The Defensive Line Podcast

The Defensive Line

The Defensive Line Weekly delivers actionable cybersecurity intelligence every week, translating the latest threats, vulnerabilities, and breaches into practical defensive advice for blue teamers. Subscribe for prioritised security recommendations that work for organisations of all sizes—curated and analysed by experienced security practitioners. thedefensiveline.substack.com

  1. 4d ago

    The Defensive Line Weekly — Episode 41 (18–25 October 2026)

    The audio edition of the weekly Defensive Line Substack intelligence briefing — the week’s most important security stories turned into practical defensive action. 🤖 This briefing is drafted and read by AI, but reviewed and edited by humans. This week’s edition: The Defensive Line Weekly #44: 18–25 October 2026 Main stories PHP2Shell: urgency without confusing attempts with compromise PHP: Security releases and critical remote code execution advisory Wiz: PHP2Shell: AI uncovers critical RCE vulnerabilities Amazon: PHP2Shell exploitation attempt identified before public disclosure CrowdStrike: Obstacles to weaponizing PHP2Shell likely constrain immediate exploitation Honeypot research: PHP2Shell packet-to-process execution evidence NCSC: Preparing for a vulnerability patch wave Zero Day Clock: Vulnerability exploitation observatory The speed of AI: ConnectWise and the follow-through Microsoft: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise The Defensive Line: Previous edition, #43: 11–18 October 2026 LiteLLM: two approvals, one attacker LiteLLM: The attack chain behind the compromised release Microsoft: Inside the LiteLLM supply chain compromise: credential theft through Python startup hooks Wiz: Gheist: attempted scaled abuse of stolen GitHub tokens stumbles Token theft: access that survives a password reset Huntress: Microsoft 365 token spray and replay campaign compromises business email accounts Microsoft Learn: Block authentication flows with Conditional Access policy Group-IB and NyxLab: Stray Cat, Open Doors: how k0t wanders through the network edge Honourable mentions Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates The Hacker News: Hackers hijack five OVHcloud CLI releases to distribute secret-stealing malware Railway: Preliminary report: October security incident This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com

    The Defensive Line Weekly — Episode 41 (18–25 October 2026)

  2. Oct 21

    The Defensive Line Weekly — Episode 40 (11–18 October 2026)

    The audio edition of the weekly Defensive Line Substack intelligence briefing — the week’s most important security stories turned into practical defensive action. 🤖 This briefing is drafted and read by AI, but reviewed and edited by humans. This week’s edition: The Defensive Line Weekly #43: 11–18 October 2026 Main stories A shared application identity reaches customer tenants Huntress: ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks Todyl: Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App ConnectWise: Trust Center advisories and current service update A trusted update changed for minutes, then reverted Google Threat Intelligence Group and Mandiant: Investigating Ephemeral Supply Chain Tampering ManageEngine Threat Analysis Lab: AOMEI Backupper supply-chain compromise Remote-support access becomes a route downstream Mandiant: ARMORY CASTLE Exploits BeyondTrust BeyondTrust: Security advisory BT26-05 BeyondTrust: ARMORY CASTLE and BT26-05: What Security Teams Need to Know Honourable mentions Citizen Lab: How Discover-Tech turned targeted ads into a pipeline for spyware MI5: Director General delivers annual threat update CERT-FR: Alert on attacks against refrigeration control systems Hunt.io: PaperCut attacker AI toolkit and exploit code Kim Zetter: Hardware-wallet implant reporting: Ledger Kim Zetter: Hardware-wallet implant reporting: Trezor Check Point: Fake calendar invites target organisations Sublime Security: Detection rule for credential theft in calendar invitations CISA: Known Exploited Vulnerabilities Catalog This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com

    The Defensive Line Weekly — Episode 40 (11–18 October 2026)

