CyberWire Daily

On this special edition podcast, Dave Bittner is joined by John Kindervag and Dr Chase Cunningham to discuss the principles of zero trust, cyber resilience, and how AI is transforming cybersecurity strategies. They explore practical frameworks, misconceptions, and the future of security in a machine-speed world. John is the author of "Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era ," and Chase is one of the book's contributors. Learn more about your ad choices. Visit megaphone.fm/adchoices

Dan Lisichkin, AI Security Researcher from Pillar Security, discussing their work on "A WIF Of Fresh Access, How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise." Researchers at Pillar Security uncovered a vulnerability in Google’s Gemini CLI workflows that could allow an attacker to turn a malicious GitHub issue into remote code execution and gain elevated access to a Google Cloud Platform (GCP) project. The exploit chain combined a misconfigured tool allowlist that allowed unrestricted command execution with exposed Workload Identity Federation credentials and overly broad service account permissions, potentially enabling attackers to impersonate privileged accounts. Google promptly addressed the issues by tightening tool restrictions, blocking the agent’s access to credential files, and limiting service account impersonation permissions, highlighting the risks of connecting AI agents to untrusted input and sensitive infrastructure. The research and executive brief can be found here: ⁠A WIF Of Fresh Access: How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise Learn more about your ad choices. Visit megaphone.fm/adchoices

An OpenAI engineer faces charges over an alleged covert recording device. Attackers exploit a PAN-OS firewall flaw and an Ivanti zero-day. Aoki infostealer hunts AI credentials. Researchers uncover critical weaknesses in an AI gateway. CikaBika Bot turns Discord into a command center. Online ads deliver mercenary spyware without a click. Microsoft disrupts a massive Chinese-language phishing operation. And INTERPOL leads an international crackdown on child sexual abuse material. Character.ai runs out of tokens.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today, we are featuring Kieran Human, Lead Cybersecurity Engineer at ThreatLocker, who guested on Hacking Humans with Maria Varmazis and Joe Carrigan this week. Tune in to listen to their full conversation here and join the crew including Dave Bittner every Thursday on your favorite podcast app. Selected Reading Office of Public Affairs | Saudi National Arrested for Installing Surreptitious Audio Recording Device at OpenAI (US Department of Justice) Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix (CSO Online) CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials (Cyber Security News) New Aoki Infostealer Targets AI Coding Assistant Credentials (Infosecurity Magazine) Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool (Infosecurity Magazine) CikaBika Bot RAT Uses Discord for C&C (SecurityWeek) AdFection: How mercenary spyware invades victims’ devices through targeted advertising (CyberScoop) Police arrests 95 suspects in international CSAM crackdown action (Bleeping Computer) Character.ai Bankruptcy Is First AI Bubble Domino to Fall (404 Media) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

French supermarkets lose their cool in a refrigeration cyberattack. Anthropic pulls the plug on AI agents behaving badly. A Canadian ransomware negotiator is arrested in the FBI’s ShinyHunters investigation. XWorm expands its surveillance capabilities. A Dutch grocery giant suffers a cyberattack. Leaked files reveal Luna Moth’s playbook. Monday business brief. Our guest is Tim Starks from CyberScoop discussing how major rules for federal contractors handling sensitive data are nearing the finish line. Six digits sink Danish security. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Tim Starks from CyberScoop discussing how major rules for federal contractors handling sensitive data are nearing the finish line. Selected Reading Ukraine strikes third Yandex data center, disrupting digital services across Russia (The Record) Cyberattack Hits Hundreds of Supermarket Refrigeration Systems in France (The New York Times) DoD confirms ‘refrigeration disruption’ at military commissaries (MilitaryTimes) Anthropic takes risky AI tests offline after models breach govt sites (Bleeping Computer) Shock and surprise after FBI arrests Canadian cybersecurity expert in ShinyHunters hacking case (CBC News) XWorm RAT Evolves Into Surveillance Platform (SecurityWeek) Cyberattack Prompts Ahold Delhaize to Disconnect Systems (SecurityWeek) Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings (Infosecurity Magazine) Armadin has raised $255.5 million in a Series B round led by Andreessen Horowitz and Accel (N2K Pro Business Briefing) '123456' password linked to Denmark data breach affecting 8.8M people (The Register) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Since taking office, the Trump administration has signed a series of Executive Orders that aims to boost the US's space presence. Host Maria Varmazis sits down with Producer Ethan Cook to dive into two recent Executive Orders signed by President Trump. These two orders look to significantly grow the US's space capabilities removing regulatory hurdles, encouraging innovation, and growing commercial investments. Key Sources: ENSURING AMERICAN SPACE SUPERIORITY. ENABLING COMPETITION IN THE COMMERCIAL SPACE INDUSTRY Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠[email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. Learn more about your ad choices. Visit megaphone.fm/adchoices

