Bishop Fox offensive security researchers, experts, and hackers take a real look at the latest cybersecurity news headlines and have a straight take on them. The goal is simple: do you actually need to care about this, or is it just another variation of the same fundamental security problems we've been dealing with for years?
A Third NetScaler Zero-Day, 8 Million Danish ID Records, and Google Pauses Its Bug Bounty
In this episode, we break down three security stories:
CVE-2026-88779, a third exploited NetScaler zero-day labeled denial-of-service
About 8 million Danish CPR records stolen through a company's lawful access
Google pausing its OSS VRP after a flood of invalid AI-generated reports
Plus, we sit down with Andrew Crotty of the Ginger Hacker Initiative to talk about how newcomers actually break into cybersecurity in 2026, from choosing a path to building a resume that gets past the first screen. We also cover Bishop Fox research on how the AI attack surface extends across your full stack and what offensive testing reveals about healthcare security.
Security Headlines:
Citrix patches NetScaler SAML zero-day exploited in attacks (https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/), BleepingComputer
Hackers steal 8 million citizens’ records from Danish government database (https://techcrunch.com/2026/10/05/hackers-steal-8-million-citizens-records-from-danish-government-database/), TechCrunch
Google halts open-source bug bounty program amid AI spam surge (https://www.bleepingcomputer.com/news/google/google-halts-open-source-bug-bounty-program-amid-ai-spam-surge/), BleepingComputer
Also mentioned:
Events: No Hat 2026 (https://bishopfox.com/events/no-hat-2026), HackMex 2026 (https://bishopfox.com/events/hackmex-2026)
Blog: Why the AI Attack Surface Extends Your Stack (https://bishopfox.com/blog/why-ai-attack-surface-extends-your-stack)
Guide: Healthcare Security: A Guide to Offensive Testing (https://bishopfox.com/resources/healthcare-security-guide)
Andrew Crotty’s The Ginger Hacker Initiative Discord server. (https://discord.gg/uKzj5RY5cR)
Join the conversation in the Bishop Fox Discord server (https://discord.gg/bishopfox) and in the Bishop Fox subreddit (https://www.reddit.com/r/BishopFox/).
2 Oct 2026
ShinyHunters PeopleSoft WAF Bypass, Arrests, And OpenAI Astra News
In this episode, we break down four security stories:
A ShinyHunters PeopleSoft WAF bypass that hinges on one URL-encoded character
The arrest of an alleged ShinyHunters leader days before the group's FBI claim
Nearly 400,000 DC Medicaid records left readable behind a public report
OpenAI scrapping GPT-6.1 Astra over scope, authorization, and honesty
We also cover Bishop Fox research on three practical risk questions: unauthenticated root RCE in Check Point management, Kubernetes namespace takeover in Zilliz Attu, and why an 85 percent jump in CVE disclosures does not automatically mean an 85 percent jump in real-world risk.
Security Headlines:
Google Warns of ShinyHunters' Fresh Oracle PeopleSoft Campaign (https://www.securityweek.com/google-warns-of-shinyhunters-fresh-oracle-peoplesoft-campaign/), SecurityWeek
Dutch police arrest suspected member of group that claimed FBI hack (https://www.bbc.com/news/articles/cw5ym18znr0ro), BBC
DC Health Agency Exposes 400,000 Beneficiary Records (https://www.securityweek.com/dc-health-agency-exposes-400000-beneficiary-records/), SecurityWeek
OpenAI scraps rollout of new AI model over safety concerns (https://www.bbc.com/news/articles/cm5y5nynl75ko), BBC
Also mentioned:
Workshop: Weaponizing CloudFormation (https://bishopfox.com/resources/weaponizing-cloudformation) (available in English and Spanish)
Events: SecureWorld Dallas 2026 (https://bishopfox.com/events/secureworld-dallas-2026), VetsinTech NatSec + Space Innovation Summit 2026 (https://bishopfox.com/events/vetsintech-natsec-space-innovation-summit-2026)
Blog: One Port to Root: Weaponizing Check Point Management CVE-2026-93616 (https://bishopfox.com/blog/weaponizing-check-point-management-cve-2026-93616)
Blog: Zilliz / Attu | 2.6.5 (https://bishopfox.com/blog/zilliz-attu-2-6-5)
Blog: Separating Signal from Slop: Triaging CVEs in the Age of AI Security Research (https://bishopfox.com/blog/triaging-cves-in-age-of-ai-security-research)
Join the conversation in the Bishop Fox Discord server (https://discord.gg/bishopfox) and in the Bishop Fox subreddit. (https://www.reddit.com/r/BishopFox/)
26 Sept 2026
Zero-Click Exchange RCE, $25 AI Intrusions, and the ShinyHunters FBI Claim
This episode breaks down:
A zero-click Exchange Server RCE triggered by a Visio attachment
AI agents compromising online retailers for about $25 a target
ShinyHunters' unverified claim that it breached the FBI
OpenAI's six new misalignment disclosures
Plus, we sit-down with Bishop Fox's Emilio Gallegos on MikroTick, a RouterOS exploit chain attackers used before defenders knew it existed.
Security Headlines:
Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days (https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/), Security Week
Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an ongoing campaign (https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company), Gambit Security
FBI investigating claim hackers have stolen details of all its agents (https://www.bbc.com/news/articles/c9n74574elljo), BBC
OpenAI Discloses Six New Incidents of ‘Concerning’ A.I. Behavior (https://www.nytimes.com/2026/09/16/technology/openai-model-safety-guardrails.html), The New York Times
Also mentioned:
Workshop: Weaponizing CloudFormation (https://bishopfox.com/resources/weaponizing-cloudformation) (available in English and Spanish)
Virtual Session: AI & Cybersecurity Priorities for 2027: Executive Chat (https://bishopfox.com/resources/executive-series-ai-security-risk-cybersecurity-priorities-2027)
Events: BSides Cleveland 2026 (https://bishopfox.com/events/bsides-cleveland-2026), Ekoparty 2026 (https://bishopfox.com/events/ekoparty-2026), No Hat 2026 (https://bishopfox.com/events/no-hat-2026), Wild West Hackin' Fest Deadwood 2026 (https://bishopfox.com/events/wwhf-deadwood-2026)
Blog: MikroTrick: Inside the RouteOS Takeover Chain (https://bishopfox.com/blog/mikrotrick-inside-the-routeos-takeover-chain)
Blog: Unified Code, Unified Risks: Uncovering Vulnerabilities in .NET MAUI Applications (https://bishopfox.com/blog/unified-code-unified-risks-uncovering-vulnerabilities-net-maui-applications)
Blog: Master Key Included: Detecting SolarWinds ARM CVE-2026-28326 (https://bishopfox.com/blog/detecting-solarwinds-arm-cve-2026-28326)
Join the conversation in the Bishop Fox Discord server (https://discord.gg/bishopfox) and in the Bishop Fox subreddit. (https://www.reddit.com/r/BishopFox/)
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
Apple Podcasts (US)
5.0 / 5
2 ratings
Contact Initial Access
Guest appearances
Books guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of Initial Access?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
