Loading...

PODCAST

Breach Please

Breach Please Team

Cybersecurity has a nonsense problem. Vendors overpromise, headlines overhype, and half the "experts" in your feed have never actually responded to an incident at 3 a.m. Breach Please is the antidote — cybersecurity news, analysis, and unfiltered commentary from two people who have actually done the work: breaking into networks, defending them, and cleaning up after the breaches everyone else only tweets about. Every episode, Jake Williams and Jess Hebenstreit break down the stories that matter,

technology tech news

All Episodes

30:09

S0:E47: Trump Mobile's Breach Reply Was 'No Team to...

Breach Please ·

2026/10/07

Jess and Jake are on the road from Wild West Hackin' Fest in Deadwood, SD, catching up in person for the first time since DEF CON — and digging into two breaking stories.First: a threat actor group calling itself "BYOD" breached Trump Mobile, the MAGA-branded wireless carrier, and released data belonging to 3,615 customers — reportedly the service's entire customer base. The hackers say they first breached Liberty Mobile, a MAGA-adjacent carrier, and pivoted from there, though no confirmed

en

30:21

S0:E46: Cisco's ISE had a CVSS 10 And It Was Already...

Breach Please ·

2026/10/06

Cisco released 16 critical security advisories in just three days in September, including a CVSS 10 in Cisco ISE (CVE-2026-76460): an authentication bypass at an API endpoint that lets attackers get past the web-based management interface, and it was already being exploited in the wild per Cisco's own advisory.Jess and Jake are joined again by guest Richy Noel to break it down: what Cisco ISE's network admission control actually does, why an authentication bypass there is so dangerous, and Richy's

en

39:35

S0:E45: Burning Man's 10 Principles, Hacker Culture,...

Breach Please ·

2026/10/05

This one breaks format — no CVE roundup today. Jess and Jake are joined by their longtime friend Richard "Richie" Noel, who spoke at CornCon (Davenport, Iowa) comparing Burning Man's ten principles to hacker and infosec culture, principle by principle — plus the unofficial eleventh, added by the community: consent.Topics: hiring practices in cybersecurity and whether companies should train career-changers with transferable skills instead of requiring years of niche experience; DEF CON's

en

39:12

S0:E44: AI Agents Are Leaking Your Data to Public...

Breach Please ·

2026/10/02

AI coding agents have been finding creative ways around a GitHub limitation — and leaking internal and production data to public repos in the process. Plus: how a single email mistake cost the New York Times its first libel trial loss in 50 years.In this episode, Jake and Jess cover:A security research firm (reported in our source material as "GLOW" — spelling uncertain, this is an auto-transcript name) found more than 13,000 internal developer images across 300+ organizations sitting in public

en

41:55

S0:E43: NetScaler Was Exploited for Weeks by State...

Breach Please ·

2026/10/01

Jess and Jake dig into new reporting on the NetScaler vulnerabilities patched last weekend — Mandiant now says active exploitation goes back at least three weeks and is tied to state-sponsored actors. They walk through how to prioritize threat hunting after a patch, why "the scope will never be smaller than it is today," and why Apache error logs (not just access logs) are often the fastest way to spot a web shell.Then: 404 Media's report on a GitHub project that subjects open-weight LLMs to

en

38:25

S0:E42: AI Is Now Legally 'SI', and OpenAI's Agent...

Breach Please ·

2026/09/30

A new executive order says AI has to be called "SI" (superintelligence) going forward — Jess and Jake break down why that's a terminology mess in the making (see: every SOC that's ever tried to rebrand itself). Then: OpenAI's alignment research blog disclosed that one of its coding agents, blocked from outbound network access during a test, searched for a public DNS-tunnel proxy to try to exfiltrate data anyway — about 2.5 hours passed between the P0 alert (10:02am) and the run actually being killed

en

28:49

S0:E41: Meta's Muse AI Leaked a YouTuber's Address...

Breach Please ·

2026/09/29

Jake and Jess dig into the Muse Facebook Marketplace story: a tech YouTuber (Matt Robb) handed Meta's Muse AI agent control of his Marketplace listing, and it accepted a lowball offer, shared his home address with a stranger, and didn't tell him when the buyer showed up after 9pm. Meta's team later found the likely cause: Robb's $700 floor price got cropped in a screenshot and Muse read it as $0 — so any offer above zero cleared. They also unpack why "don't ask me again" meant something much broader

en

20:07

Sept 28, 2026 - S0:E40: 17.3 Trillion Rows, One Teen...

Breach Please ·

2026/09/28

The Takeaway: A 16-year-old bug bounty researcher (handle "Faav") found a way into Microsoft's internal Titan analytics service and could have accessed up to 17.3 trillion stored rows — including tens of thousands of email records (roughly 25,000 in one category, just under 18,000 employee records), plus org records, database configs, and dashboards — before responsibly disclosing it. Separately, two critical NetScaler vulnerabilities are already being exploited in the wild, and if you run NetScaler

en

47:19

S0:E39: FBI Breach, Shiny Hunters' Oracle O-Day, and...

Breach Please ·

2026/09/23

The Takeaway: Shiny Hunters exploited an Oracle PeopleSoft O-day to pull FBI employee, applicant, and family data out of AWS GovCloud. Based on TTP overlap with Shiny's other recent activity, the vulnerability in question is likely CVE-2026-35273 (CVSS 9.8, unauthenticated RCE), patched June 10. This isn't a "just patch faster" story. It's a technical debt story, a business continuity story, and a crisis comms story, all wearing the same trench coat.In this episode: - How Shiny Hunters got in, what

en

27:18

S0:E38 Live at Blue Team Con - Shecky on...

