The CyberCall Podcast

Oct 21, 2026

Two Critical PHP Flaws: What MSPs Should Do Before and After Today’s Patch

We put together a special Wednesday CyberCall after two critical PHP vulnerabilities, known as php2shell, leaked a day before their planned disclosure. John Hammond of Huntress and John Strand of Black Hills Information Security joined me to talk through what happened and what MSPs should be doing about it. John Hammond explained why a flaw in PHP itself matters so much. It sits underneath WordPress, Drupal, Joomla, Magento, and many other platforms, and it can lead to full remote code execution on the server. He also shared why he took his own WordPress site offline until the patch was releas

Oct 19, 2026

Breaking Down the SkyKick Tenant Access Incident

Even if you've never used ConnectWise Cloud Backup, formerly SkyKick, this week's incident holds a lesson for every MSP. On October 15, a threat actor used a stolen credential belonging to that app to sign in to customer Microsoft 365 tenants. Huntress has confirmed more than 160 so far, and it believes the threat actor also abused several of ConnectWise's Cloud Management apps. ConnectWise has shut off Cloud Backup access while it investigates, so backups are paused for the MSPs and clients who rely on it. What makes this one interesting is how the threat actor got in. They used a trusted app

Oct 12, 2026

Unpacking Huntress’ Tragic Quadrant

Huntress just released what they're calling the Tragic Quadrant. Instead of ranking threats by how much press they get, it ranks them by two things: how often Huntress actually sees them, and how close they put a business to real damage. That's based on data from more than 5 million endpoints, 15 million identities, and nearly 300,000 organizations, and a lot of those are our clients. What caught my attention is the top right corner, where the threats are both common and dangerous. That's RMM abuse, mailbox manipulation, and account takeover. If you're an MSP, at least one of those sits square

Oct 5, 2026

MSPs & AI: What’s Working, What’s Not

Today we're talking about MSPs and AI: what's working and what's not. When it comes to AI, our clients are moving fast. They're turning on Copilot, using ChatGPT and starting to run AI agents that can get into their email, files and financial systems. A lot of the time, they're doing it without telling us. Most companies running agents don't have written policies for them, and almost half don't have a reliable list of what's running. Those are large companies. Our SMB clients are likely further behind. The stakes are going up too. Last week the FTC opened an investigation into the major AI lab

Sep 28, 2026

EvilTokens Take Down & Copilot's Biggest Announcement Yet

Two big stories from Microsoft landed within days of each other. First, EvilTokens. Last week, Nathan Taylor told us some of his co-managed clients were getting compromised through device code flow. Then Microsoft published a report showing just how big this got. EvilTokens is phishing sold as a subscription, and it uses AI at every step. It hit more than 12,000 inboxes across over 10,000 organizations, and the victims land on the real Microsoft sign-in page. Second, Microsoft announced what Satya calls the biggest Copilot update yet: Home, Code and Autopilot. Autopilot is an agent with its ow

Sep 21, 2026

The AI Threat Hype vs. the BEC Reality

Everywhere you look right now, we're hearing about AI-powered cyberattacks and what attackers might be capable of next. But while we're preparing for the attack of tomorrow, what are MSPs actually fighting today? Nathan Taylor at Sourcepass told me it's been non-stop business email compromise and Microsoft 365 hardening. And one attack in particular is exploding: device-code phishing. What's concerning is that attackers aren't necessarily exploiting some new vulnerability. In many cases, they're abusing legitimate Microsoft authentication workflows, stealing sessions and tokens, and turning tr

Sep 14, 2026

Jensen Huang Says Cyber Fear Is a Sales Pitch. Is He Wrong?

Two weeks ago, OpenAI published an open letter, as we discussed, during the previous CyberCall. Over a hundred companies signed it, warning that AI enabled cyberattacks are about to get a lot worse. A week later, they announced Daybreak, their cybersecurity solution, along with a billion dollars in subsidized access to their own platform for water utilities, hospitals, and community banks. Around the same time, Bill Gates published his own essay saying the cybersecurity experts he talks to are genuinely scared about what's coming. Then this week, Jensen Huang, CEO of Nvidia stood on stage at a

Aug 31, 2026

Frontier Models Call for Collective Action on Cyber Defenses

Last week, OpenAI published an open letter and over a hundred companies signed on. CrowdStrike, Microsoft, Google, Cisco, AWS, Anthropic, basically every major name in cybersecurity and enterprise tech. The letter warns that AI-enabled cyberattacks are about to get faster and more sophisticated, and it specifically calls out hospitals, water treatment plants, and critical infrastructure as the places most at risk. It lays out a plan: every organization needs to raise its security standards, cybersecurity companies need to build AI-powered defenses, governments need to fund the utilities that c

Aug 24, 2026

Collaboration Platforms are the New Phishing Frontier

For years, security awareness training has focused almost entirely on email phishing: spot the bad link, question the urgent request, verify the sender. But Unit 42 just published research showing attackers have found a different door, and most teams aren't watching it. Collaboration platforms like Slack and Teams have become part of the identity attack surface. Unit 42 tracked a fourfold increase in malicious activity tied to these platforms over the past year, and 99% of it started as chat-based phishing. Here's what makes this especially relevant for MSPs: most organizations use Teams to co

