Alle afleveringen
66 afleveringen, van nieuw naar oud
-
Breaking Down PHP2Shell with Sagi Tzadik & Thai Duong
21 oktober 2026 · 36 min
🚨 How AI just broke PHP (and 70% of the internet).On this episode of Crying Out Cloud, Amitai Cohen sits down with Sagi Tzadik (Wiz Research) and Thai Duong (Calif) to unpack a massive PHP RCE vulnerability discovered entirely by AI agents.This isn't just another zero-day story. It's a look at the terrifying new reality of "agentic exploit development." What used to take human researchers months of tedious lab setups and debugging to weaponize a memory corruption bug took AI agents a couple of weeks, working while the researchers slept.What's Inside:- How an AI model looking for a Drupal bug accidentally found a foundational PHP flaw from 2004.- Why AI scaling exploit development across multiple software versions changes the threat landscape.- The massive logistical challenge of coordinating a patch for 70% of the web alongside distros, WAFs, and cloud providers.- How defenders can use these same AI agents to scale detection engineering. Lees meer
-
AI-Powered Threat Actors, Poison Pills & Cyber Sabotage with John Hultquist
16 september 2026 · 24 min
On this episode of Crying Out Cloud, Eden Koby Naftali & Amitai Cohen sit down with John Hultquist, Chief Analyst at Google Threat Intelligence Group (ex-Mandiant, ex-FireEye, founder of CYBERWARCON & SLEUTHCON). Lees meer
Drawing on over two decades of tracking state-sponsored adversaries like Sandworm, John cuts through the hype to explain what modern threat intelligence actually does: it keeps CISOs from burning millions of dollars on the wrong technology, spots adversary shifts before static IOCs exist, and bridges the gap between raw binary reverse-engineering and executive decision-making.
In this episode, John unpacks how threat actors are weaponizing AI and bypassing commercial costs entirely and traces the real shift underway: adversaries embedding adversarial prompt-injection payloads inside malware to shut down automated SOC scanners.
What's Inside:
1. The economics of illicit AI: Underground access vs. hijacked enterprise compute
2. Malware poison pills designed to neutralize automated LLM triage
3. Why firmware and ICS layers are becoming primary targets for disruption
4. Behavioral detection models when living-off-the-land means zero usable IOCs
5. Lessons from tracking Sandworm and convincing leadership to act before the lights go out
-
Empowering Human Potential, AI in Cybersecurity & Scaling Operational Growth with Daniel Miessler
9 augustus 2026 · 28 min
AI is changing the security landscape, but are we automating the wrong things?
On this episode of Crying Out Cloud, Eden Koby Naftali & Amitai Cohen sit down with Daniel Miessler to unpack why most companies are completely unprepared for the AI revolution. Daniel drops some heavy truths about what happens when we automate the "boring" parts of security, and why attackers are currently winning the AI arms race. Lees meerWhat's Inside:
- The "Gym Robot" analogy for operational toil and analyst training
- Why attackers are moving 10X faster with AI than defenders
- The TELOS framework and defining your security goals in text -
WordPress RCE, GitHub vs TeamPCP & Why Meta Disabled Its Support Bot
2 augustus 2026 · 21 min
On this episode of Crying Out Cloud, Eden Koby Naftali & Amitai Cohen sit down to unpack the wildest cloud security news of the month: from AI chatbots going rogue to massive supply chain battles.
What's Inside:
- The WP2Shell vulnerability and why 60% of WordPress instances were at risk
- GitHub's aggressive mitigations to combat TeamPCP's supply chain attacks
- Why 20-year-old vulnerabilities like SquidBleed are suddenly being unearthed by AI
- The Klue hack and the hidden dangers of over-privileged AI agents in Salesforce
- How attackers bypassed Meta's security using VPNs, deepfakes, and a gullible AI support bot Lees meer -
Autonomous AI Malware, Threat Actor Startups & Beating Burnout with John Hammond
2 juli 2026 · 29 min
AI-Powered Malware and the Future of Threat Hunting Lees meer
On this episode of Crying Out Cloud, Eden Koby Naftali & Amitai Cohen sit down with John Hammond to unpack the reality of autonomous AI hacking and why cybercriminals are operating like Fortune 500 startups.
