Hacker Valley Studio

What would make a government switch off its own websites on purpose? And how does a flaw in the software behind most of the web stay hidden for 14 years? In this solo episode, Ron opens the case file on Black October, the month PHP2Shell pushed governments, hospitals, and banks offline around the world.

Ron starts with a rewind to Heartbleed in 2014 and the “change your password” scramble that followed. Then he explains what PHP2Shell is, why AI was the key to finding it, and how three separate teams found the same secret within seven weeks. He also walks through the timeline that doesn’t add up, including someone exploiting the flaw four days before anyone was warned.

Then he zooms out to the rest of the month, from supermarket freezers in France turning into ovens to a $6 billion crypto heist that may have started with one engineer’s laptop. Ron closes with three habits that protect you even if you’ve never written a line of code: one password per site, multi-factor authentication, and keeping your devices updated.

Impactful Moments

00:00 - Introduction
01:23 - Rewinding to Heartbleed in 2014
04:11 - Chapter 1: The Day The Lights Went Out
05:43 - Why going dark was the smart move
06:44 - Chapter 2: What Scared Them
07:55 - How AI chained the exploit together
08:24 - A 14-year-old door hiding in plain sight
08:36 - Chapter 3: The Four-Day Mystery
09:59 - Three teams, one secret, seven weeks
12:02 - Ron’s hot take on who knocked first
13:59 - Chapter 4: Black October
14:25 - Freezers turned ovens and a $6B heist
17:44 - Chapter 5: What This Means For You
19:25 - Three habits that actually protect you
22:24 - From years to weeks to days

Links

Check out our upcoming events: https://www.hackervalley.com/livestreams
Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com
Become a sponsor of the show: https://hackervalley.com/work-with-us/

If someone wiped your cloud environment tomorrow, how long until you’re back in business? Not what the plan says. What would actually happen? Ron sits down with Jake Bernardes, CISO at Gambit Security, who got his first CISO job by sneaking into a company’s office and sitting in the CEO’s chair. He has since run security for tech companies and early-stage security vendors, and he hosts the Random Access Memories podcast.

Jake shares the social engineering tricks that got him past security guards. He also explains why voice phishing now takes almost no effort. Then he walks through Gambit’s research on an AI-run attack that cost about $25 per target and needed fewer than ten non-technical prompts. Along the way, he takes on phishing simulations, AI guardrails and cyber insurance.

Then comes recovery, the part of security Jake says is still broken. His take: tabletop exercises are “Dungeons & Dragons for executives.” Instead, figure out your minimum viable business, the systems you can’t live without, and prove you can bring them back. Ron closes by tying it to the grocery chain outage that hit his family’s workplace.

Impactful Moments 

00:00 - Introduction
03:20 - Busting the myth: the cloud has your back
05:45 - Seven minutes of agentic ransomware
10:35 - Breaking into a CEO’s office for a CISO job
12:15 - Paying strangers to get past security guards
15:25 - People don’t hack in, they log in
18:55 - The ASOS incident and the short-stock theory
20:00 - Too much exposed to the public internet
23:05 - Anatomy of a $25 AI attack
27:10 - Translating the attacker’s Chinese prompt
29:40 - Can CISOs rely on AI guardrails?
32:25 - Why cyber insurance is a tick box
35:30 - Minimum viable business for 2027
38:25 - Ron digs into the Giant Food outage

Links

Connect with Jake Bernardes on LinkedIn: https://www.linkedin.com/in/jakeleobernardes/

–

Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/

What would you do if your phone rang and the caller ID showed your own company? Would you pick up? Would you help the person on the other end?

This Cybersecurity Awareness Month, Ron goes solo to break down a breach that started with that exact call. Attackers spoofed Astrana Health’s main corporate phone number, posed as coworkers, and talked their way into systems connected to roughly 1.5 million patients. Ron starts with a rewind from phone books to data brokers, including a live search on a people-search site that turned up his own family. From there he walks through the SEC filing, sends a swarm of AI research agents after the public record, and lines up the suspects behind the attack.

The uncomfortable part is that we spent a decade training people to spot a bad email while attackers moved to the phone. Voice phishing is now the second most common way attackers get in, and resetting credentials doesn’t fix the instinct to help when a familiar number calls. Ron closes with three practical ways to stop making it easy for them, starting with one simple habit: hang up and call back.

