Daily Briefing for 03.11.26

Top stories.

• US Senate confirms Gen. Joshua Rudd as head of NSA and Cyber Command.
• Patch Tuesday notes.
• State and local governments are urged to prepare for potential cyber fallout from the Iran conflict.
• Business news: Armadin launches with $190 million in funding.

US Senate confirms Gen. Joshua Rudd as head of NSA and Cyber Command.

The US Senate has confirmed Gen. Joshua Rudd as head of US Cyber Command and the National Security Agency (NSA), POLITICO reports. Lt. Gen. William Hartman has been serving as acting head of Cyber Command and NSA since April 2025, and plans to retire when Rudd is sworn in. Rudd has been in the US military for decades, most recently serving as deputy director of US Indo-Pacific Command. Rudd told lawmakers he will continue evaluating the long-debated dual-hat structure and defended Section 702 of the Foreign Intelligence Surveillance Act, which is set to expire in April.

The Senate voted 71-29 to approve Rudd, with some Democrats objecting to his limited cybersecurity background. The confirmation drew criticism from Senator Ron Wyden (Democrat of Oregon) in particular, who noted that Rudd has not previously held any cybersecurity leadership roles. Wyden also expressed concerns that Rudd has an insufficient understanding of NSA surveillance authorities.

Patch Tuesday notes.

Microsoft yesterday issued fixes for 83 vulnerabilities, including two publicly disclosed zero-days, though none of the flaws have been observed being exploited in the wild, Dark Reading reports. The zero-days are CVE-2026-26127, a denial-of-service flaw in .NET, and CVE-2026-21262, a privilege escalation vulnerability in SQL Server. Tenable researcher Satnam Narang notes, "These bugs are more bark than bite. The DoS vulnerability is assessed as unlikely to be exploited and requires an attacker to be authorized beforehand, while the privilege escalation bug was deemed less likely to be exploited."

Fortinet, Ivanti, and Intel have issued dozens of fixes across their products, SecurityWeek reports. Fortinet patched several flaws in FortiWeb, FortiSwitchAXFixed, and FortiManager that could be exploited by remote, unauthenticated attackers to run arbitrary code. Ivanti addressed a high-severity privilege-escalation flaw in Desktop and Server Management (DSM). Intel has rolled out fixes for nine flaws in the UEFI for some Intel reference platforms.

SecurityWeek also has a summary of patches issued by ICS vendors, including Siemens, Schneider Electric, Mitsubishi Electric, and Moxa.

State and local governments are urged to prepare for potential cyber fallout from the Iran conflict.

An intelligence group has warned that all levels of the US government, including state and local officials, should be prepared for "low-level cyber activity" following the outbreak of war between the US and Iran, StateScoop reports. The Center for Internet Security’s Multi-State Information Sharing and Analysis Center (MS-ISAC) said in an online briefing last week that Pro-Iranian hacktivist and proxy groups are beginning to form a "collective," which may enhance their capabilities. These groups frequently conduct disruptive activities such as DDoS and website defacements. Government entities are urged to implement security best practices to defend against these attacks.

Business news: Armadin launches with $190 million in funding.

San Francisco-based Armadin, an AI-powered red teaming startup founded by Kevin Mandia, has officially launched with $190 million in seed and Series A funding led by Accel, with participation from Google Ventures, Kleiner Perkins, Menlo Ventures, In-Q-Tel, and follow-on investment from 8VC and Ballistic Ventures, SecurityWeek reports. The Wall Street Journal reported in December that Armadin had secured $24 million in seed funding amid talks of a much larger round.

Mandia will serve as the company's CEO, with co-founders Travis Lanham as CTO, Evan Peña as Chief Offensive Security Officer, and David Slater as Chief Architect.

Read more in the Business Briefing at 4pm ET.