Cybersecurity Under Pressure. Real Attacks, Real Lessons

91:23

SBOM: From Inventory to Decision

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/10/07

An SBOM can tell you which components are present. It cannot decide which vulnerabilities create real operational risk.This episode examines the gap between software inventory and defensible action. We follow the path from component discovery to vulnerability assessment, operational context and treatment decisions, especially in cyber-physical environments where patching can affect availability, safety and production.We discuss:• why an SBOM is evidence, not a risk verdict• how CVSS, exploitability

en

2:01

When 40 Milliseconds Become an OT Incident | CUP...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/10/06

Forty milliseconds can turn a wireless disruption into a physical process failure. This CUP Micro Brief connects industrial 5G latency, device isolation and the identity gap between telecom authentication and industrial control.Listen to the full episode:https://podcasters.spotify.com/pod/show/toni-gonzalez-burgueo/episodes/Stopping-Stealthy-Radio-Jamming-in-Industrial-5G-When-the-Air-Interface-Becomes-the-Attack-Surface-e3lkhs7

en

3:50

The Flashing Station Is a Product Trust Boundary |...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/10/06

A compromised flashing station can turn a factory incident into a fleet-wide product integrity problem. This CUP Focus follows the trust chain from plant server to diagnostic tool, ECU firmware and secure boot.Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive.Listen to the full episode: https://podcasters.spotify.com/pod/show/toni-gonzalez-burgueo/episodes/Missing-Cybersecurity-Evidence-Can-Delay-Production-e3knvdo

en

80:20

CRA’s 24-Hour Clock: Deciding Under Incomplete Evidence

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/10/05

The Cyber Resilience Act’s 24-hour early-warning window does not give manufacturers 24 hours to complete an investigation. It forces them to decide whether the available evidence meets the reporting threshold while technical facts are still incomplete.This episode examines that decision problem in cyber-physical products. We separate software integrity from physical behaviour, follow the evidence path from detection to regulatory assessment, and test what happens when engineering, legal,

en

80:41

Schneider Electric’s CVE-2026-77120: The Dangerous...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/10/02

An authenticated user is not necessarily a trusted user. CVE-2026-77120 in Schneider Electric PowerLogic T300 shows how an account with SSH access can cross a weak privilege boundary and reach root-level control through OS command injection.This episode examines the vulnerability as an operational security problem, not just a patching task. We break down the technical path, the assumptions that make exploitation possible, and the decisions asset owners must take when an RTU supports critical

en

1:57

When EV Charging Becomes a Cyber-Kinetic Risk | CUP...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/10/01

An EV charging cable initiates a cloud-connected transaction with physical consequences. This CUP Micro Brief follows the path from complex connectivity, through unsafe input validation, to cyber-kinetic manipulation of electrical limits.Listen to the full episode:https://podcasters.spotify.com/pod/show/toni-gonzalez-burgueo/episodes/How-EV-Chargers-Could-Crash-the-Grid-The-Cyber-Risk-Behind-Mass-Electrification-e3lkh8c

en

1:44

What Actually Starts the CRA 24-Hour Clock? | CUP...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/09/29

Not every vulnerability starts the Cyber Resilience Act reporting clock. This CUP Micro Brief explains the two triggers, why reachability and VEX matter, and how CRA product obligations differ from NIS2 operator duties.Listen to the full episode:https://podcasters.spotify.com/pod/show/toni-gonzalez-burgueo/episodes/The-24-Hour-Trap-Defensible-Decisions-Under-the-Cyber-Resilience-Act-e3lumm0

en

62:51

A Supplier List Is Not a Trust Chain: NIST IR 8536...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/09/25

Knowing who your suppliers are is useful. Collecting SBOMs is useful. Neither, by itself, proves where a component came from, what happened to it during its lifecycle or whether the evidence describing it can still be trusted.In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine NIST IR 8536, Supply Chain Traceability: Manufacturing Meta-Framework, and the problem it is trying to solve: how organizations can build verifiable provenance across increasingly complex,

en

63:52

Local Does Not Mean Low Impact: CVE-2026-24083 and...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/09/23

A vulnerability with a local attack vector can have serious consequences. But “local” does not automatically mean remote vehicle compromise, and it certainly does not prove that an attacker can reach safety-relevant vehicle functions.In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine CVE-2026-24083, a memory-corruption vulnerability affecting Qualcomm Snapdragon Auto platforms including QAM8295P, QCA6696 and SA8295P. The vulnerability occurs while processing

en

75:17

One PLC, Multiple Security Lifecycles: The SIMATIC...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/09/21

An industrial asset may appear as a single box in an inventory, but that does not mean everything inside it follows the same cybersecurity lifecycle.In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine vulnerabilities affecting the additional GNU/Linux subsystem of the Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP and use them to challenge one of the most persistent simplifications in OT asset management: the assumption that one physical device represents one

en

73:51

Security Sign-Off for Silicon: Why Chip Security Must...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/09/18

