On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Ciaran Martin, former CEO of the UK’s National Cyber Security Centre (NCSC), to talk through the week’s cybersecurity news, including:

• The $6.3 billion dollar Binance hack turned out to be pretty clunky, but it ain’t dumb if it works we guess
• Meanwhile Brazil’s Mercado Bitcoin loses “millions”. Cute!
• A bit late to make the Word of the Year shortlist, but Google’s coined a new term with “LLMjacking”
• An infosec guy’s clankers hacked another infosec guy, everyone’s arguing about it, it’s funny
• Much, much more!

This week’s show is brought to you by runZero. VP of security research Tod Beardsley joins Patrick Gray to chat about fear around the looming post-quantum cryptography crisis, and how CISOs can use it as an opportunity to clean up house and finally take all the end-of-life products out to pasture.

Show notes:

Binance hot wallet heist (Oct 2026) https://therecord.media/binance-cryptocurrency-theft-months-long-campaign-nkorea

Binance on X: “29 October Binance Security Incident: Initial Findings and Response Update” / X https://x.com/binance/status/2117626126214504729?s=46

Largest crypto exchange in Brazil confirms cyberattack as millions flow out of platform https://therecord.media/mercado-bitcoin-brazil-cryptocurrency-heist

Polymarket DebugBear script compromise https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html

Chainalysis “offensive agentic techniques” breach https://www.bleepingcomputer.com/news/security/chainalysis-discloses-data-breach-from-offensive-agentic-techniques

Trezor warns of suspected crypto-theft implant in hardware wallet https://www.bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet

Second wave of suspected cyberattacks hits supermarket freezers across Europe https://therecord.media/cyberattack-grocery-freezers-europe

Amadeus booking data breach https://www.bleepingcomputer.com/news/security/japan-airlines-suffers-third-party-data-breach-exposing-passenger-info/

DHS Icepick personnel data leak https://www.sofx.com/dhs-data-breach-exposes-information-on-more-than-40000-employees-including-ice-and-border-patrol-agents/

Google says LLMjacking attacks can rack up $1 million in cloud AI charges https://www.bleepingcomputer.com/news/security/google-llmjacking-attacks-rack-up-1-million-in-cloud-ai-charges

Northflank security breach leads to abuse of customers’ AI API keys https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys

Rikiya Takehi (@rikiyatakehi) on X https://x.com/rikiyatakehi/status/2117313742891327994?s=12

Russia’s AI-powered hacks are causing chaos in Ukraine https://risky.biz/RBFEATURES43

Volt Typhoon “Silent Train” network https://www.zetter-zeroday.com/silent-train-volt-typhoons-sophisticated-infection-chain-into-us-targets-exposed

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware https://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware

PHP2Shell (CVE-2026-109618/109619) https://www.cybersecuritydive.com/news/palo-alto-networks-firewalls-compromised-chained-attacks-php2shell/873323

GitLab CVE-2026-97229 CI/CD regex RCE https://www.bleepingcomputer.com/news/security/alpine-linux-rebuilds-gitlab-after-attempted-rce-attack

CISA warns of hackers now exploiting critical Node2Shell flaw https://www.bleepingcom puter.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw

Critical Linux kernel flaw allows remote root attacks on MPTCP servers https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers

Marcus Hutchins (@MalwareTechBlog) on X | X (formerly Twitter) https://x.com/malwaretechblog/status/2117508092321747077?a=49EPEBIamn6dyblqLCg&s=46

New Android “SMS of Death” exploit can remotely crash unpatched phones https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones

Hackers now scanning systems for recently patched Oracle flaw https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw

Ivanti patches two more Connect Secure zero-days chained in attacks https://www.bleepingcomputer.com/news/security/ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks

Trojanized Claude Code extension (v2.1.313) https://www.stepsecurity.io/blog/claude-code-extension-trojanized

For full show notes visit https://risky.biz/RB858