Jared's Technology Podcast Network · Jared Rimer

Sans News Bites episode 29: the newsletter for December 5, 2025

·1 hr 26 min·5 clips

Microsoft patched a Windows .lnk flaw after seven years of widespread exploitation.

Program 29 stays procedural. The host says he is reading from the SANS newsletter, leaving the newsletter material in place, and adding commentary where he has something useful to say, while also noting that he wanted to make the recording earlier in the day and that the blog is still behind. The rhythm is loose. He reminds listeners that the editors sit at the end of the newsletter and that the links are only in the RSS show notes right now, which keeps the show feeling like a work in progress. LastPass comes up early. He says the upcoming newsletter will more than likely cover the UK Proactive action against LastPass over the 2022 breach, though he has not finished the full blog writeup. Accountability is the thread. He says victims should not be blamed, but companies still need to be held responsible for weak security, and that duty reaches outsourced services and third-party organizations that share the burden when controls are missing. He gets careful with names. The newsletter uses the British spelling, he spells out M-A-R-Q-U-I-S, and he asks listeners to send a voicemail if they know the right pronunciation. Neely's comment lands well. The host likes the point that the mandated fixes are table stakes and agrees that people should start with their boundary and work inward, even though cloud services and outside vendors make that harder. The timeline matters. He says the investigation, report writing, and notification process took a couple of months and that the delay feels fair because the problem was complex and needed proper handling before the public saw it. He is frustrated that the company did not do the basic security work right the first time, especially keeping software and hardware up to date. Askell follows. The Japanese retailer is described as gradually recovering from an October ransomware attack, which the host folds into the broader theme of how messy recovery looks when preparation was weak. The wrap-up is practical. He thanks listeners, repeats the contact options, says older episodes have been deleted, and asks for feedback on whether the show should change format or add music behind each segment.

As heard by us

A blunt security bulletin that keeps accountability and practical controls in view.

Program 29 of SANS NewsBites keeps its focus on the parts that matter: the LastPass breach, who answers when a third party fails, and how much a company really knows about its own services and dependencies.

Read the full review in PlayNext →

Why you'd press play

Press play for a plainspoken walk through breaches, accountability, and what patching means in practice.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Jared's Technology Podcast Network