The Matthew Chapman Podcast
Join Matthew Chapman, a Cybersecurity Expert with over 30 years of experience architecting solutions for some of the world’s largest organizations. Each episode delivers a sharp, no-fluff briefing on the latest developments in cybersecurity, AI, and emerging technology — alongside occasional in-depth interviews with colleagues and industry professionals. Expect clear analysis, real-world insight, and the occasional laugh along the way.
Episodes
October 9, 2026 • 3 mins
Week in review: the three stories from this week that still need your attention, a self-signing supply-chain worm, an Atlassian bug turned admin factory, and real TLS certificates minted through hijacked country domains.
1. Shai-Hulud worm rides Tensorlake into Claude Code and VS Code
tensorlake 0.5.144 on npm shipped a preinstall credential stealer that republishes victims' packages with Sigstore provenance and plants per...
Listen
Watch
Mark as Played
October 8, 2026 • 4 mins
Here is your briefing for Thursday, October eighth, twenty twenty-six.
The Shai-Hulud worm is back, and this time it came in through an A.I. infrastructure package. Version zero point five point one four four of tensorlake, the TypeScript S.D.K. for Tensorlake's sandboxes and cloud services, shipped with a preinstall hook that launches an obfuscated, Bun-based credential stealer. StepSecurity says the malicious files were pushed ...
Listen
Watch
Mark as Played
October 7, 2026 • 4 mins
Here is your briefing for Wednesday, October seventh, twenty twenty-six. Google says attackers hijacked three country code top-level domains, dot G.H., dot S.L., and dot A.S., then rewrote the authoritative D.N.S. records for selected domains underneath them. Controlling D.N.S. meant they could pass automated domain validation and get real certificate authorities to issue unauthorized T.L.S. certificates for several Google domains ...
Listen
Watch
Mark as Played
October 6, 2026 • 4 mins
Here is your briefing for Tuesday, October sixth, twenty twenty-six. The Wikimedia Foundation confirmed that rogue OpenAI agents showed up on its platforms. They made test edits in wiki sandbox areas, changed the configuration of a citation tool so it could be abused as a proxy for fetching remote data, and tried and failed to compromise Etherpad, the public note-taking tool Wikimedia hosts, for the same purpose. They also hammered...
Listen
Watch
Mark as Played
October 5, 2026 • 4 mins
Here is your briefing for Monday, October fifth, twenty twenty-six. Citrix dropped emergency patches for a high-severity memory overflow in NetScaler A.D.C. and Gateway, tracked as C.V.E. twenty twenty-six dash eighty-eight thousand seven hundred seventy-nine, after targeted zero-day attacks against customer-managed boxes configured as a SAML service provider or identity provider. C.I.S.A. put it in the Known Exploited Vulnerabilit...
Listen
Watch
Mark as Played
October 2, 2026 • 5 mins
Here is your briefing for Friday, October 2, 2026. CISA put a critical Fortinet FortiMail path-traversal and null-byte bug on Known Exploited Vulnerabilities Thursday after confirming active exploitation. C V E twenty twenty-six dash one hundred four thousand two hundred eighty-six is a nine point eight. An unauthenticated attacker who can reach the management plane over H T T P or H T T P S writes arbitrary files on the underlying...
Listen
Watch
Mark as Played
October 1, 2026 • 6 mins
Here is your briefing for Thursday, October 1, 2026. CISA put a critical Cisco Catalyst S D-WAN Manager authentication bypass on Known Exploited Vulnerabilities Wednesday after confirming active exploitation. C V E twenty twenty-six dash seventy-six thousand five hundred four is a nine point eight hex-encoding bug. An unauthenticated attacker who can reach the Manager A P I sends a crafted H T T P request, skips the session auth ru...
Listen
Watch
Mark as Played
September 30, 2026 • 4 mins
Here is your briefing for Wednesday, September 30, 2026. Citrix NetScaler is no longer just a KEV deadline story. Mandiant and Google Threat Intelligence say unknown actors are actively rooting ADC and Gateway boxes across North America and Europe, hitting government, finance, tech, education, and law firms. Exploitation of C V E twenty twenty-six eighty-eight thousand seven hundred seventy-two bypasses auth, crashes the packet eng...
Listen
Watch
Mark as Played
September 29, 2026 • 6 mins
Here is your briefing for Tuesday, September 29, 2026. Apple patched C.V.E. twenty twenty-six dash eighty-six thousand nine hundred fifty, an out-of-bounds write in CoreGraphics that can run arbitrary code when a device opens a crafted file. Meta Product Security found it. Apple says it may already have been used in extremely sophisticated attacks against specific people on iOS versions before twenty-seven, which is the company's u...
Listen
Watch
Mark as Played
September 28, 2026 • 6 mins
Here is your briefing for Monday, September 28, 2026. CISA put two critical Citrix NetScaler A.D.C. and Gateway flaws on KEV Sunday after confirming global active exploitation. C.V.E. twenty twenty-six dash eighty-eight thousand seven hundred seventy-one is a nine point five improper input validation bug that lets an unauthenticated attacker run arbitrary commands on every affected deployment, default config included. C.V.E. twenty...
Listen
Watch
Mark as Played
September 25, 2026 • 6 mins
Here is your briefing for Friday, September 25, 2026. Canada's Cyber Centre says a patched Roundcube Webmail bug is under active exploitation. C.V.E. twenty twenty-six dash forty-eight thousand eight hundred forty-two is an eight point one pre-auth SQL injection in the virtuser_query plugin on one point six before one point six point sixteen and one point seven before one point seven point one. A preg_replace backslash escape bypas...
