Full Segment Notes
Famous Mathematician feuds, Delta Flight 591, Lazarus, Akira, Computer History, Zoom, Clones, LiteLLM, Josh Marpet, and More on this episode of the Security Weekly News.
Announcements
- There’s no shortage of threat intel out there. Feeds, reports, alerts, it just keeps coming. But the real problem is figuring out what any of it actually means for your environment.At the Threat Intelligence Virtual Cybersecurity Summit on August 26th, we’ll dig into how teams are cutting through the noise and turning intel into something useful.Security Weekly listeners can register for free at https://securityweekly.com/threatintel using the promo code: CSS26-SW
- InfoSec World brings cybersecurity professionals together across industries, from healthcare and financial services to government and the Fortune 500. Join the community in Orlando, October 12–14, for practical education, new perspectives, and cybersecurity research unveiled live. Listeners save 30% on their pass with code ISW26-SWSAVINGS at securityweekly.com/infosecworld2026.
List of Articles
Doug White
- Trump Gives Green Light to U.S. Companies to Aim Hacks at Cybercriminals
- Delta Flight Hit By Hackers After DEF CON Las Vegas — Crew Says They “Jammed” The Inflight Wi-Fi
- DPRK’s Lazarus Group exploits Windows zero-day in backdoor campaign
- Akira ransomware attacker uses Safe Mode reboot to evade EDR
- OpenAI ditches Recall-style screenshot surveillance for friendly keylogging
- Zoom Patches Zero-Click Code Execution Vulnerability
- Some of tech’s CEO suite is cloning itself with AI. What happens next?
- Terabytes of credentials leaked in massive supply-chain attack
Joshua Marpet
- “We Spent 20 Years Securing the Supply Chain. AI Agents Just Reset the Clock to Zero”
AI agents load third-party skills and MCP servers at runtime, inheriting the user's email, files, and system access, but the ecosystem shipped with none of the supply-chain controls open source spent 15 years building. No mandatory authentication, no cryptographic signing, no provenance verification, no publisher vetting. The killer data points: nine of eleven MCP marketplaces accepted unvetted proof-of-concept malware with zero review; a fake agent skill passed both Cisco's and NVIDIA's scanners and reached ~26,000 corporate agents; and OX Security found 10+ critical CVEs in Anthropic's own MCP SDKs affecting 200,000 servers.
