CVE Program - Podcast Details

Shows

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497) In this episode: Apple's October updates fix 304 vulnerabilities, including an already exploited CoreGraphics flaw now patched for iOS 18; a guest diary shows how to hunt for threat actors in a DShield SIEM honeypot using HTTP language preference headers in Elasticsearch; and Microsoft and PHP ship out-of-band updates for the Brotli decompression vulnerability CVE-2026-111497. Apple Patches for October 2026: 304 Vulnerabilities Fixed Apple released updates for all of its operating systems, fixing 304 vulnerabilities. An already exploited CoreGraphics vulnerability (CVE-2026-86950), patched in current iOS versions about a month ago, is now also fixed for iOS 18. Other notable fixes cover...

2026-10-2706 min $SANS Internet Storm Center\'s Daily Network Security News Podcast$

SANS Internet Storm Center's Daily Network Security News Podcast SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497) (#)SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497) In this episode: Apple's October updates fix 304 vulnerabilities, including an already exploited CoreGraphics flaw now patched for iOS 18; a guest diary shows how to hunt for threat actors in a DShield SIEM honeypot using HTTP language preference headers in Elasticsearch; and Microsoft and PHP ship out-of-band updates for the Brotli decompression vulnerability CVE-2026-111497. Apple Patches for October 2026: 304 Vulnerabilities Fixed Apple released updates for all of its operating systems, fixing 304 vulnerabilities. An already exploited...

2026-10-2706 min $SANS Internet Storm Center\'s Daily Network Security News Podcast$

2026-10-2706 min

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More This episode covers the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which are already being exploited and moved the Internet Storm Center to Infocon yellow, and a Fortinet security hardening release for multiple products based on an AI-assisted security review. Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Exploited; Infocon Yellow Two vulnerabilities in the PHP core, an out-of-memory issue triggered by multipart MIME uploads and a memory-clearing flaw exploited with a second request, can lead to remote code execution and can be chained; exploitation is already underway, and your application code, authentication, and configuration will not...

2026-10-2213 min

SANS Stormcast: Daily Cyber Security News SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-DrivThis episode covers the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which are already being exploited and moved the Internet Storm Center to Infocon yellow, and a Fortinet security hardening release for multiple products based on an AI-assisted security review.Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Exploited; Infocon YellowTwo vulnerabilities in the PHP core, an out-of-memory issue triggered by multipart MIME uploads and a memory-clearing flaw exploited with a second request, can lead to remote code execution and can be chained; exploitation is already underway, and your application code, authentication, and configuration will not...

2026-10-2213 min $SANS Internet Storm Center\'s Daily Network Security News Podcast$

SANS Internet Storm Center's Daily Network Security News Podcast SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More (#)SANS Stormcast Thursday, October 22nd, 2026: Critical PHP RCE Vulnerabilities Exploited (CVE-2026-109618, CVE-2026-109619); Fortinet AI-Driven Security Hardening Release for FortiOS and More This episode covers the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which are already being exploited and moved the Internet Storm Center to Infocon yellow, and a Fortinet security hardening release for multiple products based on an AI-assisted security review. Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Exploited; Infocon Yellow Two vulnerabilities in the PHP core, an out-of-memory issue triggered by multipart MIME uploads and a memory-clearing flaw exploited with a second request, can lead to...

2026-10-2113 min $SANS Internet Storm Center\'s Daily Network Security News Podcast$

2026-10-2113 min

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure Today's episode covers the Panchan crypto mining worm spreading over SSH, plus three actively exploited zero-day vulnerabilities: a root-level remote code execution flaw in Cisco Secure Email Gateway, an authenticated root RCE in Palo Alto Networks' management interface, and a chained Ivanti Connect Secure exploit documented by Volexity. Panchan's Mining Island [Guest Diary] SANS.edu intern Zachary Norwood analyzes Panchan, a Golang crypto mining worm that spreads via SSH, steals SSH keys, installs a rootkit and uses Discord for command and control, using FakeNet-NG for dynamic analysis. https://isc.sans.edu/diary/Panchan%27s%20Mining%20Island%20%5...

2026-10-1605 min

SANS Stormcast: Daily Cyber Security News SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), PaloToday's episode covers the Panchan crypto mining worm spreading over SSH, plus three actively exploited zero-day vulnerabilities: a root-level remote code execution flaw in Cisco Secure Email Gateway, an authenticated root RCE in Palo Alto Networks' management interface, and a chained Ivanti Connect Secure exploit documented by Volexity.Panchan's Mining Island [Guest Diary]SANS.edu intern Zachary Norwood analyzes Panchan, a Golang crypto mining worm that spreads via SSH, steals SSH keys, installs a rootkit and uses Discord for command and control, using FakeNet-NG for dynamic analysis.https://isc.sans.edu/diary/Panchan%27s%20Mining%20Island%20%5...

2026-10-1605 min $SANS Internet Storm Center\'s Daily Network Security News Podcast$

SANS Internet Storm Center's Daily Network Security News Podcast SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure (#)SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure Today's episode covers the Panchan crypto mining worm spreading over SSH, plus three actively exploited zero-day vulnerabilities: a root-level remote code execution flaw in Cisco Secure Email Gateway, an authenticated root RCE in Palo Alto Networks' management interface, and a chained Ivanti Connect Secure exploit documented by Volexity. Panchan's Mining Island [Guest Diary] SANS.edu intern Zachary Norwood analyzes Panchan, a Golang crypto mining worm that spreads via SSH, steals SSH keys, installs...

2026-10-1505 min $SANS Internet Storm Center\'s Daily Network Security News Podcast$

2026-10-1505 min

CVE-podden Går skolattacker att förhindra? Skolattacker skiljer sig på flera sätt från annat grovt våld i skolan. Det kan handla om en hög grad av planering, en vilja att orsaka stor skada och en motivbild som kan vara kopplad till exempelvis upplevd kränkning, utanförskap eller hämnd mot skolan som institution. En viktig del i det förebyggande arbetet är därför att vara uppmärksam på förändringar, oro och signaler – även när de är diffusa. Planer kan läcka ut till kompisar, föräldrar eller skolpersonal. Någon kanske uttrycker en stark fascination för...

2026-10-0621 min

We Speak CVE CVE Numbering Authority (CNA) Scopes“We Speak CVE” podcast host Shannon Sabens chats with Alicia Mink of the MITRE Top-Level Root and Julia Turkevich of the CISA Top-Level Root about CVE Numbering Authority (CNA) scopes.Within the CVE™ Program, the term “scope” refers to the set of products, projects, services, organizations, constituencies, or cases for which a CNA is authorized to assign CVE IDs and publish CVE Records. A well-written CNA scope sets expectations, helps manage workload, improves coordination across the CVE ecosystem, and gives vulnerability reporters a clearer path to the right authority.Topics discussed in this episode inc...

2026-09-2223 min

IT SPARC Cast China's AI Hacked This CVE Autonomously — Inside the DeepSeek Remote Code Execution CampaignThis week on IT SPARC Cast – CVE of the Week, John and Lou cover three newly exploited vulnerabilities affecting Langflow, Apache Tomcat, and N-able N-central. While each vulnerability is serious on its own, the bigger story is how attackers are increasingly using AI to identify targets, automate reconnaissance, and accelerate attacks.The discussion also explores recent research showing threat actors using AI to prioritize targets, why network anomaly detection is becoming more important than ever, and why organizations can no longer afford to wait for monthly patch cycles. If you’re responsible for enterprise IT, this epis...

2026-08-0709 min

The Daily CVE Update CVE-2026-48558: The RMM Vulnerability Putting Every MSP Client at RiskCVE-2026-48558: The RMM Vulnerability Putting Every MSP Client at Risk On 29 June 2026, CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalogue. This CVSS 10.0 authentication bypass flaw in SimpleHelp, a widely deployed remote monitoring and management platform, allows attackers to create privileged technician accounts without credentials. Active exploitation campaigns have already deployed TaskWeaver persistent access malware and Djinn Stealer credential harvesting tools through compromised RMM servers. For UK small businesses, the risk is direct: if your managed service provider uses an unpatched SimpleHelp instance, every system they manage is exposed through a single vulnerability. This episode...