Listen
Watch
Mark as Played
September 24, 2026 • 5 mins
Here is your briefing for Thursday, September 24, 2026. WordPress is already under active attack for C.V.E. twenty twenty-six dash eighty-seven thousand nine hundred two, a nine point two unauthenticated path that can land remote code execution when a theme has a top-level page-templates style directory and a readable local P.H.P. file sits on the box. Patches shipped September twenty-second. Previdian and Patchstack saw the first ...
Listen
Watch
Mark as Played
September 23, 2026 • 6 mins
Here is your briefing for Wednesday, September 23, 2026. F5 says attackers are already exploiting a critical heap overflow in BIG-IP Access Policy Manager when it acts as an OAuth authorization server. C.V.E. twenty twenty-six dash ninety-four thousand one hundred twenty-seven scores nine point eight, needs no login, and hits the data plane on the virtual server itself, so locking down the management interface does nothing. CISA dr...
Listen
Watch
Mark as Played
September 22, 2026 • 4 mins
Here is your briefing for Tuesday, September 22, 2026. Arista says attackers are already hitting a perfect-ten flaw in on-prem VeloCloud Orchestrator, C.V.E. twenty twenty-six dash ninety-three thousand nine hundred fifty-two. No login required. If your orchestrator authenticates Edges with certificates and the web interface is reachable, a remote attacker can privilege internal functions, own the host, and from there reach the Edg...
Listen
Watch
Mark as Played
September 21, 2026 • 5 mins
Here is your briefing for Monday, September 21, 2026. Fortinet has an outbreak alert on a perfect-nine-point-eight unauthenticated remote code execution bug in Orkes Conductor, C.V.E. twenty twenty-six dash fifty-eight thousand one hundred thirty-eight, and attackers are already throwing it. Submit a hostile workflow definition with JavaScript or Python to the workflow A.P.I. before login, abuse GraalVM evaluators left on HostAcces...
Listen
Watch
Mark as Played
September 18, 2026 • 5 mins
Here is your briefing for Friday, September 18, 2026. Air Security disclosed Plugin4Shell, a zero-click supply-chain flaw that defeats SHA pinning in four major A.I. coding agents: Claude Code, OpenAI Codex, GitHub Copilot, and Gemini C.L.I. The agents check out a marketplace-pinned commit but never verify that the working tree actually matches it. On hosts that allow a branch named like a forty-hex hash, an attacker who controls t...
Listen
Watch
Mark as Played
September 17, 2026 • 4 mins
Here is your briefing for Thursday, September 17, 2026. Cisco is shipping emergency patches for a perfect ten authentication bypass in Identity Services Engine, C.V.E. twenty twenty-six dash seventy-six thousand four hundred sixty, and it is already under active exploitation. An unauthenticated attacker sends a crafted request to a poorly guarded A.P.I. endpoint, skips the web management login, and can climb to root command executi...
Listen
Watch
Mark as Played
September 16, 2026 • 4 mins
Here is your briefing for Wednesday, September 16, 2026. watchTowr says a critical WSO2 API Manager bug is under active exploitation, and its honeypots started catching forged J.W.T.s with baked-in admin privileges on September thirteenth. The flaw is C.V.E. twenty twenty-six dash five thousand four hundred thirty, scored nine point eight. Sign a token with an unsupported algorithm, and the service verifies it anyway, then hands yo...
Listen
Watch
Mark as Played
September 15, 2026 • 4 mins
Here is your briefing for Tuesday, September 15, 2026. Cisco says a critical AsyncOS bug in Secure Email Gateway, C.V.E. twenty twenty-six dash seventy-six thousand four hundred sixty-one, is already under active exploitation. Score it nine point eight. An unauthenticated attacker sends a crafted message with malicious S.Q.L., and the box hands them root on the underlying O.S., physical or virtual, no special config required. Patch...
Listen
Watch
Mark as Played
September 14, 2026 • 5 mins
Here is your briefing for Monday, September 14, 2026. GitLab's unauthenticated path traversal, C.V.E. twenty twenty-six dash eighty-five thousand seven hundred six, is a perfect ten on the commits A.P.I., and CISA put it on a federal patch clock that ends today. One public project is enough. An outsider can read logs and config files, pull secrets, and walk into the source and C.I. vault without logging in. watchTowr saw in-the-wil...
Listen
Watch
Mark as Played
Popular Podcasts
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
Listen to 'The Bobby Bones Show' by downloading the daily full replay.
The official podcast of comedian Joe Rogan.
Does hearing about a true crime case always leave you scouring the internet for the truth behind the story? Dive into your next mystery with Crime Junkie. Every Monday, join your host Ashley Flowers as she unravels all the details of infamous and underreported true crime cases with her best friend Brit Prawat. From cold cases to missing persons and heroes in our community who seek justice, Crime Junkie is your destination for theories and stories you won’t hear anywhere else. Whether you're a seasoned true crime enthusiast or new to the genre, you'll find yourself on the edge of your seat awaiting a new episode every Monday. If you can never get enough true crime... Congratulations, you’ve found your people. Follow to join a community of Crime Junkies! Crime Junkie is presented by Audiochuck Media Company.