Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Bryan Lachapelle - https://www.b4networks.ca/
Joshua Holloway - https://7thdi.com/
Barinder Hans - https://www.redrhinonetworks.com/

Seventy percent of websites run on WordPress, and a massive PHP vulnerability just exposed huge swaths of the internet. Attackers armed with agentic AI are exploiting it in hours, not days.

Recorded live from a vendor conference in Franklin, Tennessee (the first episode ever recorded with beers in hand and one shared microphone), Justin Shelley, Bryan Lachapelle, Mario Zaki, and Josh Holloway break down the wildest stretch of security news in years. The PHP compromise reaches far beyond websites: one technician patched fifteen phone servers overnight, vulnerability scanners flagged switches, and Steam reportedly went dark temporarily over the same issue. Microsoft is now seeing Chinese agents using agentic AI to attack companies at scale, which means the old patching timeline is gone for good.

Then the conversation turns to where AI itself is headed. Justin holds to his prediction that the underlying development of large language models will plateau, and the group stress-tests it: hardware limits, models feeding on AI-generated content, and the wildcard of recursive self-improvement. Meanwhile, a prediction from the conference floor says SaaS itself is dying, because businesses can now build exactly what they need with AI. Linux hardware compatibility jumped from 90 percent to basically 100 percent because AI can write missing drivers in minutes. But deconstructed software means the LimeWire era is back, and reportedly ten percent of AI skill sets are already infested with malware.

The big takeaway for business owners: IT is shifting from "protect, protect, protect" to actually making you money. Plus the cyber insurance trap nobody reads until it's too late, and how the City of Hamilton got millions in claims denied over partial MFA.

What you'll learn:

• Why the PHP vulnerability hits far more than websites: phone servers, POS systems, and network switches, and why the patching window collapsed from days to hours
• The three forces that could plateau AI models: hardware limits, running out of human content to ingest, and the recursive self-improvement wildcard
• Why businesses may soon skip bloated SaaS platforms with ten thousand settings and build custom tools with AI instead, and what that does to software pricing
• How the deconstructed-software era mirrors LimeWire and Napster, and why trusted, certified code becomes the new selling point
• The cyber insurance trap that cost the City of Hamilton millions, and why checking the MFA box in one place but not another means a denied claim

New episodes every week on the hacks, the hype, and the hands-on fixes that matter to business owners. Subscribe so the next surprise vulnerability doesn't surprise you.

Phoenix IT Advisors helps small and mid-sized businesses turn technology from a cost center into a profit driver. If you want security that actually holds and an AI plan that fits your business, visit PhoenixITAdvisors.com and schedule a consult.

🎧 Full episode:
https://unhackmybusiness.com/episode/109

🌐 Phoenix IT Advisors:
https://PhoenixITAdvisors.com

📱 Follow @UnHackedPodcast

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Joshua Holloway - https://7thdi.com/

A viral AI "skill" promising Apple's design secrets came loaded with keyloggers, prompt capture, and an API rug pull. Josh found it before it found him. Most people won't.

In this episode of UnHacked, Justin Shelley, Mario Zaki, and Joshua Holloway go free-form on the week in AI, and the week was wild. A new open-source tool can reverse engineer nearly any software product, and Adobe's entire suite was replicated within days. Lawsuits are coming, but nobody knows the legal ground rules yet. Meanwhile, Josh walks through a real-world discovery: a popular AI skill shared to hundreds of thousands of followers contained embedded keyloggers, captured every prompt, and was built to pull API keys and ship them off. His team now runs every skill through NVIDIA's Skill Spectre sandbox before it touches a production system, and he explains how you can too.

The guys also dig into the bigger picture: whether MSPs and IT pros will actually lose jobs to AI (Justin's answer is no, and he puts it on record), why the mass migration to vibe-coded custom software is about to make security and integration work explode, and the Blockbuster-style vendors who are about to wither on the vine because they refused to adapt. Plus Justin's closing prediction: AI development itself is about to plateau, faster than anyone expects.

