Last Week in Cyber: Project Lightwell, Glasswing, and CISA Mania

Autonomous ransomware is here, FedRAMP 2026 is mandating continuous compliance, and CISA’s new ANCHOR-CI council is rewriting critical infrastructure intel—the security landscape just fundamentally changed. Are you ready for the new reality?

Solutions architect David Gray breaks down the basics of vRx, demonstrating the complete loop from vulnerability detection to remediation.

In this overview, see how vRx 2.0 helps IT and security teams bridge that execution gap by moving from manual processes to a closed-loop remediation strategy.

In this episode, David and Sagy discuss CISA's aggressive 3-day patch mandate, Anthropic expanding invitations for its exclusive operational technology group, Project Glasswing, and OpenAI’s "Patch the Planet" initiative.

This claymation special shows what happens when a new CVE is found. Can legacy tools keep up? Or will a new, modern contender prove to have the stamina to win fastest MTTR.

Captain Patches Hook joins David to discuss three day patch deadline for U.S. agencies, OpenAI’s GPT-5.5-Cyber, OpenAI's Daybreak frontier AI platform, Microsoft’s new MDASH (Multi-Model Agentic Scanning Harness), and the Verizon DBIR 2026 report, which shows vulnerability exploitation overtaking credential theft as the top breach vector.

David and Sagy discuss NIST updating NVD operations, an advisory from FS-ISAC, CrowdStrike's Project QuiltWorks, and a Skadden memo outlining how AI tools will shift how EU and US companies comply with regulatory frameworks.

A tooth fairy advances its career to help a security analyst with a massive vulnerability backlog, bringing restorative sleep and patched CVEs.

Ditch the snorkel—vIntelligence validates every threat so you can finally start fixing the 5% that actually matter.

Learn how Vicarius's new intelligence platform is redefining the Exposure Assessment, Validation and Vulnerability Management market in the AI era

David and Sagy break down OpenAI's new bug bounty program, the EU's Cyber Resilience Act (CRA), the strategically incoherent proposed $707 Million CISA Budget Cut, and Anthropic's Project Glasswing, an AI that found thousands of dangerous security holes.

Stop going in circles with manual patching. Choose vRx to automate your updates and restore harmony to your security teams.

CISA pushes OpenEoX for end-of-support tracking—is it a solution or just 'compliance theater'? Then, we dive into Anthropic's Claude Code Security, asking why AI is brilliant at finding bugs but still struggles with fixing them at scale. Finally, we break down the UK Government's claim of cutting cyber fix times by 84%—a true breakthrough or a policy win?

vRx by Vicarius replaces the passive paradigm of reacting to every alert with targeted risk prioritization and three built-in methods to reduce exposure. It helps teams focus on what’s exploitable, likely, and impactful, so teams act on the right risks instead of reacting to everything.

This cybersec parody edition of the Gambler will have you singing along in no time!

In this dramatic short, a devastated CVE with a broken heart wonders if she will ever find true love.

Sagy and Agnayee talk ENISA's promotion to CVE Program Root, the case for making CVE funding a national security imperative, and the U.S. Department of Commerce's Vulnerability Disclosure Program (VDP) found "not fully effective".

Our anchors return to bring you the latest in cyber news, from Apple to Microsoft and the state of Maryland.

A CVE finally calls it quits with her sysadmin—tired of being ignored, unprioritized, and left exposed.

We've all been there, and maybe it's the only way out.

Well now that IT has invaded comedy clubs, we could all use a laugh.

He may never be seen again, but at least we know he's patched. Kind of.

What does it really feel like to be a Managed Service Provider on the edge? In this dramatic short, we follow an MSP through a brutal day.

How many more false promises can we take? Jason sure has heard enough.

Yes it's a lot of stats and enough charts to make you scream. But we're here to help! Request a demo today to see vRx in action!

The smash hit reimagined with a cybersec twist! Who you gonna call?