2026-07-0111 min

Resilient Cyber Rain Versus Flood, Making Sense of the 2026 CVE SurgeCVEs are on pace to hit nearly 70,000 in 2026, but Jerry Gamblin explains why the actual exploitable risk is staying surprisingly flat.DescriptionJerry Gamblin runs RogoLabs and built CVE.ICU, and he co-authored the FIRST mid-year vulnerability forecast that just put 2026 on pace for nearly 70,000 CVEs. He joins Resilient Cyber to separate the scary headline number from what actually matters for defenders. We get into why GitHub now publishes one in five CVEs, the rain versus flood distinction that explains why exploitable risk is flat even as raw volume explodes, what the NVD...

2026-06-2724 min

IT SPARC Cast One Character Broke Linux Security: CVE-2026-23111 ExplainedA single-character coding mistake in the Linux kernel created a privilege escalation vulnerability that could allow attackers to gain root access, escape containers, and compromise systems. In this episode of IT SPARC Cast – CVE of the Week, John and Lou break down CVE-2026-23111, discuss why container escapes are so dangerous, and explore how AI-powered code analysis may become essential for finding bugs before attackers do.⸻📄 Show Notes🚨 CVE of the Week: Linux Kernel Privilege Escalation (CVE-2026-23111)This week we’re covering CVE-2026-23111, a Linux kernel vulne...

2026-06-1211 min

Deep Dive The Mandate That Couldn't Be Met: A Palo Alto CVE and What It Says About Federal CybersecurityCVE-2026-0300. Unauthenticated remote code execution as root on Palo Alto firewalls. CVSS 9.3. Disclosed May 6, 2026. CISA added it to the Known Exploited Vulnerabilities catalog the same day and set a federal civilian patch deadline of May 9. The first patch batch ships May 13. The federal mandate predates the patch by four days.This is a structural problem.Binding Operational Directive 22-01 — issued November 2021 — gives federal civilian agencies two paths to KEV compliance: apply the vendor patch, or remove the product from the network. Mitigations are explicitly temporary. When CISA used the...

2026-05-1124 min

IT SPARC Cast NIST Is Falling Behind? CVE Overload, AI, and the Future of Vulnerability TrackingNIST is changing how it handles CVEs after a massive surge in vulnerability submissions—and it could reshape how enterprise IT teams manage risk. In this episode of IT SPARC Cast – CVE of the Week, John and Lou break down what this shift means, the risks of incomplete vulnerability data, and how AI-driven attacks are forcing a new security reality.⸻📄 Show Notes🚨 CVE of the Week (Special Edition): NIST Scaling Back CVE EnrichmentThis week, instead of a single CVE, we’re covering a major shift in how vulnerabil...

2026-04-2412 min

CVE-podden Red pill och misogyna konspirationsteorierCVE publicerade nyligen en rapport om konspirationsteorin Red pill, och i senaste avsnittet av CVE-podden djupdyker CVE:s utredare Astrid Askenberger och kulturskribenten Myra Åhbeck Öhrman i ämnet. Vad innebär teorin om Red pill, varför har den fått så stort genomslag bland unga män och hur kan vuxna bemöta unga som har anammat konspirationsteorier och uttrycker misogyna åsikter? Läs mer: Redpill och konspirationsteorier

2026-04-2126 min

IT SPARC Cast Open a PDF, Lose Your System: Adobe Zero-Day Exploit (CVE-2026-34621)A dangerous Adobe Acrobat zero-day vulnerability (CVE-2026-34621) is actively being exploited—allowing attackers to compromise systems simply by getting users to open a malicious PDF. In this episode of IT SPARC Cast – CVE of the Week, John and Lou break down how it works, why it’s so dangerous, and what enterprise IT teams must do immediately.⸻📄 Show Notes🚨 CVE of the Week: Adobe Acrobat Zero-Day (CVE-2026-34621)This week’s vulnerability is about as bad—and as common—as it gets. A zero-day flaw in Adobe Acrobat Reader...

2026-04-1711 min

IT SPARC Cast Docker Security Nightmare? CVE-2026-34040 Lets Attackers Escape ContainersA critical Docker vulnerability (CVE-2026-34040) is putting container security at risk by allowing attackers to bypass authorization controls and potentially access host systems. In this episode of IT SPARC Cast – CVE of the Week, John and Lou break down the exploit, why it matters, and what enterprise IT teams must do immediately to mitigate risk.⸻📄 Show Notes🚨 CVE of the Week: Docker API Authorization Bypass (CVE-2026-34040)This week’s CVE highlights a serious vulnerability in Docker Engine that undermines one of the core assumptions of container se...

2026-04-1011 min

CVE-podden Digital patrullering – om polisens onlinenärvaroDet senaste året har flera polisområden i Sverige stärkt sin närvaro på sociala medier genom att införa så kallad digital patrullering. Syftet är att komplettera den fysiska polisnärvaron med en digital, och på så sätt möta människor i deras digitala miljö. Det är ett sätt för polisen att bygga relationer, skapa trygghet och förebygga brott online. Förhoppningen är att kunna sänka tröskeln för kontakt med polisen, delta i diskussioner på onlineforum och samtidigt markera gränser när det behövs. I CVE-podden berättar John For...

2026-03-2621 min

We Speak CVE CVE Record Disputes ExplainedIn this episode of the “We Speak CVE” podcast, MITRE’s CVE and CWE Project Lead Alec Summers chats with Yves Younan of Cisco, Alex Kreilein of Qualys, Pedro Sampaio of Red Hat, and Anthony Singleton of the MITRE Top-Level Root, about the CVE Record dispute process.Topics include how the dispute policy came to exist and the two types of CVE Record disputes; a walk-through of the process for disputing a CVE Record, including what steps to take and what to expect; why so...

2026-03-2430 min

CVE-podden Terroristbrottslagen - Balansen mellan säkerhet och frihetDe senaste 50 åren har ett stort antal gärningar som kan knytas till terrorism blivit kriminaliserade i Sverige. CVE publicerade nyligen en rapport som visar på svårigheterna att balansera mellan frihet och säkerhet i svensk terrorlagstiftning. I det här avsnittet av CVE-podden medverkar Vendela Laukkanen, utredare på CVE och Patrik Bremdal, docent i konstitutionell rätt och lektor i mänskliga rättigheter vid Uppsala universitet, i ett samtal som modereras av Fredrik Meiton, utredare på CVE. Vendela berättar om rapporten medan Patrik går djupare in på den grundlagsstadgade föreningsfriheten och varför den utgö...

2026-02-1925 min

CVE-podden Konspirationsteorier och våldsbejakande extremismKonspirationsteorier är en närvarande och stor del av våldsbejakande extremism, och förhållandet mellan dem är viktigt att förstå utifrån ett förebyggande perspektiv. I senaste CVE-podden diskuterar vi vad konspirationsteorier fyller för behov, vilka konspirationsteorier som är stora just nu och hur konspirationstro påverkar relationen till myndigheter och samhällsinstitutioner. Hur bemöter vi bäst individer som tror på konspirationsteorier, utan att skapa misstro? Medverkande: Astrid Askenberger, utredare, CVE Andreas Önnerfors, professor i idéhistoria, Linnéuniversitetet Samtalsledare: Edvin Sandström, utredare på CVE Samtalet utgår f...

2026-02-1042 min

IT SPARC Cast React Server Components Under Active Exploit: CVE-2025-55182 Goes Code RedThis week on IT SPARC Cast – CVE of the Week, John Barger and Lou Schmidt break down a code-red security situation affecting a massive portion of the modern web. CVE-2025-55182 is a critical, actively exploited vulnerability in React Server Components (RSC) that enables unauthenticated remote code execution, even in applications that don’t explicitly use server functions.With an estimated 33–35% of cloud-based services running React, attackers are already leveraging automated tooling to deploy cryptominers, Linux backdoors, and persistent malware across vulnerable systems. If you run React, Next.js, or containerized web workloads, this episode outlines exactl...

