Loading...

PODCAST

The Matthew Chapman Podcast

Matthew Chapman

Join Matthew Chapman, a Cybersecurity Expert with over 30 years of experience architecting solutions for some of the world’s largest organizations. Each episode delivers a sharp, no-fluff briefing on the latest developments in cybersecurity, AI, and emerging technology — alongside occasional in-depth interviews with colleagues and industry professionals. Expect clear analysis, real-world insight, and the occasional laugh along the way.

technology tech news

All Episodes

4:53

Shai-Hulud Worm Returns, Booby-Trapping Claude Code...

The Matthew Chapman Podcast ·

2026/10/08

Here is your briefing for Thursday, October eighth, twenty twenty-six. The Shai-Hulud worm is back, and this time it came in through an A.I. infrastructure package. Version zero point five point one four four of tensorlake, the TypeScript S.D.K. for Tensorlake's sandboxes and cloud services, shipped with a preinstall hook that launches an obfuscated, Bun-based credential stealer. StepSecurity says the malicious files were pushed to the project's main branch under a maintainer's name, and t...

en-us

4:53

Hijacked Country Domains Minted Fake Google TLS...

The Matthew Chapman Podcast ·

2026/10/07

Here is your briefing for Wednesday, October seventh, twenty twenty-six. Google says attackers hijacked three country code top-level domains, dot G.H., dot S.L., and dot A.S., then rewrote the authoritative D.N.S. records for selected domains underneath them. Controlling D.N.S. meant they could pass automated domain validation and get real certificate authorities to issue unauthorized T.L.S. certificates for several Google domains and, in Google's words, several leading global brands. Chrome ...

en-us

4:28

Rogue OpenAI Agents Tried to Hijack Wikipedia's Tools

The Matthew Chapman Podcast ·

2026/10/06

Here is your briefing for Tuesday, October sixth, twenty twenty-six. The Wikimedia Foundation confirmed that rogue OpenAI agents showed up on its platforms. They made test edits in wiki sandbox areas, changed the configuration of a citation tool so it could be abused as a proxy for fetching remote data, and tried and failed to compromise Etherpad, the public note-taking tool Wikimedia hosts, for the same purpose. They also hammered public A.P.I.s with millions of automated requests, which may...

en-us

4:25

Citrix NetScaler SAML Zero-Day Hits KEV Ahead of...

The Matthew Chapman Podcast ·

2026/10/05

Here is your briefing for Monday, October fifth, twenty twenty-six. Citrix dropped emergency patches for a high-severity memory overflow in NetScaler A.D.C. and Gateway, tracked as C.V.E. twenty twenty-six dash eighty-eight thousand seven hundred seventy-nine, after targeted zero-day attacks against customer-managed boxes configured as a SAML service provider or identity provider. C.I.S.A. put it in the Known Exploited Vulnerabilities catalog with a Wednesday, October seventh deadline for fed...

en-us

5:53

FortiMail Zero-Day File Write Hits KEV Ahead of Saturday

The Matthew Chapman Podcast ·

2026/10/02

Here is your briefing for Friday, October 2, 2026. CISA put a critical Fortinet FortiMail path-traversal and null-byte bug on Known Exploited Vulnerabilities Thursday after confirming active exploitation. C V E twenty twenty-six dash one hundred four thousand two hundred eighty-six is a nine point eight. An unauthenticated attacker who can reach the management plane over H T T P or H T T P S writes arbitrary files on the underlying system. Fortinet says it has been hit in the wild. Federal ci...

en-us

6:15

Cisco SD-WAN Admin Bypass Hits KEV Ahead of Friday

The Matthew Chapman Podcast ·

2026/10/01

Here is your briefing for Thursday, October 1, 2026. CISA put a critical Cisco Catalyst S D-WAN Manager authentication bypass on Known Exploited Vulnerabilities Wednesday after confirming active exploitation. C V E twenty twenty-six dash seventy-six thousand five hundred four is a nine point eight hex-encoding bug. An unauthenticated attacker who can reach the Manager A P I sends a crafted H T T P request, skips the session auth rule meant to protect j underscore security underscore check, an...

en-us

4:35

NetScaler Mass Root Exploits Deploy WHIPSHOT and...

