On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Alex Stamos to talk through the week’s cybersecurity news, including:

• Everyone’s still panicking about “misbehaving” AI models that are pretty much just doing what they’re being told to do
• Americans are giving AI agents unfettered access to their bank accounts. What could go wrong?
• Last week’s PHP meteor seems to have missed Earth
• This week’s Brotli HTTP/2 critical flaw is this week’s meteor
• The private key is always 4. This time it’s TLS bugs in GoAhead
• Much, much more!

This week’s show is brought to you by Truffle Security. Co-founder and CEO Dylan Ayrey joins James Wilson to chat about scanning GitHub repos and finding more than half a million unique credentials that were never revoked. As Dylan explains, the problem of exposed keys exists everywhere and is only getting worse.

Show notes:

OpenAI AI agents demonstrate VM escapes and secret cross-sandbox communication https://thehackernews.com/2026/10/openai-ai-agents-demonstrate-vm-escapes.html

OpenAi agents disabled safety monitoring, one lied about it https://www.bleepingcomputer.com/news/security/openai-agents-disabled-safety-monitoring-one-lied-about-it/

solst/ICE of Astarte (@IceSolst) on X https://x.com/icesolst/status/2114772787780862362

What I learned from cheating clankers https://risky.biz/RBFEATURES42

Unvetted AI agents are accessing US bank accounts https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access

Hiding Capabilities in AI Models https://www.schneier.com/blog/archives/2026/10/hiding-capabilities-in-ai-models.html

AI is finding bugs faster. Let the market find the fixes https://www.washingtonpost.com/opinions/2026/10/25/ai-is-finding-bugs-faster-let-market-find-fixes

AI Guardrails Aren’t Stopping Criminal Hackers https://www.wired.com/story/ai-guardrails-arent-stopping-criminal-hackers

Andromeda October 2026 Security Incident https://andromeda.ai/security-updates/october-2026-security-incident

Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack

Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber https://cyberscoop.com/bipartisan-bill-combat-ai-distillation-attacks-nist

Hackers got a four-day head start on the PHP2Shell vulnerabilities https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability

Critical HTTP2Shell flaw in Brotli triggers emergency patches https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches

Senators say targeted ads are a security risk. Ad groups say the critics are off base https://cyberscoop.com/targeted-ads-spyware-government-threat

Alleged Israeli spy company heavily targeted Starlink users, sources say https://www.reuters.com/business/media-telecom/alleged-israeli-spy-company-heavily-targeted-starlink-users-sources-say-2026-10-27

LiteLLM release pipeline hacked to distribute info-stealer malware https://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware

CISA warns attackers are chaining Plex flaws in active Plex2Shell attacks https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers

Abandoned Popcorn Time app exposed millions of devices to RCE attacks https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks

Chrome adds Gemini-powered scam detection and ClickFix warnings https://www.bleepingcomputer.com/news/google/google-chrome-adds-gemini-powered-scam-detection-warns-users-of-clickfix-attacks

Microsoft Teams is getting context-aware phishing detection https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection

China-nexus actor linked to attack on ConnectWise cloud backup https://www.cybersecuritydive.com/news/china-nexus-actor-attack-connectwise-cloud-backup/833727/

University of New Mexico hospital diverts ambulances after cyberattack https://therecord.media/university-of-new-mexico-hospital-diverts-cyber-incident

solst/ICE of Astarte (@IceSolst) on X https://x.com/IceSolst/status/2115172268909424707

GitHub Repos Exposed 543,699 Credentials. Nobody Revoked Them https://trufflesecurity.com/blog/github-repos-exposed-543699-credentials-nobody-revoked-them