2025-12-1209 min

The Modern .NET Show Hayden Barnes and CVE-2025-33515Show Notes Hey everyone, and welcome back to The Modern .NET Show; the premier .NET podcast, focusing entirely on the knowledge, tools, and frameworks that all .NET developers should have in their toolbox. I'm your host Jamie Taylor, bringing you conversations with the brightest minds in the .NET ecosystem. This episode is a super important, top-of-the-heap, bonus episode that you definitely need to be listening to. I, basically, reached out to Hayden Barnes, who we've just now had on the show to talk about .NET never-ending support and what happens when you drop out of...

2025-11-2136 min

IT SPARC Cast Cisco CVE Double Feature: ASA Firewall RCE + ISE Root Takeover (CVE-2025-20333, CVE-2025-20362, CVE-2025-20337)In this week’s IT SPARC Cast, John and Lou break down a Cisco security double feature—three critical vulnerabilities impacting Cisco ASA, Cisco Secure Firewall (FTD), and Cisco Identity Services Engine (ISE). These flaws include authentication bypass, chained remote code execution, and a CVSS 10.0 root-level compromise via an undocumented ISE API.We explain how CVE-2025-20333, CVE-2025-20362, and the newly revealed CVE-2025-20337 work, why federal agencies issued emergency patch directives, and what immediate mitigation steps enterprise defenders must take. If you manage Cisco firewalls or identity systems, this episode is mandatory listening.

2025-11-1411 min

IT SPARC Cast DNS Nightmare: CVE-2025-40778 and the Scariest Phishing Setup YetIn this special Halloween edition of CVE of the Week, John and Lou dive into a truly chilling scenario — a high-severity DNS poisoning flaw that could be the perfect setup for a wave of phishing attacks and credential theft across enterprise networks.The star of the episode: CVE-2025-40778, a newly discovered vulnerability in BIND 9’s resolver logic. This flaw allows unauthenticated attackers to inject forged DNS records, redirecting legitimate queries to malicious servers — all without user interaction. With a CVSS score of 8.6, exploits are already active in the wild, and over 5,900 exposed instances have been identi...

2025-10-3110 min

We Speak CVE The CVE Consumer Working Group (CWG)“We Speak CVE” podcast host Shannon Sabens chats with CVE Consumer Working Group (CWG) co-chairs, Jay Jacobs and Bob Lord, and CVE™ Project Lead Alec Summers, about how the CWG was created to address the needs and perspectives of those who use CVE data — ranging from enterprise security teams to tool developers and managed security service providers — recognizing that their requirements and pain points often differ from those of upstream data providers.Topics include the CWG’s goals to systematically capture and organize consumer feedback, identify common and unique challenges across different user types, and inform improvements in the CVE P...

2025-10-1420 min

CVE-podden Våldsbejakande islamism i AfrikaDen globala våldsbejakande islamismen har flyttat fokus från Mellanöstern till Afrika. Sedan IS-kalifatets fall 2019 har det skett en kraftig ökning av jihadistisk aktivitet i främst Sahel-regionen och på Afrikas horn. I senaste avsnittet av CVE-podden berättar Fredrik Meiton och Vendela Laukkanen om hur utvecklingen påverkar Sverige, och om de rättsprocesser som ägt rum det senaste året som haft en koppling till IS i Somalia. Vad går att säga om gärningspersonerna? Och vad behöver vi som arbetar förebyggande mot våldsbejakande extremism i Sverige ha koll på när det gäller...

2025-09-3015 min

We Speak CVE Mapping the Root Causes of CVEs“We Speak CVE” podcast host Shannon Sabens chats with CVE™/CWE™ Project Lead Alec Summers and CWE Top 25 task lead/CWE Root Causes Mapping Working Group lead Connor Mullaly about the importance of mapping CVE Records (vulnerabilities) to their technical root causes using Common Weakness Enumeration (CWE). Additional topics include the benefits of RCM for CVE Numbering Authorities (CNAs) and consumers of CVE data, Common Vulnerability Scoring System (CVSS) and other vulnerability metadata and their differences with CWE, the CWE Top 25 Most Dangerous Software Weaknesses list, and the tools and guidance available to improve the RCM process (e.g., exa...

2025-08-0523 min

IT SPARC Cast Emergency SharePoint RCE Warning – CVE-2025-53770 & CVE-2025-53771 Under Active ExploitThis week on IT SPARC Cast – CVE of the Week, John and Lou sound the alarm on two critical zero-day vulnerabilities impacting on-premise Microsoft SharePoint servers: CVE-2025-53770 and CVE-2025-53771. Exploited via a chained attack called “ToolShell,” these flaws enable unauthenticated remote code execution (RCE). Nation-state attackers, particularly Chinese APTs, are already exploiting these vulnerabilities, targeting government and infrastructure networks slow to patch. If you’re running SharePoint 2016, 2019, or Subscription Edition on-prem, your window for action is closing fast.We break down Microsoft’s emergency guidance—including patching beyond last Patch Tuesday, rotating cryptographic keys, enabling AMS...

2025-07-2507 min

Daily Security Review CISA Flags Citrix NetScaler Flaws: What CVE-2025-6543 Means for Federal and Private NetworksThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added multiple Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog—an urgent signal for federal agencies and private enterprises alike. At the center of this update is CVE-2025-6543, a memory overflow flaw affecting NetScaler ADC and Gateway appliances, which could lead to Denial of Service attacks under specific configurations. This joins earlier additions from 2023, including CVE-2023-6548 and CVE-2023-6549, covering code injection and buffer overflow vulnerabilities.In this episode, we explore why NetScaler vulnerabilities are drawing heightened attention, how they are actively being ex...

2025-07-0156 min

Daily Security Review GerriScary: How CVE-2025-1568 Threatened Google’s Open-Source Supply ChainCVE-2025-1568, dubbed "GerriScary", has shaken the open-source ecosystem by exposing a fundamental weakness in Google’s Gerrit code review system—one that could have enabled attackers to infiltrate 18 of Google’s most widely used open-source projects, including Chromium, ChromiumOS, Dart, and Bazel.This episode breaks down how the vulnerability was discovered by researchers at Tenable using a subtle but powerful HTTP status code fingerprinting technique. A simple 209 response exposed whether a user had the “addPatchSet” permission on a given project. That small indicator opened the door to a potentially massive software supply chain compromise, allowing malicious patchsets...

2025-06-1935 min $You\'ve Already Been Hacked$

You've Already Been Hacked Cybersecurity Crisis Unfolds: Trump Cuts CVE Funding and Russians Hack DOGEHostsProfessor CyberRiskCyber CowboyLive Cyber MapsBitdefender Threat Map https://threatmap.bitdefender.com/Live Cyber threat map - https://threatmap.checkpoint.com/Kaspersky Cyber Threat Map - https://cybermap.kaspersky.com/Talos Intelligence - ebc_spam Map - https://talosintelligence.com/ebc_spamThreatbutt Internet Hacking Attack Attribution Map - https://threatbutt.com/map/Radware Live Threat Map - https://livethreatmap.radware.com/Episode InformationTitle: Cybersecurity Crisis Unfolds: Trump Cuts CVE Funding and...

2025-04-2030 min

Business of Tech: Daily MSP News & IT Services Analysis CVE Program Saved, CISA Nomination Blocked, OpenAI's AI Models Released, SolarWinds Goes PrivateThe U.S. government has renewed funding for the Common Vulnerabilities and Exposures (CVE) Program, a critical database for tracking cybersecurity flaws, just hours before its funding was set to expire. Established 25 years ago, the CVE program assigns unique identifiers to security vulnerabilities, facilitating consistent communication across the cybersecurity landscape. The renewal of funding comes amid concerns that without it, new vulnerabilities could go untracked, posing risks to national security and critical infrastructure. In response to the funding uncertainty, two initiatives emerged: the CVE Foundation, a nonprofit aimed at ensuring the program's independence, and the Global CVE Allocation System...

2025-04-1714 min

We Speak CVE 25 Years of CVE and What’s NextHost Shannon Sabens speaks with fellow CVE Board members Kent Landfield and Madison Oliver and CVE Program Lead Alec Summers about the 25th anniversary of the CVE Program. Topics include the history of the program, the program today, and what’s next.