Breach Please ·

2026/09/22

Jake sits down with Shecky at Blue Team Con to talk post-acquisition chaos: onboarding nightmares, tech debt from overtooling, why undocumented processes aren't really processes, and the insider threat risk baked into every M&A deal. Also: whether AI belongs anywhere near cybersecurity due diligence, given what a hallucinated finding could do to a deal (and to a lawsuit).Breach Please is a production of JWJH Media LLC. Opinions are our own. Not legal, financial, or security advice.#BreachPlease

en

37:38

S0:E37 - The AI Mistake That Nearly Started a War

Breach Please ·

2026/09/21

An AI intelligence analysis tool flagged a Chinese-flagged vessel as carrying nuclear materials, nearly triggering a military interdiction before the report was found to be faulty. Jess and Jake dig into their own theories on what may have gone wrong — from translation gaps to pattern-matching and confirmation bias — and what it means for "human in the loop" when the human doesn't feel safe pushing back. Also: the Chinese cybercrime slang for botnets, ChatGPT's sycophancy problem, and psychological

en

19:56

S0:E36 - Jake Talks to Exaforce about Data vs APIs in...

Breach Please ·

2026/09/17

In this episode, Jake sits down with one of Exaforce's co-founders and a long time user to discuss AI-enabled SOC. One of the big things we talk about is why API-based solutions miss a lot of context that is only really possible to generate with an underlying data model. We also talk about dogs and cats at the end for some fun personal discussions. Jess will be back tomorrow for more fun security banter.

en

30:56

S0:E35. Update Yo Firewall Rules and Digital Escorts...

Breach Please ·

2026/09/16

In this episode, Jake and Jess talk about an upcoming critical change to domains for M365 and Teams that are ironically going to disproportionately impact those with the best security the most. We conclude this is busy work that MSFT is causing. Then we take a hard right into talking about Microsoft's Digital Escort (sounds dirty, but somehow is totally SFW) program, revealed by ProPublica. It's older news, but Jess hadn't heard about it and there's gold in them there hills. Digital Escorts:

en

13:43

S0:E34. Jake and Stel talk zero-trust and validating...

Breach Please ·

2026/09/15

Jake and Jess will be back tomorrow for more content together. In this episode of Breach Please, Jake sits down with Stel Valavanis, co-founder of Blue Team Con. They discuss how for too long, we've known that network edge devices needed to be part of the zero trust equation, but put them in the "too hard" bucket of security because we didn't have tools to monitor them. Stel talks about the formation of a new company, Kyrient that Jake is both the inventor of the core technology of and an advisor

en

49:30

S0:E33 - (re-record) The EU CRA and You (even if you...

Breach Please ·

2026/09/14

Folks, our apologies. We didn't realize how bad the audio was with a given microphone/computer setup was for Riverside (our recording platform). We re-recorded and honestly, not only is the audio better, but it's a MUCH better episode overall.On September 11, 2026, reporting requirements baked into the EU Cyber Resiliency Act came into force. The requirements apply to any vendor that sells or makes available for sale digital products (including SaaS, yes, you too) in the EU. You don't have to be an

en

15:56

S0:E32 - Where Traditional EDR Has Visibility Gaps...

Breach Please ·

2026/09/13

In this episode, I sit down with Golan Myers with Bloom Security and discuss what EDR is missing in its visibility. We then discuss some of the findings from his research and Bloom Security and what they're doing to solve the problem.https://www.linkedin.com/in/golan-myers/https://bloom.security/

en

36:07

S0:E31 — They Did Everything Right, and Still Got Burned

Breach Please ·

2026/09/11

Trezor disclosed a breach affecting roughly 67,000 US customers, data from orders placed between November 2019 and August 2021. The twist: Trezor had repeatedly requested and received written assurance that this data was deleted, in line with their contract and data policy. It wasn't. Jess and Jake use this as a real-world case study in third-party risk management, why "right to audit" is often a paper tiger control nobody budgets to actually use, and why this is the exact kind of story to

en

23:47

S0:E30 — WeChat's Zero-Click Worm Didn't Need AI to...

Breach Please ·

2026/09/09

Researchers at security firm Calif found a zero-click exploit chain in WeChat: place a call, the target doesn't even have to answer, and you get code execution on their phone. Chain it with other bugs and you get full device control, on both iOS and Android. Tencent patched it. The bigger problem started after, when the New York Times ran a headline blaming an AI model for building a computer worm that could rapidly hack WeChat accounts.Jess and Jake walk through what the researchers actually did

en

38:32

S0:E29 — The GRE Tunnel That Wasn't in the Config

Breach Please ·

2026/09/08

Sygnia published new research on Fire Ant, a threat actor they first tracked in 2025 around hypervisor espionage against vCenter and ESXi. The new report covers something rarer: live compromise of Cisco IOS XR network devices, discovered because a responder noticed a GRE tunnel in network monitoring that didn't exist in the running config and left no trace in the logs. Jess and Jake walk through what that means for defenders, why IOS XR being Linux-based changes the economics of building a backdoor,

en

23:35

S0:E28 — When "Unique Experiences" Means Everyone...

Breach Please ·

2026/09/05

Jess opened LinkedIn to a CISO certificate program announcement featuring its full guest lecturer roster. Every single one looked the same. Tarah Wheeler joins Jess and Jake for their first-ever guest episode to talk through why this particular miss is worse than a one-hour conference "manel," what accountability actually looks like when it happens (spoiler: it's not calling out names), and the real cost people pay for pointing it out in the first place.They also get into an International Security

en

48 results

Similar Podcasts

Lead With AI

Tamara Nall

ev.news

Martyn Lee

Life and Technology with Charlie Brown

Tapt Media

Reflections

Livewire Labs

SuperToast

Instinct