Subscribe Share Full episode and show notes IoT , AI/ML , AI benefits/risks Fixing Vulns Is Harder Than Finding Them – PSW #936 In the news this week: InfraTrust and knowing what to patch, Adversary in the middle triggered command injection, Exploitarium again, FreeRDP comes with free vulnerabilities, AI breaking out of sandboxes on its own, WordPress RCE, DMA dangers, Nightmware eclypse is at it again, Fortisandbox, Turning AI to the dark side, more prompt injection, Secure boot is broken, still and again…. July 23, 2026 Full Segment Notes In the news this week: InfraTrust and knowing what to patch Adversary in the middle triggered command injection Exploitarium again FreeRDP comes with free vulnerabilities AI breaking out of sandboxes on its own Wordpress RCE DMA dangers Nightmware eclypse is at it again Fortisandbox Turning AI to the dark side more prompt injection Secure boot is broken, still and again... Hosts Paul Asadoorian @0offset https://securitypodcaster.com David Johnson Jeff Man https://www.obsglobal.com/ Lee Neely Mandy Logan @survivatrix#0613 Sam Bowne https://samsclass.info/ Announcements Let’s be real. Your scanners are dumping thousands of vulns, half of them noise, and you still don’t know what’s actually exploitable in your environment. Patching everything isn’t possible, and chasing CVSS isn’t working. At the Vulnerability Management Virtual Cybersecurity Summit, learn how to prioritize based on exploitability, reduce false positives, and actually fix what matters. Security Weekly listeners can register for free at https://securityweekly.com/vulnmanagement using the promo code: CSS26-SW InfoSec World brings cybersecurity professionals together across industries, from healthcare and financial services to government and the Fortune 500. Join the community in Orlando, October 12–14, for practical education, new perspectives, and cybersecurity research unveiled live. Listeners save 30% on their pass with code ISW26-SWSAVINGS at securityweekly.com/infosecworld2026. List of Articles Paul Asadoorian InfraTrust This represents so much work, can't wait to tell you about it and give you some background. A couple of points: Yes you can query public sources for vulnerabilities, but you need a crawler/scraper for every vendor website to get this information If you want to know which vulnerabilities are being patched in the last 30 days, you can't rely on NVD Chipmakers and BIOS vendors fix things, then OEMs rollout fixes sometimes months later. So the latest AMD exploit and vulnerability may be concerning, but when will that be patched for your environment? InfraTrust Pulse July 2026: What Infrastructure to Patch First Summary: InfraTrust's inaugural monthly Pulse report tracked 61 security advisories across 14 hardware/infrastructure vendors in 30 days, including 6 CVSS-critical bugs and 26 remotely exploitable, no-auth-needed flaws. Top priority is SonicWall SMA1000, where two chained CVEs enable RCE on internet-facing remote-access appliances and attackers have already harvested credentials, session databases, and MFA seeds in active attacks, patch guidance is blunt: fix that first, then everything else. FortiSandbox has two unauthenticated command-injection bugs already on CISA's KEV list with a July 19 federal deadline, and Dell Networking and F5 BIG-IP both have multiple 9.8+ CVEs. The report's broader point: internet-facing network gear, firewalls, VPN gateways, routers, switches, is the actual attack surface that matters, and one example shows a Qualcomm GPU driver fix exploited in the wild since March 3 that HP still hadn't shipped by July, a four-month gap. Paul's take: The line worth remembering from this one is "reachability is what attackers actually use, a 7.5 a stranger can hit from the internet beats a 9.8 that needs local admin." That's the correct way to prioritize and it's the opposite of how most vulnerability management tooling ranks things by default, pure CVSS score with no context on exposure. SonicWall being both the top pick and already actively exploited with MFA seeds stolen tells you this isn't theoretical, if you've got SMA1000 boxes facing the internet, that patch jumps the queue today. The HP GPU driver example is the real indictment though, four months between a fix existing and it actually shipping to customers is the hardware supply chain's dirty secret, everyone talks about zero-day timelines shrinking to hours while the actual patch pipeline for firmware and drivers still moves at the speed of a vendor's release calendar. Track reachable, unauthenticated, internet-facing bugs first, and don't assume "patched upstream" means "patched on your device." Critical ASUS Router Flaw Lets Remote MITM Attackers Execute Arbitrary Commands Summary: ASUS patched CVE-2026-13385, a pre-auth vulnerability across several router firmware branches (3.0.0.4 386, 3.0.0.4 388, 3.0.0.6_102) caused by improper validation of network communications. An attacker positioned as a man-in-the-middle