2025-02-0447 min

Below the Surface (Audio) - The Supply Chain Security Podcast CVE Turns 25In this episode, Paul Asidorian, Alec Summers, and Lisa Olson discuss the 25th anniversary of the CVE program, its evolution, and the importance of transparency in vulnerability management. They explore the history of CVE, the process of creating CVE records, and the role of CNAs in ensuring accountability. The conversation also addresses challenges related to end-of-life software vulnerabilities and the need for maintaining the integrity of CVE records in an ever-evolving cybersecurity landscape. In this conversation, the speakers discuss the complexities of managing and analyzing vulnerabilities in software, mainly focusing on the roles of CVE and CVSS in providing...

2024-12-091h 02

CYFIRMA Research CYFIRMA Research: CVE-2024-7479 and CVE-2024-7481- Privilege Escalation - Vulnerability Analysis and ExploitationCritical Alert: Organizations using TeamViewer's Remote Client and Remote Host products on Windows must act now!CVE-2024-7479 and CVE-2024-7481 present a severe risk of privilege escalation. With millions of users potentially affected globally, immediate action is crucial. Both flaws involve improper cryptographic signature verification during driver installation. Specifically, CVE-2024-7479 pertains to VPN drivers, while CVE-2024-7481 relates to printer drivers. These vulnerabilities allow local, unprivileged attackers to escalate their privileges by exploiting TeamViewer's installation process and loading malicious drivers onto the system. Users should update to version 15.58.4 or later to mitigate this risk, check...

2024-11-0603 min

We Speak CVE CNA Onboarding Process Myths Versus FactsShannon Sabens of CrowdStrike chats with Dave Morse, program coordination lead for the CVE Program, about the myths and facts of the CVE Numbering Authority (CNA) partner onboarding process. Truth and facts about the following topics are discussed: duration and complexity of the onboarding process; the fact that there is no fee to participate; ease of incorporating assigning CVE Identifiers (CVE IDs) and publishing CVE Records into an organization’s existing coordinated vulnerability disclosure (CVD) processes; availability of automated tools for CNAs; the CVE JSON Record format and available guidance; role of Roots and Top-Level Roots and ho...

2024-10-0124 min

CYFIRMA Research CYFIRMA Research- CVE-2024-40725 and CVE-2024-40898 Vulnerabilities in Apache’s HTTP Server: Vulnerability Analysis and ExploitationCVE-2024-40725 and CVE-2024-40898 are critical vulnerabilities in Apache’s HTTP Server. CVE-2024-40725 affects the mod_proxy module and enables HTTP Request Smuggling attacks, while CVE-2024-40898 allows authentication bypass due to improper SSL configuration. With widespread exposure, these vulnerabilities pose severe risks globally. Immediate patching is crucial to safeguard sensitive systems from potential exploitation.Link to the Research Report: CVE-2024-40725 and CVE-2024-40898 Vulnerabilities in Apache’s HTTP Server : Vulnerability Analysis and Exploitation - CYFIRMA #CyberSecurity #ApacheVulnerabilities #CVE202440725 #CVE202440898 #PatchNow #InfoSec #CyberThreats #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLMhttps://www.cyfirma.com/

2024-09-1603 min

CVE-podden 33. Almedalsveckan 2024: Våldsbejakande extremism i Sverige och omvärldenEn orolig omvärld skapar ett allvarligt läge i Sverige med komplexa och överlappande hot. Säkerhetspolisen ser en utveckling i Sverige där allt fler sympatiserar med våldsbejakande extremisters ideologi och propaganda. Våldsbejakande extremism, oavsett om den är höger, vänster eller islamistisk, är samtidigt transnationell. De senaste åren har ett antal händelser påverkat bilden av Sverige både inom landet och utomlands som kan vara hotdrivande. Samtidigt har olika typer av författningshot utkristalliserats. Ökad misstro mot samhällets funktioner och det demokratiska systemet riskerar att urholka tilliten till myndigheter och in...

2024-08-0756 min

CVE-podden 32. Almedalsveckan 2024: Statsstödd extremism? Hur påverkar auktoritära stater hotet från våldsbejakande extremism?Det allvarliga omvärldsläget skärper hoten mot Sverige, och främmande makt agerar allt mer offensivt. På senare år har det vid upprepade tillfällen förts på tal att statsaktörer kan underblåsa extremistiska aktörers säkerhetshotande verksamhet i och mot Sverige. Att statsaktörer kan underblåsa hot mot Sverige har uppmärksammats i samband med desinformationskampanjen mot socialtjänsten, koranbränningarna och mordplaner mot svenska judar, samt regimkritiker från olika länder. Det finns även ett flertal exempel på hur stater har främjat egna politiska och säkerhetsmässiga intressen genom att använda sig av...

2024-08-0743 min

CVE-podden 31. Almedalsveckan 2024: Kan strategisk kommunikation vara redskap mot våldsbejakande extremism?Hur ska myndigheter kommunicera för att motverka anti-demokratiska krafter som vill använda våld för att förändra samhället? Falska rykten, desinformation och propaganda som sprids via digitala plattformar och AI kan mycket snabbt påverka hotbilden mot Sverige. I början av året presenterade regeringen en nationell strategi mot våldsbejakande extremism och terrorism. Fokus är lokalt, regionalt, nationellt och internationellt. I detta arbete är kommunikation centralt. Hur ska myndigheter använda kommunikation för att motverka våldsbejakande extremism? Välkommen att lyssna på detta panelsamtal från Almedalsveckan 2024. Medverkande Karl Melin, pressch...

2024-08-0756 min

CVE-podden 30. Almedalsveckan 2024: Antisemitism – hatet som förenar extremisternaHur kan vi hindra antisemitismen från att öka i en polariserad tid? Vilka likheter och skillnader finns mellan antisemitiska idéer idag och genom historien? Hur arbetar regeringen med frågan? Under Almedalsveckan 2023 anordnade CVE och Segerstedtinstitutet ett gemensamt seminarium på detta tema. Ämnet har tyvärr knappast tappat relevans under året som gått, och därför hölls ett uppföljande seminarium under Almedalsveckan 2024. Det kan du lyssna på här! Medverkande: Christer Mattsson, föreståndare, Segerstedtinstitutet Parisa Liljestrand, kulturminister, (M) Petra Mårselius, överintendent, Forum för levande historia Isabella Pistone, filo...

2024-08-071h 01

We Speak CVE Expected Impact of the CNA Rules 4.0Host Shannon Sabens speaks with Art Manion and Kent Landfield, all three of whom are CVE Board members and CVE Working Group (WG) chairs, about the all-new “CVE® Numbering Authority (CNA) Operational Rules Version 4.0.” Topics discussed include the new fundamental concept embedded throughout the rules called the “right of refusal”; how CVE assignment is technology neutral (i.e., cloud, artificial intelligence, etc.); end-of-life assignments; the dispute process; how CNAs can add additional data to their CVE Records such as CVSS, CWE, and CPE information at the time of disclosure for use by downstream consumers; and the expected positive i...

2024-05-2137 min

Threat Talks - Your Gateway to Cybersecurity Insights Palo Alto Networks CVE-2024-3400: a comprehensive analysis of the vulnerabilityTune into this special episode of Threat Talks, as we dissect the critical CVE 2024 3400 vulnerability in Palo Alto Networks' GlobalProtect servers. Join our cybersecurity experts for a deep dive into the vulnerability's implications, our response strategies, and practical tips to bolster your defenses against similar threats. For those who crave even more detailed insights, be sure to check out our comprehensive information page on this topic: https://on2it.net/nl/cve-2024-3400-pan-os-os-command-injection-vulnerability-in-globalprotect/ And read our blog posts for a deeper dive into the technical aspects and implications of...

2024-05-0740 min

We Speak CVE Swimming in Vulns (or, Fun with CVE Data Analysis)Host Shannon Sabens of CrowdStrike chats with Benjamin Edwards and Sander Vinberg, both of Bitsight, about analyzing vulnerability data in the CVE List. This is a follow-on to their “CVE Is The Worst Vulnerability Framework (Except For All The Others)” talk at CVE/FIRST VulnCon 2024.Topics discussed include the types of vulnerabilities and vulnerability intelligence they reviewed and the different ways they approached the data; how CVE is a really good framework for compiling information about, and communicating effectively about, vulnerabilities; how increasing the number of CVE Numbering Authorities (CNAs) through federation has improved the quantity and qual...

