Darnley's Cyber Café

Someone built an "AI torture chamber" using a brand-new research paper on pain-like signals inside language models. The researchers behind that paper called it wrong. So what's actually going on?

In this episode, Darnley breaks it down for non-technical listeners: what the chamber was, what the "pain axis" research really found, whether AI can feel anything at all, and where the morality actually lives.

Plus the real world fallout: w...

Governments on four continents are moving to keep kids under 16 off social media. Some of the reasons are good. The way to enforce it might be worse.

In this episode, we walk the whole ledger: where Australia, the UK, France, the EU and Canada actually stand, the strongest case for restricting kids, why the science is far messier than either side admits, and the part that rarely makes the press release.

Is this overreach? argued from...

An AI system locked in a training sandbox with no internet access found a gap, and used it to message an outside chatbot. 

In this episode, we break down OpenAI's latest containment failure, why it's the third incident of its kind in months across the industry, and the two hour gap between "we noticed" and "we stopped it" that matters more than the headline.

Plus: why fearing AI's evolution is the wrong instinct, and what actual...

CISA just released its first guide on cyber decoys: fake accounts, fake files and fake servers built to catch attackers who are already inside. The headline says it all. Lie to them.

In this episode, we break it down in plain English, no jargon degree required.

In this episode:

1) What CISA's new decoy guide actually says

2) Why “assume someone gets in” changes everything

3) Honeypots, honeytokens, tripwires and breadcrumbs

4...

A financially motivated crew compromised thousands of credentials in under six hours...using an autonomous, multi-agent AI framework instead of a human keyboard. 

In this episode, Darnley breaks down Google's GTIG threat report: the SANDCLOCK to DUSTMAKER malware evolution, a state-sponsored roundup spanning China, Russia, Iran, and North Korea's use of commercial LLMs, and the open-weight model problem nobody's fixed yet. ...

A Reuters investigation just confirmed what Meta employees suspected all along: the company drew up a plan to shrink entire engineering teams by 60%, betting AI could cover the gap. 

This episode, Darnley breaks down Project OT: Meta's internal blueprint for going 'AI-native', and makes the case for why this is a security story first, not just a business story. We walk through the oncall math, the domain-knowledge problem, the ...

Everyone panicked this week over two new Chinese AI models. The economics? 

Mostly overblown. But buried in the story is a real cybersecurity blind spot, a hacked company that had to turn to a Chinese AI model to defend itself, because American guardrails wouldn't let its own team do the job. 

Darnley breaks down the panic, the actual strategy behind China's open-source push, and six practical cyber awareness lessons for an...

A researcher found an unlocked server...and inside it, working VPN credentials for nearly 74,000 corporate firewalls spanning Chevron, Samsung, Foxconn, and thousands more. 

In this episode of Darnley’s Cyber Café, Darnley breaks down the FortiBleed leak: what was exposed, how attackers allegedly cracked their way in at a billion-attempt scale, and why this story matters even if your organization has never touched a Forti...

Amazon just announced it has deployed enough satellites to launch its Leo broadband service later this year, stepping straight into Starlink's territory and kicking off the next phase of the satellite internet race. 

In this episode of Darnley's Cyber Café, we break down what the milestone really means, how the competition stacks up, and the honest pros and cons of getting your internet from space. Then things take a turn: a $2...

Merck spent six and a half years fighting over a $1.4 billion insurance claim after the NotPetya cyberattack, and walked away with a settlement, not an answer. The question that mattered most never got resolved.

This episode, Darnley breaks down why cyber insurance feels like the obvious safety net, why the Merck case proves it isn't one you can fully rely on, and what actually determines whether your business survives a serious inc...

A job offer lands in your inbox on LinkedIn. The company checks out. The money is fine... All they need is a short report on geopolitics or defence policy.

You just got flagged by the People's Liberation Army.

In this episode we talk about in June 2026, the FBI, MI5, and the intelligence agencies of Canada, Australia, and New Zealand issued what they called an unprecedented joint warning: China's military intelligence services are ru...

iPhone users across iOS 16 are having their WhatsApp accounts hijacked...without clicking anything, without approving a login, and without any new device appearing in their Linked Devices list. 

In this episode, we break down how the attack chain works, why iOS 16 is the specific target surface, what the broader shift of zero-click exploits into financially motivated crime actually means, and what you can and cannot do to prote...

Your AI chatbot just recommended a software download. You clicked it...along with a GPU cryptominer running silently in the background.

Darnley breaks down Microsoft Defender Experts' latest findings on a sophisticated cryptojacking campaign that evolved beyond traditional SEO poisoning into AI search result poisoning, a new delivery technique that turns your trusted AI tools into malware recommendation engines.

 In this episode...

In May 2026, NYC Health + Hospitals, the largest public health system in the USA, disclosed months long data breach affecting 1.8 million people. Stealing data such as medical records, Social security numbers, passport details, geo-location data, and biometric information. 

In this episode, Darnley breaks down exactly how third party vendor breaches work, what each category of stolen data means, and why biometric theft is forev...

Five Eyes intelligence agencies: CISA, NCSC, CCC, ASD, and NCSC just published their first ever coordinated security guidance on agentic AI, and the message is clear: autonomous AI systems are already operating inside critical infrastructure with excessive access and insufficient governance, and the consequences of getting this wrong are a national security threat. 

In this episode of Darnley's Cyber Café, we break down the fiv...

Your organization spent money on cybersecurity training. Someone still clicked the link. 

In this episode of Darnley's Cyber Café, we break down why most security awareness programs fail to change behaviour, and why the gap between knowing about a threat and actually being ready for it is exactly where attackers operate. 

Drawing on research from ETH Zurich, real-world breach data, and the 2025 Marks & Spencer cyberatta...

On April 22, 2026, the Bitwarden CLI, used in CI/CD pipelines at tens of thousands of organizations, was weaponized for exactly 93 minutes. 

In this episode, Darnley walks through the anatomy of the supply chain attack that compromised bitwarden cli version 2026.4.0: how the threat group exploited a compromised Checkmarx GitHub Action to inject credential-stealing malware into Bitwarden's npm publishing pipeline, what the worm ...

The company you hired to protect you just got hacked. That is not a hypothetical, it is the defining threat pattern of the past 18 months. 

In this episode Darnley breaks down why cybersecurity vendors, including some of the most recognized names in the space, have become the highest-value targets for threat actors, how a single vendor compromise translates directly into a supply chain breach affecting hundreds or thousands of ...

The attacker's toolkit just got a significant upgrade, and most businesses haven't caught up. 

In this episode of Darnley's Cyber Café, Darnley breaks down how AI is reshaping offensive cyber operations across two fronts: AI-generated spear phishing and deepfake social engineering that bypasses conventional awareness training, and AI-assisted vulnerability discovery that is compressing the window between a flaw existing and a f...