Meta gets a Meta-sized bill.

Meta settles. Australian police arrest two alleged TeamPCP members. The White House moves to shore up water utility cybersecurity. ATF reports a major cyber incident. The Navy tells sailors to lock down social media. The FBI warns of a prolific Chinese hacking operation. Bill Gates sounds the alarm on AI. A purported think tank tries to influence chatbot answers. And attackers focus less on individual vulnerabilities and more on the vendors behind them. Our guest is Tim Springston, Principal Product Manager at Semperis, on achieving hybrid identity resilience in the age of agentic AI. Meta pumps the brakes on going AI native.

Today is Thursday August 27th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

Meta settles. 

Meta has agreed to pay up to $18 billion over the next decade and impose new restrictions on teenage users of Facebook and Instagram, settling claims from nearly all U.S. states that its platforms were designed to addict children and harmed their mental health. The agreement limits teens to two hours of daily use and blocks access from midnight to 6 a.m. without parental consent. Meta will also restrict most push notifications during school hours and strengthen protections against age-restricted content.

The settlement includes about $12.7 billion in guaranteed payments, with another $5 billion contingent on Snapchat, TikTok and YouTube adopting similar safeguards. Meta also agreed to pay $459 million to resolve privacy claims stemming from the Cambridge Analytica scandal.

Meta denied wrongdoing. The settlement ends a federal trial but leaves thousands of other lawsuits pending, including claims from individuals, schools and governments alleging social media platforms contributed to a youth mental health crisis.

Australian police arrest two alleged members of TeamPCP. 

Australian Federal Police have arrested two Western Australian men, aged 21 and 23, accused of involvement with TeamPCP, a cybercrime group linked to an extensive campaign of software supply chain attacks and data extortion.

TeamPCP gained prominence in late 2025 by compromising open-source software packages and using the self-propagating Shai-Hulud worm to steal developer credentials and spread malicious code into additional projects. Its campaigns included a compromise of the LiteLLM AI gateway that researchers say exposed secrets from more than 2,500 organizations, as well as thousands of GitHub repositories.

KrebsOnSecurity identifies one arrested suspect as TeamPCP spokesperson Ruben Thomson, based on extensive open-source research linking his online aliases to his real identity. TeamPCP appears to operate less like a traditional criminal organization and more like a loose community of collaborating hackers.

The two defendants face a combined 14 cybercrime offenses. Researchers say TeamPCP’s attacks also helped push GitHub and other software ecosystems to strengthen supply chain security.

The White House prepares a program offering free cybersecurity services to vulnerable U.S. water utilities. 

Politico reports the Trump administration is preparing a program offering free cybersecurity services to vulnerable U.S. water utilities, following a surge of attacks that officials suspect may be linked to Iran. Led by the Office of the National Cyber Director, the initiative is expected to begin as a proof of concept in Texas before potentially expanding to other states.

Utilities will receive services including network vulnerability scanning, with private cybersecurity companies reportedly helping provide the assistance. The effort comes as water systems in at least a dozen states have faced attacks affecting IT and operational technology, sometimes forcing operators to use manual controls. Federal agencies recently warned of a significant increase in attacks targeting programmable logic controllers at water and wastewater facilities. The administration has not formally attributed the campaign to Iran.

ATF reports a major cyber incident. 

The Bureau of Alcohol, Tobacco, Firearms and Explosives says hackers breached a standalone computer system containing information about targets of ATF investigations. The agency has designated the incident a “major incident” under federal guidelines.

The Qilin ransomware group added ATF to its leak site Wednesday but did not publish samples of allegedly stolen data. ATF says the compromised system was isolated from its case management, laboratory and eForms systems and was quickly shut down after the breach was discovered. Officials say the attack did not affect the agency’s operations.

The Justice Department is investigating, while ATF has begun forensic and incident-response work. Qilin remains a prolific ransomware operation, with researchers ranking it as the second most active ransomware group in July, with 127 reported attacks.

The U.S. Navy warns sailors to tighten their social media security. 

The U.S. Navy is warning its entire workforce — roughly 608,000 active-duty personnel, reservists and civilian employees — to tighten their social media security amid what it describes as a coordinated intelligence-gathering campaign by adversaries.

In a new bulletin, the Navy advises personnel and their families to enable privacy settings and remove information linking them to the service or revealing locations and routines that could be exploited. Personnel are also being told to report suspicious activity, including surveillance of installations, drones near bases, questions about ship movements, being followed off-base, and fake social media accounts impersonating sailors.

