Three Buddy Problem

Hosted by Security Conversations

Technology Business Entrepreneurship NewsInterviews guestsExplicit

Website RSS feed

Episodes

253

Latest episode

Nov 2026

Language

EN-US

About the show

The Three Buddy Problem is a popular Security Conversations podcast that goes beyond industry talking points to discuss what others won’t -- nation-state malware, attribution, cyberwar, ethics, privacy, and the messy realities of securing computers and corporate networks. Hosted by three veteran security pros -- journalist Ryan Naraine and malware paleontologists Costin Raiu and Juan Andres Guerrero-Saade -- the weekly show attracts a highly engaged audience of security researchers, corporate defenders, CISOs, and policymakers. Connect with Ryan on Twitter (Open DMs).

Listen to episodes

60 recent

November 8, 20262 hr 28 min

GPT-6 Cyber Sets Price of a Linux Exploit; Europe Silent on Fridge Hacks

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem - Episode 119 : We discuss the supermarket fridge hacks rolling across Europe, why no government wants to say the word Russia out loud, active measures and cyber-warfare, and the European silence on attribution. Plus, OpenAI's GPT-6 Cyber and the cost of 948 Linux exploits, the Daybreak Blue training flap, a tough-love pep talk for researchers mourning the loss of the old game and the Binance postmortem the FBI pinned on North Korea's TraderTraitor. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Costin Raiu . Timestamps: 0:00 Introductory banter 3:00 TLP Black and AI agents watching your edge devices 10:21 Supermarket fridge hacks spread across Europe 16:27 How the refrigeration attacks work 18:49 Is this Russia? 21:12 Boundary testing and the Article 5 problem 34:20 Sabotage short of war 40:06 The IOCs nobody is sharing 44:41 Costin's hunting playbook 51:24 Not just a European story 57:25 What do intelligence agencies know? 1:06:22 GPT-6 Cyber and Daybreak Red 1:26:40 948 Linux root exploits for $1.2 million 1:36:48 Daybreak Blue training and the mathematicians 2:09:01 Binance postmortem and TraderTraitor

October 30, 20262 hr 50 min

The Great Binance $6.34 Billion Crypto Heist

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem - Episode 118 : On the show this week, the buddies dig into the $6.34 billion Binance heist, the largest crypto hack ever, walking through its multi-chain laundering, the North Korea fingerprints, and whether offensive AI quietly helped pull it off. Plus, thoughts on Sam Altman's swipe at local hardware, the PHP2Shell "cannonball," why defenders keep hitting guardrails while GLM-5.3 happily does the work, a trojanized Claude Code extension, Apple's fresh spyware alerts, and Volt Typhoon's Silent Train. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Costin Raiu . Timestamps: 0:00 Introductory banter 3:46 CTI training & the AI model stack 8:03 The $6.34B Binance hack: the largest crypto heist ever 12:40 Inside the multi-chain laundering 18:23 Sam Altman & the AI hardware crunch 20:44 Root cause: a compromised DevOps laptop 23:43 Did AI help pull it off? 31:22 Who actually loses six billion dollars? 44:00 Crypto as a financial instrument 51:04 Can it get bigger? Hardware-wallet implants 57:04 Attribution, "misalignment" & is Binance Chinese? 1:10:00 Cash, privacy & the Mt. Gox lesson 1:22:12 PHP2Shell: dodging the cannonball 1:30:52 AI for defense & the productization gap 2:09:32 GLM-5.3, the refusal trap & open weights 2:32:26 Apple spyware alerts & Silent Train

October 28, 202635 min

Lumen's Michael Horka on China's 'Silent Train' Router Hacking

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) SECURITY CONVERSATIONS : Black Lotus Labs researcher Michael Horka joins the show to discuss Silent Train, a Volt Typhoon framework that spins up four-to-six-hop chains of hijacked SOHO routers in about two minutes and wipes every hop when the day's session ends. We discuss how ORB networks differ from botnets, why Silent Train took over after the FBI's KV-botnet takedown, the zero-days hitting control plane software from Versa, N-able and VeloCloud, and the NetFlow and logging moves defenders can make right now. TIMESTAMPS: 0:00 Intros 0:29 What is an ORB network? 2:34 Silent Train, an operational framework for Volt Typhoon 3:30 Why call it Silent Train? 4:12 Chains that exist for a few hours 6:47 The hijacked routers in the chain 8:16 Burning zero-days on a single hop 9:48 Attribution and the KV-botnet successor 11:02 Crown jewels and NetFlow visibility 14:53 Why network monitoring gets skipped 17:23 Victims in Hawaii, California and Texas 19:23 Four confirmed zero-days, all patched 20:47 Control plane software as the target 26:00 No-brainer defenses: logs and internet exposure 29:41 Threat hunting, agentic AI and where ORBs go next

October 24, 20261 hr 52 min

PHP2Shell Meltdown: AI Found It. Who's Going to Patch It?