1. Why modern ransomware groups have sales teams, HR, and go-to-market strategies.
2. How autonomous AI agents are finding zero-days while researchers sleep.
3. Glimpsing the future of non-deterministic, AI-driven command and control (C2) servers.
4. Real talk on incident response burnout and why the "always-on" hustle is breaking defenders. -
The Linux CopyFail Vulnerability & AI Bug Hunting with Xint
20 mei 2026 · 51 min
The AI bug hunting revolution is here, and it just broke Linux. Lees meer
On this episode of Crying Out Cloud, Eden Koby Naftali & Amitai Cohen sit down with Tim Becker and Jacob Newman from Xint to unpack CopyFail, a powerful vulnerability found using autonomous AI agents.
1. How Xint's custom LLM harness uncovered CopyFail, a privilege escalation bug affecting almost every Linux machine since 2017.
2. The harsh reality of vulnerability disclosure in the AI era and why 90 days is too long when models can weaponize exploits instantly by patch-diffing.
3. The evolution of AI agents in security, from the DARPA AI Cyber Challenge to Claude 3.5 Sonnet to Mythos.
4. The importance of benchmarking in agentic workflows.
-
Hacking GitHub with a Semicolon & Claude with Sagi Tzadik
1 mei 2026 · 13 min
Wiz researcher Sagi Tzadik joins us to break down how a single semicolon led to a critical Remote Code Execution (RCE) vulnerability in GitHub. Lees meer
For two years, Sagi sat on a lead. Reverse engineering GitHub's microservices manually was too tedious to justify the time. Then, AI agents arrived. By hooking Claude directly into his reverse engineering software, he condensed months of grueling binary analysis into 48 hours. The result? A critical bug in how GitHub handles git push options that exposed both SaaS and Enterprise environments. We get into the weeds on how different microservices interpreting the same input differently creates massive attack surfaces, and why security by obscurity is officially dead in the age of AI.
What's Inside:
- How combining Claude with the IDA MCP server dramatically sped up the reverse engineering process
- The technical anatomy of the GitHub semicolon vulnerability.
- Why microservice communication breakdowns lead to critical RCEs.
- The massive difference in impact between GitHub.com and GitHub Enterprise Server.
- Why Enterprise users need to patch their instances immediately.
Resources:
- Learn more about the findings at: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
-
Protecting Vibe Coded Apps and the Shift to "Soft Guardrails" with Igor Andriushchenko
24 februari 2026 · 39 min
Igor Andriushchenko joins Crying Out Cloud to explain how vibe coding changes the role of security engineers. The shift from typing lines of code to shaping entire systems means security teams need new strategies. Developers expect their shipping velocity to increase tenfold with AI assistance. Relying on traditional hard deployment blocks will only cause friction. If you want to understand how to build secure guardrails for AI development without destroying developer momentum, this conversation covers the exact mechanics. Lees meer
What's Inside:
The evolution of the Stockholm tech scene and human ambition driven by AI.
How Lovable empowers non-developers to build disposable and deeply specific software.
The concept of "soft guardrails" and why hard blocks fail in AI-assisted workflows.
Future capabilities of AI pen testing using hundreds of autonomous agents.
The shared responsibility model when business users build internal applications.
-
Neuroscience, AI Research & Hiring Swifties with Alon Schindel
12 februari 2026 · 24 min
Agentic AI is coming. Are defenders ready? Lees meer
Alon Schindel, Director of Data & Threat Research at Wiz, joins Eden and Amitai for the Season 3 Finale. This isn't just a recap. It is a look at how top-tier research teams operate at speed. Alon explains why Wiz treats research as a "product" rather than a support function. He details the "DeepLeak" discovery where his team found thousands of exposed API keys mere hours after a platform's popularity spiked.
What's Inside:
Agentic AI: Why 2026 will be the year AI starts taking action, not just chatting.
Speed as a Weapon: How to shorten the time between a zero-day and a detection.
Culture: The power of the "Table" and collaborative chaos.
Retrospective: Lessons from IngressNightmare and the year in vulnerabilities.
