In this episode of The Secure Disclosure, host Mackenzie Jackson dives into two fascinating conversations at the intersection of cybersecurity, trust, and AI innovation.First, Romain Moisescot from Veriff (https://veriff.com) explores the heated debate around digital identities in the UK, addressing concerns about privacy, government trust, and the rising wave of online fraud. With Veriff’s Identity Fraud Report 2025 (https://www.veriff.com/resources/ebooks/veriff-identity-fraud-report-2025), he shares insights into how fraudsters leverage AI and how digitally native IDs can fight back.Then, at the Cyber Saki Bar, Geoffrey De Smet, co-founder of Timefold.ai (https://timefold.ai), recounts his journey from building an open-source project 19 years ago to launching a company after IBM’s acquisition of Red Hat. Geoffrey breaks down the difference between heuristic AI solvers and LLMs, why scheduling is one of the hardest problems in tech, and how Timefold is freeing the world from “wasteful scheduling.”If you’re curious about the future of digital trust, fraud prevention, and practical AI applications, this is an episode you won’t want to miss.Chapters00:00 – Introduction01:19 – The Digital Identity Dilemma (with Veriff)18:18 – Sponsor Segment: Aikido Security19:02 – Cyber & Sake: Geoffrey De Smet and the Timefold Journey47:31 – Would You Rather48:14 – Closing Thoughts & Farewell

This week on The Secure Disclosure, host Mackenzie Jackson dives into “the largest breach that never really happened” the September npm supply chain compromise that put 2.6 billion weekly downloads at risk but somehow didn’t take down the internet.Joining me are two key voices from the incident:Josh Junon – the maintainer who was phished, unknowingly triggering the chain of events.Charlie Erikson – the security researcher who first discovered and analyzed the malware.Together, we unpack the timeline: the phishing email that started it all, the malware hidden inside foundational packages like debug and chalk, the viral panic that followed, and why the attackers walked away with just $900 in crypto instead of world domination.We also discuss what the breach teaches us about security “working,” luck, and where the ecosystem still leaves maintainers dangerously exposed.SponsorThis episode is brought to you by Aikido Security — your complete code security platform.Check out Aikido: https://aikido.devPrevent supplychain attacks with Aikido SafeChain: https://www.npmjs.com/package/@aikidosec/safe-chainWatch & Listen🎧 Spotify & other platforms: https://creators.spotify.com/pod/profile/thesecuredisclosure/Connect with MeX (Twitter): https://x.com/advocatemackLinkedIn: https://linkedin.com/in/adovcatemackReferencesXKCD Web Comic: https://xkcd.com/2347/Wiz Blog Post: https://www.wiz.io/blog/widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalkInsiderPhD YouTube: https://www.youtube.com/c/InsiderPhDInsiderPhD X Post: https://x.com/InsiderPhD/status/1965110610972250550My LinkedIn Post: https://www.linkedin.com/feed/update/urn:li:activity:7373625746822696960/John Hammond Video: https://www.youtube.com/watch?v=4caJw0JJZTQChapters00:00 – Intro00:18 – Setting the stage: the breach that “never really happened”01:31 – Josh Junon: the phishing email that started it all04:39 – Malware injection and Charlie Erikson’s discovery06:58 – The viral panic: LinkedIn posts, headlines, and John Hammond’s roast09:01 – Why the npm compromise looked bigger than it was12:31 – Foundational packages, open-source reliance, and the Nebraska problem16:18 – What really happened: $900 stolen in crypto18:31 – Security win or just luck? Community reactions and InsiderPhD’s take23:09 – The scarier “what ifs” and why attackers underused their access23:40 – Sponsored segment: Aikido Security & SafeChain24:26 – Josh on community support and mental health for maintainers26:23 – Where npm failed and how package managers need to improve28:14 – Outro and reflections

In this episode of Secure Disclosure, host Mackenzie Jackson takes you on a journey through the evolving world of cyber threats and the people on the frontlines. We kick things off with a deep dive into phishing attacks with Jacques Louw and the surprising ways they continue to outsmart defenses in 2025. Then, we unravel the story of a dangerous WhatsApp zero-click vulnerability that, when paired with an Apple iOS flaw, gave attackers full control of victims’ devices, all without a single tap.We also take a lighter turn at the Cyber Sake Bar, where we sit down with the world’s number one competitive hacker, Philippe Dourassov, to talk about the thrill of international hacking competitions, how he accidentally hacked Discord, and why he’s now building his own startup. Along the way, we highlight the crucial role of defense, the impact of AI on modern attacks, and even taste test Japanese vs Californian sake.LinksPush Security Phishing Report - https://pushsecurity.com/resources/phishing-evolutionWhatsApp Vulnerability - https://www.bitdefender.com/en-us/blog/hotforsecurity/whatsapp-zero-click-spyware-attack-android⏱️ Chapters00:00 Intro – Welcome & Overview01:32 The Evolution of Phishing Attacks- Jacques Louw Push Security 21:31 WhatsApp Segment – Zero-Click Vulnerability Deep Dive26:18 Sponsor Segment – Aikido Security Spotlight27:01 Sake Segment – Philippe Dourassov on Competitive Hacking