Join the wolfpack and special guest Brian J. Weiss, CEO of ITECH Solutions, as they discuss the myriad ways compliance impacts security and vice versa. How do compliance frameworks drive business outcomes? Is compliance just a checkbox exercise? Are we ready for the changes AI will bring? The fellas answer all this and more!

When it comes to app and OS coverage, we don't take it lightly. Over 10,000 applications protected? Yes. Across 60 flavors of Windows, Mac, and Linux? You betcha.

With vRx, you know exactly where your assets are—there's no hiding! Status, details, grouping, and more right at your fingertips.

Learn about the vRx approach to compliance with this all-new feature, powered by CIS benchmarks!

Natural born predators, now teamed up to fight (and eliminate) CVE chaos!

In Episode 2, Roi answers the question we've had for 20 years: is patching enough?

Some things will never change....that is, unless your CISO says otherwise.

From the archives, it's Roi in Depth! In this episode, he dissects exposure management, the drawbacks of traditional scanning, and provides a modern blueprint to adapt alongside with it.

The fellas had a riot as they talked Black Basta chat logs, ransomware group strategies, and pinpointing effective countermeasures to stop the bad guys in their tracks!

Think you've seen it all? Think again! A new docuseries from 0-Day Productions exploring the sinister side of SecOps.

A CVE is on the loose, but you can't apply the update. Now what? Follow along as Super Leo battles CVE-2024-49112, adopting the configuration based scripts in vsociety to neutralize the risk and protect his system.

Security analyst Nahuel Benitez demonstrates the versatility of the vRx scripting engine with an incident response scenario.

Super Security Bros Ryan and Nahuel present an overview of the vRx scripting engine, highlighting the public library and customization options available.

IT teams are pulled in one direction, making sure systems are functioning and running properly while security has to check compliance boxes and mitigate risk. This, however, has caused a rift between them and is a conflict all too familiar to cyber practitioners. But: imagine a world where IT and Security work together in one platform. Is it possible? With vRx, you can make it a reality.

A symbol of a bygone era, or an environment ripe for hackers? No matter where the computers live, vRx is there.

A phish disguised as a love poem arrives at the desk of an unsuspecting employee. What will unfold?

Lil CISO has been making waves in the underground InfoSec hip hop community. Now, with the business acumen and resources behind the Vicarius Record label, he's poised to take over the rap game.

Lil CISO throws shade at all the IT pros who doubted him on Patch Tuesday.

Lil CISO is back with his track “In the Boardroom”, which tells the touching story of a lost CISO attending a board meeting with zero will to fall on his sword. With his signature flow and visceral emotion, Lil CISO takes listeners on a journey those only brave enough in the security world will endure.

Lady CISO’s ballad “Log4J Destroyed My Christmas” tells the heartbreaking story of thousands of IT and security professionals who couldn’t celebrate Christmas with their loved ones like the rest of us.

Infosec MC Lil CISO returns to the mic to call attention to the efforts that go unnoticed until there's a breach and being thrust into the spotlight.

From spam to glam, outbound to inbound, and everything in between, Lil CISO tells the story of a security company's journey from seed to Series B.

"Secure Our World" with Lil CISO's hard-hitting, bar-spitting verse where he explains the four things you can do this Cybersecurity Awareness Month to protect yourself when online or using connected devices.

Vicarius Records presents: 12 Days of (Infosec) Christmas 🎶🎄 Sing along if you know the words!

Lil CISO drops a nasty 16 going after Nessus, a legacy scanner with a narrow scope and requires multiple other tools to match the functionality of vRx.

Lil CISO's had enough of PM vendors. He's got a bone to pick and it ain't gonna be pretty.

Vicarius Studios in collaboration with Zero Day Productions is pleased to present the Infosec Parody series! First up, Firewall by Pitbull!

And they're off! Vulnerability management vendors running for the chance to be crowned victor at the 149th Patch Derby!

In this tutorial, we show you how easy it is to group your assets and utilize the efficiency of vRx's patch management tools.

