Risky Biz Soap Box: It took a decade, but allowlisting is cool again
In this Soap Box edition of the Risky Business podcast Patrick Gray sits down with Airlock Digital co-founders Daniel Schell and David Cottingham to talk about the role AI models could play in managing enterprise allowlists.
They also talk about the durability of allowlisting as a control. After 12 years in business, the Airlock product hasn’t really changed all that much. That’s a good thing! It also means the Airlock team have been able to spend some time doing deep engineering instead of chasing the latest attacker TTPs and writing detection rules for them.
This episode is also available on Youtube.
Show notes
Risky Business #820 -- Asian fraud kingpin will face Chinese justice (pew pew!)
Risky Business returns for 2026! Patrick Gray and Adam Boileau talk through the week’s cybersecurity news, including:
Santa brings hackers MongoDB memory leaks for Christmas
Vercel pays out a million bucks to improve its React2Shell WAF defences
39C3 delivers; the pink Power Ranger deletes nazis, while a catgirl ruins GnuPG
Cambodian scam compound kingpin gets extradited to China, and we don’t think it’ll go well for him
Krebs picks apart the Kimwolf botnet and residential proxy networks
So many healthcare data leaks that we have a roundup section
This week’s episode is sponsored by Airlock Digital. The founders of the application allow-listing vendor, David Cottingham and Daniel Schell, discuss Microsoft’s ClickOnce .NET app packaging, and how attackers have been abusing it to load code. Airlock hates it when you load code!
This episode is also available on Youtube.
Show notes
US, Australia say ‘MongoBleed’ bug being exploited | The Record from Recorded Future News
Merry Christmas Day! Have a MongoDB security incident. | by Kevin Beaumont | Dec, 2025 | DoublePulsar
Inside Vercel’s sleep-deprived race to contain React2Shell | CyberScoop
gpg.fail
Hacktivist deletes white supremacist websites live onstage during hacker conference | TechCrunch
Chinese attackers exploiting zero-day to target Cisco email security products | The Record from Recorded Future News
Ni8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858) | Cyera Research Labs
ServiceNow patches critical AI platform flaw that could allow user impersonation | CyberScoop
Alleged cyber scam kingpin arrested, extradited to China | The Record from Recorded Future News
FCC IoT labeling program loses lead company after China probe | Cybersecurity Dive
Trump picks Lt. Gen. Joshua Rudd to lead NSA spy agency - The Washington Post
NSA cyber directorate gets new acting leadership | The Record from Recorded Future News
Dutch court sentences hacker who used port systems to smuggle cocaine to 7 years | The Record from Recorded Future News
ECLI:NL:GHAMS:2026:22, Amsterdam Court of Appeal, 23-003218-22
The Kimwolf Botnet is Stalking Your Local Network – Krebs on Security
Who Benefited from the Aisuru and Kimwolf Botnets? – Krebs on Security
Coupang recovers smashed laptop that alleged data leaker threw into river | The Record from Recorded Future News
Ransomware responders plead guilty to using ALPHV in attacks on US organizations | The Record from Recorded Future News
Nearly 480,000 impacted by Covenant Health data breach | The Record from Recorded Future News
Illinois health department exposed over 700,000 residents' personal data for years | TechCrunch
Tech provider for NHS England confirms data breach | TechCrunch
Hacker claiming to be behind ManageMyHealth breach: ‘I do it for the money and I’m in negotiations to get it’ - NZ Herald
Risky Business #799 -- Everyone's Sharepoint gets shelled
Risky Biz returns after two weeks off, and there sure is cybersecurity news to catch up on. Patrick Gray and Adam Boileau discuss:
Microsoft tried to make outsourcing the Pentagon’s cloud maintenance to China okay (it was not)
She shells Sharepoint by the sea-shore (by ‘she’ we mean ‘China’)
Four (alleged) Scattered Spider members arrested (and bailed) in the UK
Hackers spend $2700 to buy creds for a Brazilian payment system, steal $100M
Fortinet has SQLI in the auth header, Citrix mem leak is weaponised, HP hardcodes creds and Sonicwalls get user-moderootkits. Just security vendor things!
This week’s episode is sponsored by Airlock Digital. CEO David Cottingham talks through what it takes to build a mature, resilient management platform for a security critical system.
This episode is also available on Youtube.
Show notes
Update on DOD’s cloud services
Microsoft to stop using engineers in China for tech support of US military, Hegseth orders review
A Little-Known Microsoft Program Could Expose the Defense Department to Chinese Hackers
While DOD policy bans unauthorized apps like TikTok from being on employees phones over national security risks
Microsoft Fix Targets Attacks on SharePoint Zero-Day – Krebs on Security
National Guard was hacked by China's 'Salt Typhoon' group, DHS says
Suspected contractor for China’s Hafnium group arrested in in Italy | Cybersecurity Dive
Singapore accuses Chinese state-backed hackers of attacking critical infrastructure networks | The Record from Recorded Future News
UK Arrests Four in ‘Scattered Spider’ Ransom Group – Krebs on Security
Four people bailed after arrests over cyber attacks on M&S, Co-op and Harrods
Brazilian police arrest IT worker over $100 million cyber theft | The Record from Recorded Future News
At Least 750 US Hospitals Faced Disruptions During Last Year’s CrowdStrike Outage, Study Finds | WIRED
Hacker returns cryptocurrency stolen from GMX exchange after $5 million bounty payment | The Record
Indian crypto exchange CoinDCX says $44 million stolen from reserves | The Record
Chainalysis: $2.17 billion in crypto stolen in first half of 2025, driven by North Korean hacks | The Record
PoisonSeed bypassing FIDO keys to ‘fetch’ user accounts
Risky Bulletin: Browser extensions hijacked for web scraping botnet
A Startup is Selling Data Hacked from Peoples’ Computers to Debt Collectors
A surveillance vendor was caught exploiting a new SS7 attack to track people's phone locations | TechCrunch
Ukrainian hackers wipe databases at Russia's Gazprom in major cyberattack, intelligence source says
File transfer company CrushFTP warns of zero-day exploit seen in the wild | The Record
HPE warns of hardcoded passwords in Aruba access points
Pre-Auth SQL Injection to RCE - Fortinet FortiWeb Fabric Connector (CVE-2025-25257)
Researchers, CISA confirm active exploitation of critical Citrix Netscaler flaw | Cybersecurity Dive
Google finds custom backdoor being installed on SonicWall network devices - Ars Technica
Hackers Can Remotely Trigger the Brakes on American Trains and the Problem Has Been Ignored for Years