Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.
Risky Business #834 -- Vercel gets owned, Mozilla dumps hundreds of Mythos bugs
April 22, 2026
1:00:33
58.14 MB
Downloads: 0
On this week’s show, Patrick Gray and James Wilson are joined by special guest The Grugq. They discuss the week’s cybersecurity news, including:
- Vercel got owned, and there’s a few infostealer and compromised employee dots to connect
- Mozilla used Mythos to find 271 bugs, which feels like a sign of the bug-pocalypse
- Speaking of the bug-pocalypse, is that why NIST is noping out of enriching a bunch of bugs?
- The NSA is using Mythos even though the government did that whole Anthropic blacklisting thing
- And DDos attacks hit a couple of smaller-player socials
This week’s episode is sponsored by Permiso. Ian Ahl chats to Pat about the subtle signals Permiso uses to detect ShinyHunters-style activity in cloud and on-prem environments.
This episode is also available on Youtube.
Show notes
- Vercel April 2026 Security incident
- Vercel breach linked to infostealer infection at Context.ai
- Vercel confirms breach as hackers claim to be selling stolen data
- Matt Johansen: “This is not a good look” | X
- NIST limits vulnerability analysis as CVE backlog swells | Cybersecurity Dive
- CISA Cyber on X
- Ransomware attack continues to disrupt healthcare in London nearly two years later | The Record from Recorded Future News
- Lawmakers ponder terrorism designations, homicide charges over hospital ransomware attacks | CyberScoop
- In defeat for Trump, House extends electronic spying program for just 10 days | The Record from Recorded Future News
- Crypto infrastructure company blames $290 million theft on North Korean hackers | The Record from Recorded Future News
- US-sanctioned currency exchange says $15 million heist done by "unfriendly states" - Ars Technica
- Hackers are abusing unpatched Windows security flaws to hack into organizations | TechCrunch
- Mozilla Used Anthropic’s Mythos to Find and Fix 271 Bugs in Firefox | WIRED
- NSA using Anthropic's Mythos despite Defense Department blacklist
- Beyond the breach: inside a cargo theft actor’s post-compromise playbook | Proofpoint US
- Beware scam messages offering ships safe transit through Hormuz Strait, says security firm | The Straits Times
- New Jersey men given lengthy sentences for running North Korean laptop farms | The Record from Recorded Future News
- Turns Out We’re Not Alone - Volodymyr Styran
- US joins nearly two dozen other countries in striking back against DDoS-for-hire platforms | Cybersecurity Dive
- Bluesky blames app outage on ‘sophisticated’ DDoS attack | The Record from Recorded Future News
- Mastodon says its flagship server was hit by a DDoS attack | TechCrunch
- An IT expert explained under what conditions using a VPN can cause a smartphone to explode