Semiconductor development already has formal gates for functionality, timing, power and physical implementation. Security is increasingly becoming another condition that must be demonstrated before a design can be considered ready.In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine the emerging concept of security sign-off in semiconductor development and what it means for an industry building increasingly complex, heterogeneous and software-dependent hardware

en

79:16

One Hardcoded Key, Many Systems at Risk: The Johnson...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/09/16

A hardcoded cryptographic key can look like a relatively simple implementation mistake. In an embedded or industrial system, however, that single decision can undermine an entire security architecture.In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine CVE-2026-64887 affecting Johnson Controls Airwall and use it to explore a broader problem in embedded cybersecurity: what happens when a secret intended to establish trust is permanently built into the product

en

96:01

When the Security Router Becomes the Attack Path:...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/09/09

An industrial security router is supposed to protect the factory floor. But when that router is vulnerable, the security boundary itself can become the attacker’s path into production.In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine vulnerabilities affecting Weidmüller industrial security routers and the wider operational problem they expose. These devices may provide firewalling, network segmentation, VPN connectivity and remote access between industrial

en

80:09

When Edit Permissions Become System-Level Code Execution

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/09/04

Least privilege can look perfectly correct inside an application and still fail one layer below.In this episode, we examine CVE-2026-3014 in Siemens Siveillance Video, a critical vulnerability affecting the Management Server API. An authenticated user with edit permissions can execute arbitrary code in the context of the Management Server Service.That distinction matters. This is not an unauthenticated remote-code-execution scenario. The attacker already needs a meaningful application privilege. But

en

90:56

A Critical CVE Is Not an Attack Path: Assessing...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/09/02

A critical vulnerability tells you what could be exploited. It does not tell you whether an attacker can actually reach it, what conditions would be required or what the operational consequences would be inside your plant.In this episode, we examine the Phoenix Contact PLCnext advisory as a practical example of why OT vulnerability management cannot stop at CVSS.For PLCnext firmware before version 2026.0.3, CVE-2025-41769 affects the PROFINET service in its default configuration. An unauthenticated

en

76:14

When a Vehicle Detects the Attack but Cannot Safely...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/08/31

Detecting a cyberattack inside a moving vehicle is only the beginning. The harder question is what the vehicle should do once malicious traffic has been identified.In this episode, we examine the AutoHack dataset and a 2023 Hyundai vehicle experiencing synchronised anomalies across its C-CAN, P-CAN and B-CAN networks. The research provides a rare view of how attacks can propagate across multiple in-vehicle buses and produce observable consequences in a real cyber-physical system.We break down the

en

40:29

Supported Hardware, Vulnerable Software: The Hidden...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/08/24

An industrial firewall can remain fully supported as hardware while carrying software risk inherited from another supplier.In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine the vulnerabilities affecting Fortinet software hosted within Siemens RUGGEDCOM industrial hardware — and the broader assurance problem exposed by that combination.The Technical Breakdown moves beyond the vulnerability list to examine the asset itself.An industrial security appliance is not

en

39:01

Authenticated but Wrong: When Railway APIs Contradict...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/08/21

A railway API can be correctly authenticated, protected by strong cryptography and accepted by every security control in the chain — while still delivering operationally wrong data.In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine a critical limitation of digital trust in interconnected railway environments: authentication can prove where data came from, but it cannot prove that the data still reflects physical reality.The Technical Breakdown explores the

en

41:17

Bendix EC80 Brake Recall: When Safety Urgency Meets...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/08/17

A brake recall is first and foremost a physical safety issue. But what happens when the pressure to act quickly collides with the security controls protecting a critical vehicle system?In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we use the Bendix EC80 brake recall to examine a difficult product cybersecurity problem: how to preserve cyber resilience when safety-critical engineering decisions have to move fast.The Technical Breakdown starts with the asset itself,

en

38:58

Minnesota Water Cyberattacks: When OT Security Meets...

Cybersecurity Under Pressure. Real Attacks, Real Lessons ·

2026/08/10

What happens when a cyberattack moves beyond IT systems and begins to threaten the physical processes communities depend on?In this episode of Cybersecurity Under Pressure: Real Attacks, Real Lessons, we examine the cyberattacks targeting water systems in Minnesota and the deeper OT security lessons behind them.We break down how attackers can exploit weaknesses around industrial environments, use detailed engineering knowledge against defenders, and turn access to PLCs and operational systems into a

en

All Episodes

Similar Podcasts

Lead With AI

Tamara Nall

Two Blokes Talking Tech

Trevor Long and Stephen Fenech

Pioneers of AI

WaitWhat

The Brave Technologist

Brave Software

The Good Tech Companies

HackerNoon