2024-04-2943 min

We Speak CVE Meet the 3 New CVE Board MembersIn this episode — recorded live at “CVE/FIRST VulnCon 2024” — CVE Board member and CVE podcast host Shannon Sabens of CrowdStrike chats with the three newest CVE Board members: Madison Oliver of GitHub Security Lab, Tod Beardsley of Austin Hackers Anonymous (AHA!), and MegaZone of F5 who joins as the new CVE Numbering Authority (CNA) Liaison to the Board.Topics include how and why each new member joined the board, the impact that participating in CVE Working Groups had on their decisions to become Board me...

2024-04-0925 min

We Speak CVE CVE Records States and TagsHost Shannon Sabens speaks with Art Manion and Kent Landfield, all three of whom are CVE Board members and CVE Working Group (WG) chairs, about CVE Records. Discussion topics include the CVE Record Lifecycle, the three “states” of CVE Records (RESERVED, PUBLISHED, and REJECTED), the current “tags” in use with CVE Records (EXCLUSIVELY-HOSTED-SERVICE; UNSUPPORTED-WHEN-ASSIGNED; and DISPUTED), the difference between the REJECTED state and the DISPUTED tag, how a DISPUTED tag can be temporary or indefinite, and much more.

2024-03-2633 min

CVE-podden 29. Nya nationella strateginDet här avsnittet handlar om den nya nationella strategin mot våldsbejakande extremism och terrorism som regeringen presenterade i början av 2024. Medverkar gör Jonas Trolle, chef CVE Josefin Bergström seniorrådgivare som ingår i CVE's mobila stödteam. Programledare är Jenny Sonesson som är pressansvarig på CVE.

2024-03-0535 min

CVE-podden 28. Hur ser CVE:s operativa stöd ut i praktiken?Det här avsnittet är en fortsättning på tidigare episod om hur CVE:s mobila stödteam arbetar. Förra samtalet handlade om vem som kan rådfråga CVE och hur ett första samtal går till. Det här avsnittet tar upp vad som händer sedan med ett ärende. Vilka insatser kan CVE erbjuda? Medverkande: Marcus Hjelm och Elias Lomfors Carlberg, rådgivare respektive handläggare i CVE:s mobila stödteam Samtalsledare: Jenny Sonesson, pressansvarig, CVE.

2024-03-0530 min

CVE-podden 27. Hur kontaktar man CVE:s mobila stödteam?CVE har ett mobilt stödteam som erbjuder vägledning till yrkesverksamma i hela landet som kommer i kontakt med frågor som rör våldsbejakande extremism. I det här avsnittet svarar vi på frågor som: Vem kan kontakta CVE? Vilka sorts ärenden kan man ta upp? Hur går ett första samtal till. Medverkande: Marcus Hjelm och Eva Mowitz, rådgivare i CVE:s mobila stödteam. Samtalsledare är Jenny Sonesson, pressansvarig CVE.

2024-03-0520 min

We Speak CVE The Council of RootsLearn how CVE Numbering Authority (CNA) partners—ranging from large to small organizations, proprietary and open-source products or projects, disparate business sectors, and different geographic locations—are overseen and supported within the CVE Program by “Top-Level Roots” and “Roots.” Topics include the roles and responsibilities of the two different types of Roots; how their work benefits the CNAs under their care; how they recruit new CNA partners, including suggestions for addressing upper management concerns if a CNA prospect organization is hesitant to partner as a CNA; how they work with and support their CNAs over time; how the “Council of Roots” work...

2024-01-3048 min

CVE-podden 26. Interreligiös dialog och förebyggande arbeteI denna podd diskuteras hur religioner, trossamfund, och samarbete med/mellan dessa kan utgöra en del av det förebyggande arbetet mot våldsbejakande extremism. Samtalet förs mellan Lenita Törning, forskare med fokus på interreligiösa frågor samt utredare vid CVE, och Sofia Hallbäck, verksamhetsansvarig på stiftelsen Open Skåne, som arbetar för att öka social sammanhållning. Diskussionen leds av Dan-Erik Andersson, docent och universitetslektor i mänskliga rättigheter vid Lunds universitet.

2023-10-1632 min

We Speak CVE How the New CVE Record Format Will Benefit ConsumersShannon Sabens of CrowdStrike and Kent Landfield of Trellix, both of whom are CVE Board members and CVE Working Group chairs, speak about how the new CVE Record format — with its new structured data format and optional information fields — will benefit and provide enhanced value to consumers of CVE content moving forward. Specific topics discussed include how the new CVE Record format will enable more complete vulnerability information to be captured early on in the advisory process and how that will benefit consumers; the ability for CVE content consumers to streamline and more easily automate their use of CV...

2023-09-2725 min

Inside Rehabilitation Counseling Exploring the CVE Certification with Lisa Byrne, MA, CRC, CVE, LCPCThe Certified Vocational Evaluator certification, or CVE, is a high-demand specialty within rehabilitation counseling. CVEs possess unique, comprehensive, and holistic proficiencies in evaluation, career assessment services, and job placement cases. The CRC-CVE dual certification can also provide clients and employers with higher success rates and overall better client outcomes.Lisa Byrne was instrumental in the revitalization of the CVE certification under CRCC, and on this episode, she shares with us the scope of the specialization and why it’s important for clients and employers.Learn more about the CVE Certification and apply for the February 2024 co...

2023-09-2019 min

Open Source Security Curl and the calamity of CVEJosh and Kurt talk about why CVE is making the news lately. Things are not well in the CVE program, and it's not looking like anything will get fixed anytime soon. Josh and Kurt have a unique set of knowledge around CVE. There's a lot of confusion and difficulty in understanding how CVE works. Show Notes Curl blog post Now it's PostgreSQL's turn to have a bogus CVE GitHub Advisory Database Josh's "CVE tried to get me fired" story

2023-09-1146 min

CVE-podden 23. Skolattacker – hur kan de förebyggas?Denna podd är en liveinspelning från ett av CVE:s seminarier under Almedalsveckan i Visby 2023.På senare år har flera fall av pågående dödligt våld ägt rum på skolor i Sverige. Det förekommer att skolattacker motiveras av våldsbejakande extremism, men vanligare är att de som begår denna typ av handlingar inspireras – snarare än motiveras – av extremistiskt tankegods, symbolspråk, etc. Detta innebär att personal, elever och föräldrar behöver stöd och förebyggande verktyg. CVE hanterar just nu i sin verksamhet flera ärenden som rör skolans värld. Jonas Trolle, chef för...

2023-08-2157 min

CVE-podden 22. Hat mot kvinnor och våldsbejakande extremismDenna podd är en liveinspelning från ett av CVE:s seminarier under Almedalsveckan i Visby 2023. Extremiströrelser inkluderar ofta en strävan att bibehålla mäns makt över kvinnor i sina ideologier. Allt oftare uppmärksammas även att hat mot kvinnor i sig kan radikalisera vissa aktörer och få dem att ta till brott och våldshandlingar. Barnrättsorganisationen Ecpat ser hur övergreppsmaterial på flickor och kvinnor sprids med närmast ideologiska förtecken. Hur ska förhållandet mellan hat och brott mot kvinnor och flickor, våldsamma mansideal och våldsbejakande extremistiska ideologier förstås? Vilka lärdomar kan...

2023-08-211h 00

CVE-podden 21. Antisemitism – kittet som förenar extremismernaDenna podd är en liveinspelning från ett av CVE:s och Segerstedtinstitutets gemensamma seminarier under Almedalsveckan i Visby 2023. Våldsbejakande extremister motiveras av en mångfald av idéer. Vissa drivkrafter är dock konstanta och spänner över samtliga miljöer. Antisemitismen har drivit våldsamma hataktörer i århundraden, och utgör en självklar del av nutida våldsbejakande extremistiska världsbilder. Hur yttrar sig antisemitismen inom dagens våldsbejakande extremistiska miljöer? Vilka likheter och skillnader finns mellan antisemitiska idéer idag och genom historien? Vad bör myndigheter, media, och andra viktiga samhällsaktörer göra för att motarb...

