YusufOnSecurity.com

YusufOnSecurity.Com
  • 0,0 (0)
  • Technologie
  • Wekelijks bijgewerkt

This is a weekly podcast on cyber security domains. We discuss, dissect and demystify the world of security by providing an in-depth coverage on the cybersecurity topics that matter most. All these in plain easy to understand language. Like it, share it, and most importantly enjoy it!

  1. 30 mei

    278 - Non-Human Identity Explained - The Invisible Accounts Outnumbering Your Staff

    Enjoying the content? Let us know your feedback! Let me start with a question that sounds simple but isn't. How many identities are on your network? Most people, if you ask them, will reach for the staff headcount. "We've got five hundred employees, so… five hundred logins-ish?" And they'd be wrong. Often wildly wrong. Because on a modern cloud network, the humans are the minority. For every one of your employees there can be ten, fifty, sometimes a hundred or more other identities — and not one of them is a person. They're software. A microservice logging into a database. A serverless function calling a payment API. A script with an access key. A CI/CD pipeline deploying code at three in the morning. And increasingly — this is the new one — an autonomous AI agent, going off and calling tools and services on your behalf while you sleep. Every one of those is an identity. Every one of them authenticates to something. Every one of them holds a secret of some kind. And every one of them can be stolen, abused, or turned against you. Be sure to subscribe!  You can also stream from https://yusufonsecurity.com In there, you will find a list of all previous episodes in there too.

  2. 23 mei

    277 - BitLocker Bypassed - How the YellowKey Zero-Day Defeats Windows 11 Encryption

    Enjoying the content? Let us know your feedback! Let me paint you a picture. You lose your work laptop. Maybe it's lifted off a café table, maybe it walks out of the back of a taxi. And your first thought — once the panic settles — is, "well, at least the drive is encrypted. Whoever has it can't actually read anything." Right? That's the whole deal. That's the promise. Today's episode is about the week that promise got broken on Windows 11. Not with a supercomputer. Not with some nation-state crypto-cracking lab. With a USB stick and a folder. The exploit is called YellowKey, and it does something that, frankly, should not be possible, it walks right past BitLocker without touching the encryption at all. Be sure to subscribe!  You can also stream from https://yusufonsecurity.com In there, you will find a list of all previous episodes in there too.

  3. 16 mei

    276 - copy.fail Explained-The Linux Kernel Bug That Turns Any User Into Root

    Enjoying the content? Let us know your feedback! This week we are going to talk about a bug with one of the most misleading names I have seen in a while. It is called copy.fail. And if you saw that name pop up in your feed, you would be forgiven for thinking it was some clever browser demo, or maybe a problem with your clipboard. It is neither. copy.fail is a Linux kernel vulnerability. Its official label is CVE-2026-31431. And what makes it worth a full episode is not how exotic it is — it is actually quite simple — but how wide its reach is. This single flaw lets an ordinary, unprivileged user on a Linux machine promote themselves all the way up to root. And it does so on nearly every modern Linux distribution shipped since 2017. - https://xint.io:copy.fail - https://www.cisa.gov: CVE-2026-31431 - https://www.bugcrowd.com: Hacker Opinion Piece How Lazy Hacking Killed Curls Bug-bounty Be sure to subscribe!  You can also stream from https://yusufonsecurity.com In there, you will find a list of all previous episodes in there too.

  4. 9 mei

    275 - The Mercor Breach-When Your Security Scanner Becomes the Attack Vector

    Enjoying the content? Let us know your feedback! Today's episode is one of those stories that, when you start pulling the thread, the whole thing just keeps unravelling. We are going to talk about the Mercor breach. Now, if that name doesn't ring a bell, Mercor is a ten-billion-dollar AI recruiting startup. They match human experts with companies like OpenAI, Meta, and Anthropic to help train AI models. Big clients. Big data. Big target. Towards the end of March of this year, a threat group called TeamPCP  and no, that is not a household cleaning detergent type of product - managed to steal roughly four terabytes of data from Mercor. And the way they did it? They didn't attack Mercor directly. They didn't even attack the software Mercor relied on directly. They attacked the security tool that was supposed to protect that software. Let me say that again. They compromised the vulnerability scanner.  We have all that coming up next in this week's episode. - https://securitylabs.datadoghq.com: LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP supply chain campaign - https://www.securityweek.com: SecurityWeek — Mercor Hit by LiteLLM Supply Chain Attack: Be sure to subscribe!  You can also stream from https://yusufonsecurity.com In there, you will find a list of all previous episodes in there too.

