Demanding pen tests and accountability from vendors

In this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• The KK Park scam compound in Myanmar gets blasted with actual dynamite
• China sentences more scammers TO DEATH
• While Singapore is opting to lash them with the cane
• Chinese security firm KnownSec leaks a bunch of documents
• Necromancy continues on NSO Group, with a Trump associate in charge
• OWASP freshens up the Top 10, you won’t believe what’s number three!

This week’s episode is sponsored by Thinkst Canary. Big bird Haroon Meer joins and, as usual, makes a good point. If you’re going to trust a vendor to do something risky like put a box on your network, they have an obligation to explain how they make that safe. Thinkst has a /security page that does exactly that. So why do we let Palo Alto and Fortinet get away with “trust me, bro”?

This episode is also available on Youtube.

Show notes

• Myanmar Junta Dynamites Scam Hub in PR Move as Global Pressure Grows
• China sentences 5 Myanmar scam kingpins to death | The Record from Recorded Future News
• Law passed for scammers, mules to be caned after victims in Singapore lose almost $4b since 2020 | The Straits Times
• KnownSec breach: What we know so far. - NetAskari
• Risky Bulletin: Another Chinese security firm has its data leaked
• Inside Congress Live
• The Government Shutdown Is a Ticking Cybersecurity Time Bomb | WIRED
• Former Trump official named NSO Group executive chairman | The Record from Recorded Future News
• Short-term renewal of cyber information sharing law appears in bill to end shutdown | The Record from Recorded Future News
• Jaguar Land Rover hack hurt the U.K.'s GDP, Bank of England says
• Monetary Policy Report - November 2025 | Bank of England
• SonicWall says state-linked actor behind attacks against cloud backup service | Cybersecurity Dive
• Japanese media giant Nikkei reports Slack breach exposing employee and partner records | The Record from Recorded Future News
• "Intel sues former employee for allegedly stealing confidential data" Post by @campuscodi.risky.biz — Bluesky
• Introduction - OWASP Top 10:2025 RC1