Watch Replay3:20Attackers target Palo Alto firewall management
Find every reachable firewall management service, check its actual inspection path and verify a fixed maintenance build.
Interactive Multimedia Walkthroughs
Because reading an article isn't for everyone.
Browse Replays
Most recent first18 Replays
Watch Replay3:20
Watch Replay2:40Fireblocks flaw exposes a signer's root share
Explain backward recovery within one signer share hierarchy while preserving the other-party requirement for a spendable key.
Watch Replay3:16vsomeip reserves memory for data never sent
Follow a declared message length into a memory reservation, then verify a fixed release or loaded size limit.
Watch Replay3:38ConnectWise attacker planted more app credentials
Trace added application credentials and changed privileges, then check what access remains after containment.
Watch Replay3:09Zimbra runs commands from rejected mail
Follow a rejected email address through Zimbra's log and notification code, then check the server's version and settings.
Watch Replay2:50Palo Alto releases PAN-OS Brotli fixes
Check the PAN-OS build, traffic decryption and Brotli inspection settings, then verify a mitigation or installed fix.
Watch Replay3:17Node.js decoder writes past its buffer
Malformed Brotli input makes a decoder keep writing past a small buffer. Trace untrusted decompression and verify that a fixed Node.js runtime is actually in service.
Watch Replay3:10Attackers stole secrets from GitHub logs
A stolen token plants a workflow that copies available secrets into its own logs. Check actual execution, preserve retained records and control access to secrets.
Watch Replay2:52LiteLLM's release used a lookalike source
A release record can accurately name an unapproved source. Compare the repository identity with the approved input, then inspect the shipped files.
Watch Replay3:19ConnectWise app access outlasted backup plans
A former backup subscription can leave application permission behind. Check the grant and distinguish issued access from its use.
Watch Replay1:48PHP Flaws Put MFA Secrets Within Reach
In the reported intrusion, PHP exploitation led to password hashes and MFA secrets. Patching and credential response address different risks.
Watch Replay1:50Nextcloud: The Risk During a Restart
A stopped CODE server exposes a command-execution path. Disabling the app leaves the vulnerable code in place.
Watch Replay1:54VeloCloud: A Read-Only Account Gains Power
On an affected orchestrator, a read-only account with network access can reach operator privileges.
Watch Replay1:57One Stealer, Several Ways Into Your Work
A Windows stealer can collect AI sessions and developer credentials. Each exposed account needs its own response.
Watch Replay2:09GlobalProtect breach reaches server disks
Remote access reaches the management layer, where a disk read can fall outside the running server’s view.
Watch Replay2:10eMudhra key flaws reach beyond browsers
A weak signing authority creates an impersonation risk that different applications must address separately.
Watch Replay2:01Poisoned LiteLLM packages steal secrets
The files delivered to a computer contain hidden startup code, even though the source tag looks clean.
Watch Replay2:06Phone scam leads to ServiceNow export
A shared recovery code lets an impostor claim an identity, reach connected applications and take data.