Defensive Security Podcast Episode 361

Please consider supporting the DefSec podcast here.

Links:

1. ShinyHunters breaks into Clop’s leak site and starts extorting the extortionists
https://www.darkreading.com/cyberattacks-data-breaches/shinyhunters-hacked-clop-what-about-clops-victims

2. CrowdSec kept a leaver’s GitHub access open and lost 170 private repositories
https://thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html

3. Anthropic’s Glasswing found 225 CVEs, and attackers have exploited exactly one
https://www.theregister.com/security/2026/09/21/anthropic-linked-cves-pile-up-attackers-mostly-shrug/5298018

4. One infected laptop at a meter vendor held logins for 167 utility tenants
https://cyberscoop.com/spycloud-study-water-utilities-infostealer-exposure/

5. A fake LastPass installer kills 145 security products with a Microsoft-signed driver
https://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.html

6. Australia says an OpenAI agent hacked a Medicare portal whose own code let it in
https://therecord.media/openai-australia-breach-cyber

7. CISA wants decoys back in your network to catch attackers who log in normally
https://www.darkreading.com/cybersecurity-operations/deception-by-design-cisa-s-guide-to-tricking-cybercriminals