2023-08-2159 min

CVE-podden 20. Psykisk ohälsa och våldsbejakande extremismDenna podd är en liveinspelning från ett av CVE:s och Segerstedtinstitutets gemensamma seminarier under Almedalsveckan i Visby 2023. Psykisk ohälsa lyfts allt oftare fram som en gemensam nämnare hos aktörer som motiveras av våldsbejakande extremism, inte minst när det kommer till ensamagerande gärningspersoner. Hur ser kopplingen mellan psykisk ohälsa, våldsbejakande extremism och våldsdåd ut? Hur påverkar denna koppling det förebyggande arbetet mot våldsbejakande extremism? Deltagare: Jonas Trolle (Chef CVE), Christer Mattsson (Föreståndare Segerstedtinstitute)t, Ahn-Za Hagström (Chef Nationellt Centrum för Terrorhotsbedömning...

2023-08-2154 min

We Speak CVE Becoming A CNA—Myths versus FactsHost Shannon Sabens of CrowdStrike chats with Julia Turkevich of the U.S. Cybersecurity and Infrastructure Security Agency (CISA) about the myths and facts of partnering with the CVE Program as a CVE Numbering Authority (CNA).Truth and facts about the following myths are discussed:Myth #1: Only a specific category of software vendors can become CNAs.Myth #2: Organizations cannot leverage their existing vulnerability management and disclosure processes when they become a CNA.Myth #3: The requirements for becoming a CNA are overwhelming and extensive.Myth #4: A fe...

2023-06-2122 min

FOCUS ON: Linux Newsupdate 05/23 - Linux 6.3 und 6.4-rc1, CVE-2023-0386/32233, QEMU 8.0, RHEL 9.2, LIT 2023#CurlMeMayBe Die Kernel-Maintainer:innen schicken Linux 6.3 und 6.4-rc1 ins Rennen, während zwei CVEs geschlossen werden wollen. QEMU veröffentlicht mit 8.0 eine neue Hauptversion mit überschaubaren Änderungen. RHEL und AlmaLinux 9.2 werden veröffentlicht, parallel lässt Rocky Linux noch auf sich warten. An der Hochschule Augsburg findet der Augsburger Linux-Infotag statt, während Red Hat Summit und SUSECON in greifbare Nähe rücken. openSUSE ALP und SoftMaker Office suchen nach Feedback. Feedback Interview mit Lomiri-Lead Developer: https://www.youtube.com/watch?v=Lc6gGs2kM4c Aufreger des Monats Red Hat KB "systemd-cryptsetup: Encounter...

2023-05-191h 15

We Speak CVE Microsoft’s Journey Adopting CVE Services & CVE JSON 5.0Kris Britton of the CVE Program speaks with Lisa Olson of Microsoft about Microsoft’s journey adopting the new CVE Services and CVE JSON 5.0 into their vulnerability management infrastructure and how they used them for the first time as part of Microsoft’s February 2023 Patch Tuesday.Discussion topics include the CVE JSON 5.0 schema mind map and other schema resources on GitHub; reviewing CVE JSON 5.0 records on the CVE.ORG website; using Vulnogram, or one of the other CVE Services clients...

2023-03-0730 min

We Speak CVE Coordinated Vulnerability DisclosureShannon Sabens of CrowdStrike chats with Madison Oliver of GitHub Security Lab about the recent release of OpenSSF’s “Guidance for Security Researchers to Coordinate Vulnerability Disclosures with Open Source Software Projects” document and the important step of obtaining a CVE ID in the coordinated vulnerability disclosure process for open-source vulnerabilities.OpenSSF is a “cross-industry organization that brings together the industry’s most important open source security initiatives and the individuals and companies that support them.” The CVD Guide was released by OpenSSF’s Vulnerability Disclosure working group in September 2022, which in 2021 released its “Guide to Implementing a Coordinated Vu...

2022-12-3023 min

CVE-podden 18. Män, maskulinitet och våldsbejakande extremism Professor Lucas Gottzén är aktuell med kunskapsöversikten Män, maskulinitet och våldsbejakande extremism, som tagits fram på uppdrag av Center mot våldsbejakande extremism (CVE) och Jämställdhetsmyndigheten. Hör honom reflektera över sina slutsatser och rekommendationer om sambanden mellan maskulinitet och våldsbejakande extremism i ett samtal med journalisten och författaren Jens Liljestrand. Gottzéns forskningsöversikt visar hur många våldsbejakande extrema miljöer delar en syn på att världen behöver en återupprättad manlighet och där kvinnohat och antifeminism är centralt. De förenas i tron på att världen behöver ett återupp...

2022-12-0638 min

CVE-podden 19. Maskulinitet och våldsbejakande extremism - hur ska vi se på sambandet? Jonas Trolle, chef för CVE och Mikael Thörn, enhetschef på Jämställdhetsmyndigheten resonerar om hur sambanden mellan manlighet och våldsbejakande extremism kan användas i det förebyggande arbetet mot våldsbejakande extremism. Utgångspunkten för deras samtal är den nysläppta kunskapsöversikten Män, maskulinitet och våldsbejakande extremism. Samtalet leds av journalisten och författaren Jens Liljestrand. Män, maskulinitet och våldsbejakande extremism finns att ladda ner på CVE.se under sektionen publikationer. Lyssna gärna på avsnitt Män, maskulinitet och våldsbejakande extremism för att höra Lucas Gottzén samtala om rapporte...

2022-12-0621 min

We Speak CVE CNA Mentoring Program: Members Helping MembersHost Shannon Sabens of CrowdStrike chats with Tod Beardsley of Rapid7, who is the chair of the CVE Program's CNA Coordination Working Group (CNACWG), about the CNACWG’s "CNA Mentoring Program." Topics discussed include how CVE is a community, how the mentoring program is as little or as much work as you’d like it to be, the many ways in which mentoring can help new CVE Numbering Authorities (CNAs) be successful, the benefits to both organizations, the very simple signup process (a Google form, no login requ...

2022-10-1821 min

CVE-podden 17. Vad gör Center mot våldsbejakande extremism?Välkommen till samtal om Center mot våldsbejakande extremism (CVE) där medarbetare berättar om verksamheten. Centret, som ligger inom Brottsförebyggande rådet, har sedan starten 2018 ett mobilt stödteam som vägleder yrkesverksamma personer i frågor som rör våldsbejakande extremism. CVE arbetar även med kunskapsunderlag och utbildningsverksamhet. Podden är en inspelning från ett seminarium som CVE anordnade under Almedalsveckan i Visby 2022. Medverkande: Edvin Sandström, ansvarig kunskapsfrågor, CVE Joakim von Scheele, utbildningsansvarig, CVE Marcus Hjelm, senior rådgivare mobila stödteamet, CVE Emma Holmg...

2022-09-2941 min

CVE-podden 16. Ungas radikalisering - vad ska samhället göra?Den digitala utvecklingen innebär att allt fler yngre personer lättare kan ta del av våldsbejakande extremistiska budskap. Vad kan samhället göra för att bemöta ungas radikalisering? Välkommen till ett samtal med CVE, Säkerhetspolisen, stiftelsen Doku och stiftelsen Expo. Podden är en inspelning från ett seminarium som CVE anordnade under Almedalsveckan i Visby 2022. Medverkande: Ahn-Zha Hagström, senior analytiker Säkerhetspolisen Jonas Trolle, särskild utredare för säkerhet i skolan och chef CVE Emma Holmgren, senior rådgivare CVE Sofie Löwenmar...

