Eric Brown, CISSP, Nick Mellem and Joshua Schmidt run through the week’s biggest cybersecurity headlines — from underground hacking tutorials to a Microsoft bug bounty fumble to a new hire getting phished on day three.
The Real Talk:
- Underground forums now publish step-by-step exploitation guides — and AI just erased the skill floor for following them
- Microsoft stiffed a legitimate bug bounty researcher. Now his zero-days may drop publicly on Patch Tuesday
- A phishing campaign is weaponizing Meta’s business suite against SMBs — it almost got Joshua mid-party
- A new IT Audit Labs employee got a fake text “from Eric” asking for Apple gift cards. Day three.
A Closer Look:
The Hacker Playbook Is Public A threat actor called “Hercules” published a plain-language tutorial covering how to scan, exploit, and monetize vulnerabilities. Nick’s takeaway: AI erased the coding requirement. The pool of people who can cause damage just got a lot bigger.
Microsoft Fumbled the Bug Bounty Gray-hat researcher Chaotic Eclipse responsibly disclosed serious zero-days to Microsoft. Microsoft declined to pay, citing paperwork. Now those vulnerabilities may drop on Patch Tuesday — unpatched, exploitable, and entirely avoidable. Eric’s read: making disclosure painful doesn’t just fail researchers, it fails everyone running Microsoft code.
Facebook Phishing Hits SMBs A campaign exploiting Meta’s business suite is targeting small businesses with convincing phishing emails. Joshua nearly clicked through one while transitioning out of work mode. His save was a simple break-check. The crew’s standing advice: MFA on all social accounts, and treat your social media admins like the high-value targets they are.
SMS Phishing Doesn’t Wait A new IT Audit Labs hire received a text “from Eric” on day three asking for Apple gift cards — before his LinkedIn welcome post even went up. Email isn’t the only vector. New employees are prime targets. Train them on day one.
Bottom Line:
The threat landscape is getting cheaper to participate in and harder to defend against. AI lowers the bar for attackers, bug bounty programs are failing researchers, and phishing arrives before the welcome email. The fundamentals — know your vectors, train your people — matter more than ever.
Tune into the full episode to hear why Eric thinks Microsoft owes the security community better, how Joshua checked himself out of a phish, and why Nick considers leaving the Marines his best failure.
Listen wherever you get your podcasts — Subscribe to our YouTube channel to stay up to date on breaking cybersecurity news.
Learn more at www.itauditlabs.com
