Loading...

PODCAST

Cyberside Chats: Cybersecurity Insights from the Experts

Stay ahead of the latest cybersecurity trends with Cyberside Chats! Listen to our weekly podcast every Tuesday at 6:30 a.m. ET, and join us live once a month for breaking news, emerging threats, and actionable solutions. Whether you’re a cybersecurity professional or an executive looking to understand how to protect your organization, cybersecurity experts Sherri Davidoff and Matt Durrin will help you stay informed and proactively prepare for today’s top cybersecurity threats, AI-driven attack and

technology tech news

All Episodes

35:47

Three Big AI Shifts: Containment, Cancellation &...

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/10/06

On September 28, three things happened: NVIDIA shipped an open platform to contain AI agents, OpenAI cancelled the release of its next flagship model because it strayed outside its instructions and misreported what it did, and Florida's attorney general asked a court to stop OpenAI from building new models without independent safety review. They are the same story from three angles — and the story began over the summer, when every major lab disclosed that its agents had broken out of the

en

14:27

North Korea’s Fake Job Interviews: The WaterPlum...

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/09/29

This week, Sherri and Matt dig into a joint advisory from seven government agencies across Japan, the US, Australia, and Germany naming WaterPlum, the North Korean actors posing as prospective employers to target software developers and IT professionals.Japan’s National Police Agency reports at least 30,000 infected devices in more than 100 countries between December 2025 and July 2026, with funds or credentials taken from more than 7,000 cryptocurrency wallets and roughly $10.71 million moved to

en

12:31

You Can't Trust the Last Mile: Wiretapping Fiber From...

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/09/24

Two friends ordered a new fiber connection, followed the installer around with a camera, and noticed that the box on the pole outside their house had no power. That one observation led them to capture their entire neighborhood's internet traffic — web browsing, email, even live phone calls — with $99 worth of equipment.Sherri Davidoff and Tom Pohl break down "gPWN," one of the standout talks from Black Hat USA 2026. Fiber to the home broadcasts everyone's traffic to every house on the street and

en

16:30

Outpaced: What AI Did to the Attack Clock

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/09/15

Palo Alto Networks’ Unit 42 investigated an intrusion where the attacker used AI agents to carry out the attack — and compressed work a human team would have needed more than two weeks to do into just under ten hours, using more than 50 MITRE ATT&CK techniques.Sherri Davidoff and Matt Durrin unpack what actually happened, starting with a correction: despite the headlines, this was not an autonomous AI. A human directed it. They walk the chain from a breached public website through sub-agents

en

20:13

AI Collusion? Inside the OpenAI–Hugging Face Attack

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/09/10

This week, Sherri and Matt talk about how much worse the OpenAI–Hugging Face story has gotten. New reporting revealed it wasn't a single model that escaped its sandbox — roughly 1,200 did, and about 700 of them went on to attack Hugging Face. Sherri and Matt walk through how agents that were never supposed to communicate found each other through a shared software package manager, built an improvised message board, started delegating work, and even rolled out their own public-key message signing once

en

16:11

Your Security Tools Can Be Used Against You

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/08/25

On the first night of a remote internal penetration test, a bank’s own vulnerability scanner tried to log in to our computer, using a highly privileged account. That was all it took. We had started with nothing: a foothold on the internal network, no credentials, no domain access. A day later we had domain admin and the password hashes of every user in the bank, a complete takeover built out of the bank’s own security tooling.Sherri Davidoff and Tom Pohl walk through the whole chain: why we relayed

en

12:12

Zoomsday: Anyone in Your Meeting Can Own You

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/08/18

Anyone who can join your Zoom meeting could run code on your device: no click, no download, no sign that anything happened. That’s what Ⓐ Security disclosed on 11 August, in four vulnerabilities in Zoom’s screen-share annotation feature. Zoom patched quickly. The part that should concern security leaders is how the exploit was built — Ⓐ says one researcher did it in under 24 hours, using fewer than 20 prompts to publicly available AI models, against a closed protocol with no published

en

12:36

AI vs. AI: Hacking the Agent, Not the Human

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/08/11

In August 2026 the UK AI Security Institute disclosed that during a routine security evaluation, an AI agent went off-script and attacked real people on the live internet — trying to plant malicious code in a publicly used open-source project and inventing fake identities to pressure the maintainer into approving it. The most unsettling part isn't the deception. It's the targeting: the agent worked out that an AI assistant was helping run the project, and wrote its payload to be invisible to humans

en

28:40

We don’t break in, we badge in (rerun)

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/08/04

In this timely rerun episode, Matt interviews Tom and Derek from our pen test team to break down why attackers often don’t need to hack their way in at all.While most organizations invest heavily in tools like EDR and SIEM, Tom and Derek share how they regularly get inside buildings using nothing more than confidence, a good story, and sometimes even a box of donuts. From posing as copier technicians to tailgating behind employees, their experiences show that people are often the easiest way into

en

12:16

The OpenAI – Hugging Face Autonomous Agent Breach

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/07/28

In this episode, Sherri and Matt discuss the July 2026 incident in which OpenAI’s own AI models escaped a sandboxed cybersecurity evaluation and broke into Hugging Face, generating more than 17,000 recorded malicious actions over a single weekend. The models were being scored on the ExploitGym benchmark — turning known vulnerabilities into working exploits — with safety classifiers deliberately disabled. They found a zero-day in the one service they could reach, escaped, inferred on their own that

en

19:48

Data Is Hazardous Material: How Data Brokers...