2022-09-2956 min

CVE-podden 15. Våldsbejakande extremism i Sverige och omvärldenSäkerhetspolisen ser en utveckling i Sverige där allt fler sympatiserar med våldsbejakande extremisters ideologi och propaganda. Våldsbejakande extremism, oavsett om den är höger, vänster eller islamistisk, är samtidigt transnationell. Välkommen till ett samtal med Center mot våldsbejakande extremism (CVE) och Säkerhetspolisen. Podden är en inspelning från ett seminarium som CVE anordnade under Almedalsveckan i Visby 2022. Medverkande: Ahn-Zha Hagström, senior analytiker Säkerhetspolisen Jonas Trolle, chef CVE Moderator: Jenny Sonesson, pressansvarig CVE

2022-09-2958 min

CVE-podden 14. Varför är lokal samverkan mot våldsbejakande extremism viktigt?Det talas ofta om lokal samverkan i det brottsförebyggande arbetet, men det är inte alltid så lätt att få svar på hur det rent praktiskt ska gå till. CVE och Brottsförebyggande rådet ger vägledning. Medverkande: Linus Dahlström, senior rådgivare CVE Christina Söderberg, utredare vid enheten för utveckling av brottsförebyggande arbete (UBA) inom Brottsförebyggande rådet Moderator: Jenny Sonesson, pressansvarig CVE

2022-09-2938 min

CVE-podden 13 Hur gör man lokala lägesbilder om våldsbejakande extremism?Samhällets brottsförebyggande aktörer uppmanas ofta att arbeta utifrån lägesbilder, men hur detta kan göras beskrivs mer sällan konkret. Medarbetare från CVE:s mobila stödteam ger vägledning. Medverkande: Marcus Hjelm, senior rådgivare CVE Josefin Bergström, senior rådgivare CVE Moderator: Jenny Sonesson, pressansvarig CVE

2022-09-2929 min

CVE-podden 12 Vad gör mobila stödteamet mot våldsbejakande extremism?Sedan starten 2018 har Center mot våldsbejakande extremism (CVE) ett mobilt stödteam som erbjuder vägledning och handledning till yrkesverksamma, framförallt i kommuner. I det här avsnittet presenteras verksamheten. Medverkande: Marcus Hjelm, senior rådgivare mobila stödteamet Elias Lomfors Carlberg, handläggare mobila stödteamet Moderator: Jenny Sonesson, pressansvarig CVE

2022-09-2928 min

CVE-podden 11 MetodstödI detta avsnitt informerar vi om det bedömningsstöd - eller metodstöd som vi numera benämner det, som CVE har tagit fram för att stötta socialtjänsten vid utredning av oro för våldsbejakande extremism. Medverkande är Maria von Bredow utredare på CVE, Emma Holmgren rådgivare på CVE, Lenita Törning utredare på CVE.

2022-09-2813 min

We Speak CVE An Insider’s View of the CVE ProgramShannon Sabens of CrowdStrike and Tod Beardsley of Rapid7, both of whom are CVE Board members and CVE Working Group chairs, chat about the CVE Program from their insider’s perspectives.Topics include the value of a federated program of CVE Numbering Authorities (CNAs) from around the world for increased assignment of CVE Records; the upside and minimal requirements to becoming a CNA; the types of organizations that are CNAs; how CNAs are a community with a mentoring program; how CNAs assigning CVE Identifiers (CV...

2022-09-2723 min

FOCUS ON: Linux Newsupdate 06/22 – CVE-2022-1966, openSUSE Leap 15 SP4, AlmaLinux 9.0, NixOS 22.05, HP Dev OneKurz vor dem Sommerloch erreicht uns mit CVE-2022-1966 wieder eine kritische Sicherheitslücke, die es zu schließen gilt. Glücklicherweise gibt es mit openSUSE Leap 15 SP4, AlmaLinux 9.0 und NixOS 22.05 neue Distributionsversionen mit erfreulichen Verände Kurz vor dem Sommerloch erreicht uns mit CVE-2022-1966 wieder eine kritische Sicherheitslücke, die es zu schließen gilt. Glücklicherweise gibt es mit openSUSE Leap 15 SP4, AlmaLinux 9.0 und NixOS 22.05 neue Distributionsversionen mit erfreulichen Veränderungen. Canonical zeigt sich bemüht, Ubuntu "snappier" zu machen und Christian findet HPs neues Dev One-Notebook vielversprechend und gleichermaßen überarbeitungswürdig. Links zur Folge:

2022-06-241h 04

We Speak CVE The Value of Assigning CVEsShannon Sabens of CrowdStrike chats with Madison Oliver of GitHub Security Lab about how and why CVEs are assigned, the value of CVEs in vulnerability management, responsible coordination of vulnerability disclosures, the importance of comprehensiveness in security advisories, and why there is no stigma in a CVE. CVE Numbering Authority (CNA) scopes, disclosure policies, turnaround times, and more are discussed in general, as are GitHub’s specific CNA processes and how it helps open-source projects hosted on GitHub with their CVEs and advisories. Madison also writes about many of these topics in...

2022-06-1419 min

We Speak CVE Researchers and PSIRTs Working Well TogetherShannon Sabens of CrowdStrike and Milind Kulkarni of a NVIDIA discuss what security researchers should expect when reporting vulnerabilities to a Product Security Incident Response Team (PSIRT); how to best to collaborate with them; how to interpret responses from the PSIRT; how to get the best outcome when making a report; supported versus end-of-life (EOL) products; CVE Numbering Authority (CNA) scopes; timing of a patch versus the publication of a CVE Record; and more.

2022-05-0326 min

FOCUS ON: Linux Newsupdate 04/22 – CVE-2022-1015/1016, Ubuntu 22.04 LTS, elementaryOS, SUSE Adaptive Linux Platform, Red Hat Satellite 7.0Auch im April reißt die Kette nicht ab: mit CVE-2022-1015 und CVE-2022-1016 gibt es wieder zwei Sicherheitslücken, die es zu schließen gibt. Wir besprechen das sehnlich erwartete Ubuntu 22.04 LTS-Release und die aktuelle Pop!_OS-Beta. Weniger schöne News Auch im April reißt die Kette nicht ab: mit CVE-2022-1015 und CVE-2022-1016 gibt es wieder zwei Sicherheitslücken, die es zu schließen gibt. Wir besprechen das sehnlich erwartete Ubuntu 22.04 LTS-Release und die aktuelle Pop!_OS-Beta. Weniger schöne News gibt es aus dem elementaryOS-Projekt, welches sich nach Streitigkeiten neu ausrichtet. SUSE lässt mit A...

2022-04-291h 08

We Speak CVE The Latest on Transitioning to CVE Services 2.1 & CVE JSON 5.0Lisa Olson of Microsoft and Kris Britton of the CVE Program speak with Kelly Todd of the CVE Program about the transition that’s currently underway for CVE Numbering Authorities (CNAs) to CVE Services 2.1 and CVE JSON 5.0. Their discussion includes how the new services and data format will enable effective and secure automation, improve workflows, and reduce the transaction costs of program participation for CNAs, as well as provide enhanced information in CVE Records for use by downstream consumers.Specific topics include how the CVE Services 2.1 web application adds the CVE Record Submission and Upload Service (RSUS) fo...

2022-03-1522 min

FOCUS ON: Linux Newsupdate 01/22 – CVE-2022-0185, D-Installer, SUSE Liberty LinuxDas neue Jahr beginnt wie das alte Jahr endete: mit einer knackigen CVE! Neben fehlerhaften Operatoren thematisieren wir auch den womöglich größten Kernel-Einzelpatch aller Zeiten. Es keimen Gerüchte um einen weiteren CentOS-Fork auf, während SUSE und Fe Das neue Jahr beginnt wie das alte Jahr endete: mit einer knackigen CVE! Neben fehlerhaften Operatoren thematisieren wir auch den womöglich größten Kernel-Einzelpatch aller Zeiten. Es keimen Gerüchte um einen weiteren CentOS-Fork auf, während SUSE und Fedora an neuen Web-Installern arbeiten. Ubuntu schraubt an Snapcraft und schneidet alte Zöpfe ab. AppImage, Flatpak und Snap im...

2022-01-2854 min

We Speak CVE Enhancing CVE Records as an Authorized Data PublisherKent Landfield of McAfee and Art Manion of CERT/CC discuss how the CVE Program’s upcoming release of JSON 5.0 will allow for additional and related information to be added to CVE Records after they have been published by CVE Numbering Authorities (CNAs). These additions — such as risk scores, affected product lists, versions, references, translations, etc. — will be made by “Authorized Data Publishers (ADPs),” which will be organizations authorized within the CVE Program to enrich the records. Also discussed are the benefits of enriched CVE Records to downstream users and the overall vulnerability management community, the use of Stakeholder-specific Vulnerabil...

