Oct 21, 2026 · 1h 5m
Weak keys and AI breaches expose cybersecurity’s widening fault lines
Risky Business #856 -- 8-bit encryption, PHP megabugs and more
The episode connects technical vulnerabilities, criminal ecosystems, geopolitical operations, and constrained incident-response capacity into one increasingly interdependent security picture.
- 1Weak certificate-authority keys and major PHP and virtualization flaws show how basic infrastructure failures can create outsized exposure.
- 2AI services now expand the attack surface through stolen model-access tokens, questionable retrieval, espionage attempts, and contested government restrictions.
- 3Ransomware, phishing, North Korean IT-worker schemes, compromised operational technology, and supply-chain attacks are stretching defensive and response capacity.
Don't miss
The panel examines how faulty randomness apparently left eMudra certificate private keys with an extraordinarily small effective key space.
The brief
Patrick Gray, James Wilson, and guest Mark Khoury open with a week where PHP and virtualization flaws, weak certificate keys, and premature patching warnings expose fragile foundations.
The panel moves from compromised OpenCode accounts and stolen model-access tokens to the US ban on DeepSeek, questioning how AI restrictions work through proxies and hosted services.
Across ransomware, phishing marketplaces, recycled domains, North Korean IT-worker schemes, and compromised refrigeration monitors, the recurring problem is access hiding in ordinary infrastructure.
The discussion widens to malvertising, software supply-chain compromise, gift-card fraud, espionage, and Ukraine’s strikes on Russian data centers, while incident-response capacity becomes a constraint.
The standout technical absurdity is the eMudra certificate problem: faulty randomness apparently left private keys with extremely low entropy, making revocation only part of the challenge.
A Trail of Bits conversation closes the episode by examining AI-assisted vulnerability patching and regression hunting, extending the debate from finding flaws to safely fixing them.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.