This episode breaks down a Tenda router backdoor that turns out to be three years old, a phishing kit called EvilTokens that hides until a victim's browser builds it, and CISA turning Anthropic's Mythos model on the government's own code, plus a sit-down with IoT researcher Matt Evans on why Tenda keeps getting away with it.

Security Headlines:

· CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware, The Hacker News

· New Ghost Phishing Wave Is Breaking Traditional Email Security, The Hacker News

· CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws, Security Week

Also mentioned:

· Blog: Matt ‘uturn’ Evans

· Event: Boston Security Meetup 2026

· Workshop: Social Engineering: How to Build Pressure-Proof Pretexts

· Virtual Session: The Prioritization Problem: Why More Findings Don’t Mean Less Risk

Join the conversation in the Bishop Fox Discord server and in the new Bishop Fox subreddit.

This episode breaks down a Cisco flaw exploited within 24 hours of disclosure, a credential-harvesting campaign that hit 430,000+ FortiGate firewalls, and what Fable's restricted return and China's Tulongfeng mean for controlling offensive AI. Plus, a sit-down with Bishop Fox's Shad Malloy on building the first open-source Sparkplug B fuzzer for ICS environments.

Security Headlines:

• In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw, Dark Reading

• FortiBleed campaign steals 110M credentials from FortiGate targets, SC Media

• Buckle Up: The Bad Guys Now Have A Model As Powerful As Mythos, Forbes

Also Mentioned:

• Research: On Favicons: From Browser Icons to Attack Surface Intelligence

• Event: Summercon 2026

• Event: San Diego Comic-Con 2026

Join the conversation in the Bishop Fox Discord Server.

This episode breaks down a public FIFA signup form wired straight to World Cup broadcast controls, an FFmpeg RCE buried in half your media apps, a SaaS breach cascading through delegated OAuth, and home routers conscripted into proxy infrastructure, plus a sit-down with Bishop Fox's Marco Sanchez on hardware hacking.

Security Headlines:

• I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID, BobDaHacker

• FFmpeg fixes PixelSmash flaw in widely used video decoder, BleepingComputer

• Klue hack results in data breach at several cybersecurity firms, TechCrunch

• How Hackers Found a Back Door Into the American Living Room, The Wall Street Journal

Also Mentioned:

• Workshop: Debug to Root: A Friendly Introduction to Hardware Hacking (available in English and Spanish)

• Virtual Session: Beyond the Hype: What Mythos Actually Means for Security Teams

• Event: SummerCon 2026
• XKCD Comic: Dependency

Join the conversation in the Bishop Fox Discord Server.