  5. 2 mei

    274 - Ransomware Hit a Water Plant - Why Your Tap Water Is a Cybersecurity Problem

    Enjoying the content? Let us know your feedback! Today's episode is one of those stories that really does hit home. Not a bank breach. Not some government leak. I want to talk about the water coming out of your tap. On March 14th, 2026, hackers dropped ransomware on a water treatment plant in Minot, North Dakota. Staff walked in that morning, saw a ransom note sitting on a server screen, and had to unplug the whole thing. For the next sixteen hours, plant operators were physically walking through the facility, reading gauges by hand — old school, the way it was done decades ago — while the FBI got the call. The city says the water stayed safe. Nobody got sick. But this incident ripped the cover off a problem the cybersecurity community has been warning about for years: water infrastructure is dangerously exposed. And most people have no idea. Today I want to unpack what happened in Minot, why water utilities are such soft targets, what SCADA systems actually are and why they are so difficult to defend, and what defenders and regulators are doing — and should be doing — about all of this. - https://therecord.media: North Dakota Ransomware Water Plant - https://www.cisa.gov: CISA — Adapting Zero Trust Principles to Operational Technology Be sure to subscribe!  You can also stream from https://yusufonsecurity.com In there, you will find a list of all previous episodes in there too.

  6. 25 apr

    273 - Project Glasswing (Mythos) - Anthropic Watershed Moment for Cybersecurity - Part 2

    Enjoying the content? Let us know your feedback! This is Part 2 of our deep dive into Anthropic's Claude Mythos Preview and Project Glasswing. In Part 1, we covered what Mythos is, how it fits into the Claude model family, and why Anthropic is pushing the boundaries of extended thinking and complex reasoning. Today, we are picking up right where we left off and turning our attention to Project Glasswing — what it is, what it means for security professionals, and why this convergence of advanced AI reasoning and autonomous capability should be on every defender's radar. If you have not listened to Part 1 yet, I would recommend going back and starting there, but if you are already caught up, let us get right into it. https://www.forrester.com: Project Glasswing The 10 Consequences Nobody Writing About Yet - https://www.anthropic.com: Project Glasswing - https://blogs.cisco.com: Rising To the Era of AI Powered Cyber Defense - https://www.wired.com: Mozilla Used Anthropics Mythos To Find 271 Bugs In Firefox Be sure to subscribe!  You can also stream from https://yusufonsecurity.com In there, you will find a list of all previous episodes in there too.

  7. 18 apr

    272 - Project Glasswing (Mythos) - Anthropic Watershed Moment for Cybersecurity - Part 1

    Enjoying the content? Let us know your feedback! About three weeks ago, on the 7th of April, Anthropic — the company behind the Claude family of AI models — announced something called Claude Mythos Preview. They paired the announcement with a coordinated industry effort they're calling Project Glasswing. And the headlines that followed have been, frankly, alarming. Fortune ran a piece headlined that Mythos can hack nearly anything, and we aren't ready. Coindesk reported that banks like JP Morgan, and crypto exchanges like Coinbase and Binance, are already approaching Anthropic to test it. And Anthropic's own researchers described this as a watershed moment — meaning, a before-and-after divide in how we think about software security. So let's break this down. What is Mythos? What can it actually do? And — most importantly — what should you and I, as defenders, be doing about it starting today? - https://www.anthropic.com: Project Glasswing - https://blogs.cisco.com: Rising To the Era of AI Powered Cyber Defense - https://www.wired.com: Mozilla Used Anthropics Mythos To Find 271 Bugs In Firefox Be sure to subscribe!  You can also stream from https://yusufonsecurity.com In there, you will find a list of all previous episodes in there too.

  8. 11 apr

    271 - $21 Billion Lost to Cybercrime — FBI's 2025 Report and Microsoft's Massive April Patch Tuesday

    Enjoying the content? Let us know your feedback! We have got two big stories to get through today. First, the FBI just released its 2025 Internet Crime Report — and the numbers are not just record-breaking, they are genuinely alarming. We are talking about over twenty billion dollars in reported losses in a single year. And for the first time ever, the report includes a dedicated section on how criminals are using artificial intelligence to supercharge their scams. Then, we are going to pivot to Microsoft's April 2026 Patch Tuesday — one of the largest patch cycles we have seen in a long time. A hundred and sixty-seven vulnerabilities fixed, including an actively exploited zero-day in SharePoint Server. If your organisation runs SharePoint, and most do, you are going to want to hear this. Be sure to subscribe!  You can also stream from https://yusufonsecurity.com In there, you will find a list of all previous episodes in there too.

Bekijk alles (278)

Info

This is a weekly podcast on cyber security domains. We discuss, dissect and demystify the world of security by providing an in-depth coverage on the cybersecurity topics that matter most. All these in plain easy to understand language. Like it, share it, and most importantly enjoy it!

Informatie

  • Maker
    YusufOnSecurity.Com
  • Jaren actief
    2021 - 2026
  • Afleveringen
    278
  • Beoordeling
    Veilig
  • Copyright
    © 2026 YusufOnSecurity.com
  • Website van aflevering
    YusufOnSecurity.com