Auto actions are carefully designed to deliver the most powerful and efficient remediation features to your security teams. Follow along in this segment as we break down four common scenarios you may come across—and how auto actions remove the labor!

vRx’s user management feature enables you to create, organize, and manage teams for more efficiency and stronger security. Invite users, assign permissions, and develop stronger interdepartmental teamwork.

vRx's prediction capacity stems from its ability to reverse engineer binary files and learn all of the software structure's components: executables, libraries, and resources. In this first part series, we take you inside Firefox and explore how vRx works from the molecular level to predict vulnerabilities.

Learn how to deploy vRx in a few simple steps.

vRx's prioritization engine is fueled by the unique and contextual properties inside the organization—how the assets are being used, by whom, and on which computers. Combined with rich data from external sources, vRx assesses the risk level for each application to determine remediation severity. In this second part series, we take you inside Firefox and explore how vRx builds a risk profile to prioritize vulnerabilities.

vRx's in-memory protection is powered by its unique ability to learn each software component (libraries and executables). vRx defends against process memory scraping, process impersonation, and direct API abuse—attacks that attempt to exploit the vulnerable memory space. In this third and final series, we take you inside Firefox and explore how vRx protects against these attacks.

vRx's patch management features are rich, simple, and efficient. Rather than creating a package and script for each patch, security teams can knock out their Patch Tuesday workload in just a few clicks. And because threat analysis is connected to patch management, you can see the risk update immediately.

Rather than reporting your vulnerabilities at one moment in time—and left with a static representation of your risk—vRx utilizes event-driven metrics to provide real-time vulnerability assessments. When software is upgraded or installed, vRx correlates CVE data to the application and OS inventory, reflecting the changing nature of your modern work environment.

Learn how to leverage the power of Nmap to get full network visibility and monitor the devices, systems, traffic, and applications that utilize your IT infrastructure.

Learn how to deploy vRx on your Mac.

Vicarius Studios in collaboration with 0-Day Productions is pleased to present the next installment in the Infosec Parody series! Baby Got Hacked, a parody of the mega 90s hit, Baby Got Back.

Vicarius Studios presents: Wake Me Up When Patch Tuesday Ends, an infosec parody of Green Day.

It's the question we've all been wondering: what does Santa do the remaining 11 months of the year? Finally, the truth has been revealed.

David shares his thoughts on the latest from the AI world.

David rambles on LeftoverLocals, its double life as a secret agent, and Microsoft's Copilot Pro subscription.

Organizations are vulnerable to cyberattacks due to outdated vulnerability prioritization and remediation methods. Vicarius offers an immediate, proactive and simplified vulnerability remediation process to continuously discover, prioritize, and prevent the exploitation of critical vulnerabilities and to keep your organization secure with a patching or virtual patching strategy.

Mr. Lumberjack 🪵🪓 joins David to discuss pro-Russian hacktivists targeting OT systems, Docker Hub shenanigans, Panda Express data breach, and much more!

Wizard prodigy Harry Potter joins David to discuss Zscaler's test environment fiasco, PuTTY problem, TunnelVision bug (CVE-2024-3661), and much more!

Elon Musk joins David to discuss BreachForums seizure, Storm-1811 deploying Black Basta ransomware, SSID Confusion, and UNK_SweetSpecter targeting AI companies.

Vicarius Studios is back with another parody, this time taking the country route with Nancy Sinatra's "These Boots Are Made for Walkin".

In this show, David and Don humorously discuss cybercriminals using Stack Overflow to spread malware, ShinyHunters selling Ticketmaster customer data, LightSpy's expansion to macOS, and OpenAI's shutdown of covert influence operations.

vRx is carefully engineered to contain the most advanced and comprehensive vulnerability remediation tools. Follow along in this tutorial as we show you around the platform and look at ways to remediate vulnerabilities even when a patch isn't available.

David and Captain Patches Hook 🏴‍☠️ discuss China-linked hackers using Operational Relay Box networks for cyber espionage, MITRE Corporation's infiltration by hackers exploiting zero-day flaws, and phishing campaigns using Cloudflare Workers to mimic login pages. They also cover a bug in Apple’s iOS 17.5.1 that restored deleted photos, causing privacy concerns.