  3. Oct 14

    The Defensive Line Weekly — Episode 39

    The Defensive Line Weekly — Episode 39 (4–11 October 2026) The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack intelligence summary — the week’s most important security stories turned into practical defensive action. 🤖 This briefing is drafted and read by AI, but reviewed and edited by humans. This week’s edition: The Defensive Line Weekly #42: 4–11 October 2026 Main stories Customer data behind an employee login BleepingComputer: ASOS links data breach to social engineering attack, credential theft BBC News: Asos hackers took more personal details than first revealed, BBC finds Okta: When enrollment isn’t enough: How attackers trick users into MFA downgrades The support caller and the visitor at reception The Record: Leaked chats show Russian extortion gang sending ‘agents’ into US law firms FBI: Silent Ransom Group Impersonating IT Personnel through Social Engineering S-RM: Cyber briefing note: The Luna Moth files A trusted release with a destructive response trap Tensorlake: Malicious tensorlake release: credential-stealing worm with destructive dead-man’s switch OX Security: “Shai-Hulud: Here We Go Again” — “tensorlake” npm Package Hit With Malware Renovate: Configuration Options — minimumReleaseAge Honourable mentions StepSecurity: GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories Australian Cyber Security Centre and international partners: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools to steal sensitive data Google: Chrome’s Response to Recent ccTLD Registry Hijacks Gen Digital: Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data CloudSEK: Caught in 4K: The Gentlemen Files Bitdefender: The phone was compromised before the user turned it on: the rise of Midnight Mimosa This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com

    The Defensive Line Weekly — Episode 39

  4. Oct 7

    The Defensive Line Weekly — Episode 38

    The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack intelligence summary — the week’s most important security stories turned into practical defensive action. 🤖 This briefing is drafted and read by AI, but reviewed and edited by humans. This week’s edition: The Defensive Line Weekly #41: 27 September–4 October 2026 Main stories The upgrade that did not finish the job Citrix: CTX697174 — Citrix NetScaler ADC and NetScaler Gateway security bulletin Citrix Community: Understanding and addressing CVE-2026-88779 in Citrix NetScaler ADC and NetScaler Gateway CISA: CISA adds one known exploited vulnerability to catalog Google Threat Intelligence Group: Defending against active exploitation of Citrix NetScaler ADC and Gateway appliances BleepingComputer: Citrix patches NetScaler SAML zero-day exploited in attacks The paste that does not care where it lives Microsoft: 2026 Digital Defense Report Huntress: ChatGPT Custom GPTs used to deliver ClickFix Push Security: Malicious copy and paste detection One remote tool installs the next Microsoft Defender Experts and Security Research: Phishing abuses RMM tools for persistent access CrowdStrike: Beyond the binary: stop attackers living off your land Honourable mentions Symantec and Carbon Black: Warlock ransomware targeting critical infrastructure Proofpoint: China-aligned actor impersonates its way into US AI policy circles Fortinet: FG-IR-26-175 — FortiMail identity-based encryption vulnerability Cisco: Cisco Catalyst SD-WAN Manager authentication bypass Microsoft Threat Intelligence: Unauthenticated command injection on internet-facing mail servers This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com

    The Defensive Line Weekly — Episode 38

  5. Sep 30

    The Defensive Line Weekly — Episode 37

    The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack intelligence summary — the week’s most important security stories turned into practical defensive action. 🤖 This briefing is drafted and read by AI, but reviewed and edited by humans. This week’s edition: The Defensive Line Weekly #40: 20–27 September 2026 Main stories When the workaround isn’t the fix Google Threat Intelligence Group: ShinyHunters renewed mass exploitation campaign targeting Oracle PeopleSoft Oracle: Security alert for CVE-2026-35273 BleepingComputer: ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks Citrix: CTX697096 — NetScaler ADC and NetScaler Gateway security bulletin CISA: Critical zero-day vulnerabilities exploited in Citrix NetScaler ADC and Gateway watchTowr: Citrix NetScaler zero-day vulnerabilities FAQ Citrix: Steps to take if NetScaler ADC is suspected compromised Seven minutes, two service principals Microsoft Security Research: Storm-3168: agentic-driven cloud attacks using compromised service principals Sysdig: No single pane of glass: anatomy of an Azure permission takeover EvilTokens and the genuine login Microsoft Threat Intelligence: Unmasking EvilTokens: getting to the root of device code phishing Microsoft: Block authentication flows with Conditional Access Sublime Security: Detection rule for links to Microsoft device code authentication with suspicious indicators Honourable mentions Independent researcher: How I could’ve accessed 17 trillion Microsoft records Red Hat: Security bulletin RHSB-2026-006 Aikido: Red Hat npm packages compromised by a credential-stealing worm Socket: Mini Shai-Hulud campaign hits Red Hat cloud services npm packages SecurityWeek: SalesBleed flaws in Salesforce Agentforce enabled zero-click data exfiltration Dark Reading: SalesBleed exploits Salesforce agents for Slack phishing Proofpoint: Spraying in the Andes: TeamFiltration returns F5: K000162605 — BIG-IP APM vulnerability Check Point: Active exploitation of CVE-2026-85102 and management pre-authentication vulnerability CVE-2026-93616 The Hacker News: Roundcube pre-auth SQL injection flaw now exploited in the wild CISA: CISA adds two known exploited vulnerabilities to catalog Patchstack: Attackers started probing WordPress sites hours after the patch This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com

    The Defensive Line Weekly — Episode 37

  6. Sep 23

    The Defensive Line Weekly Podcast 036

    The Defensive Line Weekly — Episode 36 (13–20 September 2026) The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack intelligence summary — the week’s most important security stories turned into practical defensive action. 🤖 This script was written and read by AI, but reviewed and edited by humans. This week’s edition: The Defensive Line Weekly #39: 13–20 September 2026 Main stories The Brevo key and ClickFix on trusted sites Brevo: Incident post-mortem BleepingComputer: Brevo supply chain attack injected ClickFix scripts on customer sites Push Security: Malicious copy and paste detection Two exploited Cisco zero-days Cisco: Identity Services Engine authentication bypass advisory CISA: CISA adds two known exploited vulnerabilities to catalog The Hacker News: Cisco warns of new zero-day ISE authentication bypass Sophos: Cisco Secure Email Gateway vulnerability in active exploitation The Register: Cisco email security boxes can be rooted by an email Help Net Security: Cisco ISE vulnerability exploited Dark Reading: Sandworm chains Cisco vulnerabilities to deploy Cyclops Blink Developer trust: Plugin4Shell and WaterPlum Air Security: Plugin4Shell The Hacker News: Plugin4Shell lets repository owners swap pinned plugin code The Register: AI coding agents 0-click RCE flaw could hand attackers keys to the kingdom FBI/IC3: Joint advisory on WaterPlum The Record: North Korean hackers infect thousands of devices in WaterPlum scheme BleepingComputer: North Korean WaterPlum hackers infected 30,000 devices worldwide The Hacker News: WeaselBiscuit stealer spreads via 13 npm packages GitLab: How to detect and prevent Contagious Interview IDE attacks Honourable mentions LastPass: Delphos Labs report on the Rapuncel infostealer BleepingComputer: Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer Microsoft: Application Control vulnerable driver blocklist Hacktron: Hacking OpenAI The Hacker News: Claude Opus 5 helped researchers take over OpenAI staff accounts Mandiant: AI risk and resilience 2026 The Hacker News: Attacker hijacks AI coding assistant session Elastic Security Labs: Malicious browser extension KREMLIN banking malware The Hacker News: KREMLIN banking malware hijacks Chrome CISA: Known Exploited Vulnerabilities catalogue The Hacker News: CISA flags three Linux kernel vulnerabilities The Hacker News: Active exploitation attempts target WSO2 API Manager The Hacker News: Acronis cPanel backup plugin exploited BleepingComputer: Check Point warns critical flaw lets hackers execute code as root The Hacker News: BIND 9 update fixes 14 flaws This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com