The warning comes amid the U.S.-Israeli military campaign against Iran. While some commentators have questioned its timing, the Navy says adversaries are attempting to gather intelligence, test defenses, disrupt operations and intimidate personnel.

The FBI says a sophisticated Chinese hacking group known has spent years targeting U.S. government agencies and critical infrastructure. 

The FBI is warning that a sophisticated Chinese hacking group known as QTFY has spent years targeting U.S. government agencies and critical infrastructure, including defense contractors, communications providers, financial institutions and universities.

The group uses a custom ecosystem of tools, including QScan, a platform for identifying and exploiting vulnerable systems, and QTRouter, which routes malicious traffic through compromised IoT devices to obscure its origins. In 2024, QTFY reportedly exfiltrated data from more than 300 organizations after exploiting a Check Point Quantum Gateway vulnerability.

The FBI attributes QTFY to a Chinese company linked to PRC cyber operations. U.S. authorities announced Wednesday that they had disrupted QScan and QTRouter. Agencies are urging organizations to patch systems, isolate critical infrastructure from edge devices, hunt for compromise, and audit applications for exposed credentials.

Bill Gates weighs in on AI perils. 

Microsoft co-founder Bill Gates is warning that artificial intelligence could usher in one of the most turbulent periods in human history unless governments act quickly to manage its risks. In a new essay, Gates argues that rapidly improving AI could replace humans across many tasks, causing widespread job losses, economic disruption and greater inequality.

Gates says global efforts to prepare for the transition are inadequate and suggests policies including taxes on AI usage and robots that replace workers. Revenue could support retraining programs and stronger safety nets. He also proposes reserving some roles, including caregiving and certain medical work, for humans.

University of Washington computer science professor Oren Etzioni agreed with Gates’ concerns but questioned some proposed solutions, particularly taxing AI tokens. He warned that slowing U.S. development could also put American companies at a disadvantage against foreign competitors.

A purported online Think Tank looks to influence AI system responses. 

A website presenting itself as the Hanover Institute for Public Policy has published more than half a million words of pro-Israel content designed in part to influence how AI chatbots answer questions about Israel and Gaza, according to the Guardian.

The purported think tank has no apparent legal entity, physical address, named staff or report bylines. Its articles resemble neutral academic research but consistently frame disputed issues in ways favorable to Israel. The site was built using technology marketed to help content get cited by AI systems.

Piro Inc., the U.S. company behind the site, registered the material under the Foreign Agents Registration Act as work for the Israeli government. The effort is part of a broader, multimillion-dollar public diplomacy campaign involving several contractors. Researchers warn such techniques could influence not only chatbot search results but eventually AI training data, potentially shaping responses without users knowing the original source.

Attackers concentrate on particular technology vendors and product lines. 

Joint research from SentinelOne and Tenable suggests attackers are concentrating on particular technology vendors and product lines rather than individual vulnerabilities. Comparing exposure and runtime detection data, the companies found a 79% overlap in targeted edge-device vendor surfaces, but only 21% overlap among specific vulnerabilities.

The researchers argue that defenders should prioritize what Tenable calls “Persistently Targeted Vendors” — product lines that repeatedly attract attackers even as individual CVEs change. Twelve vulnerabilities were exploited independently by both state-sponsored and ransomware actors, while more than half of organizations using F5 products had at least one exposed, actively exploited vulnerability. Citrix customers had the slowest median remediation time at 461 days.

The findings suggest organizations should combine vulnerability remediation with attack-surface reduction and behavioral detection, particularly as AI accelerates vulnerability discovery and exploit development.

Meta pumps the brakes on going AI native. 

Meta spent part of this year exploring just how “AI native” it could become, and how many humans might become optional along the way. Reuters reports that Project OT, short for organization transformation, considered shrinking some teams by as much as 60 percent while AI agents took over much of their daily work.

One round of layoffs followed in May, but CEO Mark Zuckerberg reportedly canceled a planned second round. The rethink came amid questions about whether the promised productivity gains were actually materializing. Internal data reportedly showed code changes soaring while user-facing improvements rose much more modestly. More concerning, AI agents were linked internally to a 40 percent increase in major technical and security incidents, with employees spending considerably more time cleaning up afterward.

By July, Zuckerberg acknowledged that agentic development hadn’t accelerated as expected. Apparently, becoming AI native still requires a fair number of native humans.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

We’re proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world’s preeminent intelligence and law enforcement agencies.

N2K helps cybersecurity professionals and organizations grow, learn, and stay ahead. We’re the nexus for discovering the people, tech, and ideas shaping the industry.  Learn how at n2k.com.

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.