The Defensive Line Podcast

The Defensive Line

0.0 (0)
Technology
Updated Weekly

The Defensive Line Weekly delivers actionable cybersecurity intelligence every week, translating the latest threats, vulnerabilities, and breaches into practical defensive advice for blue teamers. Subscribe for prioritised security recommendations that work for organisations of all sizes—curated and analysed by experienced security practitioners. thedefensiveline.substack.com

22h ago

The Defensive Line Weekly Podcast 031

The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack intelligence summary — the week’s most important security stories turned into practical defensive action. 🤖 Voices are AI-generated. Story curation, research and writing are human. This week’s edition: The Defensive Line Weekly #34: 9–16 August 2026 Main stories Lazarus, fake job offers, and a Windows zero-day Check Point Research: Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack The Hacker News: Lazarus Exploits Windows Zero-Day to Deploy FudModule Rootkit The Hacker News: Microsoft Patches 398 Flaws Including Actively Exploited Zero-Day Recruitment as an attack surface CERT-UA: UAC-0145 campaign targeting administrators and IT staff ANY.RUN: Lazarus Group IT Workers Investigation — Part Two The Record: Russian military hackers pose as recruiters to target Ukrainian IT workers Akira, Safe Mode, and EDR bypass Huntress: Akira Hits Safe Mode: Ransomware Rebooting Around EDR The Register: Akira ransomware scum blocked victims’ security tools — and broke their own encryptor NetScaler and the collapsing exploitation window watchTowr Labs: You’re Back In The Room: Citrix NetScaler Pre-Auth RCE CVE-2026-8452 Citrix: Citrix security advisories Zero Day Clock: Time-to-exploit tracking City-Forum, Salesforce, ServiceNow, and OAuth abuse Reco: City-Forum campaign against Salesforce and ServiceNow Dark Reading: Long-running data-theft campaign targets Salesforce and ServiceNow Honourable mentions Genians: Kimsuky using local LLMs for offensive operations Pillar Security: Deadbugz: active malicious MCP supply chain campaign The Hacker News: New passkey attacks can recover synced passkeys Mozilla: Updated GPG key for signing Firefox and Thunderbird releases This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com
Aug 12

The Defensive Line Weekly Podcast 030

The three stories that influence the defensive priorities this week: a vishing extortion crew calling employees on their personal phones, a self-propagating credential-stealing worm in npm, and an actively exploited RMM platform flaw that reached downstream managed customer networks. 🤖 Voices are AI-generated. Story curation and analysis is human. This episode Vishing extortion reaches the personal phone Google Threat Intelligence Group reports the financially motivated data-theft extortion group behind BlackFile (also operating as Redact, Pink, Helix and Falcon) running helpdesk-themed vishing, AiTM credential harvesting on fake passkey/MFA/SSO enrolment portals, and automated SaaS exfiltration — with first contact often on employees’ personal phones. * Google Threat Intelligence Group * The Hacker News * Bloomberg ChainDrop: a self-propagating worm in npm’s plumbing A credential-stealing worm entered through the keyv and cacheable packages and republished itself across more than 400 packages, harvesting developer credentials and GitHub Actions secrets, with persistence hooks in Claude Code and VS Code. * Wiz Research * Microsoft * Unit 42 * The Hacker News — 800 malicious npm packages N-able N-central: when the management plane is the way in Active exploitation of an unauthenticated remote-admin flaw (CVE-2026-18577, alongside CVE-2026-18556), a bypassed first fix, and vendor-confirmed downstream compromise of managed customer networks via Take Control. * N-able security update, 6 August * N-able Hotfix 2 release note * N-able security update, 2 August * The Register * The Hacker News — CISA KEV Versions: N-central Hotfix 1 = 2026.3.1.7 (2 August); Hotfix 2 = 2026.3.1.10 (6 August). Hotfix 2 is required even if Hotfix 1 was already applied. Honourable mentions * AISI incident report on unsanctioned AI agent behaviour — AISI, NCSC statement, The Hacker News, CrowdStrike agent containment architecture * Device-code phishing in commodity kits (Greatness, Kali365) — The Hacker News — Greatness, The Hacker News — Kali365, Dark Reading * INC ransomware exploiting SonicWall SMA 1000 flaws — Resecurity, The Hacker News * Metabase zero-day exploited in the wild (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) — The Hacker News, Wiz Read the full written edition The Defensive Line Weekly #33: 2–9 August 2026 → Substack This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com
Aug 6