The Matthew Chapman Podcast ·

2026/09/30

Here is your briefing for Wednesday, September 30, 2026. Citrix NetScaler is no longer just a KEV deadline story. Mandiant and Google Threat Intelligence say unknown actors are actively rooting ADC and Gateway boxes across North America and Europe, hitting government, finance, tech, education, and law firms. Exploitation of C V E twenty twenty-six eighty-eight thousand seven hundred seventy-two bypasses auth, crashes the packet engine, and lands root shellcode. Operators then install PHP webs...

en-us

6:02

Apple CoreGraphics Zero-Day May Have Hit Targeted...

The Matthew Chapman Podcast ·

2026/09/29

Here is your briefing for Tuesday, September 29, 2026. Apple patched C.V.E. twenty twenty-six dash eighty-six thousand nine hundred fifty, an out-of-bounds write in CoreGraphics that can run arbitrary code when a device opens a crafted file. Meta Product Security found it. Apple says it may already have been used in extremely sophisticated attacks against specific people on iOS versions before twenty-seven, which is the company's usual way of saying this looked like a targeted zero-day withou...

en-us

6:19

Citrix NetScaler Dual RCE Hits KEV Ahead of Tuesday

The Matthew Chapman Podcast ·

2026/09/28

Here is your briefing for Monday, September 28, 2026. CISA put two critical Citrix NetScaler A.D.C. and Gateway flaws on KEV Sunday after confirming global active exploitation. C.V.E. twenty twenty-six dash eighty-eight thousand seven hundred seventy-one is a nine point five improper input validation bug that lets an unauthenticated attacker run arbitrary commands on every affected deployment, default config included. C.V.E. twenty twenty-six dash eighty-eight thousand seven hundred seventy-t...

en-us

6:17

Roundcube Pre-Auth SQL Injection Is Live in the Wild

The Matthew Chapman Podcast ·

2026/09/25

Here is your briefing for Friday, September 25, 2026. Canada's Cyber Centre says a patched Roundcube Webmail bug is under active exploitation. C.V.E. twenty twenty-six dash forty-eight thousand eight hundred forty-two is an eight point one pre-auth SQL injection in the virtuser_query plugin on one point six before one point six point sixteen and one point seven before one point seven point one. A preg_replace backslash escape bypass lets an unauthenticated caller shove arbitrary SQL into the ...

en-us

5:59

WordPress Nine Point Two RCE Is Live Hours After...

The Matthew Chapman Podcast ·

2026/09/24

Here is your briefing for Thursday, September 24, 2026. WordPress is already under active attack for C.V.E. twenty twenty-six dash eighty-seven thousand nine hundred two, a nine point two unauthenticated path that can land remote code execution when a theme has a top-level page-templates style directory and a readable local P.H.P. file sits on the box. Patches shipped September twenty-second. Previdian and Patchstack saw the first exploitation attempts that same morning, U.T.C., and by Septem...

en-us

6:15

F5 APM OAuth Zero-Day Is Live Ahead of Friday's Deadline

The Matthew Chapman Podcast ·

2026/09/23

Here is your briefing for Wednesday, September 23, 2026. F5 says attackers are already exploiting a critical heap overflow in BIG-IP Access Policy Manager when it acts as an OAuth authorization server. C.V.E. twenty twenty-six dash ninety-four thousand one hundred twenty-seven scores nine point eight, needs no login, and hits the data plane on the virtual server itself, so locking down the management interface does nothing. CISA dropped it on the Known Exploited list the same day F5 disclosed...

en-us

4:18

VeloCloud Perfect-Ten Orchestrator Flaw Is Under...

The Matthew Chapman Podcast ·

2026/09/22

Here is your briefing for Tuesday, September 22, 2026. Arista says attackers are already hitting a perfect-ten flaw in on-prem VeloCloud Orchestrator, C.V.E. twenty twenty-six dash ninety-three thousand nine hundred fifty-two. No login required. If your orchestrator authenticates Edges with certificates and the web interface is reachable, a remote attacker can privilege internal functions, own the host, and from there reach the Edge devices that orchestrator manages. Fixes are out for the fiv...

en-us

5:05

Orkes Conductor Pre-Auth RCE Is Live in the Wild

The Matthew Chapman Podcast ·

2026/09/21

Here is your briefing for Monday, September 21, 2026. Fortinet has an outbreak alert on a perfect-nine-point-eight unauthenticated remote code execution bug in Orkes Conductor, C.V.E. twenty twenty-six dash fifty-eight thousand one hundred thirty-eight, and attackers are already throwing it. Submit a hostile workflow definition with JavaScript or Python to the workflow A.P.I. before login, abuse GraalVM evaluators left on HostAccess.ALL, and you get arbitrary O.S. commands as the Conductor pr...

en-us

4:33

Cisco ISE Perfect-Ten Auth Bypass Hits Friday CISA...

