If we needed any more evidence that the internet was a mistake, this week provided it. We kick things off with a discussion of the Canvas breach that has affected thousands of schools worldwide, then we dig into the disclosure of two new vulnerabilities in Ivanti and Palo Alto Networks products that are actively exploited, and then we talk about a new branded Linux bug called Dirty Frag. Finally, we wrap up with some comic relief from the Everything App.



Links

Ivanti bug: https://decipher.sc/2026/05/07/ivanti-warns-of-exploited-epmm-flaw-cve-2026-6973/

Palo Alto bug: https://decipher.sc/2026/05/06/845/

Dirty Frag: https://decipher.sc/2026/05/07/new-dirty-frag-linux-bug-emerges/

The viral tweet: https://x.com/DennisF/status/2050682024587845690

The Canvas Attack, Ivanti and Palo Alto Exploits, and Dirty Frag

Will Dixon has seen the evolution of cybercrime as both a GCHQ intelligence officer and a private sector executive and analyst, and has seen the way these groups operate up close. He joins Dennis to talk about the ongoing threat from ransomware gangs, how organizations are managing their responses, and what he expects to come next.

Fighting Cybercrime With Global Intelligence | Will Dixon

JAGS joins Dennis Fisher to unpack the complex history of fast16, a highly targeted cyber espionage platform that goes back as far as 2005, many years before Stuxnet, and was deployed against targets in Iran. JAGS has been in the APT hunting game for a long time, and brings his historical perspective and context around the Shadow Brokers leak, Stuxnet ties, and how this discovery changes what we know about the use of these tools.
LinksSentinelLabs report: https://www.sentinelone.com/labs/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stuxnet/

The fast16 Mystery, Stuxnet, and the History of Cyber Espionage | Juan Andres Guerrero-Saade

The security news was out of hand this week, so we had to pick our spots. We start with the nasty cPanel/WHM vulnerability [https://decipher.sc/2026/04/29/researchers-warn-of-critical-cpanel-flaw-cve-2026-41940/]that affects tens of millions of domains in shared hosting environments, then we discuss the Copy Fail Linux bug [https://decipher.sc/2026/04/30/a-copy-fail-faq/] and its effects before seguing into the delightful history of branded bugs, logos, and parodies.



Links

Branded bugs and logos: https://io.netgarage.org/logo/

cPanel Exploits, Copy Fail, and the History of Branded Bugs

Ariana Mirian, cofounder of startup Beesafe, joins Dennis to talk about the mechanics of online romance and finance scams, how the scammers draw in victims over weeks or months, and why user awareness isn't the complete solution to the problem. LinksBeesafe AI: https://beesafe.ai/

Defeating Online Scams and Disrupting the Cybercrime Chain | Ariana Mirian

This week we dig deep into the Vercel intrusion that emerged last weekend, how it happened, what the response was, and what the downstream effects may be for defenders. Then we talk about CISA's bizarre delayed response to the Axios npm compromise and what it signals about the agency's capabilities going forward.

The Vercel Intrusion and What is Happening at CISA

It's been A WEEK. Security news never sleeps, and neither does AI, so Dennis and Lindsey dive into all of the storylines coming from the Claude Mythos and Project Glasswing [https://decipher.sc/2026/04/13/myths-and-mythos-an-ai-vulnerability-research-faq/] announcements, how organizations will deal with the coming flood of CVEs and patches, NIST's decision to only enrich specific CVEs [https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth]going forward, and what could possibly be next on the horizon.

Claude Mythos, Automated Bug Hunting, and AI Eating Everything

Dennis sits down with Tom Ptacek of Fly.io, a veteran security researcher, founder, and observer of the vulnerability landscape, to talk about the recent wave of AI-assisted vulnerability discovery and exploit development, specifically from the use of frontier models such as Claude Mythos. Tom has strong opinions on what's coming and how human researchers and defenders need to respond.



Tom's post: https://sockpuppet.org/blog/2026/03/30/vulnerability-research-is-cooked/

The Era of AI-Led Vulnerability Research With Tom Ptacek

The internet is dark and full of terrors, but thanks to folks such as Andrew Northern, a principal security researcher at internet-mapping pioneer Censys, it doesn't have to be, Andrew joins Dennis to talk about the cybercrime ecosystem, getting his start in security on a tiny team with huge responsibilities, and the value of a strong mentor.

Mapping the Cybercrime Ecosystem With Andrew Northern of Censys

It's been quite a week in security news, and Dennis and Lindsey dig into the continued effects of the axios supply chain attack, the incredibly fast adoption of AI tools for vulnerability research and what that means for software makers and defenders, and what the future holds for vulnerability research and exploit development.

The Rapid Rise of AI Exploit Development and More Axios Compromise Effects

The editors of Decipher talk with a rotating cast of security practitioners, researchers, and executives about a variety of topics in the security and privacy fields.

Dennis

Shows