Podcast Summary — Talkin’ Bout [Infosec] News

Episode: Palo Alto Fears China Retaliation – 2026-02-16

Recorded: February 16, 2026
Published: February 22, 2026
Hosts & Guests: Corey, Wade, Ralph, Bronwyn, Cheddar, Eric (Secure Ideas), Jennifer (Secure Ideas)

Episode Overview

This week’s episode features the usual fun, digressions, and in-depth security discussion from the Black Hills Information Security crew and friends. The team dives into news about Palo Alto Networks’ decision not to explicitly blame China in a threat attribution — sparking a broader discussion on the politics of nation-state cybersecurity and corporate risk. The crew digs into the growing impact of generative AI on both offense and defense, notable supply chain and browser security events, the escalating shortage (and price) of IT hardware, and quirky news like Vietnam’s move against long YouTube ads. The episode, as always, blends industry insight, memorable banter, and actionable takeaways.

Key Discussion Points & Insights

1. Palo Alto Networks and Attribution Fears

[11:33 – 15:39]

• A report claims Palo Alto Networks did not explicitly attribute a recent hacking campaign to China, referring only to "threat actors operating within Asia."
• Corey: “This is kind of a nothing burger... They already got banned from China. We talked about that two weeks ago. Along with every other US-based and Israeli-based cybersecurity company.” [12:46]
• Wade: “For most people, attribution does not matter at all... but if you’re a Fortune 100 with a lot of intellectual property, you better be hardening for China.” [13:59]
• The crew notes that Palo Alto still has ~70 employees in China; this spurs discussion about corporate risk and the limited upside of downplaying attribution.
• Ongoing difficulties with attribution in public and private sector are debated.

2. AI as a Threat & Productivity Force in Security

[6:56, 16:19 – 38:01]

• Conversation jumps into AI’s role in both malicious activity and security work.
• Rentahuman AI: The hosts analyze a viral “AI hires humans to do jobs for it” platform – mostly as a curiosity and potential abuse vector (“Silk Road 3 but less exciting” — Cheddar, [19:44]).
• The panel discusses supply chain attacks in AI agent “skills” marketplaces, the problem of prompt injection, and models stealing data through clever web links and previews.
• Wade: “...I’m like on the cutting edge of AI most of the time, and then stuff like this happens and I’m like, how? I thought I knew stuff. Right? Like with the agents... it’s too fast.” [33:29]
• Threat actors using AI for recon, social engineering, and even model extraction, based on Google Threat Intelligence reporting.
• Defensive ideas discussed: input sanitization, automated heuristics, AI summarizers and human “gates” for risky actions.
• Ralph: “If you can 10x your not-illegal work, you can 10x your illegal work.” [30:20]

3. Supply Chain: Hardware Shortages & Extension Malware

[24:00 – 25:49, 53:51 – 57:03]

• The skyrocketing cost and demand for hardware—now including hard drives, not just GPUs/RAM—driven by AI.
• Ralph: “Western Digital announced today they’ve sold all their hard drive supply for 2026, and are taking orders for 2027.” [24:28]
• Warnings about browser extension supply chain attacks:
  • 287 Chrome extensions found leaking user data (37M installs, including browsing history and internal URL leaks).
  • Advice: “Don’t install sketchy Chrome extensions. Password manager is the only must-have.” [56:40]
  • Even seemingly innocuous AI/AUX tools can abuse user trust.

4. Security Tool CVEs: SolarWinds & Helpdesk

[50:04 – 53:30]

• SolarWinds Helpdesk (Java-based) found with three major vulnerabilities, including unauthenticated deserialization RCE.
• Corey: “RMM tool software is like the highest priority for attackers right now—access is getting harder, and this is a really good way to get initial access.” [50:57]
• Reminder to audit and update remote management tools, especially legacy codebases.

