Mythos finds a curl vulnerability - 2026-05-18 – Talkin' Bout [Infosec] News

This episode covers Mythos uncovering a vulnerability in cURL, a recent Google Threat Intelligence report on a zero-day exploit, and the growing impact of AI on capture-the-flag competitions and bug bounty programs. The hosts also discuss the economics of AI platforms like OpenAI, security research trends, and broader concerns around software vulnerabilities, automation, and defensive tooling.

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

Chapters

(00:00) - PreShow Banter™ — Token CTFs
(03:18) - Story # 1: Mythos finds a curl vulnerability
(06:36) - Story # 2: Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation
(14:47) - Story # 3: The down fall of bug bounties
(15:34) - Story # 3: Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’
(40:52) - Story # 4: Germany to Flood Ukraine’s Front Lines With Hundreds of New GEREON Combat Robots
(43:51) - Story # 4b: Wild Video Shows Delivery Robots Causing Havoc, Getting Obliterated
(49:35) - Story # 5: Windows BitLocker zero-day gives access to protected drives, PoC released
(56:09) - Story # 6: Deal reached with hackers to delete data stolen from the Canvas educational platform
(58:07) - Story # 7: Celebrities’ and influencers’ private communications exposed in stalkerware data breach
(58:54) - Story # 8: Exclusive: Hackers have breached tank readers at US gas stations; officials suspect Iran is responsible
(01:00:29) - Threat Hunting Summit Talk: Threat Hunting in the Dark: A Practical Approach
(01:04:47) - WEBCAST: Looking at A.I. Wrong with John Strand, BB King and Derek Banks

Links
Story # 1: Mythos finds a curl vulnerability
Story # 2: Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation
Story # 3: The down fall of bug bounties
Story # 3: Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’
Story # 4: Germany to Flood Ukraine’s Front Lines With Hundreds of New GEREON Combat Robots
Story # 4b: Wild Video Shows Delivery Robots Causing Havoc, Getting Obliterated
Story # 5: Windows BitLocker zero-day gives access to protected drives, PoC released
Story # 6: Deal reached with hackers to delete data stolen from the Canvas educational platform
Story # 7: Celebrities’ and influencers’ private communications exposed in stalkerware data breach
Story # 8: Exclusive: Hackers have breached tank readers at US gas stations; officials suspect Iran is responsible
Threat Hunting Summit Talk: Threat Hunting in the Dark: A Practical Approach
WEBCAST: Looking at A.I. Wrong with John Strand, BB King and Derek Banks

Creators & Guests

John Strand - Host

Corey Ham - Host

Wade Wells - Host

Bronwen Aker - Host

Ralph May - Host

Shane Hartman - Guest

Meagan Bentley - Producer

Hayden Covington - Host