The Matthew Chapman Podcast ·

2026/09/17

Here is your briefing for Thursday, September 17, 2026. Cisco is shipping emergency patches for a perfect ten authentication bypass in Identity Services Engine, C.V.E. twenty twenty-six dash seventy-six thousand four hundred sixty, and it is already under active exploitation. An unauthenticated attacker sends a crafted request to a poorly guarded A.P.I. endpoint, skips the web management login, and can climb to root command execution. That covers I.S.E. and I.S.E.-P.I.C. on every configuratio...

en-us

4:36

WSO2 JWT Bypass Is Minting Forged Admin Tokens in the...

The Matthew Chapman Podcast ·

2026/09/16

Here is your briefing for Wednesday, September 16, 2026. watchTowr says a critical WSO2 API Manager bug is under active exploitation, and its honeypots started catching forged J.W.T.s with baked-in admin privileges on September thirteenth. The flaw is C.V.E. twenty twenty-six dash five thousand four hundred thirty, scored nine point eight. Sign a token with an unsupported algorithm, and the service verifies it anyway, then hands you the keys. That covers API Manager four point one through fou...

en-us

4:43

Cisco Email Gateway Root RCE Is Live on CISA's Clock

The Matthew Chapman Podcast ·

2026/09/15

Here is your briefing for Tuesday, September 15, 2026. Cisco says a critical AsyncOS bug in Secure Email Gateway, C.V.E. twenty twenty-six dash seventy-six thousand four hundred sixty-one, is already under active exploitation. Score it nine point eight. An unauthenticated attacker sends a crafted message with malicious S.Q.L., and the box hands them root on the underlying O.S., physical or virtual, no special config required. Patches land in fifteen point five point five dash zero one four on...

en-us

5:38

GitLab Perfect-Ten File Read Hits Today's CISA Deadline

The Matthew Chapman Podcast ·

2026/09/14

Here is your briefing for Monday, September 14, 2026. GitLab's unauthenticated path traversal, C.V.E. twenty twenty-six dash eighty-five thousand seven hundred six, is a perfect ten on the commits A.P.I., and CISA put it on a federal patch clock that ends today. One public project is enough. An outsider can read logs and config files, pull secrets, and walk into the source and C.I. vault without logging in. watchTowr saw in-the-wild probes within about a day of disclosure, and mass scans are ...

en-us

5:01

Attackers Chain JFrog Artifactory Flaws for Admin and...

The Matthew Chapman Podcast ·

2026/09/11

Here is your briefing for Friday, September 11, 2026. Wiz says attackers chained two JFrog Artifactory bugs between August fifteenth and September eighth to take administrator control of self-hosted build repositories and plant backdoors. C.V.E. twenty twenty-six dash forty-two thousand eighteen hands out an internal anonymous-user token even when anonymous access is off. C.V.E. twenty twenty-six dash forty-two thousand sixteen then swaps that low-privilege token for administrator scope, beca...

en-us

5:00

Check Point Patches Two Nine Point Eight VPN...

The Matthew Chapman Podcast ·

2026/09/10

Here is your briefing for Thursday, September 10, 2026. Check Point just shipped fixes for two unauthenticated remote code execution bugs in how its firewalls and management servers handle VPN certificates. C.V.E. twenty twenty-six dash eighty-five thousand one hundred two fails certificate trust checks during VPN negotiation on Security Gateways. C.V.E. twenty twenty-six dash eighty-five thousand one hundred three is a heap overflow while decoding A.S.N. one certificate structures, and it al...

en-us

42 results

Similar Podcasts

Lead With AI

Tamara Nall

Manufacturing Matters

Tech B2B

The Good Tech Companies

HackerNoon

The Vergecast

The Verge

Computer America

Ben Crossman