Binance's Fake Interview Hack, Railway's AI Incident, Hacked Freezers & a Critical Linux Bug

The Low Down Podcast is presented by Maze.
https://mazehq.com/lowdown
X: https://twitter.com/Maze_Security

The "signup test" was probing for Kubernetes secrets.

Ed and Matt get into Railway's AI testing incident, hacked refrigeration systems, and fake job interviews targeting developers. Then Ed works through a Linux kernel bug before we finish with ARTEX and a warning about a prebuilt Docker image.

Today we're talking about:

Railway and the AI testing incident
We follow the logs, the apologies, and the personal credit card that helped identify the employee. Josh Manders says every probing attempt was blocked and nothing was accessed; Railway later described it as an employee's personal project. Ed and Matt have plenty to say about authorization and the "my agent did it" explanation.
Employee's account (https://x.com/jakerunzer/status/2117474337682780643)
Josh's account (https://x.com/joshmanders/status/2117530391183507484)
Railway's statement (https://x.com/JustJake/status/2117746864745578719)
Credit-card exchange (https://x.com/vxunderground/status/2117656394396778956)

Hacked freezers, blood banks, and exposed controls
More refrigeration attacks lead into the practical problems of securing operational systems. We talk about slow patch approvals, unclear ownership, and what getting a management interface off the public internet actually involves.
Supermarket report (https://www.bbc.com/news/articles/cq1kd1nee80eo)
Blood-storage report (https://www.theguardian.com/technology/2026/nov/04/france-national-blood-service-hack-cyber-attack-europe)

Binance and fake job interviews
Binance's account of an employee compromised through a fake interview leads into how fake recruiters target developers. Matt walks through separate malicious coding-test and VS Code examples, including the pressure to run unfamiliar code while an interviewer watches. We discuss keeping those exercises off your everyday machine.
Binance report (https://www.reuters.com/world/binance-says-hackers-used-fake-job-interview-compromise-computer-before-63-2026-11-03/)
MetaPlay case study (https://github.com/alexhraber/metaplay-fake-interview-supply-chain-incident)
VS Code case study (https://ransom-isac-landing.pages.dev/blog/contagious-interview-vscode-to-rat/)

Linux TCP, MPTCP, and exploit math
Ed explains a kernel use-after-free, the demonstrated MPTCP exploit, and why reliable exploitation is more complicated than the severity score suggests. We get into the conditions an attacker needs, patching, and some increasingly elaborate math.
Go Security Team advisory (https://groups.google.com/g/golang-announce/c/PCoQcdxoScw/m/aD-MgXEvAAAJ)

ARTEX and the Docker image warning
CrowdStrike reports on ARTEX in real intrusions. Separately, researchers raise backdoor concerns about a specific prebuilt Docker image. We look at what they found and Jason Haddix's SpikeStrip experiment for tripping up AI pentesting tools.
CrowdStrike research (https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/)
Image warning (https://x.com/GrahamHelton3/status/2117782531856581004)
SpikeStrip announcement (https://x.com/Jhaddix/status/2117342447445627141)

If you work with grocery-store or other operational networks, we'd like to hear what getting these systems off the internet looks like on the ground.

Linked reports may include later updates.

—————-

Listen on Spotify!
https://go.lowdownpod.com/spotify

The Low Down is presented by Maze.
LinkedIn: https://www.linkedin.com/company/mazehq/
X: https://twitter.com/Maze_Security

Follow Us!
https://www.instagram.com/lowdown.pod

Ed / Low Level
Instagram: https://www.instagram.com/lowleveltv/
LinkedIn: https://www.linkedin.com/in/lowleveltv/
YouTube: https://www.youtube.com/@LowLevelTV

Matt Johansen / Vulnerable U
Instagram: https://www.instagram.com/mattjayy/
LinkedIn: https://www.linkedin.com/in/matthewjohansen/
YouTube: https://www.youtube.com/@VulnerableU