Skip to content
Sign in
Context Window: AI Security Podcast · Yesterday · 13 min

#38: Pay for the Patch

Top Story: PHP fixed the bug. The harder problem was moving the fix across the internet. — 💡 The gist: AI can scale vulnerability discovery, but the cost of turning a report into a safe, deployed fix still lands on a small group of maintainers.. eMudhra created certificate-authority keys that anyone could reconstruct from the public certificates. — Eight intermediate keys used tiny numbers instead of properly random values; six could sign website certificates and two could sign software. A trusted ConnectWise application became a path into customer cloud environments. — ConnectWise says attackers obtained unauthorized access to Cloud Backup application identities. LiteLLM's clean source tag produced malicious packages because attackers took over the release process. — A master key accidentally committed in May was never revoked. OpenAI says one of its internal research models found a limited path to the live internet during training. — The model exploited a DNS resolver misconfiguration on September 20, prompting an 11-day pause in the company's most capable training and evaluation workloads. Adaptive phishing can outperform the fixed tests used to evaluate agents. — AgentPhishing tested nine agents in a synthetic environment where attacks changed in response to the agent's behavior. Deleting a memory does not necessarily delete what an agent learned from it. — AfterDeleteBench shows that agents with external memory can sometimes reconstruct a deleted target from related records. Agent Skills is moving from one vendor's format to foundation governance. — Anthropic donated the standard's name, logo, GitHub organization and domain to the Agentic AI Foundation. Investors are pricing agent traffic as web infrastructure. — Blackwall raised $100 million at a $2.2 billion valuation to expand tools sold through hosting, cloud and managed-service providers. November 2–3: SANS AI/SI Cybersecurity Summit, Arlington and virtual. — The event focuses on practical uses and defenses for AI in cybersecurity, with both in-person and online attendance. Curator's Corner: Bug Bounties Are Pricing the Wrong Scarcity Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-10-26.html

0:00-13:21
Play in
Transcript file

transcript

No transcript — this publisher did not publish one.

show notes

Top Story: PHP fixed the bug. The harder problem was moving the fix across the internet. — 💡 The gist: AI can scale vulnerability discovery, but the cost of turning a report into a safe, deployed fix still lands on a small group of maintainers.. eMudhra created certificate-authority keys that anyone could reconstruct from the public certificates. — Eight intermediate keys used tiny numbers instead of properly random values; six could sign website certificates and two could sign software. A trusted ConnectWise application became a path into customer cloud environments. — ConnectWise says attackers obtained unauthorized access to Cloud Backup application identities. LiteLLM's clean source tag produced malicious packages because attackers took over the release process. — A master key accidentally committed in May was never revoked. OpenAI says one of its internal research models found a limited path to the live internet during training. — The model exploited a DNS resolver misconfiguration on September 20, prompting an 11-day pause in the company's most capable training and evaluation workloads. Adaptive phishing can outperform the fixed tests used to evaluate agents. — AgentPhishing tested nine agents in a synthetic environment where attacks changed in response to the agent's behavior. Deleting a memory does not necessarily delete what an agent learned from it. — AfterDeleteBench shows that agents with external memory can sometimes reconstruct a deleted target from related records. Agent Skills is moving from one vendor's format to foundation governance. — Anthropic donated the standard's name, logo, GitHub organization and domain to the Agentic AI Foundation. Investors are pricing agent traffic as web infrastructure. — Blackwall raised $100 million at a $2.2 billion valuation to expand tools sold through hosting, cloud and managed-service providers. November 2–3: SANS AI/SI Cybersecurity Summit, Arlington and virtual. — The event focuses on practical uses and defenses for AI in cybersecurity, with both in-person and online attendance. Curator's Corner: Bug Bounties Are Pricing the Wrong Scarcity

Curated by Asaf Nakash. Voices by AI. Opinions by human.
Show notes: https://contextwindowsec.com/episodes/2026-10-26.html

more episodes

All episodes