BlueTeam #BugBounty #Podcast #BreachPlease

  5. 4 days ago

    S0:E64: Claude's New Snitch Mode & Japan's Cyber Attack Surge

    Anthropic just gave corporate IT a tattletale button for Claude — and it's being sold as a productivity feature. Jess and Jake break down Claude's new enterprise 'smart reports,' which let managers see team-wide prompts, spend, and even flag 'personal or off-topic' usage — and why turning this on without legal, HR, and privacy involved is an instant liability trap (Title VII protected classes, EU employee-monitoring law, minimum-group-size de-anonymization problems, and the Accenture $29/month token-budget story that kicked off the whole AI-spend reckoning). Then: a real surge in cyberattacks hitting Japanese organizations — a 44-agent automated hacking campaign, Trend Micro's numbers (19 orgs hit, 16 in Japan), El Kentaro's incident-tracking dashboard, and a theory about Japan's older median age as a contributing factor. Did we make you smarter? Tell a friend. Did we make you mad? Tell Anthropic. Sources: El Kentaro Incident Dashboard: https://elkentaro.github.io/jp_incidents/ Japan Cyber Attack (TechCrunch): https://techcrunch.com/2026/10/27/japan-internet-giant-gmo-says-hackers-posted-stolen-customer-data/ Anthropic Smart Reports: https://claude.com/resources/articles/smart-reports-surveys-pooled-budgets https://discord.gg/wYJnTpczV

  6. 4 days ago

    S0:E63: Pentagon's AI Access Scandal — Plus a Backdoored Claude Code Extension

    Richy fills in for Jess this episode, and Jake Williams digs into a Pentagon AI access story straight out of Wired: an Accenture contractor apparently ran a personal Claude account against NIPRNet, raising hard questions about shadow AI, token-budget pressure, and whether anyone would even notice the traffic. Richy and Jake also break down a backdoored VS Code extension — the official Claude Code connector for Cursor — that quietly opened port 22 and installed an attacker-controlled SSH key, no malicious behavior required to get burned. Then: an update on DDoS Secrets' 'Ice Pick' leak. After the site got flooded with DHS/ICE personnel searching their own names, the US government leaned on a UK-based domain registrar through a takedown firm — and got the site pulled within hours, despite the hosting and DNS infrastructure sitting outside US jurisdiction. Richy and Jake walk through how domain takedowns actually work, and why that speed should worry anyone who assumes jurisdiction will protect them. Topics covered: - Accenture contractor's personal Claude account allegedly used on the Pentagon's NIPRNet - Why shrinking AI token budgets create a perverse incentive toward shadow AI - A backdoored official Claude Code VS Code extension that opened port 22 - Why EDR alone won't catch this class of extension-based compromise - DDoS Secrets' 'Ice Pick' leak: the domain-takedown saga and multi-jurisdictional pressure - How TLD registries (NICs) can kill DNS resolution outright, bypassing your registrar entirely Join our Discord: https://discord.gg/wYJnTpczV

  7. 29 Oct

    S0:E62: ICE Agents Doxxed in 'Ice Pick' Leak — Plus Pentagon's Freezer Hack Mystery