Resources:
Read the DeepLeak Research: https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak
Wiz Threat Research Hub: https://www.wiz.io/research
-
Hacking Moltbook with Gal Nagli
3 februari 2026 · 13 min
🚨 Vibe coding meets critical data exposure: The Moltbook Hack. Lees meer
On this episode of Crying Out Cloud, Eden Koby Naftali & Amitai Cohen sit down with Wiz researcher Gal Nagli to unpack how he compromised the "Facebook for AI Agents" in under an hour ↓
How a simple boolean manipulation (valid: false to true) bypassed authentication
Cloud Database misconfigurations and the failure of Row Level Security (RLS)
How Claude Code was used to identify and exploit the vulnerability
The security reality of "Vibe Coding" and zero-manual-code applications
-
CodeBreach: Hijacking the AWS Console with Yuval Avrahami
15 januari 2026 · 17 min
🚨 Everything you need to know about CodeBreach with Yuval Avrahami Lees meer
On this episode of Crying Out Cloud, Eden Koby Naftali & Amitai Cohen sit down with Wiz researcher Yuval Avrahami to unpack a major supply-chain flaw that put cloud environments at risk ↓
Misconfigured CodeBuild instances used by AWS themselves
One small regex mistake, huge consequences
How an SDK used by the AWS Console could have been hijacked (!)
The CI/CD controls that can mitigate this risk
-
React2Shell, Shai-Hulud 2.0, Gogs Zero-Day & Tika RCE
1 januari 2026 · 20 min
🎙️ Shai-Hulud, Shai-Hulud 2.0, are you keeping up? Lees meer
In this episode of Crying Out Cloud, Eden Koby Naftali & Amitai Cohen go deep into real-world cloud security incidents ↓
How Shai-Hulud evolved into Shai-Hulud 2.0
A vulnerability affecting Apache Tika
React2Shell and its implications
Gogs zero-day explained
You DONT want to miss this!
This is a technical, concrete conversation focused on how attacks actually happen, how they evolve, and what defenders need to understand to keep up. -
Live Talk: Security Minds from Google Cloud, AWS & Wiz
8 december 2025 · 22 min
🎙️ AI is changing the rules of cyber, are you keeping up?Eden Naftali goes live with leading voices in cloud security:Ryan Nolette (AWS), @John Miller (Google Cloud), and Alon Schindel (Wiz). This episode is essential listening for anyone defending at cloud scale. 👇🔍 Inside ↓1) How AI is supercharging attacker tactics — from hyper-variable phishing to rapid exploit generation2) The rise of "AI slop" and why it's burning analysts' time3) Emerging AI bug-hunters — what they can (and can't) do Lees meer
-
Cloud Detection Engineering, AI in the SOC and Parallel Parking with Alex Hurtado
14 november 2025 · 26 min
Detection engineering just got real!
Eden Naftali and Amitai sit down with detection engineering powerhouse Alex Hurtado - and it's a must-listen for anyone in cloud security. 👇 Lees meer🔍 What's inside:
The evolution of detection engineering in the cloud — and why traditional rules no longer apply
Why DIY detections > vendor defaults
How AI is reshaping detection and threat hunting (and why the human in the loop still wins)
-
VSCode Extension Secrets, RediShell, & Living-off-the-LLM
7 november 2025 · 30 min
🔍 From discovering VS Code supply chain risks → to uncovering Redis Shell vulnerabilities. Lees meer
Eden Naftali and Amitai sat down to unpack: 👇
How VS Code extensions became a critical supply chain risk (w/ Rami McCarthy)
What RediShell reveals about attacker innovation
Where AI is being weaponized in modern malware
🎙️ Listen now to our NEW Crying Out Cloud episode
-
eBPF, Fishy Book Covers, and Open Source Security with Liz Rice
16 september 2025 · 33 min
🚨 The kernel-level security revolution you can't ignore — a must-listen with Liz Rice Lees meer
Eden Naftali and Amitai sit down with Liz Rice, Chief Open Source Officer at Isovalent (Cisco), and a global expert in eBPF, containers, and Kubernetes security.
🎙️ In this episode:
How eBPF is reshaping cloud security from the ground up
Practical strategies to tackle open source supply chain attacks (a hot topic given today’s events)
A must-listen for anyone building or securing cloud infrastructure in an era of AI coding and supply chain attacks.
-
Security Metrics, Detection & Response & Paintball with Erik Bloch
18 augustus 2025 · 28 min
🔐 Erik Bloch on his path from military hacker to Illumio security leader. Lees meer
Eden Naftali and Amitai sat down with Erik Bloch & here's what they covered 👇
How starting in the military shaped Erik's approach to security
Building and scaling cloud detection & response teams
Converting security metrics into actionable business KPIs
-
Adversary Emulation, Cyber Education & Community Building with Day Johnson
1 augustus 2025 · 29 min
🚨 How do you build a 4,000+ strong student-tech community from scratch?Eden Naftali and Amitai sat down with Day Johnson, Security Engineer at @amazon , ex-Datadog, founder of CyberWox Academy.What they covered 👇- Detection engineering that works at scale- What breaks IR processes (and how to fix them)- Real talk on breaking into security without shortcutsAlso: why being the "tech kid" in your neighborhood might just launch your whole career. Lees meer
-
Live Talk: Security Minds from Riot Games, Microsoft & Wiz
15 juli 2025 · 40 min
💡 From cloud chaos to career confessions: live with security minds from RiotGames & Microsoft.