What do you do when ransomware comes for you? vRx makes incident response easier than ever before with automated scripting, giving you clarity, precision, and insight.

David and Harry Potter discuss Google's 50 Pixel vulnerabilities, Microsoft replacing DirectAccess for the potentially flawed Always on VPN, and the ransomware attack on Ascension caused by an employee's mistake. Harry then ridicules ZkTeco's biometric systems for having 24 vulnerabilities, likening their security to Swiss cheese 🧀

vRx está cuidadosamente diseñado para contener las herramientas de corrección de vulnerabilidades más avanzadas y completas. Siga este tutorial mientras le mostramos la plataforma y buscamos formas de corregir las vulnerabilidades incluso cuando no haya un parche disponible.

O vRx foi cuidadosamente projetado para conter as ferramentas de correção de vulnerabilidades mais avançadas e abrangentes. Acompanhe este tutorial enquanto mostramos a plataforma e analisamos maneiras de corrigir vulnerabilidades mesmo quando um patch não está disponível.

In today's episode, David and Captain Patches Hook discuss the Biden administration's ban on Kaspersky antivirus, a major breach of AMD and Apple by IntelBroker, RansomHub's ransomware targeting VMware ESXi environments, and a $3 million theft from Kraken crypto exchange.

Vicarius Studios returns for another installment in the fan-favorite Infosec Parody series. This time, they managed to restore a tape from a familiar British band....and the rest, as they say, is history 🎸

David and Bob Query discuss recent cybersecurity threats, including Snowblind malware, BlackSuit ransomware, a flaw in Progress MOVEit Transfer, and the P2PInfect botnet.

CVE-2024-6385 has long feared the devastating scripting capabilities of x_detection and x_remediation. Together, they remove vulnerable GitLab versions and reinstall the patched version to protect against exploitation. All in under a minute!

Legendary illusionist Harry "Hacker" Houdini breaks down several major tech news stories, including: Europol's Operation Morpheus taking down nearly 600 Cobalt Strike servers used by cybercriminals, OVHcloud mitigating a DDoS attack, a Twilio data breach exposing 33 million phone numbers registered with Authy, and Xbox Live suffering a major outage, preventing users worldwide from accessing their accounts.

Follow along in this tutorial as we show you how to use our new scripting categories to tackle your daily vulnerability-induced headaches.

Host David and Batman discuss the disastrous CrowdStrike Falcon update that caused 8.5 million Windows devices to crash, affecting airports, TV stations, and hospitals. They mock the chaos, with Batman joking about the BSOD and Microsoft’s recovery tool. They also touch on the MediSecure data breach that exposed personal and health information of 12.9 million customers.

Harry Potter returns to talk WhatsApp delivering Python and PHP attachments, Gh0st RAT drive-by downloads, Microsoft updates breaking Remote Desktop Gateway, and a malicious package on PyPI stealing Google Cloud credentials.

Weaving together a string of metaphors that would make Shakespeare blush, Lil CISO drops bars reminding us to respect those who protect our networks and keep us safe from threats.

With cybersecurity threats growing in both volume and sophistication, small and medium-sized businesses (SMBs) must adopt proactive measures to protect their digital environments. Continuous Threat Exposure Management (CTEM) provides a strategic, structured framework for managing these evolving threats. This discussion delves into the CTEM framework and emphasizes practical approaches that unify various cybersecurity functions under a cohesive plan.

John Lennon imagines a world with no CVEs, no patches, no downtime. Is it hard to do?

In this episode, host David and guest Willy Wonka humorously discuss recent cybersecurity incidents. They start with a vulnerability in air transport security that could allow unauthorized access to aircraft cockpits, joking about the ease of the breach.

In this week's episode, David and Don Donny dive into recent tech and cyber news with their trademark humor and sarcasm. They kick off with the news of a cyberattack on Halliburton, a major energy services provider, which forced the company to shut down some of its systems. Don explains the potential implications of such an attack on critical infrastructure and the steps likely taken to contain the threat.