between the router and a legitimate service can manipulate that traffic to inject arbitrary commands, no login required. Successful exploitation means full device compromise: traffic interception, DNS hijacking, and a foothold for lateral movement into the internal network. The article doesn't name specific router models, give a CVSS score, or mention any confirmed in-the-wild exploitation, just a patch and the usual mitigation checklist: update firmware, disable remote admin, segment your network, watch for DNS changes. Paul's take: MITM-triggered command injection on a router is about as bad a place as you can have a bug, that box sits between every device in the house and the internet, so owning it means owning DNS, owning traffic, owning everything downstream. What bugs me about this writeup is what's missing: no CVSS score, no specific models named, just "multiple branches," which makes it hard to know if this actually affects the router sitting in your closet right now. That's not a knock on the vulnerability, it's a knock on vague vendor advisories that make defenders do extra homework just to figure out if they're exposed. If you run ASUS gear, don't wait to find out which model, just go check for a firmware update today, and if you've ever left remote admin turned on out of laziness, this is your reminder to turn it off. Exploitarium: Inside the Archive Behind the Mass 0-Day Drop Summary: An anonymous GitHub account called "bikini" runs Exploitarium, an uncoordinated disclosure archive of PoC exploits across 35 projects, 204 tracked files and counting, spanning libssh2, curl, Git, Redis, PostgreSQL, Nextcloud, Docker, AnyDesk, Firefox, and more. The README states outright that none of it was reported to vendors before posting, and the maintainer has since taken outside contributions, including Windows kernel driver bugs. The standout finding is CVE-2026-55200, a pre-auth out-of-bounds write in libssh2's packet parsing, reachable with zero credentials, and made worse because libssh2 rides along as a transitive dependency inside curl, Git, and PHP. No confirmed in-the-wild exploitation yet, but the archive keeps growing at two to three new findings a week, and the maintainer built real integrity verification into the repo (matching Git blob IDs across consolidated sub-repos) while ignoring the disclosure norms that exist to protect users. Paul's take: Looks like there are updates here. Also, CISA KEV is not the end all and be all source of exploited in the wild, it goes deeper. The line that sums this up is "cares a great deal about the provenance and integrity of their own work product, while remaining indifferent to the standard that exists to protect the users." That's a researcher who's organized, careful, and completely uninterested in coordinated disclosure, which is a much scarier combination than a sloppy dump. This isn't a one-time leak with a start and end date, it's an ongoing archive somebody actively maintains and grows, and a pre-auth libssh2 bug that rides quietly inside curl and Git means the blast radius here isn't "one app," it's half the software supply chain that happens to link that library. If you maintain anything that touches libssh2, curl, or Git internals, don't wait for a headline cycle, go check whether Exploitarium already has your project's name on a folder, because coordinated disclosure just got opted out of on your behalf. FreeRDP Windows Client Cliprdr Virtual Channel Heap Buffer Overflow Summary: A CVSS 9.4 heap buffer overflow in FreeRDP's Windows client (wfreerdp) lets a malicious RDP server hand back a file-contents response larger than the client requested. The size value ( cbRequested ) comes straight from the server with no bounds check and gets passed directly into CopyMemory() , so a buffer sized for 16KB can get handed 64KB, corrupting adjacent heap memory and, under the right heap layout, leading to remote code execution. It needs clipboard redirection enabled (the default) and the victim to paste something in Explorer, no authentication required. Fixed in 3.28.0 to 3.29.0. The advisory also notes wfreerdp itself is unmaintained and has already been pulled from nightly builds. Paul's take: This flips the usual RDP threat model on its head, it's not "attacker compromises the server you're connecting to," it's "you connect to an attacker's server and your own client gets popped the moment you hit paste." That matters because a lot of people assume the risk in RDP runs one direction, protect the server, and don't think twice about what happens when their own machine initiates a connection out to something they don't fully trust, like a client hopping onto a vendor's or contractor's RDP box. And burying the lede here is worse than the bug itself: FreeRDP is telling you flat out that wfreerdp is unmaintained and shouldn't be used, while it's still what a lot of people have installed. If you're running FreeRDP anywhere, update to 3.29.0, and if you're on