Risky Business #834 -- Vercel gets owned, Mozilla dumps hundreds of Mythos bugs

On this week’s show, Patrick Gray and James Wilson are joined by special guest The Grugq. They discuss the week’s cybersecurity news, including:

• Vercel got owned, and there’s a few infostealer and compromised employee dots to connect

• Mozilla used Mythos to find 271 bugs, which feels like a sign of the bug-pocalypse

• Speaking of the bug-pocalypse, is that why NIST is noping out of enriching a bunch of bugs?

• The NSA is using Mythos even though the government did that whole Anthropic blacklisting thing

• And DDos attacks hit a couple of smaller-player socials

This week’s episode is sponsored by Permiso. Ian Ahl chats to Pat about the subtle signals Permiso uses to detect ShinyHunters-style activity in cloud and on-prem environments.

This episode is also available on Youtube (youtu.be/vMqA4giggoM).

Show notes

• Vercel April 2026 Security incident (vercel.com/kb/bulletin/vercel-april-2026-secur…)

• Vercel breach linked to infostealer infection at Context.ai (infostealers.com/article/breaking-vercel-breac…)

• Vercel confirms breach as hackers claim to be selling stolen data (bleepingcomputer.com/news/security/vercel-conf…)

• Matt Johansen: “This is not a good look” | X (x.com/mattjay/status/2046222804555608574?s=46&…)

• NIST limits vulnerability analysis as CVE backlog swells | Cybersecurity Dive (cybersecuritydive.com/news/nist-vulnerability-…)

• CISA Cyber on X (x.com/CISACyber/status/2046284602218549277)

• Ransomware attack continues to disrupt healthcare in London nearly two years later | The Record from Recorded Future News (therecord.media/ransomware-nhs-cyberattack-dis…)

• Lawmakers ponder terrorism designations, homicide charges over hospital ransomware attacks | CyberScoop (cyberscoop.com/lawmakers-ponder-terrorism-desi…)

• In defeat for Trump, House extends electronic spying program for just 10 days | The Record from Recorded Future News (therecord.media/fisa--trump-congress-extension…)

• Crypto infrastructure company blames $290 million theft on North Korean hackers | The Record from Recorded Future News (therecord.media/crypto-north-korea-theft-kelp)

• US-sanctioned currency exchange says $15 million heist done by "unfriendly states" - Ars Technica (arstechnica.com/security/2026/04/russia-friend…)

• Hackers are abusing unpatched Windows security flaws to hack into organizations | TechCrunch (techcrunch.com/2026/04/17/hackers-are-abusing-…)

• Mozilla Used Anthropic’s Mythos to Find and Fix 271 Bugs in Firefox | WIRED (wired.com/story/mozilla-used-anthropics-mythos…)

• NSA using Anthropic's Mythos despite Defense Department blacklist (axios.com/2026/04/19/nsa-anthropic-mythos-pent…)

• Beyond the breach: inside a cargo theft actor’s post-compromise playbook | Proofpoint US (proofpoint.com/us/blog/threat-insight/beyond-b…)

• Beware scam messages offering ships safe transit through Hormuz Strait, says security firm | The Straits Times (straitstimes.com/world/middle-east/scam-messag…)

• New Jersey men given lengthy sentences for running North Korean laptop farms | The Record from Recorded Future News (therecord.media/new-jersey-men-sentenced-north…)

• Turns Out We’re Not Alone - Volodymyr Styran (arunninghacker.substack.com/p/turns-out-were-n…)

• US joins nearly two dozen other countries in striking back against DDoS-for-hire platforms | Cybersecurity Dive (cybersecuritydive.com/news/ddos-service-takedo…)

• Bluesky blames app outage on ‘sophisticated’ DDoS attack | The Record from Recorded Future News (therecord.media/bluesky-blames-app-outage-on-d…)

• Mastodon says its flagship server was hit by a DDoS attack | TechCrunch (techcrunch.com/2026/04/20/mastodon-says-its-fl…)

• An IT expert explained under what conditions using a VPN can cause a smartphone to explode (kuban.kp.ru/online/news/6926840)