Risky Business #791 -- Woof! Copilot for Sharepoint coughs up creds and keys
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
Struggling to find that pesky passwords.xlsx in Sharepoint? Copilot has your back!
The ransomware ecosystem is finding life a bit tough lately
SAP Netweaver bug being used by Chinese APT crew
Academics keep just keep finding CPU side-channel attacks
And of course… bugs! Asus, Ivanti, Fortinet… and a Nissan LEAF?
This week’s episode is sponsored by Resourcely, who will soothe your Terraform pains. Founder and CEO Tracis McPeak joins to talk about how to get from a very red dashboard full of cloud problems to a workable future.
This episode is also available on Youtube.
Show notes
Exploiting Copilot AI for SharePoint | Pen Test Partners
MrBruh's Epic Blog
Ransomware group Lockbit appears to have been hacked, analysts say | Reuters
"CONTI LEAK: Video they tried to bury! 6+ Conti members on a private jet. TARGET’s birthday — $10M bounty on his head. Filmed by TARGET himself. Original erased — we kept a copy."
Mysterious hackers who targeted Marks and Spencer's computer systems hint at political allegiance as they warn other tech criminals not to attack former Soviet states
The organizational structure of ransomware groups is evolving rapidly.
SAP NetWeaver exploitation enters second wave of threat activity
China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures
DOGE software engineer’s computer infected by info-stealing malware
Hackers hijack Japanese financial accounts to conduct nearly $2 billion in trades
FBI and Dutch police seize and shut down botnet of hacked routers
Poland arrests four in global DDoS-for-hire takedown
School districts hit with extortion attempts after PowerSchool breach
EU launches vulnerability database to tackle cybersecurity threats
Training Solo - vusec
Branch Privilege Injection: Exploiting Branch Predictor Race Conditions – Computer Security Group
Remote Exploitation of Nissan Leaf: Controlling Critical Body Elements from the Internet
PSIRT | FortiGuard Labs
EPMM Security Update | Ivanti
Cybersecurity's Past, Present, and AI-Driven Future
Is it time to hand over cybersecurity to machines amidst the exponential rise in cyber threats and breaches?
We trace the evolution of cybersecurity from minimal measures in 1995 to today's overwhelmed DevSecOps. Travis McPeak, CEO and Co-founder of Resourcely, kicks off our discussion by discussing the historical shifts in the industry. Kevin Tian, CEO and Founder of Doppel, highlights the rise of AI-driven threats and deepfake campaigns. Feross Aboukhadijeh, CEO and Founder of Socket, provides insights into sophisticated attacks like the XZ Utils incident. Andrej Safundzic, CEO and Founder of Lumos, discusses the future of autonomous security systems and their impact on startups.
Recorded at a16z's Campfire Sessions, these top security experts share the real challenges they face and emphasize the need for a new approach.
Resources:
Find Travis McPeak on Twitter: https://x.com/travismcpeak
Find Kevin Tian on Twitter: https://twitter.com/kevintian00
Find Feross Aboukhadijeh on Twitter: https://x.com/feross
Find Andrej Safundzic on Twitter: https://x.com/andrejsafundzic
Stay Updated:
Find a16z on Twitter: https://twitter.com/a16z
Find a16z on LinkedIn: https://www.linkedin.com/company/a16z
Subscribe on your favorite podcast app: https://a16z.simplecast.com/
Follow our host: https://twitter.com/stephsmithio
Please note that the content here is for informational purposes only; should NOT be taken as legal, business, tax, or investment advice or be used to evaluate any investment or security; and is not directed at any investors or potential investors in any a16z fund. a16z and its affiliates may maintain investments in the companies discussed. For more details please see a16z.com/disclosures.
Stay Updated:
Find a16z on YouTube: YouTube
Find a16z on X
Find a16z on LinkedIn
Listen to the a16z Show on Spotify
Listen to the a16z Show on Apple Podcasts
Follow our host: https://twitter.com/eriktorenberg
Please note that the content here is for informational purposes only; should NOT be taken as legal, business, tax, or investment advice or be used to evaluate any investment or security; and is not directed at any investors or potential investors in any a16z fund. a16z and its affiliates may maintain investments in the companies discussed. For more details please see a16z.com/disclosures.
Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.