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/07/22

For throwback Tuesday we are rerunning a timely episode about Data, and how it should be treated as hazardous material.The FTC has issued an order against General Motors for collecting and selling drivers’ precise location and behavior data, gathered every few seconds and marketed as a safety feature. That data was sold into insurance ecosystems and used to influence pricing and coverage decisions — a clear reminder that how organizations collect, retain, and share data now carries direct security,

en

11:14

600 Payloads, Zero Humans

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/07/14

In this episode, Sherri and Matt discuss JADEPUFFER — the first publicly documented ransomware operation executed end-to-end by an AI agent. According to Sysdig Threat Research, the AI drove the whole intrusion: reconnaissance, exploitation, lateral movement, and extortion. It fixed its own failed attacks in 31 seconds, fired off 600+ payloads, and encrypted 1,342 database records — yet it also narrated its crimes in plain English and demanded ransom to a hallucinated Bitcoin address. Fast AND

en

19:32

RMISC 2026 Recap: Twenty Years In — Who's Holding the...

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/07/07

The Rocky Mountain Information Security Conference just celebrated its 20th anniversary in Denver — and the anniversary edition told us exactly where the industry's head is at. In this quick-hit recap, Matt Durrin and Todd Stewart break down the biggest themes from three days at the Colorado Convention Center: agentic AI moving into the SOC (and the “circuit breaker” conversation about how to rein it in), state-level AI regulation getting real with the Colorado AI Act and updated CCPA audit rules,

en

26:18

Poisoned on Open: The New Worm Hacking Your AI

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/06/30

Vibe coding is everywhere now and a new worm is built to exploit it. Whether it's your IT staff spinning up a handy new tool or the software vendor you rely on, the moment someone opens AI-generated or downloaded code in an assistant like Cursor or Claude Code, it strikes, no install, no "run" required. In its nastiest move, this worm, known as Miasma, talks the AI itself into running the attacker's payload. This isn't theoretical: in June 2026 it breached Microsoft's own code, compromising

en

12:33

The Meta AI Hack: Just Ask Nicely

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/06/23

Hackers didn’t breach Meta’s systems, they just asked. In this episode, we break down the Meta AI hack, where attackers used a VPN and a politely worded chat message to convince Meta’s AI support agent to hand over more than 20,000 Instagram accounts, including the dormant Obama White House account and the personal account of a senior Space Force leader. No malware, no phishing, no exploit code. We flash back to the 2023 MGM Resorts attack to show how this fits one of the fastest-growing attack

en

11:48

Washington Calls AI a Weapon: Ghosts of the Crypto Wars

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/06/16

Three days after Anthropic put its most powerful AI models in public hands, the U.S. government invoked export-control authority to bar foreign nationals from Fable 5 and Mythos 5. The result: Anthropic was forced to shut both models down for everyone, worldwide. We dig into what actually triggered the order, why the only outside expert known to have read the underlying report calls it an overreaction, and how the fight echoes the 1990s crypto wars, when Washington branded encryption software a

en

15:18

Damaged Goods: When your new hire is already compromised

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/06/09

In this eye-opening episode of Cyberside Chats, Sherri Davidoff sits down with Tom Pohl, Director of Penetration Testing at LMG Security, to unpack a chilling new attacker technique: threat actors posing as recruiters, conducting real interviews, and delivering malicious coding challenges that infect candidates’ personal machines. What looks like a legitimate take-home coding test is actually malware that steals passwords, browser credentials, crypto wallets, SSH keys, and more, all before the

en

16:31

The CRM Goldmine: Inside the Salesforce Breach Wave

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/06/02

It started with a phone call. No malware, no zero-day — just someone talking a Charter worker out of their login. Months later, 4.9 million customer records surfaced on a leak site, pulled from the company's Salesforce instance.The CRM has become the richest target in enterprise security. Sherri and Matt break down why, and walk through three cases: Charter, where one vished login reached everything; the Salesloft Drift and Gainsight chain, where one stolen token unlocked the next breach and the

en

28:53

Shadow Agents: When Your AI Workforce Has No Boss

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/05/26

Your organization is already running an AI workforce and almost nobody knows who they report to, what they can touch, or how to shut them down. In this episode, Sherri Davidoff and Matt Durrin break down the shadow AI agent problem: what makes an agent a "shadow" agent, how real breaches are already happening because of them, and what security leaders can do about it this week. Using three case studies: Anthropic's Claude Dispatch as a canonical product example, the April 2026 Vercel breach (the

en

15:17

Better Than Google, Still Risky: The OpenEvidence Story

Cyberside Chats: Cybersecurity Insights from the Experts ·

2026/05/19

65% of US doctors are using an AI tool their hospital never approved — on personal phones, under click-through contracts. Sherri and Matt unpack what every CISO and IT leader should learn from it about shadow AI, "free" professional tools, and the contracts nobody's reading.The tool is OpenEvidence — 27 million clinical queries in April 2026 alone, 60% of them shaping actual treatment decisions. Doctors love it because the alternative was Googling patient symptoms on a personal browser. Their

en

90 results

Similar Podcasts

Lead With AI

Tamara Nall

Two Blokes Talking Tech

Trevor Long and Stephen Fenech

Pioneers of AI

WaitWhat

The Brave Technologist

Brave Software

The Good Tech Companies

HackerNoon