How to lose friends and DDoS people

February 26, 2026·49 min·3 clips

Archive.today threatened a Finnish blogger with a new AI porn category and a gay dating app built in his name.

The opening is baffled. Graham and Paul start with the awkward claim that the internet has somehow found a new category of AI porn, then use their own disbelief as the warm-up. Episode 456 settles in fast. After the sponsor roll call for ThreatLocker, CoreView and Vanta, the show moves into Microsoft 365 risk with its usual chatty push. The CoreView segment sounds properly uneasy. An attacker inside a tenant is not imagined as loud chaos. It is someone quietly weakening conditional access, defender policies and admin roles. That silence is the ugly part. The practical horror is simple: backups may save files, but they do not bring back the whole tenant configuration by magic. Then Duck takes over. His story turns to ESXi ransomware, aimed less at stray laptops than at the VMware servers holding up business systems. The point is deep disruption. CRM systems, payment systems, websites and blogs all become pressure points because the crooks want the business boxed in. Then comes the ridiculous mercy. The Nitrogen malware apparently carried not one but two memory mismanagement bugs, exactly the kind of detail that makes Paul say he should not laugh. The joke still has teeth. Buggy ransomware is still ransomware when it is built to scramble the core machines a company depends on. Graham keeps the mood conversational. The sponsor material sits inside the flow, with a URL, a white paper and grim tenant scenarios mixed in with the usual banter. The ending eases off. Patrons get thanked by name, a Jonathan Haddock joke swims past, and Graham closes with the familiar request to like, subscribe and spread the word. Security storytelling, eyebrows raised.

As heard by us

A dry, practical security episode built around ESXi ransomware, business disruption, and malware that may stumble over its own bad code.

Smashing Security leans into its usual mix of gallows humor and practical security talk, with Graham Cluley and Paul Ducklin steering from jokes about AI porn into the kind of operational risk that keeps IT teams awake.

Read the full review in PlayNext →

Why you'd press play

Ransomware that accidentally breaks itself, and a cloud takeover scenario scarier than it has any right to be.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Smashing Security