SN 1075: Yes. Exactly. - The Zero-Day Ticking Clock
Security Now episode 1075 discusses the growing threat of AI-powered vulnerability discovery, particularly Anthropic's Project Mythos, which Mozilla confirmed found 271 bugs in Firefox. The episode also covers a disgruntled researcher publishing Windows zero-days, Microsoft's record bug bounty payouts, and a formal industry-wide warning signed by top cybersecurity leaders urging immediate action.
Summary
The episode opens with Steve Gibson revisiting his coverage of Anthropic's Project Mythos, an AI system capable of autonomously discovering security vulnerabilities. Gibson's central thesis from the prior week — that Mythos represents a genuine, non-marketing threat shift — was validated when a who's who of cybersecurity professionals, including Bruce Schneier, former CISA director Jen Easterly, and Cloudflare's CISO, co-authored a 23-page paper titled 'The AI Vulnerability Storm: Building a Mythos-Ready Security Program.' Gibson titled the episode 'Yes, Exactly' to underscore that the industry's top experts independently reached the same conclusions he had.
A major news item involves a disgruntled security researcher using the moniker 'nightmare-eclipse' who began publicly releasing working zero-day exploit code for Windows vulnerabilities, including 'Red Sun' and 'Blue Hammer,' both local privilege escalation flaws in Microsoft Defender. The researcher claims Microsoft's Security Response Center (MSRC) mistreated him, ruined his business, and dismissed his disclosures. Within 24 hours of posting the proof-of-concept code to GitHub, threat actors were actively exploiting the vulnerabilities in the wild. All currently patched Windows systems remain vulnerable to at least one of these exploits, and the only known mitigation is disabling Windows Defender — the very component being abused.
On the flip side, Microsoft announced record bug bounty payouts: $2.3 million from this year's Zero Day Quest competition, with over 80 high-impact cloud and AI vulnerabilities found during a live hacking event. Gibson notes the irony of Microsoft 'gleefully bragging' about how many critical bugs researchers found when sufficiently motivated by cash prizes.
A separate story covers Microsoft's suspension of Windows Hardware Developer accounts, including those for WireGuard, VeraCrypt, and MemTest86, due to incomplete identity verification. Developers claimed they received no warning; Microsoft said they had been emailing for six months. Microsoft has since offered a fast-track reinstatement process, though full compliance requirements must still be met.
Gibson also covers a sophisticated adware campaign by a company called Dragon Boss Solutions, whose software aggressively disabled antivirus tools, blocked AV vendor domains via hosts file manipulation, and silently installed system-level payloads. Critically, the operator abandoned the update domain, which security firm Huntress re-registered — discovering it had command-and-control reach into 23,500 endpoints, including 221 academic institutions, 41 operational technology networks, 35 municipal governments, and multiple Fortune 500 companies. Gibson frames this as a systemic Internet design flaw: abandoned domains tied to auto-updating software create ready-made backdoors.
Mozilla's Firefox CTO confirmed that Mythos was used on Firefox and found 271 bugs — patched in version 150 — with at least 13 rated high severity. This is presented as definitive proof that Mythos is not marketing hype. The cybersecurity industry paper further cites data from zerodayclock.com showing that average time-to-exploit has collapsed from 2.3 years in 2018 to just 10 hours in 2026, driven largely by AI-assisted attack automation. The paper urges CISOs to immediately adopt LLM-based vulnerability discovery, prepare for simultaneous high-volume patch events, build tabletop exercises, and accept that human-speed defenses can no longer match machine-speed attacks.
The episode closes with reflections on the future of software development, with Gibson arguing that AI will eventually make software provably correct, comparing it to chess engines surpassing grandmasters. He also briefly discusses Project Hail Mary the film versus the book, a listener-inspired exploration of AI-assisted open source repository security, and personal steps he has already taken — including shutting down exposed SSH servers — in response to the Mythos threat.
About this episode
<p>Security leaders warn the era of AI-driven bug hunting has arrived, with Mythos uncovering hundreds of overlooked vulnerabilities in code bases as trusted as Firefox. Are defenders ready for the avalanche of exploits and the frantic race to patch?</p><ul> <li>A disgruntled developer discloses multiple Windows 0-days.</li> <li>Microsoft purchases its own bugs in massive campaign.</li> <li>VeraCrypt & Wireshark suddenly lost their dev accounts.</li> <li>A serious problem with re-captured domain names.</li> <li>How might AI help to secure open source repositories.</li> <li>A listener wonders what we thought of Project Hail Mary.</li> <li>Cyber security professionals tell us What Mythos Means</li></ul> <p>Show Notes - <a href="https://www.grc.com/sn/SN-1075-Notes.pdf">https://www.grc.com/sn/SN-1075-Notes.pdf</a></p> <p><strong>Hosts:</strong> <a href="https://twit.tv/people/steve-gibson">Steve Gibson</a> and <a href="https://twit.tv/people/leo-laporte">Leo Laporte</a></p> <p>Download or subscribe to <em>Security Now</em> at <a href="https://twit.tv/shows/security-now">https://twit.tv/shows/security-now</a>.</p> <p>You can submit a question to <em>Security Now</em> at the <a href="https://www.grc.com/feedback.htm" target="_blank">GRC Feedback Page</a>.</p> <p>For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: <a href="https://www.grc.com/securitynow.htm" target="_blank">grc.com</a>, also the home of the best disk maintenance and recovery utility ever written <a href="https://www.grc.com/sr/spinrite.htm" target="_blank">Spinrite 6</a>.</p> <p><strong>Join Club TWiT for Ad-Free Podcasts!</strong><br /> Support what you love and get ad-free audio <em>and</em> video feeds, a members-only Discord, and exclusive content. Join today: <a href="https://twit.tv/clubtwit" rel="payment">https://twit.tv/clubtwit</a></p> <p><strong>Sponsors:</strong><ul> <li><a href="http://canary.tools/twit" rel="sponsored" target="_blank">canary.tools/twit - use code: TWIT</a></li> <li><a href="http://joindeleteme.com/twit" rel="sponsored" target="_blank">joindeleteme.com/twit promo code TWIT</a></li> <li><a href="http://hoxhunt.com/securitynow" rel="sponsored" target="_blank">hoxhunt.com/securitynow</a></li> <li><a href="http://meter.com/securitynow" rel="sponsored" target="_blank">meter.com/securitynow</a></li> <li><a href="http://zscaler.com/security" rel="sponsored" target="_blank">zscaler.com/security</a></li> </ul></p>
Key Insights
- Gibson argues that the average time-to-exploit has collapsed from 2.3 years in 2018 to approximately 10 hours in 2026, driven by AI automation, meaning defenders now have almost no window between vulnerability disclosure and active exploitation.
