This episode covers the critical unauthenticated RCE vulnerabilities in the core PHP runtime and the Brotli compression library, alongside the LiteLLM supply chain attack that exposed master keys. The discussion also touches on Sam Altman's comments regarding the inability to patch all AI-generated bugs, the fact that it took 40 years, but FOSS got what they wanted. I also chat about the eMudra TLS certificate key weakness.

Watch the video on YouTube: https://www.youtube.com/watch?v=mTu8sGbzdiA has 30 minutes of additional audio with our weekly www.socvel.com/quiz for all things threat intelligence.

 

Chapters
00:00 Intro and Zero Breach Toolkit
07:35 LiteLLM Supply Chain Attack
13:02 PHP Core Runtime Vulnerabilities
22:35 Sam Altman on Patching AI Bugs
37:56 eMuhdra TLS Certificate Weakness
44:22 Qwen AI Model Egress Incident
53:12 BSides Seattle and BSides San Diego CFP

Links
07:35 https://www.theregister.com/security/2026/10/26/litellm-supply-chain-attack-started-with-an-exposed-master-key/5305544
13:02 https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619
22:35 https://tech.yahoo.com/cybersecurity/articles/no-longer-think-going-able-152427001.html?
37:56 https://hackread.com/emudhra-exit-ssl-tls-market-8-ca-keys-guessable/
44:22 https://securityaffairs.com/201810/ai/cohere-finds-qwen-ai-model-contacting-a-server-in-china.html

 

Rss Apple Podcaster
Podden och tillhörande omslagsbild på den här sidan tillhör Bryan Brake, Amanda Berlin, and Brian Boettcher. Innehållet i podden är skapat av Bryan Brake, Amanda Berlin, and Brian Boettcher och inte av, eller tillsammans med, Poddtoppen.