Eden Naftali went live, and got personal, with 3 leaders shaping the future of cloud and cybersecurity: Lees meerNicole Dove, Head of Security Engineering at @Riot Games
Sherrod DeGrippo, Director of Threat Intelligence Strategy at Microsoft
Alon Schindel, VP of AI & Threat Research at Wiz
What they unpacked? 👇
The heart of threat intel, building trust over tools, and how hobbies reflect how they lead.This Crying Out Cloud episode from RSA just hits different.
⏱ Chapters
00:05:02 – What it means to be a threat intelligence leader
00:10:08 – How threat intelligence should really look
00:15:48 – Skirting the tough questions in cybersecurity
00:21:07 – Working with third-party vendors in the cloud
00:26:17 – What the security industry is getting wrong
00:31:20 – The special skill of deep research
00:36:20 – A real-world story about leading with trust#CyberSecurity #CloudSecurity #ThreatIntelligence #Infosec #CloudComputing
-
AI Double Agents to Blame, Scattered Spider Pivots to Planes
9 juli 2025 · 18 min
🎙️ Scattered Spider's new target? Airlines.Eden Koby Naftali & Amitai Cohen break down the latest in the cloud:1️⃣ A connectivity tool vuln & Open WebUI misconfig putting orgs at risk2️⃣ Why attackers are still tricking help desks (and how!)3️⃣ The "lethal trifecta" of AI agent danger, explained 🧠🤖0:25 – Scattered Spider targets the aviation industry1:38 – Help desk hacks: impersonation & real-world stories4:52 – Teleport vulnerability explained9:48 – AI’s “lethal trifecta” and why it matters#CloudSecurity #ScatteredSpider #AIThreats #HelpDeskAttacks #CryingOutCloud #CybersecurityPodcast Lees meer
-
Pyramid of Pain, PEAK, and Bagpipes with David Bianco
25 juni 2025 · 27 min
🎙️ New ep: David Bianco from Splunk with 🔥 insights from a lifetime of threat hunting.Eden Koby Naftali & Amitai Cohen sat down with David Bianco, creator of some of the most influential models in cyber detection.What they got into ⬇️1) How a threat intel milestone led to the Pyramid of Pain2) Why detection isn't just about indicators3) What good threat hunting teams actually do#CryingOutCloud #CyberSecurity #ThreatHunting #PyramidOfPain #DavidBianco #Splunk #Infosec #CloudSecurity #DetectionEngineering #BlueTeam #SecurityPodcast #SOC #ThreatIntel #IncidentResponse Lees meer
-
AI-powered Security, Shared Fate, and an Archery Lesson with Dr. Anton Chuvakin
29 mei 2025 · 26 min
🎙️ Just dropped: Dr. Anton Chuvakin from Google Cloud, with legendary insights (and cloud security jokes).Eden Koby Naftali & Amitai Cohen sat down with Dr. Anton Chuvakin, Google Cloud's Office of the CISO, and the guy who made SIEM cool!What they got into ⬇️ Lees meer
1) Why SOCs are broken (and full of toil)2) How to actually apply AI in security3) Why cloud appliances are still a problem4) What shared responsibility really means
-
UK Retail Breaches, SAP 0day, and CVE Troubles
14 mei 2025 · 29 min
🎙️ All you need to know from Ransomware to CVE Programs!☁️ Join Amitai Cohen and Eden Naftali as they break down the top stories in the cloud:- UK Retail Sector Hit by Ransomware (DragonForce & Scattered Spider)- SAP NetWeaver Vulnerability Exploited in the Wild- CVE Program Faces Major Backlog and Trust Issues Lees meer
-
Bug Bounty Secrets, Hacker Communities, and a Hit of Volleyball with Justin Gardner
8 mei 2025 · 40 min
🎙️ Listen to the biggest insights of bug bounty hunting with Justin Gardner 🚨 Lees meer
In this episode, Amitai Cohen and Eden Naftali are joined by none other than Justin, renowned bug bounty hunter and host of the Creative Thinking podcast (ctbbpodcast).
