When attackers gain the authority to act, even strong technology can fall short.

This week on What Matters in Cyber, Steve examines the reported Binance theft and what it tells us about transaction approvals, signing authority and trust.

Also in this episode:

• Malicious Claude Code builds distributed through the Cursor marketplace, and what developers should check.
• The PHP2Shell update and the risks of exposed management interfaces.
• Microsoft’s research into how North Korean operators use AI, with humans still directing the activity.
• Google’s plans for more controlled environments for AI agents.
• Practical Monday priorities covering developer tools, patching and high-impact approval processes.

In “My Take,” Steve connects the stories with one question: are we protecting access, or also controlling what happens after access is granted?

Join the conversation: which action in your organisation deserves a second pair of eyes?

Subscribe for a conversational weekly look at the cybersecurity, AI and IT developments that matter.

cybersecurity, cyber news, AI security, IT news, Binance, cryptocurrency security, software supply chain, Claude Code, Cursor, PHP2Shell, Palo Alto Networks, North Korea, AI agents, identity security, vulnerability management, What Matters in Cyber

Send us Fan Mail

Patch Fast. Think Faster.

Finding a security weakness is only useful if you can do something about it.

This week, Steve breaks down PHP2Shell, the critical PHP vulnerabilities that triggered an emergency patching response, and separates demonstrated risks from the more dramatic headlines.

Also covered: the eMudhra certificate incident and its implications for website trust, the latest SafePay ransomware warning, AWS Continuum’s approach to validating vulnerabilities and proposing fixes, and the compromised Rank Math PRO update affecting some WordPress sites.

Along the way, Steve shares practical Monday priorities, from confirming what your hosting provider has patched to checking certificate dependencies and testing recovery.

In “My Take,” he explores the gap between discovering a problem and fixing it. Better tools can help, but unclear ownership, slow approvals and untested recovery plans can still leave you exposed.

Subscribe to What Matters in Cyber for a practical weekly look at the IT and cybersecurity stories that matter.

Send us Fan Mail

Some of the most serious cyber risks can enter through systems, suppliers and processes you do not directly control.

This week, Steve looks at the ConnectWise Cloud Backup incident affecting Microsoft 365 environments, altered Ledger hardware wallets, North Korean remote IT workers using laptop farms and commercial spyware delivered through targeted online advertising.

Also covered are the cyber incident disrupting the federal Bankruptcy Noticing Center, Proofpoint’s proposed acquisition of Varonis, new Android scam protections and an unusually busy Monday patch list.

In “My Take,” Steve explains why dependency risk is operational, not simply contractual, and offers four practical questions every organization should be asking about its suppliers, applications, people and equipment.

Subscribe to What Matters in Cyber for a practical weekly look at the IT and cybersecurity stories that genuinely matter.

Send us Fan Mail