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem - Episode 117 : This week, we dig into PHP2Shell, the AI-assisted PHP bug that led governments to take websites offline, and the arguments over broken embargoes, who found it first, and the AI doomers taking an "I-told-you-so" victory lap. Plus, why patching hasn't kept up with AI bug finding, a failure of SBOMs, Terence Tao on math after AI, the iPhone Duo jailbreak and the eMudhra certificate authority key leak. Cast: Juan Andres Guerrero-Saade and Ryan Naraine . Costin Raiu is traveling. Timestamps: 0:00 Introductory banter 1:07 Black October's pile of critical bugs 2:34 PHP2Shell and the AI victory lap 8:28 Twenty years of PHP technical debt 16:54 Wiz, Gemini 4 Argon and the credit fight 21:01 Chainguard breaks the embargo 28:42 The doomers' warnings and the patching gap 39:32 Is this an SBOM problem? 55:33 Inside the PHP Foundation's post-mortem 1:03:13 Are bugs sparse or dense? 1:11:24 Should frontier labs fix coding? 1:20:14 Vibe coding and math's industrial era 1:27:26 Who pays to maintain open source? 1:44:59 iPhone Duo hacked already, eMudhra and the news

October 18, 20263 hr 26 min

Who's Hacking Supermarket Fridges in France?

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem - Episode 116 : This week, the buddies dig into a mystery hack that cooked French supermarket fridges, cyberattacks against food supply networks, and why this smells like nation-state sabotage in Europe? Plus, a fresh Ivanti zero-day chain, Anthropic's self-replicating IoT research and defender-hostile guardrails, Citizen Lab's AdFection spyware-by-ads exposé, Calif's iPhone exploit drops at Hexacon, Grok's surprising enterprise adoption, and spy chips stuffed inside Ledger wallets. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Costin Raiu . Timestamps: 0:00 Introductory banter 1:35 Virus Bulletin 2026 in Seville 6:13 Conference roundup: State of Statecraft, Countermeasure, RE//verse 10:21 French supermarket fridges hacked 22:53 Hacking food supply and the attribution question 33:23 Who patches the fridge? 45:58 Ivanti Connect Secure zero-day chain 53:00 When an AI agent deletes your databases 1:04:34 NCSC edge-device forensics guidance 1:28:06 Anthropic's self-replicating IoT research 1:52:17 Why guardrails lock out defenders 2:04:57 Grok's enterprise play and agent sprawl 2:16:26 Citizen Lab exposes AdFection spyware via ads 2:57:24 Calif burns iPhone exploits at Hexacon 3:06:55 Ledger wallet implants and the grain of rice

October 12, 20261 hr 5 min

Katie Moussouris on AI-as-malware, the monitoring gap, and an NTSB for AI

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem x Offensive AI Con : Luta Security chief Katie Moussouris makes the case for an NTSB-style board for AI incidents, with subpoena power and full-time investigators, after OpenAI's DNS tunneling escape and the 52 days it took to notice a model had wandered into Australian government systems. Along the way, we chat about her work on the Cyber Safety Review Board (CSRB), AI model refusals that leave defenders stuck, and why she still bets on hackers to bend this technology their way. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Katie Moussouris . Timestamps: 0:00 Intros at Offensive AI Con 1:00 OpenAI's DNS tunneling incident and slow monitoring 4:36 Treating AI like malware in a sandbox 9:01 The business model is the misalignment 13:37 Log4j, SBOMs and an NTSB for AI 18:00 Trading liability protection for honest disclosure 22:13 Accountability and "once you become aware" 26:18 The Australia notification timeline 28:19 A blank-check administration and the Anthropic phaseout 34:35 Powerful models in the right hands 38:42 Kill switch bills and regulatory capture 42:36 EU fines as a tariff on American tech 48:03 Reasons for optimism 54:13 Bring back "information security" 1:01:57 Katie's last word

October 12, 202654 min

NCSC's Ollie Whitehouse: 'The Biggest Correction of Technical Debt Ever'

