Light

Episode #1097 Quiz

Mega Patch Tuesday Fallout
Date: 2026-09-22 | Length: 2.75 hrs | Episode page at twit.tv

About this episode

Patch Tuesday fixes reduced exploitable vulnerabilities, but introduced severe regressions: Remote Desktop hangs, domain authentication failures from enforced Machine Identity Isolation, Excel copy/paste breakage, USB audio loss, WinRE resize boot failures, Secure Boot code-integrity loops, VDI Explorer crashes, VPN failures, and update rollbacks. Mitigations included rollback policies, out-of-band patches, registry changes, repairs, and manual reinstallation.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific flaw in the European Commission’s open-source age verification app made the PIN mechanism ineffective against credential reuse?

Question 1

According to the episode, what specific flaw in the European Commission’s open-source age verification app made the PIN mechanism ineffective against credential reuse?

The PIN was derived from the device’s biometric template and could be guessed offline The PIN was sent to the issuer each time and rejected only after a remote rate limit expired The PIN was not cryptographically tied to the credential store The PIN was stored only in the browser cache and could be restored from a replayed token

Question 2: In the OpenAI forum compromise described in the episode, what was the practical role of the HEIC/HEIF image bug in libheif?

Question 2

In the OpenAI forum compromise described in the episode, what was the practical role of the HEIC/HEIF image bug in libheif?

It enabled memory corruption that could be combined into code execution on the forum server It only caused a denial of service with no security relevance beyond availability It forced the forum to disable single sign-on for all employees It directly exposed OpenAI staff passwords in the image metadata stream

Question 3: What was the key reason the researchers were able to turn a break-in on OpenAI’s public forum into access to employee accounts elsewhere?

Question 3

What was the key reason the researchers were able to turn a break-in on OpenAI’s public forum into access to employee accounts elsewhere?

The forum shared the same sign-on as OpenAI’s internal staff systems The forum bypassed OpenAI authentication by exposing a hardcoded API key The forum account database was synced to the employee HR directory in real time The forum had a separate admin portal that mirrored employee passwords nightly

Question 4: What does the episode identify as the real bottleneck to an AI-created bioweapon, according to David Bellamy’s argument?

Question 4

What does the episode identify as the real bottleneck to an AI-created bioweapon, according to David Bellamy’s argument?

Physical synthesis, equipment, and iteration in the lab The absence of public literature describing viral proteins The model’s inability to generate any plausible viral genome sequence The inability to train enough agents to run the required computation in parallel

Question 5: Which Microsoft Patch Tuesday issue was tied to Machine Identity Isolation being flipped into enforcement mode on domains that were not ready for it?

Question 5

Which Microsoft Patch Tuesday issue was tied to Machine Identity Isolation being flipped into enforcement mode on domains that were not ready for it?

Excel copy and paste silently failing after KB5002914 RDP sessions hanging after several hours on patched servers USB Audio Class 1.0 devices stopping with Code 10 errors Domain authentication failures for Windows 11 users

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.