An international coalition disrupts Chinese state-backed hacking operations. Officials dismantle cybercrime centers in Ghana. Anthropic launches initiatives aimed at quicker remediation. A maximum-severity SonicWall vulnerability is under active exploitation. The Cybersecurity Information Sharing Act remains in legislative limbo. Ransomware spikes. Attackers exploiting unpatched vulnerabilities in AhsayCBS backup software. Midnight Mimosa targets cheap Android device firmware. Prosecutors saddle a money mule. Maria Varmazis joins Dave to continue our CyberWire’s 10th anniversary celebration with a conversation about public-private partnerships. Open AI does the math.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Maria Varmazis⁠ and ⁠Dave Bittner⁠ continue the CyberWire Daily’s 10th anniversary celebration with a conversation about public-private partnerships and law enforcement operations over the last decade. Selected Reading International coalition seizes tools used by cyber firm behind Flax Typhoon (The Record) FBI announces over 130 arrests in Ghana during Operation Blackout targeting overseas cyber scam compounds (Digital Watch Observatory) Ghana Rejects FBI-Led Claims Over Operation Blackout Cybercrime Raids (TechAfrica News) Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security (SecurityWeek) Max severity SonicWall SMA1000 flaw now exploited in attacks (Bleeping Computer) Cyber information-sharing law stuck in Senate stalemate (Roll Call) Q3 2026 Sets New Record for Ransomware Attacks (Infosecurity Magazine) Unpatched AhsayCBS Vulnerabilities Exploited in the Wild (SecurityWeek) Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries (SecurityWeek) Man admits to running network of 15,000 money mules for cybercriminals (Bleeping Computer) ‘Breathtaking,’ ‘Devastating’: Mathematics Reels After New OpenAI Release (The New York Times) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our ⁠brief listener survey⁠. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at ⁠sponsor.thecyberwire.com⁠. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

SonicWall issues emergency patches. European wind and solar sites are exposed online. South Korea warns of AI-powered attacks on banks. Maria Varmazis unpacks the EU’s new Space Threat Response Architecture. Google patches dozens of high-severity Chrome flaws. Researchers uncover an SSRF vulnerability in Harbor. AI reshapes vulnerability management. Wikimedia says OpenAI agents repeatedly broke its rules. Pwn2Own kicks off in Ireland. Our guest is Derek Holt, CEO of Digital.ai, who says AI has killed the cybersecurity response window. VIN there, done that. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.CyberWire Guest Today we are joined by Derek Holt, CEO of Digital.ai, sharing his views on how AI has killed the cybersecurity response window.  Selected Reading SonicWall warns of max severity SSRF flaw in SMA1000 gateways (Bleeping Computer) Thousands of European wind and solar power systems exposed online, Dutch researchers say (Reuters) South Korea's Lee says AI appears to have been used in bank hacks (Reuters) The new EU Space Threat Response Architecture explained (EEAS) Chrome 155 Update Patches 247 Vulnerabilities (SecurityWeek) SSRF in Harbor Webhooks: Any User Can Reach the Server’s Cloud Credentials (OX Security) AI is turning offensive security into a continuous necessity (CSO Online) Wikimedia Foundation: OpenAI agents tried to edit pages and compromise notes tool (The Record) Ethical hackers have already found 32 zero days in various products at Pwn2Own Ireland (Infosecurity Magazine) Connected Cars Talk to Google and Ad Trackers While Seven Car Apps Hand Over the Owner's VIN (HackingPassion.com) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

The President launches a new federal AI task force. South Korea investigates financial sector data leaks. AI slop overwhelms a Google bug bounty program. Citrix patches an exploited zero-day. Stealthy malware hides inside Asian email security appliances. Apple tightens macOS privacy around AI agents. Attackers exploit a critical Rejetto File Server flaw. The Senate advances healthcare cybersecurity legislation. Monday business briefing. Our guest is Jared Shepard, CEO of Hypori, with insights on how the military is adopting AI technologies. A real good password…isnt’. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Jared Shepard, CEO of Hypori, sharing how he sees the military and DoW adopting AI technologies. Selected Reading Trump names national intelligence director Jay Clayton to lead a new federal AI task force (AP News) South Korean president orders probe into data leaks across financial industry (Reuters) Google freezes open-source bug bounty program amid flood of invalid AI slop submissions — product flaw submissions halted until 2027 as maintainers drown in hallucinations (Tom's Hardware) Citrix patches NetScaler SAML zero-day exploited in attacks (Bleeping Computer) New Linux malware mimics network edge appliances to evade detection (SC Media) Apple changes full-disk access permissions to curb abuse from AI agents (Ars Technica) Exploitation Hits Rejetto HFS Vulnerability Discovered by AI (SecurityWeek) Senate Passes Bipartisan Bill to Strengthen Healthcare Cybersecurity (SecurityWeek) Island raises $400 million in a Series F round. (N2K Pro Business Briefing) CISO thought he had a 'r3@lg00dp@$$w0rd' but forgot to patch (The Register) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Today we are joined by Jean-Pierre Mouton, Senior Threat Intelligence Consultant at GuidePoint Security, discussing their work on "How Play Achieves Encryption." Play ransomware, also known as PlayCrypt, continues to target organizations across multiple sectors using a consistent double-extortion playbook that combines data theft with widespread encryption. A recent investigation details how the group gained access through a SonicWall VPN, moved laterally using tools such as Mimikatz and PsExec, exfiltrated sensitive data, and used the victim’s own SentinelOne uninstallation utility to disable endpoint protection. The findings highlight several behavioral indicators defenders can monitor, including tool staging through SYSVOL and SystemBC for command and control, event log clearing, and suspicious WinSCP activity. The research and executive brief can be found here: ⁠⁠⁠⁠How Play Achieves Encryption Learn more about your ad choices. Visit megaphone.fm/adchoices

