BadHost, Dead CTFs, Exploding NPMs, and the Verizon DBIR - ASW #385

We dedicate an episode to catching up on appsec news with Kalyani Pawar. We see parsing problems that led to the BadHost vuln, which exposed lots of LLMs, MCPs, and agents to potential compromise. We wonder where to look for security education and practice as the camaraderie of the CTF community becomes infiltrated by LLMs. We talk about the tradeoffs in trust between using public packages vs. having agents write replacements from scratch. And we examine some of the appsec details that the Verizon DBIR reveals about how orgs are being attacked -- and how orgs might use that information to protect themselves. Visit for all the latest episodes! Show Notes:

You can listen to BadHost, Dead CTFs, Exploding NPMs, and the Verizon DBIR - ASW #385 online on Radio and Podcast. Open the player on this page to stream the available audio.

BadHost, Dead CTFs, Exploding NPMs, and the Verizon DBIR - ASW #385 is an episode from Paul's Security Weekly by Security Weekly Productions.

This episode is 45:22 long.

This episode was published on Jun 2, 2026.

Yes. Use the heart button on the episode page to add it to your favorite episodes list.

Yes. This page shows related episodes from Paul's Security Weekly when more episodes are available from the podcast feed.