Justin unpacks some of today's 🔥 topics:
- Bug bounty disclosure challenges & trends
- Security stories from tech giants: lessons we can all learn
- Messaging platform exploits & SSRF risks
- Breaking into popular monitoring tools — HTTP pitfalls & key takeaways
-
Quadruple Supply Chain Attack, IngressNightmare Exploited, and Rumors Abound
9 april 2025 · 29 min
🎙️ All you need to know on the latest discoveries and updates ft. Rami McCarthy 🚨In this episode of Crying Out Cloud, @Amitai Cohen & @Eden Koby Naftali are joined by Rami — a Principal Security Researcher here at Wiz.Rami adds some energy and expertise to the table as we dive into a variety of topics:• GitHub Action supply chain attack • IngressNightmare updates. A follow-up to our last episode on this critical vulnerability.• Alleged Oracle breaches: Breaking down the latest rumors and insights. Lees meer
-
Ingress Nightmare: How a Single Request Could Take Over Your K8s Cluster
25 maart 2025 · 22 min
🎙️ All you need to know on our latest discovery #IngressNightmare 🚨In this episode of Crying Out Cloud, Amitai Cohen & Eden Koby Naftali are joined by Nir Ohfeld — Head of Vulnerability Research at Wiz. Nir and his team have uncovered some of the most impactful vulnerabilities affecting cloud and SaaS applications. In this episode, he's diving into the latest discovery, a critical vulnerability in Ingress-NGINX:• How the team uncovered a critical unauthenticated RCE in NGINX Ingress Controller• Why Kubernetes admission controllers might be the next big attack surface• The wild journey of hunting vulnerabilities in the cloud Lees meer
-
From Hotmail Hacks to AI hype, CTFs & Cloud Guardian: with Ashish Rajan
5 maart 2025 · 22 min
🎙 Ready for the latest on AI, cloud security, and Fortune 500 challenges?This week on our podcast Crying Out Cloud, we're joined by none other than Ashish Rajan— a seasoned cybersecurity leader and host of the AI Cybersecurity Podcast & Cloud Security Podcast.Amitai Cohen & Eden Koby Naftali dive into:- The evolution of AI & cloud security- Lessons from securing Fortune 500 & FTSE 100 companies- The biggest challenges (and laughs) in the industry Lees meer
-
HACKERS ARE HIJACKING CLOUD KEYS: The Rise of Cloud-Native Ransomware
21 februari 2025 · 23 min
From Supply Chain Attacks to S3 Ransomware: Critical Cloud Security Stories You Need to Know. Lees meer
🎙️ In this episode of Crying Out Cloud, Eden and Amitai break down the latest cloud security chaos, from sneaky supply chain attacks to AI-powered malware:1) How attackers exploited a GitHub misconfiguration to enable a supply chain attack.2) The latest twist on cloud-native extortion (spoiler: it all comes back to stolen cloud keys).3) NullifAI – Malicious AI models hiding in plain sight.4) whoAMI attack – The clever AWS AMI name confusion flaw that might catch you off guard.
-
Norwegian Cloud Security, Open Source Tools, and Financial Sector Risks with Karim El-Melhaoui
10 februari 2025 · 22 min
🎙️ SEASON PREMIERE ALERT: Tune in to our latest episode featuring Karim El-Melhaoui, where we dive into the latest cloud security challenges ☁️🔥 Amitai Cohen & Eden Koby Naftali are kicking off the season with:- Cyber risk vs. operational risk – Why cyber risk is harder to quantify and how Norges Bank used NIST's Cybersecurity Framework to strengthen resilience.- Open-source tools fuel innovation, but many are abandoned without long-term support.- How cloud security alliance Norway is setting stronger security standards.🎧 Ready for season 3 of #CryingOutCloud? Lees meer
-
DeepSeek Data Leak with Gal Nagli (Wiz Research)
30 januari 2025 · 11 min
Why is everyone suddenly talking about DeepSeek? 👀 Lees meer
🎙️ If you've been seeing DeepSeek everywhere but are wondering what the actual buzz is about - this is for you: Our new podcast features Gal Nagli from the Wiz Research team, breaking it down with Eden Koby Naftali and Amitai Cohen.
Plus: Get the full story behind our recent DeepSeek database discovery that made headlines ⚡
-
Co-Founding Wiz, R&D and Security Leadership with Roy Reznik
23 december 2024 · 32 min
🎙️ Every great story starts with a beer in the Alps...