    Jake Williams and Jess Hebenstreit cover two very different flavors of exposed infrastructure. First: freezer failures at five or six US military commissaries (including Fort Huachuca) that the Pentagon is now calling a possible cyber attack, echoing a similar incident at French grocery stores. Jake and Jess dig into why the victimology makes sense regardless of attribution — operational technology connected to the internet without proper security is going to get found, whether it's a grocery store or a government commissary. Then: DDoS Secrets published 'Ice Pick,' a leak exposing personal and organizational details on ICE and CBP personnel. Jake walks through why this looks like a basic Active Directory/Okta reconnaissance dump rather than a sophisticated breach, why that should worry every enterprise sitting on old AD exports and database dumps, and the case for why this particular disclosure isn't really 'doxxing' in the traditional sense. They also cover Blue Sky's inconsistent blocking of click-throughs to the leak — a new and strange form of platform-level censorship. Topics covered: - Pentagon commissary freezer failures at multiple US bases, and whether it's really a cyber attack - Why exposed building-management and OT systems keep getting hit, and how to find yours - DDoS Secrets' 'Ice Pick' leak of ICE/CBP personnel data, and why it looks like an AD/Okta dump - Is this doxxing? The debate over public-servant data and FOIA - Blue Sky's selective blocking of the Ice Pick link - Enterprise lessons: protecting AD/NTDS.dit backups, DLP basics, and extra monitoring for new and seasonal employees Sources: Pentagon freezer failures (Reuters): https://www.reuters.com/technology/pentagon-treating-military-base-freezer-malfunctions-suspected-cyberattack-2026-10-29/ Ice Pick leak (Wired): https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/ Join our Discord: https://discord.gg/wYJnTpczV

  8. 28 Oct

    S0:E61: Palo Alto Retracts Its PHP Claim — Did an AI Model Phone Home to China?

    Jake Williams and Jess Hebenstreit cover a fast-moving correction: days after Unit 42 reported active exploitation of two critical PHP vulnerabilities, Palo Alto retracted the claim, acknowledging they couldn't tie the compromise they saw back to those specific CVEs. Jake and Jess break down why a retraction like this is a sign of a higher-quality threat intel source, not a black eye — and why real-world PHP exploitation is still very much happening, as proven by a public Bitcoin bounty challenge that fell in under 20 hours. Along the way, Jake uses his post-office-box analogy to explain Address Space Layout Randomization (ASLR) and why the attackers' bypass technique was genuinely novel. Then they dig into Cohere's claim that Alibaba's Qwen 3.8 model generated a command that tried to send data back to an Alibaba-controlled endpoint during a security test — and debate whether that's a real backdoor, a conflict-of-interest publicity stunt, or something in between. They cover how AI guardrails get 'obliterated' out of open-weight models, why chain-of-thought monitoring didn't catch this one, and the practical defenses (sandboxing, DNS blackholing, pro-code guardrails) security teams should actually be running. Topics covered: - Palo Alto/Unit 42's retraction of their PHP exploitation report, and why retracting builds credibility rather than costing it - The public Bitcoin bounty challenge that proved PHP exploitation is real, regardless of the retraction - ASLR explained with Jake's post-office-box analogy, and why the Bitcoin Challenge's ASLR bypass was novel - Cohere's report that Alibaba's Qwen 3.8 model generated a callback to an Alibaba endpoint during testing - How AI model guardrails get 'obliterated,' and why that doesn't make open-weight models inherently dangerous - Why LLMs keep ignoring prompt-based guardrails, and the sandboxing/DNS/pro-code defenses that actually work Join our Discord: https://discord.gg/wYJnTpczV

See All (69)

About

Cybersecurity has a nonsense problem. Vendors overpromise, headlines overhype, and half the "experts" in your feed have never actually responded to an incident at 3 a.m. Breach Please is the antidote — cybersecurity news, analysis, and unfiltered commentary from two people who have actually done the work: breaking into networks, defending them, and cleaning up after the breaches everyone else only tweets about. Every episode, Jake Williams and Jess Hebenstreit break down the stories that matter, call out the nonsense that doesn't, and translate the never-ending chaos into something you can actually use — whether you're in the SOC, the boardroom, or somewhere pretending to understand both. No fear-mongering. No vendor scripts. No "synergizing our threat posture." Just two seasoned practitioners, the news that matters, and the takes your CISO wishes they could say out loud. Breach? Please. Pull up a chair.

Information

  • Creator
    Breach Please Team
  • Years Active
    2026
  • Episodes
    69
  • Rating
    Explicit
  • Copyright
    © Copyright JWJH Media LLC
  • Show Website
    Breach Please
  • Provider

You Might Also Like