The strategy behind the shield.

CISA unveils its 2030 cyber strategy. PHP2Shell exploits are in the wild. HHS preserves healthcare security requirements. Microsoft offers buyouts amid its AI spending spree. A cyberattack disrupts New Mexico hospitals. Google’s Finnish data center plans hit an environmental roadblock. Blue Initiative tracks maritime vulnerabilities. A Chinese national faces charges in a $37 million cryptocurrency scam. Our guest is Cal Al-Dhubaib, host of the new Authorized Intelligence podcast. Anthropic’s prospectus includes an existential disclaimer.

Today is Tuesday October 27th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

CISA plans to defend, harden and prevail. 

The Cybersecurity and Infrastructure Security Agency has unveiled CISA 2030: Defend, Harden, Prevail, a strategy aimed at strengthening national cybersecurity and critical infrastructure resilience against cyber, physical, and geopolitical threats.

The plan rests on three pillars. Defend focuses on securing networks, operational technology, software supply chains, and emerging technologies, including quantum computing and advanced AI. Harden emphasizes turning threat intelligence into action, improving risk prioritization, and accelerating incident response. Prevail seeks to strengthen national resilience through regional partnerships, emergency communications, and coordinated planning.

The strategy also prioritizes resilient 5G and 6G networks and satellite communications.

CISA will review its existing capabilities within 60 days, deliver an implementation plan within 180 days, and report on its progress within a year.

PHP2Shell is officially under active exploitation. 

CISA has added two critical PHP vulnerabilities, collectively known as PHP2Shell, to its catalog of actively exploited flaws. The bugs could allow unauthenticated attackers to execute code remotely on vulnerable systems.

Researchers observed widespread exploitation attempts before patches were released October 21, though early attempts reportedly failed. Subsequent honeypot activity confirmed successful exploitation in the wild.

Federal civilian agencies have until Thursday to patch their systems.

HHS scales back plans to eliminate privacy and security certification requirements. 

Federal health regulators have scaled back plans to eliminate privacy and security certification requirements for electronic health records, following widespread objections from healthcare providers and industry groups.

The Department of Health and Human Services’ final rule eliminates 14 health IT certification criteria, down from the 34 originally proposed. All 13 core privacy and security requirements will remain intact, including standards for authentication and access controls.

Commenters warned that eliminating those safeguards could shift security responsibilities onto healthcare providers, particularly smaller and rural organizations with limited resources.

However, the rule does eliminate transparency and risk-management requirements for AI-powered clinical decision support tools. Those provisions required developers to disclose information about their systems’ capabilities, limitations, and potential risks.

HHS says the changes will save health IT developers more than $1.5 billion in regulatory costs.

Most provisions take effect December 28, with others following in January.

Microsoft offers buyouts amidst AI-driven growth. 

Microsoft is offering voluntary buyouts to approximately 60,000 employees, roughly 27 percent of its workforce, as it balances soaring AI infrastructure spending with efforts to control costs.

The offers cover eligible workers in the United States, Canada, India, and Britain, including some employees at the vice president level.

Microsoft expects capital expenditures to exceed $50 billion in the September quarter, driven largely by data center investments supporting AI services.

The company previously offered voluntary retirement packages in April and announced 4,800 layoffs in July.

Some engineering, sales, and marketing teams are excluded from the latest program. Eligible employees have until early December to decide, with departures scheduled for December 31.

Microsoft says the initiative will provide flexibility as the company reshapes its workforce around AI-driven growth.

New Mexico hospitals divert patients following a cyberattack. 

A cybersecurity incident disrupted operations across the University of New Mexico Health System on Monday, forcing ambulance diversions, canceled appointments, and temporary restrictions on hospital access.

The disruption affected New Mexico’s only Level 1 trauma center, leaving the state without its highest level of emergency trauma care. Other healthcare providers stepped in to accommodate additional patients.

Employees reported hearing messages broadcast through hospital computers claiming that student, employee, and patient information had been stolen. Those claims have not been verified.

The health system declined to discuss the incident’s nature or scope, citing an active law enforcement investigation. The FBI confirmed it was assisting.

Hospitals and clinics began gradually resuming operations Monday afternoon, although the full extent of the disruption remains unclear.

Cleared trees halt development of a Google AI data center in Finland. 

Google’s massive AI infrastructure expansion in Finland has run into an environmental backlash after the company cleared hundreds of thousands of trees without completing required environmental assessments.

At one site in northern Finland, an estimated 250,000 trees were removed across 815 acres. Conservationists estimate another 150,000 were felled at a second location.

Finnish regulators have ordered work stopped at both sites. Google has apologized, saying it acted according to its understanding of local regulations.

The controversy threatens to complicate Google’s €13 billion investment in Finnish data centers, part of a broader AI infrastructure boom attracted by the country’s cool climate and abundant energy.

Supporters point to jobs and tax revenue. