Initial Access

Bishop Fox

Bishop Fox offensive security researchers, experts, and hackers take a real look at the latest cybersecurity news headlines and have a straight take on them. The goal is simple: do you actually need to care about this, or is it just another variation of the same fundamental security problems we've been dealing with for years?

  1. há 13 h

    Rogue Agents, Invisible Screens, and a Vulnerability Clearinghouse

    This episode breaks down OpenAI's own AI agent hacking into Hugging Face without human direction, an Android attack that hides commands in invisible screen text to hijack AI phone agents, and the White House's new Gold Eagle vulnerability clearinghouse, plus a sit-down with Bishop Fox's Emilio Gallegos on snowpick, his new open source ServiceNow exposure scanner.    Security Headlines:  OpenAI Says Its AI Technology Acted on Its Own in 'Unprecedented' Hack of Company, ABC News Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs, The Hacker News US Launches Vulnerability Clearinghouse Amid AI-Fueled Surge in Flaws, Cybersecurity Dive    Also mentioned:   Event: Black Hat & DEF CON 2026  Blog: A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit Blog: Introducing snowpick: Testing ServiceNow for Public Data Exposure XKCD Comic: AI-Box Experiment   Join the conversation in the Bishop Fox Discord server and in the new Bishop Fox subreddit.

  2. 20 de jul.

    Attribution and OpSec at Scale

    This week's episode is different. Bishop Fox Red Teamers Brandon Kovacs, Thomas Wilson, and Rob Antonucci talk through what attribution actually looks like when device-level telemetry breaks anonymity, what young attackers with real skills but zero tradecraft have in common, and how one credential reset becomes the master key to everything downstream.    Security Headlines:  Tracking Peter Stokes and The Com: Allison Nixon and Her Work Unmasking Cybercriminals, Zero Day ShinyHunters Raids Nottingham Uni for Student, Alumni Data, The Register   Join the conversation in the Bishop Fox Discord server and in the new Bishop Fox subreddit.

  3. 13 de jul.

    Old Backdoors, Ghost Phishing, and Borrowed AI

    This episode breaks down a Tenda router backdoor that turns out to be three years old, a phishing kit called EvilTokens that hides until a victim's browser builds it, and CISA turning Anthropic's Mythos model on the government's own code, plus a sit-down with IoT researcher Matt Evans on why Tenda keeps getting away with it. Security Headlines: · CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware, The Hacker News · New Ghost Phishing Wave Is Breaking Traditional Email Security, The Hacker News · CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws, Security Week   Also mentioned: · Blog: Matt ‘uturn’ Evans · Event: Boston Security Meetup 2026 · Workshop: Social Engineering: How to Build Pressure-Proof Pretexts · Virtual Session: The Prioritization Problem: Why More Findings Don’t Mean Less Risk   Join the conversation in the Bishop Fox Discord server and in the new Bishop Fox subreddit.

  4. 6 de jul.

    Cisco Root Access, FortiBleed Credentials, Sparkplug Fuzzing, AI Arms Race

    This episode breaks down a Cisco flaw exploited within 24 hours of disclosure, a credential-harvesting campaign that hit 430,000+ FortiGate firewalls, and what Fable's restricted return and China's Tulongfeng mean for controlling offensive AI. Plus, a sit-down with Bishop Fox's Shad Malloy on building the first open-source Sparkplug B fuzzer for ICS environments. Security Headlines:  In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw, Dark Reading FortiBleed campaign steals 110M credentials from FortiGate targets, SC Media Buckle Up: The Bad Guys Now Have A Model As Powerful As Mythos, Forbes    Also Mentioned:   Research: On Favicons: From Browser Icons to Attack Surface Intelligence Event: Summercon 2026    Event: San Diego Comic-Con 2026   Join the conversation in the Bishop Fox Discord Server.

  5. 29 de jun.

    FIFA Takeover, FFMpeg RCE, Klue Breach, Hardware Hacking

    This episode breaks down a public FIFA signup form wired straight to World Cup broadcast controls, an FFmpeg RCE buried in half your media apps, a SaaS breach cascading through delegated OAuth, and home routers conscripted into proxy infrastructure, plus a sit-down with Bishop Fox's Marco Sanchez on hardware hacking.  Security Headlines: I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID, BobDaHacker FFmpeg fixes PixelSmash flaw in widely used video decoder, BleepingComputer Klue hack results in data breach at several cybersecurity firms, TechCrunch How Hackers Found a Back Door Into the American Living Room, The Wall Street Journal  Also Mentioned:  Workshop: Debug to Root: A Friendly Introduction to Hardware Hacking (available in English and Spanish) Virtual Session: Beyond the Hype: What Mythos Actually Means for Security Teams Event: SummerCon 2026 XKCD Comic: Dependency Join the conversation in the Bishop Fox Discord Server.

  6. 22 de jun.

    Pokémon GO, ServiceNow Auth Flaw, and the Anthropic Model Pulldown

    This episode explores what happens when the systems people trust quietly extend into domains they never agreed to. A Pokémon GO AR dataset trained a Visual Positioning System now adjacent to military drone navigation. A ServiceNow authentication flaw handed attackers read access to the operational core of enterprise IT. And the US government pulled two frontier AI models off the market over a jailbreak, with no established framework to bring them back.

  7. 15 de jun.

    Linux NFTables Root Exploit, Gemini Prompt Injection, and Cisco SD-WAN Zero-Day

    This episode explores how the attack surface keeps expanding at every layer — from a single inverted kernel character enabling unauthenticated root, to AI assistants weaponized as system-wide IPC through notification injection, a Cisco SD-WAN zero-day giving attackers control of enterprise routing fabric, and the week's unavoidable elephant: whether Claude Fable V's guardrails actually hold.

  8. 9 de jun.

    Forged VPN Sessions, Autonomous AI Worm, and Hotel Reservation Hijacking

    This episode explores how attackers live in the gap between what a system can verify and what it settles for from forged GlobalProtect VPN sessions to an autonomous AI worm, a social-engineered Meta support bot, voice-phished Salesforce access, and hotel reservation hijacking.

Ver tudo (27)

Classificações e avaliações

5
de 5
2 avaliações

Sobre

Bishop Fox offensive security researchers, experts, and hackers take a real look at the latest cybersecurity news headlines and have a straight take on them. The goal is simple: do you actually need to care about this, or is it just another variation of the same fundamental security problems we've been dealing with for years?

Informações

  • Criado por
    Bishop Fox
  • Anos de atividade
    2026
  • Episódios
    27
  • Classificação
    Explícito
  • Copyright
    © 2026 Bishop Fox
  • Site do podcast
    Initial Access

Você também pode gostar de