Doombuds, Office, Telnetd, Chrome, Vishing, Ralph, PeckBirdy, The Boss, Aaran Leyland – SWN #550
Doombuds, Office 1.0, Telnetd, Chrome, Vishing, Cursed Ralph, PeckBirdy, The Boss, Aaran Leyland, and More on the Security Weekly News.
Security Weekly listeners save $100 on their RSAC 2026 All Access Pass! RSAC 2026 Conference will take place March 23rd to March 26th in San Francisco. To register using our discount code, please visit securityweekly.com/rsac26 and use the code 56U5SECWEEKLY! We hope to see you there!
Most security conferences talk about threats. Zero Trust World lets you attack them. From March 4th to 6th, 2026 in Orlando, Florida, this hands-on cybersecurity event features live hacking labs where you’ll break real environments, think like an adversary, and learn how attacks really work. You’ll also get expert sessions, real-world case studies, CPE credits, and networking with top practitioners. And yes — the Security Weekly team will be there too. Don’t miss it! Register today at securityweekly.com/ZTW.
Doug White
- Microsoft patches actively exploited Office zero-day vulnerability
- Nearly 800,000 Telnet servers exposed to remote attacks
- Researchers find 16 browser extensions stealing ChatGPT session tokens
- Okta warns of multiple vishing attacks that can defeat MFA
- ‘Ralph Wiggum’ loop prompts Claude to vibe-clone software
- China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023
- Should smartphones be locked away at gigs and in schools?
- How to get Doom running on a pair of earbuds
Aaran Leyland
- Wiper Malware Targeting Poland’s Power Grid Tied to Moscow
• Treat internet exposure of OT-adjacent management as a defect. Eliminate it or justify it formally. • Build a real OT asset + remote access inventory (including vendor paths), then continuously validate it from the outside. • Enforce segmentation with strict choke points, and make remote access time-bound, monitored, and isolated. • Invest in OT-visible logging and detection, not just IT SOC coverage. • Rehearse manual operation and recovery (loss of view, loss of HMI, workstation wipe, historian rebuild). • Build a cross-org playbook with suppliers and integrators for rapid containment and rebuild. • Use policy: procurement and regulation that penalises insecure default remote management in CNI supply chains. • Deterrence: coordinated attribution, sanctions, takedowns, and public exposure when it’s warranted.