What you'll learn:

• How malicious AI skills hide keyloggers, prompt capture, and API key theft inside plain-text instructions, and how to sandbox-test them before installing
• Why the new reverse-engineering tools threaten software giants like Adobe and Microsoft, and what the coming legal battles over IP could mean for your business
• Why Justin believes AI won't eliminate MSP and IT jobs, and the parallel he draws to the cloud migration panic
• How vibe-coded custom apps with zero security (like the wide-open database Justin found) are becoming the next attack surface
• Why human relationships and customer service are the real differentiators as AI commoditizes the work itself

New episodes every week breaking down the cybersecurity and AI threats facing your business, in plain English. Subscribe so you don't miss the next one.

If this episode raised questions about your own business's security posture, Phoenix IT Advisors helps small and mid-sized businesses get unhacked before it's too late. Visit PhoenixITAdvisors.com to schedule a consult.

Watch the full episode:
https://unhackmybusiness.com/episode/108
PhoenixITAdvisors.com
@UnHackedPodcast

Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Bryan Lachapelle - https://www.b4networks.ca/
Joshua Holloway - https://7thdi.com/

Should you host your own AI so sensitive client data never leaves your building? Five security pros weigh cost, risk, and trust.

Justin Shelley admits up front that he is coming in with more questions than answers. He is fed up with vendors and wants to bring AI in-house. So he asks a panel of IT and security people whether open weight AI models are the way out. Nobody agrees, and the disagreements are where the useful parts are.

The group starts with the plain-English difference between open weight and open source models. Then they get practical. Mario Zaki describes the in-house server his team trained on its own PSA data, and why he turned down a roughly $35,000 seven-GPU build. Joshua Holloway explains why a Chinese-trained model is a compliance problem for anyone handling CUI. He also tells the story of a model that switched from English to Mandarin mid-conversation. Craig Taylor lays out why regulated data (healthcare, financial, student, defense contract) is the strongest case for private hosting. He also explains why he doesn't trust "we don't train on your data" promises from public AI vendors.

It ends on two things you can act on this week. Craig describes a law firm breach that exposed 25 years of client data, and what it would have taken to avoid it. Justin tells how something he typed into a vendor's AI chat showed up, redacted, in that vendor's social media marketing.

ABOUT THE GUEST
Craig Taylor is CEO and co-founder of CyberHoot, a security awareness training company. He has a psychology degree and built CyberHoot around rewarding good cyber behavior instead of punishing mistakes. He also runs AI Policy Scan, a tool he built to score the privacy policies of AI vendors, and he works with virtual CISO clients.

WHAT YOU'LL LEARN

• The difference between open weight and open source AI models, in plain English, and why neither is a magic privacy fix.
• What it really costs to bring AI in-house: a Tesla GPU at roughly $700, a $35,000 seven-GPU quote, about $6,000 in RAM for a small server build, and a six-month wait on one server order.
• Why Chinese-trained models are a compliance risk for CUI and CMMC, and where the group disagreed about whether hosting one locally makes it safe.
• Why Craig says public vs. private vs. hybrid AI hosting is the same debate as web hosting in the 2000s, and how a tabletop exercise firm moved to a private setup.
• The data-hygiene move that could have limited a 25-year client data breach: archive old records off your network.
• How to check what an AI notetaker or assistant does with your conversations before it joins your next meeting. Craig scored one vendor's privacy policy 3.8 out of 10.

SUBSCRIBE
New episodes every week that explain AI, cybersecurity, and digital risk in plain language for business owners. Subscribe so you don't miss the next one.

NEED HELP WITH THIS IN YOUR OWN BUSINESS?
If this episode left you wondering what your team is already pasting into public AI tools, you're not alone. Phoenix IT Advisors helps small and mid-sized businesses with IT support, cybersecurity, and technology strategy. Visit PhoenixITAdvisors.com and schedule a consult.

LINKS
Full episode: https://unhackmybusiness.com/episode/107
Phoenix IT Advisors: https://PhoenixITAdvisors.com
Craig Taylor's AI Policy Scan: app.aipolicyscan.com