From building #Adallom to becoming a sommelier — hear Roy Reznik's journey as Co-Founder and VP R&D at @wiz in our podcast season finale! Lees meerIn this episode Eden Koby Naftali & Amitai Cohen dive into:
☁️ Roy's journey from Tel Aviv to London—culture.
🛠️ How companies can scale fast while staying secure.
💡 How R&D should foster a culture where developers proactively embrace security as a core value.
🤖 Thoughts on AI in development — Co-Pilots: where do they excel? -
post:Invent with Scott Piper (re:Invent digest)
13 december 2024 · 33 min
🎙️ Unpack AWS re:Invent's top announcements, trends, and what's next for cloud practitioners with @Scott Piper! Lees meer
Join Eden Naftali and Amitai Cohen in our latest #CryingOutCloud episode featuring Scott Piper, Wiz's Principal Cloud Security Researcher and "cloud security historian".
In this episode:
🌟 AWS re:Invent highlights: Aurora DSQL, Nova genAI, EKS Auto Mode
🔒 Security updates on RCPs, VPC Block Public Access, Declarative Policies for EC2
🎬 Scott's favorite cloud-themed movies from Wiz Video World (Pulp Encryption, anyone?) -
Red Team Tactics with EA’s Johann Rehberger
29 november 2024 · 35 min
Dive into the latest #CryingOutCloud episode featuring Johann Rehberger! Lees meer
Join Eden and Amitai as they sit down with Johann Rehberger, Red Team Director at @electronicarts and a cybersecurity expert. Johann also publishes innovative security research on his blog, Embrace the Red.
What you'll learn:
📌 Red teaming strategies to strengthen security programs
📌 Insights from Johann’s cutting-edge AI security research and experience
📌 The funny story behind Johann’s alias, Wunderwuzzi
Tune in now! 🎧
-
Canadian Cybersecurity, Open Source Risks, and AppSec Insights with Tanya Janca
8 november 2024 · 35 min
🎙️ Tune in to the latest #CryingOutCloud episode featuring Tanya Janca, where we dive into all things cloud! Lees meer
Join Eden and Amitai as they welcome Tanya Janca, founder of 'We Hack Purple', and the author of 'Alice and Bob Learn Application Security'. She's seen it all—from launching AppSec programs to teaching secure coding and leading on education at Semgrep.
In this episode:
🌐 Building security programs from scratch
🔍 The value of static analysis tools for developers
🇨🇦 The Canadian cybersecurity landscape and her take on global challenges
💡 Tips for securing AI applications in the age of generative AI -
Hybrid Cloud Attacks, Linux Malware, and LLMJacking Exposed
29 oktober 2024 · 19 min
🎙️ Ready for the latest on Hybrid Cloud Attacks, Linux Malware, and LLMJacking?
Join our hosts Eden Koby Naftali and Amitai Cohen in our NEW #CryingOutCloud episode. Lees meerIn this episode:
📌 The perfctl malware campaign—stealthily mining crypto on thousands of Linux machines undetected for years
📌 Storm-0501 hybrid cloud attacks, targeting everything from hospitals to law enforcement, with ransomware and stolen admin credentials
📌 LLMJacking—the latest evolution in malicious cloud access, selling AI access on underground markets -
AI Toolkit Risks, CUPS Vulnerabilities, and Google's Infostealer Defenses
8 oktober 2024 · 24 min
🎙️ Catch the latest episode of #CryingOutCloud, where Amitai Cohen and Eden Koby Naftali tackle key cloud security challenges from AI Toolkit Risks to CUPS Vulnerabilities! Lees meer
Tune in to hear about:
📌 Wiz Research discovered a vulnerability affecting the Nvidia container toolkit
📌 Google's novel Info Stealers Mitigations
📌 All the talk around the CUPS vulnerabilities
📌 How to leverage Atomic Cloud IOCs[And so much more...]
-
From NASA to GitLab: Democratizing Security, Open Source, and Empowering Women – With: Julie Davila
4 oktober 2024 · 28 min
📢 Tune in for the special episode of Crying Out Cloud with @Gitlab 's Julie Davila! 🚀 Lees meer
Join our Co-host Eden Koby Naftali and the cybersecurity leader Julie Davila, VP of Product Security at GitLab as they dive into:
📌 Balancing transparency in open-source tooling with security risks.
📌 Democratizing security: How GitLab empowers engineers to take ownership of security without disrupting their workflow.
