On this week’s show Patrick Gray and James Wilson are joined by special guest co-host security engineer Mark El-Khoury to talk through the week’s cybersecurity news, including:

• The PHP foundation is about to release patches for a couple of critical bugs… We’re watching to see if the internet burns down
• 8 private keys underpinning some CA certs got compromised. The keys only had 8 bits of entropy!
• Is the breach-polcalypse upon us?
• OpenAI’s inside spy, Anthropic’s safety bill and election influence campaigns are coming for your chatbots
• Ukraine drone strikes hit more Russian data centres, this time VK’s in the firing line
• Much, much more!

This week’s show is brought to you by Trail of Bits. Principal Security Engineer Anish Naik joins James Wilson to chat about two agent skills plugins, Patching Bugs and Regression Hunt, that the company is releasing off the back of its joint initiative with Open AI, Patch the Planet.

Show notes:

The PHP Foundation (@ThePHPF) on X https://x.com/ThePHP F/status/2112633155631108544

The Internet goes on high alert after discovery of 8 compromised TLS certs https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs

OpenCode breach exposes users’ external AI-provider API keys https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts

DHS to ban DeepSeek from federal civilian agencies https://cyberscoop.com/dhs-bans-deepseek-federal-agencies

Rob Joyce (@RGB_Lights) on X https://x.com/RGB_Lights/status/2112165080527667256

OpenAI engineer accused of spying on executives remains in custody https://www.wired.com/story/openai-engineer-accused-of-spying-on-executives-ordered-to-remain-in-custody

An OpenAI Employee Allegedly Used a Chatbot to Help Plant a Recording Device at the Office https://www.wired.com/story/an-openai-employee-allegedly-used-a-chatbot-to-help-plant-a-recording-device-at-the-office

Anthropic quietly pitches its own AI safety bill to lawmakers https://www.politico.com/news/2026/10/16/anthropic-ai-safety-01124654

The next election influence campaign will target your AI chatbot https://cyberscoop.com/ai-chatbots-election-influence-hyperlocal-networks

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site

Thousands of refrigerator devices remain exposed following French cyberattack https://www.cybersecuritydive.com/news/thousands-refrigerator-devices-exposed-french-cyberattack/833117

AI agents navigated unfamiliar OT systems and moved equipment within minutes https://www.security week.com/ai-agents-navigate-unfamiliar-ot-systems-and-move-equipment-in-minutes-booz-allen-finds

Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem https://cyberscoop.com/microsoft-disrupts-chinese-language-phishing-kit-ecosystem

Feds crack down on North Korean IT-worker schemes with new raids, charges and arrests https://www.cybersecuritydive.com/news/north-korea-it-worker-raids-arrests-charges/832968

Federal bankruptcy courts dealing with outages after contractor cyberattack https://therecord.media/federal-bankruptcy-courts-dealing-with-cyberattack-outage

Russian social media giant VK faces disruptions after data center drone strike https://therecord.media/russian-social-media-giant-vk-faces-disruptions-drone-strike-data-center

Data Centers Are War Targets Now https://www.404media.co/data-centers-are-war-targets-now

How a Massive Chinese Crime Ring Hacked Staples to Steal Millions https://www.404media.co/how-a-massive-chinese-crime-ring-hacked-staples-to-steal-millions

Microsoft Patches More Than 1,400 Security Flaws https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws

GitHub expands malware advisories across eight package ecosystems https://openssf.org/blog/2026/10/16/case-study-github-expands-malware-advisories-across-eight-ecosystems-with-openssf

Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack

AdFection: How mercenary spyware invades victims’ devices through targeted advertising https://cyberscoop.com/adfection-zero-click-spyware-discover-tech

CISA warns of new Ivanti bug being exploited as latest Patch Tuesday breaks records https://therecord.media/new-ivanti-microsoft-bugs-exploitation

Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day https://therecord. /beyond-trust-cyberattack-china

Drupal patches critical RCE flaws and warns exploits may emerge soon https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon

Find full show notes at https://risky.biz/RB856