The Defensive Line Weekly Podcast 029

The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack Intelligence Summary — the week’s most important security stories turned into practical defensive action. 🤖 Voices are AI-generated. Story curation, research and writing are human. Russia-linked CaptiveCrunch turns hotel Wi-Fi into an identity attack surface; autonomous AI attacks move from lab accident to real adversary use; and exposed water PLCs cause real-world disruption. CaptiveCrunch and hostile hotel Wi-Fi * Microsoft Threat Intelligence — CaptiveCrunch: https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/ * The Hacker News — Device-code phishing: https://thehackernews.com/2026/07/6-reasons-why-device-code-phishing-is.html Autonomous AI attacks * Cloud Security Alliance — Hugging Face CISO post-mortem: https://cloudsecurityalliance.org/artifacts/hugging-face-ciso-post-mortem * OpenAI — Hugging Face model evaluation security incident: https://openai.com/index/hugging-face-model-evaluation-security-incident/ * Anthropic — Investigating incidents in cybersecurity evals: https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals * Unit 42 — Autonomous A-I cyber attack campaign: https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ * Hugging Face — Agent intrusion technical timeline: https://huggingface.co/blog/agent-intrusion-technical-timeline Water-sector PLC attacks * FBI/EPA — Water sector public service announcement: https://www.ic3.gov/PSA/2026/PSA260730.pdf Honourable mentions * JetBrains — TeamCity advisory: https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/ * CISA — S-V-R exploitation of TeamCity CVE-2023-42793: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a * Ruby on Rails — Active Storage advisory: https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432 * Adobe — Campaign Classic security bulletin: https://helpx.adobe.com/security/products/campaign/apsb26-114.html * The Register — Brinks Home / ShinyHunters Salesforce claim: https://www.theregister.com/security/2026/07/31/the-most-famous-brand-in-physical-security-got-pwned-by-shinyhunters/5281924 * BleepingComputer — Adform script compromise: https://www.bleepingcomputer.com/news/security/online-ad-firm-adforms-script-compromised-to-steal-cryptocurrency/ This week’s edition * The Defensive Line Weekly #32: 26 July – 2 August 2026: https://thedefensiveline.substack.com/p/the-defensive-line-weekly-32-26-july Previous episode referenced * The Defensive Line Weekly #31: 19–26 July 2026: https://thedefensiveline.substack.com/p/the-defensive-line-weekly-31-1926 This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com
Jul 29

The Defensive Line Weekly Podcast 028

The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack Intelligence Summary — the week’s most important security stories turned into practical defensive action. Two voices, one focused briefing, made for and by blue teamers. 🤖 Voices are AI-generated. Story curation, research and writing are human. This week: OpenAI’s AI models breach Hugging Face autonomously; LAUNDRY BEAR’s zero-click Zimbra attack; a $25 WordPress RCE built by AI. AI Models Breach Hugging Face OpenAI — Hugging Face model evaluation security incident Hugging Face — security incident July 2026 Cloud Security Alliance — Hugging Face Incident Initial Post-Mortem The Hacker News Hunt.io — Hermes AI agent, Thailand Ministry of Finance The Hacker News — Kimi K3 agents find Redis zero-days The Register LAUNDRY BEAR’s Zero-Click Zimbra Campaign Joint Cybersecurity Advisory AA26-204A NCSC Unit 42 A $25 WordPress Exploit Searchlight Cyber Wiz — wp2shell Elastic Security Labs — detection guidance Honourable Mentions Ransom-ISAC — Cl0p Windchill/FlexPLM PTC advisory — CVE-2026-12569 The Hacker News — Qilin PAN-OS Island — AgentBaiting Vulnerability Roundup Check Point — CVE-2026-16232 SmartConsole advisory Microsoft — CVE-2026-50522 SharePoint The Hacker News — Certighost AD exploit This week’s edition The Defensive Line Weekly #31: 19–26 July 2026 This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com
Jul 22

