Initial Access

Bishop Fox

Bishop Fox offensive security researchers, experts, and hackers take a real look at the latest cybersecurity news headlines and have a straight take on them. The goal is simple: do you actually need to care about this, or is it just another variation of the same fundamental security problems we've been dealing with for years?

  1. -4 j

    Custom Payload Evasion, Chained Network-to-Physical Breach, and Satellite Hacking

    This episode goes inside the Bishop Fox Red Team — exploring how AI accelerates custom payload evasion and social engineering at scale, what a chained network-to-physical breach looks like in practice, and why satellites and gas pumps are reachable from the public internet right now.

    47 min

  2. 26 mai

    VS Code Supply Chain Attack, Microsoft Exchange Zero-Day, and AI-Accelerated Vulnerability Discovery

    This episode explores how attackers exploit infrastructure that became load-bearing before anyone secured it from a malicious VS Code extension that compromised thousands of GitHub repositories and an actively exploited Exchange zero-day, to Cisco SD-WAN auth bypasses, AI chaining low-severity bugs into real attack paths, and AWS GovCloud credentials left exposed in a public repo.

    27 min

  3. 18 mai

    AI Zero-Day Exploit, CI/CD Supply Chain Poisoning, and Vibe-Coded Data Exposure

    This episode explores how modern development's trust assumptions keep failing in attackers' favor, from the first confirmed AI-written zero-day to a coordinated supply chain attack poisoning 518 million download paths, developer credential harvesting via rootkit, AWS SES abuse for phishing at scale, and thousands of vibe-coded apps leaking sensitive data in the open web.

    46 min

  4. 11 mai

    Linux Kernel Exploit, GitHub RCE, and Canvas Cyberattack

    This episode explores how every layer of the stack has become an attack surface — from a privilege-escalating Linux kernel flaw and a GitHub infrastructure RCE to a poisoned RubyGems supply chain, a trojanized vendor installer, and a ransomware hit on centralized education infrastructure.

    48 min

  5. 5 mai

    cPanel Auth Bypass, Claude AI Code Risks, and Trigona Ransomware

    This episode explores how access is being created, scaled, and kept with less friction, from a critical cPanel authentication bypass to AI-generated vulnerable code, AI-assisted attacks, persistent footholds in trusted systems, and stealthier data exfiltration.

    34 min

  6. 28 avr.

    Anthropic Tool Access, EU App Bypasses, and Active Zero-Days

    This episode explores how access control is breaking down across AI systems, consumer apps, and vulnerability management, from leaked AI tooling and bypassed EU verification apps to actively exploited Windows zero-days and growing strain on the NVD.

    32 min

  7. 20 avr.

    Trusted Tools, Hijacked Sessions & Cheap Paths to Big Access

    In this Initial Access episode, we look at how attackers are reusing trust that is already in place, from hijacked sessions and malicious browser extensions to overlooked industrial systems infrastructure and tightly controlled AI capabilities.

    32 min

  8. 13 avr. ·  Bonus

    Project Glasswing: AI Vulnerability Discovery & Exploit

    In this special episode, we break down Anthropic’s Project Glasswing announcement and what it signals for the future of cybersecurity. At its core, Glasswing is a defensive initiative built around a new class of AI capability: models that can identify, exploit, and help remediate software vulnerabilities. The conversation goes beyond the announcement to unpack what this actually means in practice: where the capability holds real weight, where it remains constrained, and how security leaders should be thinking about control, oversight, and risk as AI begins to meaningfully accelerate offensive security outcomes. Key Takeaways: Glasswing reflects a real inflection point in offensive capability The discussion enforces that AI systems are now capable of performing meaningful vulnerability discovery and exploitation tasks. The significance isn’t just in finding bugs, but in doing so at scale and speed that begins to outpace traditional human-led approaches. The core shift is compression of the attack lifecycle A major theme from the conversation is how AI reduces the time between discovery and exploitation. What historically required time, expertise, and iteration can now be accelerated, which has direct implications for how quickly defenders need to detect and respond. This is as much about attacker enablement as defender tooling While Glasswing is positioned as a defensive effort, the underlying capability is inherently dual-use. The experts highlight that the same advancements enabling defenders will inevitably lower the barrier for attackers, making this a race to adapt rather than a one-sided advantage. Control—not capability—is the real constraint today The limitation isn’t what the AI can do, but how safely it can be deployed. The discussion emphasizes that governance, access restriction, and controlled usage are currently the primary mechanisms preventing misuse—not a lack of technical capability. Human-in-the-loop remains a necessary safeguard While the technology is advancing quickly, the experts stress that human oversight is still critical, particularly when validating findings, making remediation decisions, and preventing unintended consequences from automated actions. This is less about slowing AI down and more about ensuring reliability and accountability. Security programs are not designed for this speed yet Existing security processes (patching cycles, validation workflows, detection models) are not built for a world where vulnerabilities can be discovered and operationalized at machine speed. This creates a growing gap between attacker capability and defender readiness. Validation and testing models need to evolve The conversation highlights the need for more realistic testing approaches that account for AI-driven discovery and exploitation. Traditional assessments may not fully capture how these systems behave or how quickly weaknesses can be identified and chained together. The long-term impact is an expanding and accelerating attack surface As AI continues to improve in code understanding and system analysis, the number of exploitable paths, and the speed at which they can be uncovered, will increase. This isn’t a single breakthrough moment, but the start of a compounding effect on both offense and defense.

    23 min
Tout afficher (19)

À propos

Bishop Fox offensive security researchers, experts, and hackers take a real look at the latest cybersecurity news headlines and have a straight take on them. The goal is simple: do you actually need to care about this, or is it just another variation of the same fundamental security problems we've been dealing with for years?

Informations

  • Création
    Bishop Fox
  • Années d’activité
    2 k
  • Épisodes
    19
  • Classification
    Contenu explicite
  • Copyright
    © 2026 Bishop Fox
  • Site web de l’émission
    Initial Access