Aug 18, 2026

When AI Generated Patches Become the New Vulnerability

This week's conversation is one we believe every MSP needs to hear. AI-generated vulnerability patches have become the obvious next move for software developers drowning in a tsunami of CVEs. It sounds like a great answer, until you look at the actual data. That's exactly why we wanted Keith Hoodlet on the show. Keith just published the inaugural research from 1Password's new security research team, Off-by-1 Labs, and the findings are fascinating: when frontier AI models were tasked with patching six real, recently-disclosed vulnerabilities, they got it fully right without breaking anything el

Aug 10, 2026

Future of AI Advisory for MSPs

AI is reshaping our industry faster than anything we have witnessed, and yes, threat actors are using it too. But we don't want to spend today talking about AI simply as a threat. We want to talk about it as the biggest opportunity our industry has had in a long time and how we consider adopting AI for ourselves and our clients. That's exactly why we wanted Lior Bela on the show. Lior recently stepped into a new role leading AI Strategy for Security at Microsoft, and he posted something that we believe resonates with every MSP. Organizations are eager to adopt AI, they just need to do it secur

Aug 3, 2026

MCP for MSPs: Cutting Through the Noise

Most MSPs are asking the same question in a different way: "Do I need to care about MCP, or is this just another acronym I can ignore for six months?" MCP Servers are becoming the connective tissue between AI agents and the tools you already run; your PSA, your RMM, your security stack. MSPs are using them to kick off assessments, run queries to determine continuous EDR deployment and many other critical tasks within the business. So today we're getting digging into this topic to help you make good decisions. Where are MSPs are actually finding value with MCP right now, and where the hype is r

Jul 27, 2026

When AI is the Hammer, is Everything a Nail?

Right now, every MSP is hearing the same sentence from clients: "We need AI." But when you start to ask questions like “what are you trying to accomplish,” there is no plan, no process, just a mandate. Our guest has heard it three times before. Ian Barkin built his career watching this exact cycle repeat, first in Business Process Outsourcing, then in Robotic Process Automation, and now in agentic AI. Same hammer, different decade. Companies are convinced the tool is the answer before they've asked what problem they're actually solving, or done the unglamorous work of documenting the process u

Jul 20, 2026

How MSPs Can Win Clients on LinkedIn: Turning Cyber Expertise into Pipeline

Today we're doing something different. No tradecraft, compliance or threat intel. Today is about the other thing that keeps MSP owners up at night: where the next client comes from. Here's the uncomfortable truth. Your buyers are on LinkedIn every single day and most MSPs are invisible there. Or worse than invisible: a profile that reads like a resume from 2014, three posts a year about patch Tuesday, and a network full of other MSPs and vendors. Everyone selling, nobody buying. Our guest today built his entire company on fixing exactly that. Dean Seddon is the founder and CEO of Maverrik, the

Jul 20, 2026

CMMC Phase II Paused: What Every MSP Needs to Know

It's Thursday, July 16th, and three days ago the Department of War suspended CMMC Phase II, effective immediately. The third-party certification requirement that was set to hit on November 10th is gone for now, a reform task force has 60 days to review the entire program, and officials would not rule out scrapping it altogether. Here's the thing: if you were paying attention, you saw this coming. Back in March, CIO Kirsten Davies sat in front of the House Armed Services cyber subcommittee and told lawmakers she was looking at CMMC through the lens of Secretary Hegseth's push to reduce regulato

Jul 14, 2026

Who’s Breach Is It – The Legal Grey Area of MSP Client Transitions

Here's a scenario that's playing out right now, for several MSPs across the country, and based on our research, most do not have it covered in writing. A client decides to switch providers. The new MSP starts rolling out EDR and standing up monitoring. The old MSP begins winding down. Somewhere in that overlap, credentials are still active, agents are only half deployed, and it isn't clear who's actually watching. Then the breach hits. Now two MSPs are pointing at each other, the client's data is exposed, and everyone reaches for the contract, only to find the transition period was not CLEARLY

Jul 6, 2026

Inside the Credential Spray Hitting Microsoft 365

This week we're digging into a Huntress report that came out on June 30th, updated just a couple days ago on July 2nd a large-scale password spray campaign that hit Microsoft 365 environments through Azure CLI. Between June 12th and June 26th, Huntress tracked more than 81 million login attempts, leading to at least 78 compromised accounts across 64 organizations. What makes this one worth a full conversation isn't just the volume it's that a lot of the businesses hit already had Conditional Access policies and MFA in place. The attackers got in anyway, by using a deprecated OAuth flow called

Jun 30, 2026

The Vulnpocalypse is here and your MSP can survive it

Today we have one of the most important voices in cybersecurity joining us. Chris Hughes started his career defending the nation in the United States Air Force. He's spent over two decades in the trenches from the Department of Defense to the federal government to the commercial world as a CISO, security architect, and engineer. Today he's VP of Security Strategy at Zenity, where his focus is on what he believes is the defining security challenge of our era: agentic AI. He's the author of multiple books published by Wiley, including Modern Vulnerability Management, and he runs Resilient Cyber,

Jun 22, 2026

The Vulnerability Crisis No One is Funding

Last week, I asked Philippe Langlois, principal author of the 2026 Verizon DBIR, a simple question: if an MSP could only focus on one thing this year, what should it be? His answer, without hesitation: "Vulnerability management." That tracks, as this is the first year in DBIR history that vulnerability exploitation has overtaken stolen credentials as the top breach entry point, jumping from 20% to 31%. Meanwhile, median time-to-patch climbed from 32 to 43 days, and only 26% of known exploited vulnerabilities got fully remediated. As most know, NIST just overhauled how the National Vulnerabilit