Three Buddy Problem

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 120: Calif's Bruce Dang joins the buddies to cover why his shop refuses to sell a $50 million iPhone exploit chain, the March 2026 moment Mythos started finding real bugs, Lockdown Mode and MIE bypasses, hallucinated crash logs, and why verification is now the real bottleneck.

Plus, Google Project Zero drops a 30-day disclosure deadline mid-show, and the conversation swings to AI-written patches, careers for new hackers, Calif's plan to be the TSMC of hacking, Jensen Huang's exit from Nvidia, and where all the GReAT APT reports went.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:

0:00 Introductory banter

2:18 What is Calif? Why burn expensive zero-days?

16:04 OpenAI's Daybreak Red and the future of pen-testing

18:46 March 2026: the first look at Mythos

30:03 Why iPhones are still hard to hack

33:48 BFU persistence, daily reboots, and Lockdown Mode

44:35 Breaking Apple's MIE on the M5

54:50 Bruce's SMB bug workflow and hallucinated crash logs

1:09:11 AI reverse engineering and the future of IDA and Binary Ninja

1:20:10 Patch floods, patch quality, and Rust

1:43:09 Teaching malware analysis when AI does the reversing

1:57:04 Breaking: Project Zero moves to 30-day disclosure

2:06:29 Careers, hiring, and the TSMC of hacking

2:22:24 Nvidia, AI power concentration, and the six-month window

2:42:01 Where are the great APT reports? Shoutouts

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 119: We discuss the supermarket fridge hacks rolling across Europe, why no government wants to say the word Russia out loud, active measures and cyber-warfare, and the European silence on attribution.

Plus, OpenAI's GPT-6 Cyber and the cost of 948 Linux exploits, the Daybreak Blue training flap, a tough-love pep talk for researchers mourning the loss of the old game and the Binance postmortem the FBI pinned on North Korea's TraderTraitor.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:

0:00 Introductory banter

3:00 TLP Black and AI agents watching your edge devices

10:21 Supermarket fridge hacks spread across Europe

16:27 How the refrigeration attacks work

18:49 Is this Russia?

21:12 Boundary testing and the Article 5 problem

34:20 Sabotage short of war

40:06 The IOCs nobody is sharing

44:41 Costin's hunting playbook

51:24 Not just a European story

57:25 What do intelligence agencies know?

1:06:22 GPT-6 Cyber and Daybreak Red

1:26:40 948 Linux root exploits for $1.2 million

1:36:48 Daybreak Blue training and the mathematicians

2:09:01 Binance postmortem and TraderTraitor

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 118: On the show this week, the buddies dig into the $6.34 billion Binance heist, the largest crypto hack ever, walking through its multi-chain laundering, the North Korea fingerprints, and whether offensive AI quietly helped pull it off.

Plus, thoughts on Sam Altman's swipe at local hardware, the PHP2Shell "cannonball," why defenders keep hitting guardrails while GLM-5.3 happily does the work, a trojanized Claude Code extension, Apple's fresh spyware alerts, and Volt Typhoon's Silent Train.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:

0:00 Introductory banter

3:46 CTI training & the AI model stack

8:03 The $6.34B Binance hack: the largest crypto heist ever

12:40 Inside the multi-chain laundering

18:23 Sam Altman & the AI hardware crunch

20:44 Root cause: a compromised DevOps laptop

23:43 Did AI help pull it off?

31:22 Who actually loses six billion dollars?

44:00 Crypto as a financial instrument

51:04 Can it get bigger? Hardware-wallet implants

57:04 Attribution, "misalignment" & is Binance Chinese?

1:10:00 Cash, privacy & the Mt. Gox lesson

1:22:12 PHP2Shell: dodging the cannonball

1:30:52 AI for defense & the productization gap

2:09:32 GLM-5.3, the refusal trap & open weights

2:32:26 Apple spyware alerts & Silent Train

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

SECURITY CONVERSATIONS: Black Lotus Labs researcher Michael Horka joins the show to discuss Silent Train, a Volt Typhoon framework that spins up four-to-six-hop chains of hijacked SOHO routers in about two minutes and wipes every hop when the day's session ends.

We discuss how ORB networks differ from botnets, why Silent Train took over after the FBI's KV-botnet takedown, the zero-days hitting control plane software from Versa, N-able and VeloCloud, and the NetFlow and logging moves defenders can make right now.

TIMESTAMPS:

0:00 Intros

0:29 What is an ORB network?

2:34 Silent Train, an operational framework for Volt Typhoon

3:30 Why call it Silent Train?

4:12 Chains that exist for a few hours

6:47 The hijacked routers in the chain

8:16 Burning zero-days on a single hop

9:48 Attribution and the KV-botnet successor

11:02 Crown jewels and NetFlow visibility

14:53 Why network monitoring gets skipped

17:23 Victims in Hawaii, California and Texas

19:23 Four confirmed zero-days, all patched

20:47 Control plane software as the target

26:00 No-brainer defenses: logs and internet exposure

29:41 Threat hunting, agentic AI and where ORBs go next

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 117: This week, we dig into PHP2Shell, the AI-assisted PHP bug that led governments to take websites offline, and the arguments over broken embargoes, who found it first, and the AI doomers taking an "I-told-you-so" victory lap.

Plus, why patching hasn't kept up with AI bug finding, a failure of SBOMs, Terence Tao on math after AI, the iPhone Duo jailbreak and the eMudhra certificate authority key leak.

Cast: Juan Andres Guerrero-Saade and Ryan Naraine. Costin Raiu is traveling.

Timestamps:

0:00 Introductory banter

1:07 Black October's pile of critical bugs

2:34 PHP2Shell and the AI victory lap

8:28 Twenty years of PHP technical debt

16:54 Wiz, Gemini 4 Argon and the credit fight

21:01 Chainguard breaks the embargo

28:42 The doomers' warnings and the patching gap

39:32 Is this an SBOM problem?

55:33 Inside the PHP Foundation's post-mortem

1:03:13 Are bugs sparse or dense?

1:11:24 Should frontier labs fix coding?

1:20:14 Vibe coding and math's industrial era

1:27:26 Who pays to maintain open source?

1:44:59 iPhone Duo hacked already, eMudhra and the news