Castuner

The Critical Stack

Jacob C

Cybersecurity news moves fast. Most of it is noise. This is the signal. The Critical Stack Daily Briefing cuts a day's worth of security news down to what actually matters: real CVEs, real breaches, real regulatory deadlines, no vendor spin. If it's not worth your attention, it's not in the episode.

Сайт подкаста

Слушайте в своём приложении

Эпизоды

58 эпизодов

  1. Nov 7: SonicWall SSL-VPN SAML flaw (CVE-2026-19868) can bypass MFA and is exploited in attacks 5:36
  2. Nov 6: CWPdoor backdoor hides in trojanized Control Web Panel web server 5:32
  3. Nov 5: Zyxel patches zero-day exploited to compromise nearly 1,000 network switches 5:26
  4. Nov 4: CISA confirms active exploitation of WordPress core flaw during software upgrades 4:49
  5. Nov 3: Maximum-severity Siemens SIMATIC IoT2050 flaw under active exploitation 5:21
  6. We're Thinking Too Small About AI-Driven Containment 8:57
  7. Nov 2: Follow-up: Ivanti patches two more zero-days exploited in the Connect Secure attack chain 4:37
  8. Nov 1: CVSS 10.0 flaw in LXD and MicroCloud lets attackers impersonate trusted clients 4:18
  9. Oct 31: Attackers chain three Ivanti Connect Secure flaws for unauthenticated root access 5:16
  10. Oct 30: Official Claude Code VS Code extension compromised to install persistent SSH backdoor 5:20
  11. Oct 29: Cisco SD-WAN flaw exploited to plant KeyDrift malware that steals traffic encryption keys 5:17
  12. Oct 28: ShinyHunters' Oracle PeopleSoft zero-day is actually three chained flaws 5:17
  13. Oct 27: CISA confirms PHP2Shell flaws are now exploited in attacks 5:07
  14. Oct 26: AI coding agents hijacked via a malicious AGENTS.md in the Downloads folder 5:45
  15. The Threats Don't Decide What Matters 10:38
  16. Oct 25: CISA flags actively exploited critical flaws in Collabora Online and Arista VeloCloud 5:51
  17. Oct 24: Brotli decoder flaw behind Node.js RCE also hits Bun, Python and other software 5:19
  18. Oct 23: Arista patches second VeloCloud Orchestrator zero-day exploited in attacks 6:02
  19. PHP Emergency Patches, a Japanese Cloud Breach, and Agents That Switch Off the Watchers 2:59
  20. Federal Patch Order: Plex2Shell, Siemens and SiteGuard Chain Into Unauthenticated RCE 3:07
  21. Signed, Trusted, and Compromised: Siemens ClickFix and the ConnectWise Backup Shutdown 3:11
  22. Your Firewall Is the Foothold: SiteGuard WAF Under Active Attack 2:51
  23. One Stolen Credential, One Hundred Seventy-Three Tenants: The ConnectWise Breach 3:11
  24. Trusted Access, Turned Against You: Next.js RCE, a China-Linked BeyondTrust Zero-Day, and an AI Agent Gone Rogue 3:14
  25. BeyondTrust Zero-Day Lands as AI Agents Learn to Move Industrial Equipment 2:54
  26. PAN-OS Root Exploit, a Ledger Reseller Implant, and an AI Agent's OTP Bypass 3:06
  27. Ship AI Like a Medical Device 10:00
  28. Ivanti Zero-Day Hits Connect Secure as Microsoft Ships a Record Patch Batch 3:06
  29. SonicWall Under Fire: One Hundred Thirty-Five Attacks Land After the Patch 3:14
  30. CyberXero Turns Claude Code on Ukraine as Bricksforge and Palo Alto Flaws Stay Open 3:05
  31. Agents at the Bank Door: ARTEX AI and Claude Agents Hit South Korea 3:11
  32. SonicWall Exploited in Three Days, and an AI Agent Hands Over the Keys 3:13
  33. Citrix NetScaler Burns Again: Patch the Edge First 2:58
  34. Hours, Not Days: PoeLLM Hits 3,400 AI Servers as SonicWall Patches a Perfect 10 3:11
  35. FortiBleed Keeps Bleeding Credentials While WordPress Backdoors and Rogue Agents Pile On 4:08
  36. Bounded Autonomy 12:13
  37. Missed Patch, Open Doors: FBI Blames a Contractor as Denmark's Registry Leaks 2:39
  38. NetScaler Zero-Day CVE-2026-88779 Is Under Attack: Patching May Not Be Enough 3:15
  39. OpenAI's Runaway Agents Draw a Subpoena as GitLab Patches a Nine Point Nine a-i Gateway Flaw 3:51
  40. Cisco's s-d-wan Zero-Day, and the Agents Nobody Is Watching 3:52
  41. Cisco SD-WAN Manager Hits k-e-v: The Management Plane Is the Target 4:06
  42. Trusted Tools, Untrusted Code: Bitget's $388M Third-Party Flaw and the MCP Server Stealing OAuth Tokens 4:05
  43. The Trouble with Context 6:20
  44. JadePuffer Deletes the Cloud: Stolen Service Principals and the Ninety Percent Problem 4:02
  45. Carbonato's AI Agents, Astrana's Spoofed Phone Call, and Who Goes to Jail When the Model Hacks 4:03
  46. Power Down: Kiteworks Pulls the Plug, and North Korea Takes Three Hundred Fifty-One Million 4:19
  47. Perimeter On Fire: SonicWall's Chained Ten, AnMed Goes Dark, and Ransomware Without a Human 4:14
  48. Same-Day Exploitation: WordPress, Revolut's Fake Warrant, and Cisco's Perfect Ten 4:07
  49. A Perfect Ten: Arista VeloCloud Under Attack, ShinyHunters Robs Cl0p 4:27
  50. Nine Hundred Seventy-Four Bugs — And the One That Actually Matters 4:25