The Everything Feed - All Packet Pushers Pods PP091: News Roundup–Securing MCP, Hunting Backdoors, and Getting the Creeps From AI Kids’ Toys
Dec 16, 2025
This holiday special dives into a creepy yet fascinating array of security topics. Discover the shady seven-year campaign that exploited browser extensions to steal credentials. Learn about the React2Shell vulnerability and a major security breach affecting a VPN provider. The hosts dissect alarming AI toy risks that spout inappropriate responses and the implications of insecure surveillance cameras. From federal cybersecurity funding to the dark side of online freight marketplaces, it’s a whirlwind of cautionary tales and tech insights.
AI Snips
Chapters
Transcript
Episode notes
Browser Extensions As Persistent Spyware
- Browser extensions can be hijacked and updated to act as long-term spyware across millions of users.
- Jennifer JJ Bonilla warns that extensions can exfiltrate cookies, credentials, and even keystrokes without user awareness.
Harden Browser Extension Usage
- Lock down browser extensions on corporate devices and use allow-listing via MDM or group policy.
- Jennifer JJ Bonilla advises using dedicated password managers instead of browser-stored credentials.
Fast Exploitation Meets Fast Mitigation
- React Server Components vulnerability "React2Shell" is critical and rapidly exploited worldwide.
- Drew Connery-Murray notes mitigation attempts (e.g., Cloudflare) can cause availability impacts during fast response.