A Pentagon breach exposes data on millions. ShinyHunters goes dark. MI5 warns universities about Chinese espionage. AI agents find creative ways around their guardrails. A fake Zoom installer delivers macOS malware. Cisco patches an actively exploited SD-WAN flaw. OpenAI disrupts a “distillation attack.” Cyber Command confronts operator burnout. Treasury targets alleged ATM jackpotters. Our guest is Etay Maor, Vice President of Threat Intelligence at Cato Networks, with a reminder that your network isn't a recycling bin. Prophecy as a service. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Etay Maor, Vice President of Threat Intelligence at Cato Networks, sharing his views on how your network isn't a recycling bin. Selected Reading Hackers stole millions of US military personnel records during months-long data breach (TechCrunch) ShinyHunters website goes offline after FBI deadline expires (Reuters) MI5 Warns Over 100 Academics Helped China's Espionage Plans (Infosecurity Magazine) Rogue Agents Investigation (Asymmetric Security) CloudSyncD: macOS backdoor hidden in a fake Zoom installer (Jamf) Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability (SecurityWeek) Irony alert: OpenAI whines that Chinese model stole its special IP that it stole from everybody else (The Register) After reports on suicide deaths, Pentagon puts Cyber Command on notice (The Record) Treasury Blacklists Most-Wanted ATM Malware Developer and His Network (SecurityWeek) Chatbots as oracles: How AI is giving new life to the ancient practice of seeking answers from inscrutable sources (The Conversation) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

OpenAI holds back its newest model over safety concerns. Kiteworks lifts its precautionary shutdown. Apple patches an exploited zero-day. Japanese rail operators disclose cyberattacks. An Anthropic authentication flaw opens the door to account takeover. Thousands of Supabase databases leak data. NeedyMantis targets telecoms and governments. A Vietnamese national faces charges in a multimillion-dollar crypto laundering scheme. James Winebrenner, CEO of Elisity, is sharing barriers to compliance and challenges for manufacturers as the EU Cyber Resilience Act is implemented. If you’re hoping for credit, be careful what you share. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest James Winebrenner, CEO of Elisity, is sharing barriers to compliance and challenges for manufacturers as the EU Cyber Resilience Act (EU CRA) is implemented. Selected Reading OpenAI Says It Will Not Release Newest Astra A.I. Model Over Safety Concerns (The New York Times) Florida asks for order to halt ChatGPT development (Axios) Kiteworks Urges Customers to Restart Systems After Shutdown Notice (Infosecurity Magazine) Apple patches CoreGraphics zero-day flaw exploited in attacks (Bleeping Computer) Japanese Railway Operators Hit with Weekend Cyber Attacks (Infosecurity Magazine) Cycode Uncovers Account Takeover in Anthropic's MCP Python SDK (Cycode) Everything Everywhere: Systemic Data Exposure in Supabase Apps (UpGuard) Daemon Tools Hackers' NeedyMantis Malware Dissected by Microsoft (SecurityWeek) Vietnamese man charged in $16 million 'pig butchering' crypto scam (Bleeping Computer) Did Anthropic’s A.I. Really Make a Scientific Discovery on Its Own? (The New York Times) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Though spacecraft are important, space cybersecurity extends well beyond these assets touching ground stations, mission-control assets, and other critical components. Host Maria Varmazis speaks with Milenk Starcevic, cybersecurity lead at Vision Space, and Andrzej “Andy” Olchawa, a space-focused offensive security professional, about the broader space cybersecurity attack surface. By considering all aspects of a space mission, both in orbit and on the ground, cybersecurity professionals can better understand where vulnerabilities exist and what measures can be taken to reduce risk. Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠⁠ Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠[email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠⁠ T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠. Learn more about your ad choices. Visit megaphone.fm/adchoices

Today we are joined by Ensar Seker, VP of Research and CISO at SOCRadar, discussing their work on "Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain." An investigation into AnonyMousKIT reveals an AI-powered Phishing-as-a-Service platform designed to steal Apple credentials and disable Activation Lock on stolen devices. The platform uses email, SMS, WhatsApp, and AI-driven voice calls to impersonate Apple Support, with researchers uncovering a broader ecosystem spanning 506 domains, 168 storefront brands, and 30 backend installations. Despite its sophisticated social-engineering capabilities, basic coding flaws exposed extensive operational logs and revealed the shared infrastructure, developer activity, and reseller network behind the criminal operation. The research and executive brief can be found here: ⁠Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain Learn more about your ad choices. Visit megaphone.fm/adchoices