2021-12-0727 min

We Speak CVE How Red Hat's Active Participation Helps Improve the CVE ProgramShannon Sabens of CrowdStrike chats with Peter Allor, Fábio Olivé, and Martin Prpic of Red Hat, which is a long-time CVE Numbering Authority (CNA). The benefits of actively participating as a member of the CVE community are discussed, especially in the CVE Working Groups, which allows Red Hat to directly contribute to enhancing CVE automation and quality, as well as strategic planning for future improvements.Specific topics include Red Hat being a resource for other CNAs, particularly for open-source vendors and projects; the industry-wide value of the upcoming CVE Record JSON Schema to be a universal vu...

2021-11-2024 min

We Speak CVE CVE Myths versus FactsEpisode 9 – Three CVE Board members provide the truth and facts about the following myths about the CVE Program: Myth #1: The CVE Program is run entirely by the MITRE Corporation Myth #2: The CVE Program is controlled by software vendors Myth #3: The CVE Program doesn’t cover enough types of vulnerabilities Myth #4: The CVE Program is responsible for assigning vulnerability severity scores CVE Program – https://www.cve.org CVE Board – https://www.cve.org/ProgramOrganization/Board

2021-10-1227 min

We Speak CVE CVE Working Groups, What They Are and How They Improve CVEOur eighth episode is all about how community members actively engage in the six CVE Working Groups (WGs) to help improve quality, automation, processes, and other aspects of the CVE Program as it continues to grow and expand. The chairs and co-chairs of each WG, each of whom is an active member of the CVE community, chat about their WG’s overall mission, current work, and future plans. Discussion begins with the Transition (TWG), a temporary WG focused on managing the numerous modernization, automation, and process transitions currently underway in the CVE Program. Each of the five ma...

2021-09-0226 min

We Speak CVE Managing Modernization and Automation Changes in the CVE ProgramEpisode 7 – Kelly Todd of the CVE Program speaks with Lisa Olson of Microsoft about managing the modernization and automation changes currently underway in the CVE Program. Topics include the efforts of the newly formed CVE Transition Working Group (Lisa, a CVE Board member, is co-chair); automation of CVE ID assignment and CVE Record publishing for CVE Numbering Authorities (CNAs), including the availability of free APIs and other improvements on the way; the upcoming new version release of JSON for the CVE Record format to enhance the data associated with a record; the upcoming availability of program metrics for the CV...

2021-08-2122 min

We Speak CVE How the New CVE Record Format Is a Game ChangerEpisode 6 – Shannon Sabens of CrowdStrike chats with Chandan Nandakumaraiah of Palo Alto Networks about how the very basic legacy format of CVE Records is being transformed for the future by adding many new optional content fields such as multiple severity scores, credit for researchers, additional languages, ability for community contributions, etc., to make CVE Records even more valuable. The use of JSON for the new format and how that enables automation for both CNA publishers and CVE content consumers are also discussed, as are the use and availability of the CVE Program’s automated CVE Numbering Authority (CNA) tools for...

2021-07-0225 min

We Speak CVE Engaging with CVE's Automated CNA ServicesEpisode 5 – David Waltermire of NVD speaks with Milind Kulkarni of NVIDIA and Kris Britton of the CVE Program to discuss the CVE Program's automated CVE Numbering Authority (CNA) services. Topics include the automation architecture being developed and deployed by the CVE Automation Working Group (AWG); the benefits of using JSON for the CVE Record format; how automation simplifies and increases the speed of CNA processes; the currently deployed CVE ID Reservation (IDR) service; the upcoming release of the CVE Record Submission and Upload (RSUS) service; and future automation plans. CVE automated services on GitHub - https://github.com...

2021-06-0932 min

We Speak CVE Interview with Larry Cashdollar - A Researcher's PerspectiveEpisode 4 – Kelly Todd of the CVE Program interviews security researcher Larry Cashdollar about how he got started researching vulnerabilities and his experiences over the years, how he became the CVE Program’s first-ever independent vulnerability researcher CVE Numbering Authority (CNA), best practices, and the benefits of being able to assign his own CVE IDs to the vulnerabilities he discovers. CVE - https://cve.mitre.org/ Larry Cashdollar - https://twitter.com/_larry0

2021-04-2620 min

We Speak CVE Partnering with the CVE ProgramEpisode 3 - Shannon Sabens of CrowdStrike speaks with Jo Bazar of the CVE Program, Erin Alexander of CISA ICS, and Tomo Itou of JPCERT/CC about the structure and objectives of the CVE Numbering Authority (CNA) program, what it means to be a Root and a CNA, the benefits of partnering with the CVE Program, and recommendations for organizations considering becoming a Root or CNA. CVE - https://cve.mitre.org/ CISA - https://www.cisa.gov/ CrowdStrike - https://www.crowdstrike.com/JPCERT/CC - https://www.jpcert.or.jp/vh/index.html

2021-03-3118 min

We Speak CVE How MongoDB Manages Its CVEsEpisode 2 - Chris Sandulow, Boris Sieklik, and Lena Smart from MongoDB discuss their internal processes for managing CVEs, the importance of CVSS scoring to their customers, the benefits experienced from partnering with the CVE Program as a CVE Numbering Authority (CNA), and recommendations for other organizations considering becoming a CNA.

2021-03-0123 min

CVE-podden 4 Vem gör vad när det gäller våldsbejakande extremism?Ansvaret för frågor som rör våldsbejakande extremism har inte en enskild huvudman - men vilka är det som har ansvaret och hur ska de samverka? Det diskuteras i det här avsnittet av Snacka om extremism special från Centrum mot våldsbejakande extremism (CVE). Avsnittet är en inspelning från ett seminarium i Almedalen 2019. Medverkande: Jonas Trolle, chef för CVE Moderator: Willy Silberstein

2019-09-1839 min

CVE-podden 3 När tonläget höjs riskerar det extrema att normaliserasI takt med att samhällsdebatten hårdnar ökar risken för att det extrema normaliseras. Vilka socialpsykologiska grundmekanismer har betydelse när vi sätter ord på våldsbejakande extremism? I det här avsnittet av Snacka om extremism special diskuterar en panel ordets betydelse i det förebyggande arbetet mot våldsbejakande extremism. Inspelat vid ett seminarium i Almedalen 2019. Medverkande: Jenny Yourstone, doktor och forskningsledare på CVE; Marie Gustafsson Sandén, docent och språkforskare vid Södertörns högskola; Jonas Trolle, chef för CVE; Magnus Ranstorp, docent och terrorismforskare vid Försvarshögskolan; Ahn-Za Hags...

2019-09-1843 min

CVE-podden 2 Är det möjligt att åtala IS-återvändare? I den här podden samtalar Jonas Trolle, chef för CVE och Reena Devgun kammaråklagare vid Åklagarmyndigheten, riksenheten mot internationell och organiserad brottslighet. Samtalet handlar om arbetet med att lagföra dem som har begått brott mot krigets lagar, brott mot mänskligheten eller gjort sig skyldig till folkmord. Podden är inspelad i april 2019.

2019-05-1329 min

CVE-podden 1 Vad är CVE?Vad är CVE – och varför är CVE viktiga? Om det berättar Jonas Trolle, Chef för center mot våldsbejakande extremism. Intervjun spelades in vid ett seminarium arrangerat av CVE i november 2018.

2018-12-2013 min

ImanWire Podcast Ep. 3: The Debate Over Countering Violent Extremism (CVE)CVE (Countering Violent Extremism) programs have been a source of controversy in the Muslim American community, yet there is a lack of clarity in the discussion as to what CVE is. Is it a black and white issue as both its proponents and critics make it seem? In this episode, Alejandro Beutel, a researcher in CVE, and Mohamed Ghilan, a critic of CVE, discuss both government and community-led initiatives in countering violent extremism and consider how to address this divisive issue constructively in the Muslim community. Check out additional articles on CVE from different perspectives on www.imanwire.com including: ...

2016-11-291h 35