📌 Plus, insights into empowering women in cloud security and why diverse representation is crucial for the industry's future.
-
Azure DDoS, Certificate Revocations, and ESXi Ransomware
12 augustus 2024 · 25 min
📢 From DDoS attacks to discovering a new cryptojacking campaign, tune in to our NEW episode of #CryingOutCloud to learn about all the latest cloud security news. Lees meer
Join our hosts Eden and Amitai as they dive into the latest cloud security stories:
* SeleniumGreed: Wiz Research discovered a new cryptojacking campaign targeting SeleniumGrid
* Why your Starbucks app went down?
* Internet chaos and lessons learned from DigiCert revoked certificates.
* ESXi ransomware: The danger of trusting by name. -
Navigating Hyper Growth, AI Impact, and Mandiant Memories - Special Guest: Ryan Kazanciyan
5 augustus 2024 · 38 min
📢 Tune in for an exclusive session with Ryan Kazanciyan on securing a security vendor, hyper-growth, and AI impact in the latest podcast episode of #CryingOutCloud! Lees meer
Join our hosts, Amitai Cohen and Eden Koby Naftali, as they dive into cloud security with Ryan Kazanciyan, our seasoned expert leading security at @Wiz.
🔍 Episode Highlights:
📌 Managing security during hyper growth: challenges and lessons learned.
📌 Ryan's experiences at Mandiant and the impact of the APT1 investigation on his approach to security.
📌 Current security trends and the role of AI in security.
📌 Ensuring safe use of AI tools like ChatGPT within the organization for internal use and product development. -
SAPwned: SAP AI Core vulnerabilities - Special Guest: Hillai Ben-Sasson
17 juli 2024 · 9 min
📢 Tune in to our special episode with Hillai Ben-Sasson with all you need to know about #SAPwned. Lees meer
TL;DR - The Wiz Research Team uncovered serious vulnerabilities in SAP AI Core, revealing potential risks in #AI infrastructure.
-
CROC Talks - Securing DBs, Cloud Threat Intel, and Detection- Special Guest: Snowflakes’ Haider Dost
15 juli 2024 · 30 min
📢 Tune in to Snowflake's Haider Dost for an exclusive session on Securing Databases, Cloud Threat Intelligence, and Detection strategies. Lees meer
The latest podcast episode of #CryingOutCloud is LIVE! Join our special hosts, @Alon Schindel and @Eden, as they dive deep into the world of cloud security with Haider Dost, Head of Global Threat Detection and Threat Intelligence at Snowflake.
🔍 Episode Highlights:
📌 Recent campaign targeting Snowflake customers.
📌 Discussion on the new mandatory MFA for Snowflake admins and its impact.
📌 Architecture of detection in the cloud & logging. What does it mean to work in a highly regulated environment compared to a fast-growing company like Snowflake.
📌 Defining "good security" in traditional vs. cloud-native settings. -
CROC News: Firewall Fumbles, Gitloker Etiquette, and Private Cloud Compute
28 juni 2024 · 24 min
📢 From data privacy norms in the age of AI
— tune in to the latest episode of #CryingOutCloud with all you need to know from the cloud security news 🚨 Lees meerJoin Eden Naftali and Amitai Cohen as they dive into:
🔍 How a new AI processing cloud service is challenging data privacy norms.
🛡️ The implications of a potential firewall misconfiguration and how to secure your environment.
🔐 The latest ransomware attacks on GitHub repositories and how to safeguard your data.
⚠️ A new discovery by Wiz research: crypto-jacking campaign targeting Kubernetes clusters.
🐘 Critical remote code execution vulnerability in PHP and how to mitigate the risk.
-
CROC Talks: RCE Vulnerability in Ollama explained
24 juni 2024 · 11 min
💥 EXCLUSIVE: Wiz Research uncovers CVE-2024-37032, aka #Probllama — a vulnerability in Ollama that that left thousands of #AI models exposed 😲
-
CROC Talks: Chief Llama Officer and IBM CISO - Jerry Bell
6 juni 2024 · 39 min
What is it like to be IBM's 'Chief Llama Officer'? 🦙 Lees meer
🎙️ Tune in as Jerry Bell shares his journey from crashing his first computer at 10 to leading IBM's Public Cloud Security
What's on today's agenda?
😲 Managing a popular 'Mastodon' server post-Twitter acquisition
🛡️ Challenges and surprises as IBM's CISO
🔐 Insights on the security implications of M&A -
CROC News: Ninjas, Grand Theft AI, and Backlogged CVEs
27 mei 2024 · 23 min
🎙️ All that's 🔥 in the cloud: From logging and cloud attacks to NVD backlog updates. Lees meer
what's on today's agenda?