Impactful Moments

00:00 - Introduction
02:25 - The rewind: from phone books to data brokers
03:15 - What a people-search site found on Ron’s family
05:30 - A breach that started with a phone call
06:15 - Inside Astrana Health’s SEC filing
07:55 - Why spoofing the main number changes everything
09:05 - How the attack likely played out
11:35 - Technical fixes for a human attack
12:50 - The time Ron got got
13:35 - Why attackers want healthcare data
15:15 - 1.5 million patients’ worth of exposure
17:15 - Voice phishing climbs to #2 in M-Trends
19:35 - Three ways not to make it easy for them
21:05 - How to run a phone drill

Links

Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/

What happens when your marketing team, your sales team, and the person down the hall can all ship a full app from a single prompt? And what is that app quietly connected to? In this episode, Ron sits down with Roi Nisimi, Principal Security Researcher, and Yonatan Levi, AI Security Researcher, of Orca Security. They built apps on the most popular AppGen platforms and then tried to break into them.

Ron, Roi, and Yonatan get into what's really running behind a prompt-built app, and what Orca's team found when they went looking for trouble. In one case, a single misconfigured app gave them a way into every integration connected to the workspace. They also explain why Supabase has become a favorite of builders and attackers alike, and share the security questions they ask before sending a prompt.

The bigger tension is speed. With no code review between the prompt and production, Roi argues that velocity has broken the threat models that security relied on for years. And when the agent makes every decision, nobody fully understands what was built, not even the security researchers.

Impactful Moments

00:00 - Introduction
02:15 - Busting the vibe coding myth
04:40 - Inside Orca's State of AI report
05:55 - The unpatched AI SDK problem
07:40 - What is AppGen?
10:20 - Who builds the backend?
12:25 - Inside Orca's AppGen hackathon
14:10 - Thinking like a citizen developer
15:15 - Who's really building these apps
19:25 - One misconfigured app, every integration exposed
20:45 - Why Supabase is the holy grail
23:00 - Checking your own exposure
24:30 - Why the SDLC is breaking down
26:55 - Prompting for a secure app
28:15 - Don't hand the agent every decision
31:20 - Staying sharp by never stopping learning
33:35 - From protecting environments to protecting apps

Links

Connect with Roi Nisimi on LinkedIn: https://www.linkedin.com/in/roinisimi/ 

Connect with Yonatan Levi on LinkedIn: https://www.linkedin.com/in/yonatan-levi-b22168258/ 

Register for Orca’s virtual Builder Exchange: https://orca.security/builder-exchange/?utm_source=HVN&utm_medium=3rd-part

Read the security findings in Orca’s 2026 State of AI Security Report: https://orca.security/lp/2026-state-of-ai-security-report/?utm_source=HVN&utm_medium=3rd-party 

–

Check out our upcoming events: https://www.hackervalley.com/livestreams 

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com 

Become a sponsor of the show: https://hackervalley.com/work-with-us/ 

Your newest hire has a Google Workspace account, a Slack login and a laptop. It never sleeps, and it never asks before it acts. So who owns its identity? Ron welcomes back Ashish Rajan, CISO at Techriot.io and researcher with AI Security Lab, who spent 17 years in identity, cloud security and security leadership. His take: vendors haven't solved AI identity, and the open questions are on your side, not the product's.

Ashish got into identity after failing his OSCP three times: if he couldn't break in, he wouldn't let anyone else in. Now he reviews Ron's own setup, where Hacker Valley's AI agent, Jennifer Romani, has her own accounts just like an employee. Ashish explains how that call changes from a one-laptop small business to an enterprise where every developer's machine acts like five. They also cover the Gemini breach headlines, swarms of agents and AI Security Lab, which Ashish describes as what OWASP is for AppSec, but for AI security.

The uncomfortable truth: defenders have the same models attackers do, but attackers don't wait for a pull request review. Ashish calls that a people problem, not a technology problem. He also shares the question he asks before handing anything to an AI agent: can this be reversed?

Impactful Moments

00:00 - Introduction
02:30 - Busting a myth: AI identity isn't solved
05:30 - Three OSCP attempts and a pivot to IAM
07:00 - Why AI identity is more complex than ever
09:15 - Hot or not: giving an AI agent its own accounts
11:10 - One laptop, five machines in the enterprise
12:50 - AI gateways and developer observability
14:05 - Where Ashish would spend his AI security budget
18:20 - Why defenders don't hack themselves first
19:05 - The real problem is people
22:15 - Swarms of agents are coming
23:50 - What AI Security Lab is building
26:35 - Never share your credit card with AI
28:40 - Ron's callback: can it be reversed?

Links
Connect with Ashish Rajan on LinkedIn: https://www.linkedin.com/in/ashishrajan/

Listen to Ashish's first Hacker Valley Studio episode: https://www.podbean.com/pw/pbblog-bpaij-51b280
– 
Check out our upcoming events: https://www.hackervalley.com/livestreams 

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com 

Become a sponsor of the show: https://hackervalley.com/work-with-us/