Bishop Fox

AI is changing healthcare (and how attackers target it!) Join experts from Moderna, BlueCross BlueShield of Tennessee, Holland & Knight, and Bishop Fox for a discussion on ransomware, AI adversaries, and protecting patient care. Nov. 10 | 3 PM ET

Not every proof-of-concept exploit is what it claims to be. After the recent PHP disclosure, unofficial PoCs appeared almost immediately. Some were broken. Others may have been malicious or misleading. Sergio Villegas discusses the fallout on Initial Access.

Your conference room door is closed. But is the conversation actually private? @Alethe explores how physical penetration testing reveals gaps in access controls, visitor verification, and the detection of unfamiliar devices.

How much is too much to disclose before a patch is available? Kendrick Urbaniak used AI agents to investigate the recent PHP demonstration. Within an hour, they'd narrowed down the bug. What if someone else's agents went further?

A successful red team engagement isn't just about getting the shell or opening the door. What did you learn along the way? @Alethe is delivering the keynote at BSides Peoria this Saturday, exploring what success really looks like in offensive security.

Are your medical devices actually isolated, or are you assuming they are? Shad Malloy explores that question and medical device patching myths at the Health-ISAC workshop on Oct. 22. Insights from 160+ Bishop Fox healthcare assessments.

AI swarm attacks can burn millions of tokens in minutes. So how do attackers afford them? On Initial Access, Kendrick Urbaniak explains the surprisingly cheap AI token resale market and why its sophistication resembles malware marketplaces.

How do you contain a ransomware attack when taking systems offline could disrupt patient care? Join experts from Moderna, Holland & Knight, and Bishop Fox on Nov. 10 to discuss AI threats, ransomware readiness, and healthcare security.

Research, offensive security, open-source tools, and the occasional ridiculous war story. We're growing r/BishopFox as a place for security practitioners to talk shop.

Seeing command injection in a log doesn't prove code execution. On the latest Initial Access, Dillon Sparks discusses inflated vulnerability claims, unrealistic configurations, and why demonstrated impact matters when evaluating severity.

SolarWinds ARM shipped with a shared authentication secret. An attacker who could reach TCP 55555 could bypass authentication and achieve SYSTEM-level RCE. @Jon Williams & the Bishop Fox TEA team reproduced CVE-2026-28326 and built a safe detector. The 8.8 score? It depends on your firewall.

¡Hoy tenemos taller en español! Samanta Aranda nos enseñará cómo aprovechar configuraciones incorrectas de CloudFormation para escalar privilegios en AWS. Un taller práctico sobre IAM, roles de servicio y rutas de ataque.

Who has the AI advantage right now? Evan Wolff says attackers. But as AI becomes embedded into everyday security tools, he expects defenders to start closing the gap.

Happening today: Weaponizing CloudFormation Samanta Aranda is going hands-on with how attackers can turn limited IAM permissions and misconfigured CloudFormation roles into paths to more access.

@Jon Williams gave an AI-powered vulnerability research lab raw UniFi firmware. It helped take the research all the way to a working unauthenticated exploit. This week at Ekoparty, Jon is demoing the takeover live and sharing where the AI worked and where it fell flat.

What does “no evidence of exploitation” mean when your telemetry couldn't distinguish legitimate access from abuse? Thomas Wilson breaks down the bigger lesson from the DC healthcare data exposure in the latest Initial Access.

Happening next week: Weaponizing CloudFormation Samanta Aranda is going hands-on with how misconfigured CloudFormation execution roles can create paths to privilege escalation and persistence in AWS. Available on our site or in the Bishop Fox Discord server!

Finding more vulnerabilities doesn't help much if you can't really tell what matters. Ori Zigindere explains CTEM and how continuous scoping, prioritization, validation, and remediation can turn an endless backlog into actual risk reduction.

Happening tomorrow at 2 PM ET. Vinnie Liu, Justin Greis, and Evan Wolff are getting together to talk AI security, identity risk, and the cybersecurity decisions organizations should be thinking about now as 2027 approaches.

Attackers can now build an AI team. Kendrick Urbaniak breaks down a campaign where different models were chosen for different jobs, using one for orchestration and others with looser restrictions for exploitation.

The questions that matter most in cybersecurity aren't always technical. Daniel Wallace of McKinsey explains why AI's shift to a non-deterministic world is changing how leaders think about risk, governance, and what actually deserves attention.