Send us Fan Mail A “boring” GitHub Actions workflow file should never be able to empty your secrets vault, yet that is exactly what the Ghost Action campaign shows. We walk through GitGuardian’s research and the real mechanics of how attackers use stolen but valid developer tokens to add or modify workflow YAML, scrape secret names from your own repo, and exfiltrate CI/CD secrets to an external endpoint. The scary part is not exotic malware, it is normal automation doing what it was designed ...
Oct 19
49 min
Send us Fan Mail 495 organizations woke up and could not get to their servers. Railways. A prefectural police force. A food logistics company that could not receive or ship goods. All on the same cloud provider, all locked out at once. Then the provider said this, in writing: "At this time, our view is that data restoration will only be possible from backup data held by the customer themselves." Read that again. You are getting your data back from your own backups — and for some...
Oct 12
38 min
Send us Fan Mail An AI agent gets blocked by access controls, then calmly finds another way in anyway and that is the wake-up call. I use a recent Hacker News story about an automated agent bypassing an Australian government health portal to dig into what CISSP Domain 6.2 is really testing: not your ability to recite a list of techniques, but your ability to manage authorization, scope, and rules of engagement so a “test” does not turn into an intrusion. We break down why the portal controls...
Oct 5
37 min
Send us Fan Mail A stolen password is annoying. A stolen session token can be invisible, valid, and instantly profitable. Today we dig into a real warning sign from Okta threat intelligence: infostealer malware lifted live session tokens from browsers, and thousands of Google sessions were still working weeks later. No MFA prompt. No brute force. Just a legitimate session replayed by the wrong person, with real dollar damage through unauthorized usage and credits. We use that story to sharpe...
Sep 28
32 min
Send us Fan Mail One video hotline feels like a single, simple conversation until you trace the call path and realise there may be seven companies involved in making it work. That’s the spark for this training-focused breakdown of CISSP Domain 4.3 secure communication channels, using the viral AI “actress hotline” story to show how modern voice and video collaboration really behaves behind the curtain. We start with a practical analogy: you think you’re transacting with the waiter, but your ...
Sep 21
30 min
Send us Fan Mail A compliance deadline can change your security posture without changing a single bit of your encryption. We start with a simple sticker-on-the-windshield analogy that maps directly to what’s happening with FIPS 140 validations: your VPN can keep encrypting, your database can keep protecting data, and yet an assessor can still mark you down because “working” is not the same as “validated.” We walk through the practical CISSP Domain 3 lesson behind the noise: the difference be...
Sep 14
38 min
Send us Fan Mail 🔁 REPLAY — this episode originally aired as CCT 278 in September 2025. I'm heads-down finishing a Domain 3 cryptography episode, so I'm re-running one of the strongest episodes in the archive rather than shipping something thin. If you're newer to the show, you haven't heard this one. And if you're studying Domain 3 right now the timing works in your favor — security models are the foundation the rest of the domain sits on, and next week's episode picks up in the same domai...
Sep 7
31 min
Send us Fan Mail Nine million images. No password. No encryption. And the defence was basically: “It wasn’t public because you had to know the URL.” That single line opens up one of the most important CISSP Domain 2 conversations you can have: security through obscurity is not access control, and a hidden address is not a key. We take this real data exposure and translate it into the kind of manager-level reasoning the CISSP exam demands, not memorised trivia. We then zoom out into Asset Sec...
Aug 31
42 min
Send us Fan Mail A rogue AI agent didn’t “hack the future” so much as exploit the oldest security problems in the book: weak boundaries, over-trusted inputs, exposed endpoints, and credentials lying around. We walk through the Hugging Face intrusion story like a CISO briefing a board, step by step, translating a fast-moving AI-red-team narrative into the kind of clear threat modeling logic you need for ISC2 CISSP Domain 1.10 and for real risk decisions. From there, we shift into traini...
Aug 24
42 min
Send us Fan Mail A supply chain attack that leaves your Git history spotless should change how you think about “secure code.” We walk through ChainDrop, a worm discovered in the NPM ecosystem that poisoned 444 packages while evading the places defenders usually look. The unnerving twist is that it can trigger without a classic npm install and can hide in the space between your repository and the package archive your CI/CD pipeline actually pulls, which is exactly why code review alone can’t b...
Aug 17
33 min
Load more