- Mozilla's Firefox CTO confirmed that Anthropic's Mythos AI found 271 bugs in the current shipping version of Firefox — including at least 13 rated high severity — in software that had already undergone extensive human testing, which Gibson cites as definitive proof Mythos is not merely marketing.
- A researcher calling himself 'nightmare-eclipse' published working exploit code for Windows Defender privilege escalation flaws after claiming MSRC dismissed his disclosures and 'ruined his business'; within 24 hours of GitHub publication, threat actors were exploiting the vulnerabilities in real attacks.
- Gibson highlights that the Dragon Boss Solutions adware campaign illustrates a systemic Internet design flaw: when software publishers abandon their update domains, those domains become available for re-registration by anyone, creating ready-made command-and-control backdoors into every endpoint still running the software — in this case, systems inside hospitals, municipal governments, and Fortune 500 companies.
- The Cloud Security Alliance paper, co-signed by Jen Easterly, Bruce Schneier, and Cloudflare's CISO among others, argues that the asymmetry created by AI is structural — AI lowers the cost and skill floor for attackers faster than organizations can patch — and that organizations which wait for visible damage before responding will find it too late to act.
Topics
Transcript
It's time for security now. Steve Gibson is here. He's got some more thoughts on Project Mythos, the new super smart AI that can find security flaws. He's saying, you know what, this isn't hype. And he's got some real evidence behind it. We'll talk about Microsoft buying its own bugs back and ignoring other ones. And what do Steve think of Project Hail Mary? Yeah, even that. Coming up next on Security Now. Podcasts you love. From people you trust. This is Twit. This is Security Now with Steve Gibson. Episode 1075, recorded Tuesday, April 21st, 2026. Yes, exactly. It's time for security now. Yay. Tuesday has come. You've been waiting all week long to hear from this guy.…
Full transcript available for MurmurCast members
Sign Up to AccessMore from Security Now (Audio)
SN 1086: The Apex Agentic Adversary - Visual Prompt Injection Strikes
Security Now episode 1086 covers Fable 5's degraded performance due to strict safety guardrails, Chrome 150's massive 433 security fixes, visual prompt injection attacks (Inkjet), and severe FATFS library vulnerabilities affecting millions of embedded devices. The episode explores how AI is transforming both offensive and defensive cybersecurity capabilities.
SN 1085: A SOTA State-Sponsored Campaign - AI's New Superpower: Loop Engineering
Security Now Episode 1085 covers Windows 10 receiving another year of extended support, Meta's employee surveillance program backfiring with exposed data, state-sponsored credential attacks on Fortinet devices affecting 86,000+ organizations globally, and AI's emerging capability to discover vulnerabilities at scale through iteration and looping techniques.
SN 1081: AI Captured the Flag - Personal AI: Productivity Superpower or Privacy Threat?
The podcast discusses the significant impact of AI on cybersecurity practices and Capture the Flag (CTF) competitions, noting a shift in the ability to solve challenges using AI tools. This transition raises concerns about the future of skill measurement in the cybersecurity field, as traditional CTF competitions are being undermined by AI's capabilities.
SN 1076: FAST16.SYS - Unmasking the NSA's Most Diabolical Digital Sabotage
Security Now episode 1076 covers the discovery of FAST16.SYS, a sophisticated NSA-linked kernel rootkit from 2005 that subtly corrupted physics and engineering calculation software — predating Stuxnet by five years. The episode also covers a Bitwarden CLI supply chain attack, Iranian router malfunctions before the US/Israeli strikes, Meta's employee activity logging for AI training, and Steve Gibson's GRC e-commerce system rewrite.
SN 1074: What Mythos Means - Marketing or Mayhem
Security expert Steve Gibson analyzes Anthropic's new Mythos AI model, which demonstrates superhuman capability in discovering software vulnerabilities. While Anthropic claims the model is too dangerous to release publicly, Gibson examines the evidence and concludes this represents a watershed moment for cybersecurity that exposes widespread flaws in existing software.