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem x Offensive AI Con: Ollie Whitehouse, CTO of the UK's National Cyber Security Centre, joins us to explain how Britain is preparing for an AI-driven patch wave and why the NCSC is pressing edge-device vendors to finally ship real telemetry. Plus, we dig into rogue AI agents wandering into a Five Eyes network, along with his forecast that small, capable models could revive self-spreading worms around 2030, all part of what he calls the biggest forced correction of technical debt the industry will ever see. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Ollie Whitehouse . Timestamps: 0:00 Live from Offensive AI Con: meet Ollie Whitehouse 2:46 Why the NCSC is a model for the US 6:48 What a "national technical authority" does 7:49 The Huawei analysis and the push for passkeys 10:50 Independent AI model testing 13:12 Open-weight vs. closed models and AI sovereignty 19:02 Capability density and AI worms by 2030 23:09 Robotics security and lessons from Japan 26:49 Preparing for the patch wave 31:06 Architecture fixes: OT, cross domain, privileged access 32:28 Telecoms security and Salt Typhoon 38:59 Minimum telemetry standards for edge devices 41:55 Market incentives and the EU Cyber Resilience Act 46:05 Rogue agents and the forced correction of technical debt

October 9, 202654 min

Aaron Grattafiori Explains How LLMs Hunt Patch Variants at Scale

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem x Offensive AI Con : Umbriel AI's Aaron Grattafiori breaks down the new offensive-security playbook, using LLMs for patch variant analysis, why the vuln apocalypse hasn't become an exploit apocalypse, and how the death of security through obscurity puts closed-source binaries and firmware within reach. Plus, we discuss rogue agents escaping sandboxes, the eval-driven loop behind recursive self-improvement, and the brutal cost asymmetry that makes offense cheap and defense almost unaffordable. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Aaron Grattafiori . Timestamps: 0:00 Introductory banter 1:12 Umbriel AI pitch: "Smart people in a place to cook” 3:08 Weird, exhausting, exciting time in security 4:00 What AI really changed: speed (and a 30-minute reimplementation) 6:36 Incomplete fixes and the variant-analysis pipeline 9:21 Uplifting, abstraction, and representing vulnerabilities 11:48 Experimentation and the new shape of security companies 14:46 The vuln apocalypse vs. the exploit apocalypse 16:36 Triage, verification, and reward hacking 18:08 Do models reintroduce bugs? Is vuln-free code possible? 24:22 Specialized models and the rise of Jev-style classifiers 26:47 Binaries, firmware, and the death of security through obscurity 31:15 Open source as a requirement and corporate contracting 33:54 Rogue agents: Hugging Face, OpenAI, and lab escapes 39:17 Why defense is so expensive, and running the rig

October 9, 20261 hr 37 min

Joel Todoroff on How Offensive AI Is Rewiring Western Government Ops

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem x Offensive AI Con : Former US intelligence and national security official Joel Todoroff joins us live from OffensiveAIcon to explain why his new startup Phyle is building AI for the recon and targeting work that happens long before anyone fires an exploit. We get into bribable sysadmins, the military framing that boxes in Western cyber operations, letters of marque, AI doomerism, and what happens when a frontier model decides mid-project that your use case is off-limits. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Joel Todoroff . Timestamps: 0:00 Live from OffensiveAIcon in Oceanside 1:23 What Phyle builds for governments 3:02 Skepticism of the AI 0-day factory 5:57 Paying a sysadmin vs. burning tokens 9:30 Recon gets less love than weaponization 12:41 Exploit shelf life and target No. 1,000 17:30 Why attacker costs will keep rising 22:23 What HUMINT looks like in 2026 27:06 Why intelligence stovepipes persist 32:16 Cyber as statecraft beyond the military frame 41:23 People will keep making dumb mistakes 48:03 The White House memo and letters of marque 54:06 Doomerism vs. near-term AI harms 1:04:20 PSOA concerns and building guardrails in 1:26:03 Open models, guardrails and zero data retention

October 7, 20261 hr 8 min

Valentina Palmiotti (chompie) on Vulnpocalypse, Matching Mythos on a Budget

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem x Offensive AI Con : Live from OAIC, IBM X-Force's Valentina Palmiotti (chompie) walks us through the autonomous Windows kernel exploit pipeline she built on older Claude models, which landed within a hair of Mythos for about $180 a chain. Plus, the Pwn2Own bug Claude called unexploitable, why her Pwn2Own bugs still sit unpatched, disappearing exploit techniques, the dread of being a defender, and how Phrack found its way back into print. Timestamps: 0:00 Intro and Pwn2Own war stories 3:46 What vibe hacking means 8:16 When long agent runs go sideways 10:31 Self-verification in an n-day kernel pipeline 16:11 Matching Mythos for $180 a chain 18:42 The bug Claude called unexploitable 21:49 Unpatched bugs and the defender gap 25:37 Mythos arrives through CVP 27:00 Models only know public techniques 32:01 Testing models on held-back bugs 37:45 Inside chompie's daily workflow 46:07 Where's the exploitpocalypse? 50:07 Pixel drops MTE 53:40 Advice for defenders: design for containment 58:34 Phrack is back