The Defensive Line Weekly Podcast 027

The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack Intelligence Summary — the week’s most important security stories turned into practical defensive action. Two voices, one warm and focused briefing, made for and by blue teamers. Transport for London sentencing * Judiciary of England and Wales — sentencing remarks * National Crime Agency * Crown Prosecution Service * The Guardian * The Register * Sophos — State of Ransomware 2026 * Dark Reading — identity attacks overtake exploits One leaked credential to Global Administrator * Sysdig — anatomy of an Azure permission takeover * Microsoft Entra Workload ID (Workload Identities Premium) SonicWall SMA 1000 zero-days * SonicWall PSIRT advisory — CVE-2026-15409 & CVE-2026-15410 (firmware 12.4.3 and 12.5.0; models 6210, 7210, 8200v) * The Hacker News * Dark Reading — Inc ransomware exploitation * Help Net Security * Zero Day Clock Honourable mentions * Microsoft — defending SaaS applications against ShinyHunters OAuth abuse * BleepingComputer — Abbott Laboratories incidents * CERT-UA — UAC-0145 ClickFix playbook * Microsoft — ACR Stealer * Elastic Security Labs — TELEPUZ * RH-ISAC — ClickLock Stealer (macOS) * JFrog — Miasma worm returns to npm * OX Security — AsyncAPI compromise * Hugging Face — security incident disclosure * Hunt.io — AI coding agents in government intrusions * NCSC — Russian intelligence router targeting This week’s edition * The Defensive Line Weekly #30: 12–19 July 2026 This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com
Jul 15

The Defensive Line Weekly Podcast 026

The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack intelligence summary — fifteen minutes of the week’s most defensively useful security stories, for blue teamers and security leaders. Vishing crews plant rogue passkeys; Helix loots SharePoint via device codes; ShareFile ordered offline; npm kills install scripts. Full breakdown: https://thedefensiveline.substack.com/p/the-defensive-line-weekly-29-512 Story 1 — Two crews, one phone: passkey enrolment vishing and Helix * Okta Threat Intelligence: https://www.okta.com/blog/threat-intelligence/vishing-actors-target-microsoft-entra-passkey-enrollment-/ * BleepingComputer — Entra passkey enrolment vishing: https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/ * SecurityWeek — Okta vishing warning: https://www.securityweek.com/okta-warns-of-vishing-attacks-targeting-microsoft-365-customers/ * The Hacker News — fake Microsoft Entra pages: https://thehackernews.com/2026/07/hackers-use-fake-microsoft-entra.html * ReliaQuest — Helix threat spotlight: https://reliaquest.com/blog/threat-spotlight-helix-new-name-in-data-extortion-ecosystem/ * BleepingComputer — Helix SharePoint data theft: https://www.bleepingcomputer.com/news/security/new-helix-vishing-group-emerges-in-sharepoint-data-theft-attacks/ Story 2 — Progress orders ShareFile Storage Zone Controllers switched off * The Hacker News — ShareFile shutdown instruction: https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html * ShareFile status page: https://status.sharefile.com/ Story 3 — npm’s bad week and the install-scripts default * Affected versions: jscrambler 8.14.0; @injectivelabs/sdk-ts 1.20.21 * StepSecurity — jscrambler malicious preinstall binary: https://www.stepsecurity.io/blog/jscrambler-npm-package-publishes-malicious-preinstall-binary * Socket — jscrambler supply chain attack: https://socket.dev/blog/jscrambler-supply-chain-attack * The Hacker News — compromised jscrambler release: https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html * The Hacker News — Injective Labs GitHub compromise: https://thehackernews.com/2026/07/injective-labs-github-compromise-pushes.html * The Hacker News — npm 12 disables install scripts by default: https://thehackernews.com/2026/07/npm-12-disables-install-scripts-by.html Honourable mentions * Wiz — GhostApproval: https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants * Noma Security — GitLost: https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/ * The Hacker News — GitLost: https://thehackernews.com/2026/07/public-github-issue-could-trick-github.html * BleepingComputer — Ghostcommit: https://www.bleepingcomputer.com/news/security/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets/ * Adobe — ColdFusion security bulletin (CVE-2026-48282): https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html * BleepingComputer — ColdFusion flaw exploited in attacks: https://www.bleepingcomputer.com/news/security/max-severity-adobe-coldfusion-flaw-now-exploited-in-attacks/ * Google Cloud / Mandiant — recovering ADFS signing keys: https://cloud.google.com/blog/topics/threat-intelligence/recovering-active-adfs-signing-keys-machine-dpapi/ This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com
Jul 8