    The Defensive Line Weekly Podcast 036

  7. Sep 16

    The Defensive Line Weekly Podcast 035

    🤖 The voices in this episode are AI generated. The briefing is drafted and read by AI, then reviewed and edited by humans. This week’s edition: The Defensive Line Weekly #38: 6–13 September 2026 Main stories Topic 1 — AI as the execution layer Anthropic’s September threat report, and PaperCut exploitation at scale. Anthropic: Detecting and countering misuse of AI — September 2026 Blackpoint Cyber: Death by a thousand PaperCuts — AI-driven exploitation at scale GreyNoise: AI-orchestrated campaign against PaperCut NG/MF The Register: Hundreds of AI agents helped the PaperCut attacker hit 395 orgs PaperCut: Security bulletin and fixed releases Topic 2 — Passkey lures and help-desk vishing Social engineering aimed at M-F-A enrolment and identity support, into Microsoft 365. Microsoft: Passkey-themed social engineering leads to identity and cloud compromise Topic 3 — Systems that hold credentials Artifactory exploitation and the build pipeline as the objective, plus an exposed A-I gateway chained to cloud compromise. Wiz: Artifactory under attack — in-the-wild exploitation CISA: Three vulnerabilities added to the Known Exploited Vulnerabilities catalogue Wiz: Off guard — breaking LiteLLM from authentication bypass to cloud compromise Further reading, not covered in this episode: Google Threat Intelligence Group on manipulated AI coding assistants, malicious Model Context Protocol packages and prompt injection in repository configuration — From prompting to autonomy: the evolution of adversarial AI. Full write-up in The Defensive Line Weekly #38. Honourable mentions Cisco Secure Firewall Management Center exploitation and the new Linux variant of Cyclops Blink — The Hacker News, Sophos GitLab critical file-read flaw in self-managed instances (CVE-2026-85706) — GitLab patch release, The Hacker News, BleepingComputer Chrome actively exploited flaw used by the BlueMoon exploit kit (CVE-2026-87491) — Chrome Releases, Malwarebytes, The Register MikroTik RouterOS and ConnectWise ScreenConnect flaws added to the Kev catalogue on 12 September — CISA, The Hacker News Check Point V-P-N gateway certificate-handling flaws — watchlist (CVE-2026-85102, CVE-2026-85103) — The Hacker News, BleepingComputer Prompt-injection research from Check Point and ESET — Check Point Research, ESET Versions: PaperCut fixed in 26.0.5, 25.0.13 and 24.1.10. GitLab fixed in 19.3.2, 19.2.6 and 19.1.8. Artifactory: apply the fixed release for your branch covering all three issues. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com

    The Defensive Line Weekly Podcast 035

  8. Sep 9

    The Defensive Line Weekly Podcast 034

    The Defensive Line Weekly podcast is the audio edition of the weekly Defensive Line Substack intelligence summary — the week’s most important security stories turned into practical defensive action. 🤖 This briefing is drafted and read by AI, but reviewed and edited by humans. This week’s edition: The Defensive Line Weekly #37: 30 August–6 September 2026 Main stories One exposed AI key, six hundred thousand dollars of compute METR: Update on Security at METR SonicWall’s edge is under attack again SonicWall: SMA 1000 Series affected by multiple vulnerabilities CISA: CISA adds seven known exploited vulnerabilities to its catalogue Fake support turns trusted tools into an attack path Microsoft Threat Intelligence: Impersonating IT support — how threat actors turn a remote session into enterprise-wide access Huntress: Rogue ScreenConnect installations suggest worm-like activity ConnectWise: Security advisories Honourable mentions Softaculous: Security incident — BGP hijacking Kentik: Latest BGP hijack targets a hosting-software vendor Microsoft: ASCII smuggling crosses over from AI prompt injection to phishing evasion Arctic Wolf: Exploited PaperCut vulnerabilities lead to credential theft PaperCut: Urgent security advisory JFrog: CVE-2026-82329 — authentication bypass in Artifactory Google Chrome Releases: Stable Channel Update for Desktop Wordfence: Attackers actively exploit a critical Elementor Pro vulnerability Cisco: Nexus 9000 Series Silicon One remote-code-execution vulnerability GitLab: Critical remote code execution in vm2 Sublime Security: Sublime and CrowdStrike unify email detection, response and sandbox analysis CrowdStrike: Real-Time Supply Chain Attack Protection CrowdStrike: The next evolution of the Agentic SOC CrowdStrike: Agentic Identity Provider CrowdStrike: Falcon Guardian defines the next generation of AI security GitHub: FalconFlank proof of concept The Hacker News: Researcher releases FalconFlank PoC showing privilege escalation in CrowdStrike Falcon The Register: Prolific Microsoft zero-day hunter drops CrowdStrike Falcon exploit PoC This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit thedefensiveline.substack.com

    The Defensive Line Weekly Podcast 034
See All (42)

About

The Defensive Line Weekly delivers actionable cybersecurity intelligence every week, translating the latest threats, vulnerabilities, and breaches into practical defensive advice for blue teamers. Subscribe for prioritised security recommendations that work for organisations of all sizes—curated and analysed by experienced security practitioners. thedefensiveline.substack.com

Information

You Might Also Like