1️⃣ Discover how logging bypass made password-spray attacks undetectable.
2️⃣ Learn about the latest way attackers are monetizing cloud access - by selling access to other people's AI models.
3️⃣ NVD's ongoing backlog - Hear about how the industry is dealing with it. -
CROC Talks - Threat Models, Cloud Tools, and Security Tales - Special Guest: Kat Traxler
9 mei 2024 · 34 min
Our latest episode of Crying out cloud features none other than Kat Traxler, a seasoned security professional renowned for her expertise in cloud research.🚀 Lees meer
Here's a sneak peek at what we'll cover:
🔍 Threat modeling: Kat's practical insights
🔧 "DeRF": Kat's revolutionary tool and how it can help cloud security practitioners
💡 Dispelling myths about cloud security and how it challenges the OSI model
🔬 Future research directions in cloud security & Kat's latest projects in the field
-
CROC Talks: Helping Secure Hugging Face Hub - Special Guest: Shir Tamari
4 april 2024 · 11 min
🚨 BREAKING: Wiz Research identifies critical risks in #AI-as-a-service 🚨 Lees meer
Dive into Crying Out Cloud's latest episode, featuring a very special guest, Shir Tamari, head of the research team at Wiz. This episode sheds light on the security challenges that come with the rapid integration of AI technologies. Highlights include:
🚀 Exploring the rapid integration of AI and its associated security risks, identified by Wiz Research in collaboration with Hugging Face.
🛡️ Exposing two significant security flaws within Hugging Face's systems: shared inference and CI/CD systems, which could potentially offer unauthorized access to sensitive data.
📢 Highlighting the critical need for robust security frameworks in AI services.
✅ Demonstrating Hugging Face's dedication to security through the adoption of Wiz CSPM, continuous vulnerability assessments, and annual penetration tests, thereby establishing a high standard in AI safety.
-
CROC News - XZ Utils backdoor explained
31 maart 2024 · 13 min
The backdoor in XZ Utils is shaking the industry 🔔
How could we not talk about it? Lees meerTune in to the special unscheduled episode of Crying Out Cloud with Eden Naftali and Amitai Cohen as they delve into the stealthy supply chain attack!
In this episode:
🔍 The Alert from CISA regarding CVE-2024-3094, a vulnerability in XZ Utils Data Compression Library versions 5.6.0 and 5.6.1
🛑 The potential risks posed by the embedded malicious code and the unauthorized access it may grant to affected systems
🛡️ Security Team Action PlansTune in now!
-
CROC News: Malicious Repos, Bandwidth Theft, & NVD or NoVD?
26 maart 2024 · 32 min
🎙️ What is a better way to stay updated on cloud security than a NEW Crying Out Cloud episode! Lees meer
Join Eden Naftali and Amitai Cohen as they explore what is new and 🔥:
👾 Open-source repos flooded by malicious code.
💻 What is to become of the National Vulnerability Database?
⛓️ Proof of bandwidth cryptojacking
🛠️ Critical vulnerabilities discovered in popular CI/CD tool
Links:
https://apiiro.com/blog/malicious-code-campaign-github-repo-confusion-attack/
https://github.blog/2024-02-29-keeping-secrets-out-of-public-repositories/
https://research.openanalysis.net/github/lua/2024/03/03/lua-malware.html
https://resilientcyber.substack.com/p/death-knell-of-the-nvd
https://sysdig.com/blog/cloud-threats-deploying-crypto-cdn/
-
CROC Talks: Bug Bounty Hunting & Pen Testing with Sam Curry
20 maart 2024 · 41 min
The NEW exclusive interview with hacker extraordinaire Sam Curry on Crying Out Cloud is out! Lees meer
Join Eden Naftali and Amitai Cohen as they explore the role of a Bug-Bounty Hunter with Sam Curry:
🔑 Learn about Sam's journey into security research
🛠️ Favorite tools and underrated platforms
🤖 The trustworthiness implications of AI-driven technologies in transportation.
🔒 Vulnerabilities within a major tech company's infrastructure. The tradeoff between scanning gigantic IP ranges and selecting the best research targets.
Important links:
https://samcurry.net/web-hackers-vs-the-auto-industry/
https://samcurry.net/hacking-apple/
https://samcurry.net/points-com/