Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Weak or reused passwords can give cybercriminals access to your accounts, often at your expense. As a proud Cybersecurity Awareness Month Champion with the National Cybersecurity Alliance, we're reminding everyone that stronger passwords and smarter security habits make a difference. Don't make it easy for attackers.

This week on the podcast, we dive into a pair of PHP vulnerabilities dubbed PHP2Shell and the chaos they caused through uncoordinated disclosure. After that, we discuss a certificate authority who's random number generator only goes to three digits before ending with law enforcement action around ShinyHunters ransomware negotiators.

Most cyber incidents trace back to people, so a vendor’s employee engagement can say a lot about its security. Brian Mackerer of Craft.co explains why procurement teams are starting to look at cyber risk alongside other signals, like employee engagement and financial stability, instead of relying on a cyber score alone. Discover more at upguard.com.

PHP2Shell is here. See how Tanium finds PHP across your environment, scopes your exposure, and maps attack paths so you know what to patch first. In this special edition, we walk through how Tanium gives you visibility into the new PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and the resources available to help you respond.

This week’s briefing covers: Dive deeper.

In this explainer from Arctic Wolf's Peter Ingebrigtsen, we break down what the PHP2Shell vulnerabilities are, how attackers are exploiting them, and the steps organizations should take now to reduce exposure. Arctic Wolf customers can use Aurora Exposure Management to identify affected assets and prioritize remediation, while the Aurora Agentic SOC helps detect and respond to post-exploitation activity such as webshell deployment, unauthorized command execution, persistence, and lateral movement.

Learn how to set up Self-Service Password Reset (SSPR) for Microsoft 365 so users can reset their passwords without contacting IT support. In this video, discover how SSPR helps reduce password-related help desk requests and keeps employees productive. A password reset restores access—but it can’t recover deleted emails or lost files. BDRShield Microsoft 365 backup helps you restore the business data behind the login.

Passkeys are a strong alternative to passwords. With a fingerprint scan, facial recognition or PIN, there’s nothing to remember so there’s nothing to steal. But most sites still require traditional passwords, so the smartest approach right now is to use both. Keeper Security stores your passwords and passkeys in the same vault, synced across all your devices.

As AI rapidly advances, identity security is undergoing a massive shift. Gavin Chen, Global Alliances at Cloudflare, shares how Cloudflare and Ping Identity are partnering to help organizations secure human users, non-human agents, and autonomous AI workflows—all while empowering businesses to innovate without friction.

What if you only had to remember one password for the rest of your life? A password manager makes that possible. Keeper Security stores your passwords in an end-to-end encrypted vault with zero-knowledge architecture, meaning not even Keeper can see what's inside. You get strong, unique passwords for every account synced across all your devices, and peace of mind knowing your digital life is locked down.