This week gave us the gift of some more React Server Components vulnerabilities (0:22) and further exploitation of the previously disclosed bugs by a variety of threat groups. There were also a long list of vulnerabilities disclosed by Microsoft, Adobe, and others, which we discuss in the context of how difficult vulnerability management is right now (09:55). Finally, we discuss CISA's warning about continued Russian targeting of US critical infrastructure (20:25).

Support the show [https://www.buzzsprout.com/228511/support]

More React Bugs Reaction, the Challenge of Vulnerability Management, and CI Attacks

Coming from a military family, Erin Whitmore was prepared for a career of service. But her path took her not into the military, but the intelligence community, first in the private sector supporting the DIA and NGA, and later as a cybersecurty program manager in the Office of the Director of National Intelligence. She eventually joined CIA as an operations officer and served in locations around the world before moving back to the private sector where she now focuses on executive risk and strategic intelligence at CYPFER. Erin joins Dennis Fisher to talk about her unique path and how it's prepared her for today's threats and the nascent AI revolution.

Support the show [https://www.buzzsprout.com/228511/support]

From CIA Officer to a Career in Cybersecurity With Erin Whitmore

Dennis and Lindsey react (!) to the React2Shell vulnerability disclosure [https://decipher.sc/2025/12/03/critical-flaw-cve-2025-55182-affects-react-server-components/] and the quick exploitation of it by Chinese threat actors, then discuss the continues intrusions into critical infrastructure by the Salt Typhoon actors and this week's congressional hearing on telecom network security [https://decipher.sc/2025/12/04/government-private-sector-officials-mull-telecom-security-woes/]. Finally, we talk about some upcoming hacker movie episodes, including Die Hard and maybe Home Alone!

Support the show [https://www.buzzsprout.com/228511/support]

React2Shell, Typhoon Attacks, and Why Our Infrastructure is So Vulnerable

Jeff Gothelf, a renowned author and product strategist and co-founder of Sense and Respond Learning [https://www.senseandrespond.co/about-us], joins Dennis to discuss the need to design products with users in mind, how critical thinking can help teams succeed, and what the AI revolution means for security teams and other groups.

Support the show [https://www.buzzsprout.com/228511/support]

Jeff Gothelf on Designing for Users, Enterprise Agility, and the AI Conundrum

It's an acronym-filled, government-only bonanza this week! We discuss the DoJ sanctioning [https://decipher.sc/2025/11/19/doj-sanctions-bulletproof-hosting-provider-used-by-ransomware-groups/] Russian bulletproof hosting provider Media Land (0:53), the SEC dropping [https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26423] its enforcement action against SolarWinds and its CISO (13:25), and the FCC reversing course [https://www.fcc.gov/document/fcc-corrects-course-outlines-improved-cybersecurity-measures] on a longstanding security rule for telecom providers (26:00).

Support the show [https://www.buzzsprout.com/228511/support]

DoJ Sanctions, the SEC Abandons the SolarWinds Action, and the FCC Reverses Course on Telecom Security

Dennis is joined by Rich Mogull [https://slaw.securosis.com/], chief analyst at the Cloud Security Alliance [https://cloudsecurityalliance.org/], cloud security trainer, and all around good guy to talk about the Cloudflare outage, why the internet is now just six companies, and what, if anything, organizations can do to improve their resilience in the current environment. 

Support the show [https://www.buzzsprout.com/228511/support]

Rich Mogull on the Cloudflare Outage, Resilience, and Single Points of Failure

This week was a bit of a throwback to olden times, with the disclosure by Amazon threat intelligence of  zero days in Cisco and Citrix products that were exploited by an unnamed APT, and Google using legal action to disrupt the Lighthouse phishing service operation. We dig into those two stories, plus we discuss the challenge of trying to quantify the financial and other effects of a major cyber attack. 

Related stories:

https://decipher.sc/2025/11/12/apt-targets-cisco-and-citrix-zero-days/

https://decipher.sc/2025/11/14/marks-and-spencers-profit-drop-the-financial-toll-of-cyberattacks/

https://decipher.sc/2025/11/12/google-wants-to-snuff-out-lighthouse-phishing-kit/

https://censys.com/blog/highway-robbery-2-0

Support the show [https://www.buzzsprout.com/228511/support]

Lighthouse Phishing Kit Takedown, Zero Day Mysteries, and Measuring Cyber Attack Costs

"You know, you really don't need a forensics team to get to the bottom of this. If you guys were the inventors of Facebook, you'd have invented Facebook." Melanie Ensign joins Dennis Fisher and Lindsey O'Donnell-Welch to discuss David Fincher's massively successful 2010 film, The Social Network, a movie that opens a window into the dark side of Silicon Valley and the lengths that some people will go to in order to win.

Support the show [https://www.buzzsprout.com/228511/support]

The Hacker Movie Canon: The Social Network

Yahoo CISO and Chief Paranoid Sean Zadig [https://www.yahooinc.com/paranoids/suddenly-a-ciso-four-pieces-of-transitional-advice] returns to the podcast for a discussion with Dennis Fisher  about how to go about getting kids interested in technology and teaching them about hacking (in the broad, classical sense) safely (9:10). Then they talk about how rapidly the cybersecurity industry is changing and what effects AI is and is not having on offense, defense, and the job market (45:00).

Support the show [https://www.buzzsprout.com/228511/support]

Yahoo's Sean Zadig on How to Raise a Hacker Safely and How Maybe AI Isn't Changing Everything 

We don't do holiday themed episodes in this house, so no tricks, but we have some treats for you. First we discuss the problem of shadow AI (1:00) and how it seems like we're just repeating the mistakes of previous tech waves in ignoring security until it's too late. Then we dig into a new report from Kaspersky about a crazy exploit they discovered for a Chrome sandbox escape that led them to identify the new version of Hacking Team's spyware called Dante (23:00). Finally, we provide some important updates on our respective wildlife encounters (33:00).



Kaspersky report: https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/

 

Support the show [https://www.buzzsprout.com/228511/support]

Shadow AI Is Eating the World, the Return of Hacking Team, and the Commercial Spyware Landscape

The editors of Decipher talk with a rotating cast of security practitioners, researchers, and executives about a variety of topics in the security and privacy fields.

Decipher Security Podcast