5. Regulatory & End-User Privacy News

[39:25 – 45:05]

• Ongoing drama over Discord’s impending age verification requirements:
  • Uncertainty over which servers are impacted.
  • Debate over privacy, trusted brokers, and the future of pseudonymous internet access.
  • Corey: “If you had to prove you were a human and you were 18, people would just never go [to many websites] anymore.” [44:36]
• Vietnam bans unskippable YouTube ads over 5 seconds, triggering VPN jokes and debates on digital consumer rights.
• Quirky side notes: Country-by-country internet rules and their odd local effects.

6. Physical Scams & Human Exploitation

[58:13 – 60:50]

• Threat actors now mailing physical scam letters (with QR codes) to owners of cryptocurrency hardware wallets (Trezor, Ledger).
• Cheddar: “If you have a crypto wallet, ignore all communications—especially snail mail.”
• Growing trend of crypto money laundering via gig work (“Rentahuman AI” tie-in): people become money mules without realizing legal exposure.
• USPS investigators: “They have like a 98% conviction rate... if they show up at your door, you’re done.” — Bronwyn [60:21]

Notable Quotes & Memorable Moments

• Corey [13:32]: “Attribution is irrelevant... but if you’re a big Fortune 100... you better be hardening for China.”
• Ralph [24:27]: “46% increase in platter disk hard drives. Western Digital announced today... sold all of 2026’s supply.”
• Jennifer [35:27]: “You could also have automation audit [AI skills]... have some kind of whitelist—essentially, an open Claw soul whitelist.”
• Wade [33:29]: “I thought I knew stuff, right? Like with the agents... it’s too fast.”
• Cheddar [19:44]: “This is Silk Road 3, but less exciting.”
• Bronwyn [60:21]: “USPS investigators... have a 98% conviction rate. If they’re showing up... you’re done.”
• Corey [44:36]: “If you had to prove you actually were a human and you were 18, people would just never go...[to most websites].”

Timestamps for Major Segments

| Segment | Topic | Start Time | |---------|-------|------------| | Casual banter, introductions | Panel intros, mustache talk | 00:01 | | Palo Alto / China attribution | Nation-state, retaliation fears | 11:33 | | AI tools for crime/hiring & skills supply chain | AI abuse, Rentahuman AI, prompt injections | 16:19 | | Hardware shortages | AI demand for RAM/GPUs/HDDs | 24:00 | | Threat actors & AI | Social engineering, model extraction | 28:20 | | Prompt Injection & Skills marketplaces | AI vulnerabilities, supply chain | 30:25 | | Discord age verification, internet privacy | Age gates, digital ID, VPNs | 39:25 | | Vietnam YouTube ad ban | VPNs, ad-blocking | 46:09 | | SolarWinds Helpdesk CVEs | Legacy RMM vulnerabilities | 50:04 | | Chrome extension data leaks | Supply chain, internal data leakage | 53:51 | | Physical scam mail & crypto | Trezor, Ledger, snail mail phishing | 58:13 | | Final plugs, Summit & sock tangents | Courses, API sec webcast, socks | 61:05 |

Episode Tone & Takeaways

The banter is irreverent and lively, mixing deep technical analysis with jokes, pop culture references, and meta-commentary. The group freely shares opinions and actionable advice, flagging where infosec theory meets reality (and frustration).

Actionable wisdom:

• Don’t trust attribution for its own sake—focus on threat modeling that fits your real asset exposure.
• AI amplifies both good and malicious work—defenders need to adopt it as much as attackers do.
• Restrict browser extensions; favor allowlists and audit extensions organization-wide.
• Watch for supply chain weaknesses, especially in both hardware and software “marketplaces” (AI, extensions, skills).
• Stay aware of new scam techniques—from QR snail-mail to gig economy laundering.
• Anticipate the next regulatory hurdles for user authentication and internet anonymity.

Closing

The episode wraps with plugs for upcoming red team and API security webcasts, the “security stadium” (BHIS community resource), and advice on quality socks (“Darn Tough” is the official hacker sock, apparently).
Friendly reminder: “If you want to learn about actual blue teaming stuff instead of socks, attend the SOC summit!” — [66:03]

For more: Join BHIS live on YouTube, Mondays at 4:30PM ET, and check out their backlog of webcasts and community content.