CyberWire Daily

A leak in the chain of command.

DHS suffers a massive data leak. Researchers reveal Volt Typhoon’s sophisticated methods. Cisco patches a firewall zero-day. A suspected coordinated supply chain attack targets public GitHub repositories. Online scams overtake phishing. NIST shares post-quantum cryptography guidance. CISA warns a VMware ESXi vulnerability is under active exploitation. The Federal Election Commission takes systems offline. A Ukrainian national gets prison time for ransomware operations. Our guest is Yonald Chery, CTO from Technology Advancement Center (TAC), discussing securing operational technology in our critical infrastructure. Bitcoin mining gets you in hot water.

Transcript

A matter of national secrecy.

Senators accuse the White House of illegally withholding a secret surveillance court ruling. A suspected surveillance operation targets Starlink users. Attackers probe vulnerable Oracle E-Business Suite systems. The FBI shuts down a bulletproof hosting provider. Tailworm targets Tailscale. Ohio’s Auditor of State investigates a cyberattack. A suspected ransomware attack disrupts Israel’s largest vehicle importer. Norway raises their cyber risk level to high. Our guest is Amy Blackshaw, Senior Vice President of Product Marketing for Identity at Palo Alto Networks, discussing AI exploits and identity containment. AI science needs a spam filter.

Transcript

The strategy behind the shield.

CISA unveils its 2030 cyber strategy. PHP2Shell exploits are in the wild. HHS preserves healthcare security requirements. Microsoft offers buyouts amid its AI spending spree. A cyberattack disrupts New Mexico hospitals. Google’s Finnish data center plans hit an environmental roadblock. Blue Initiative tracks maritime vulnerabilities. A Chinese national faces charges in a $37 million cryptocurrency scam. Our guest is Cal Al-Dhubaib, host of the new Authorized Intelligence podcast. Anthropic’s prospectus includes an existential disclaimer.

Transcript

The breach wasn't in the model.

A cybersecurity startup claims to have accessed sensitive internal documents at Anthropic. The Pentagon spins up covert technology programs. AI developers get a crash course in key management. A ransomware recovery executive faces federal fraud charges. Two men are accused of using AI generated phone calls to scam bank customers. Stadia RAT rises from the StealC ashes. Researchers extract sensitive information using USB power-management signals. Patching what matters…matters. Monday business briefing. Tim Starks from CyberScoop is discussing targeted ads as a security risk. Championship rings come with a catch.

Transcript

The apps are only the beginning.

Attackers target critical PHP flaws, and former CISA director Chris Krebs weighs in on AI’s role in the vulnerability surge. Railway confirms a cyberattack. HPE patches critical ArubaOS flaws. Quest Diagnostics investigates a disruptive intrusion. Capcom reports a data breach. China-linked hackers put AI-powered attacks on autopilot. And researchers uncover a Microsoft 365 campaign that hijacks authentication tokens to bypass MFA. Our guest is Anudeep Parhar, COO at Entrust, sharing his thoughts on AI kill switches. eMudra throws in the certificate towel.

Transcript