Risky Business #856 -- 8-bit encryption, PHP megabugs and more

On this week’s show Patrick Gray and James Wilson are joined by special guest co-host security engineer Mark El-Khoury to talk through the week’s cybersecurity news, including:

• The PHP foundation is about to release patches for a couple of critical bugs… We’re watching to see if the internet burns down
• 8 private keys underpinning some CA certs got compromised. The keys only had 8 bits of entropy!
• Is the breach-polcalypse upon us?
• OpenAI’s inside spy, Anthropic’s safety bill and election influence campaigns are coming for your chatbots
• Ukraine drone strikes hit more Russian data centres, this time VK’s in the firing line
• Much, much more!

This week’s show is brought to you by Trail of Bits. Principal Security Engineer Anish Naik joins James Wilson to chat about two agent skills plugins, Patching Bugs and Regression Hunt, that the company is releasing off the back of its joint initiative with Open AI, Patch the Planet.

This episode is also available on YouTube

Show notes

• The PHP Foundation (@ThePHPF) on X
• The Internet goes on high alert after discovery of 8 compromised TLS certs
• OpenCode breach exposes users' external AI-provider API keys
• DHS to ban DeepSeek from federal civilian agencies
• Rob Joyce (@RGB_Lights) on X
• OpenAI engineer accused of spying on executives remains in custody
• An OpenAI Employee Allegedly Used a Chatbot to Help Plant a Recording Device at the Office
• Anthropic quietly pitches its own AI safety bill to lawmakers
• The next election influence campaign will target your AI chatbot
• Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
• Thousands of refrigerator devices remain exposed following French cyberattack
• AI agents navigated unfamiliar OT systems and moved equipment within minutes
• Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem
• Feds crack down on North Korean IT-worker schemes with new raids, charges and arrests
• Federal bankruptcy courts dealing with outages after contractor cyberattack
• Russian social media giant VK faces disruptions after data center drone strike
• Data Cente