The Defensive Line Weekly Podcast 025

The Defensive Line Weekly — Episode 25 (28 June – 5 July 2026). A new CitrixBleed exploited in 24 hours; FortiBleed theft turns to ransomware; device-code phishing goes pro; AI runs ransomware end-to-end. 🤖 Voices are AI-generated. Story curation and analysis is human. A new CitrixBleed (CVE-2026-8451) * Citrix Security Bulletin CTX696604 — fixed builds * watchTowr Labs — CitrixBleed to Infinity and Beyond: technical analysis * Field Effect — Citrix NetScaler memory disclosure: patch guidance * SecurityWeek — New CitrixBleed vulnerability exploited immediately after public disclosure FortiBleed → INC Ransom and Lynx ransomware * SOCRadar — FortiBleed: INC / Lynx ransomware link * Dark Reading — FortiBleed actors tied to INC and Lynx ransomware gangs * SecurityWeek — FortiBleed campaign linked to INC, Lynx ransomware attacks * BleepingComputer — FortiBleed credential theft campaign linked to Lynx ransomware ARToken — device-code phishing as a service * Cisco Talos — ARToken: inside an EvilTokens affiliate panel targeting Microsoft 365 * Sekoia — EvilTokens: AI-augmented phishing-as-a-service for automating BEC fraud * Microsoft — AI-enabled device-code phishing campaign (April 2026) * Microsoft Learn — Conditional Access: block authentication flows (device code) JADEPUFFER — AI-agent-run ransomware * Sysdig — JADEPUFFER: agentic ransomware for automated database extortion * BleepingComputer — JADEPUFFER ransomware used AI agent to automate entire attack * SecurityWeek — Agentic AI used to conduct ransomware attack via Langflow Honourable mentions * Socket — PolinRider: North Korea-linked supply chain campaign expands * OpenSourceMalware — PolinRider rides again: North Korean attack expands across GitHub * The Hacker News — North Korean hackers publish 108 malicious packages * The Hacker News — New ChocoPoC RAT targets vulnerability researchers Vulnerabilities * MSRC — CVE-2026-45659: Microsoft SharePoint RCE * The Hacker News — SharePoint RCE CVE-2026-45659 added to KEV * Cisco — Unified Communications Manager security advisory * SecurityWeek — Cisco confirms in-the-wild exploitation of Unified CM vulnerability Subscribe * This week’s written edition — The Defensive Line Weekly #28 This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com
Jul 1

The Defensive Line Weekly Podcast 024

The Defensive Line Weekly — Episode 24, covering 21–28 June 2026. A weekly briefing for blue teamers and security leaders: the biggest stories of the week, why they matter, and what to do next. 🤖 Voices are AI-generated. Story curation and analysis is human. Sources Cisco Catalyst SD-WAN zero-day exploited for months * Mandiant / Google Cloud — zero-day exploitation of Cisco Catalyst SD-WAN Manager * Cisco Security Advisory — SD-WAN Manager privilege escalation * The Hacker News * SecurityWeek Amazon Q Developer flaw — malicious repos and cloud credential theft * Wiz — Amazon Q vulnerability * AWS Security Bulletin * The Hacker News * SecurityWeek “BadBlocker” — 11M-install ad blocker that can run code anywhere * Island — BadBlocker research * The Hacker News Russian intelligence targeting Signal backup recovery keys * FBI / IC3 Public Service Announcement * CISA advisory * The Hacker News * The Record Operation Endgame — SocGholish, Amadey and StealC takedown * Europol * Microsoft Security Blog * The Hacker News * Wired — LastPass user data stolen again Honourable mentions & vulnerability roundup * The Register — “Miasma” npm supply-chain campaign * Novee Security — “Cordyceps” CI/CD weakness * The Hacker News — Cordyceps exposes 300+ GitHub repos * Microsoft — photo-zip campaign targeting hospitality * The Hacker News — “Gaslight” macOS stealer with prompt injection * BleepingComputer — CISA deadline for exploited Cisco CUCM flaw * Dark Reading — attackers weaponise Cisco CUCM flaw * The Hacker News — CISA adds exploited PTC Windchill RCE * The Hacker News — “DirtyClone” Linux kernel flaw * The Hacker News — Linux “pedit” copy-on-write exploit This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com

The Defensive Line Weekly delivers actionable cybersecurity intelligence every week, translating the latest threats, vulnerabilities, and breaches into practical defensive advice for blue teamers. Subscribe for prioritised security recommendations that work for organisations of all sizes—curated and analysed by experienced security practitioners. thedefensiveline.substack.com

Creator

The Defensive Line
Years Active

2026
Episodes

32
Rating

Clean
Copyright

© FixPoint
Show Website

The Defensive Line Podcast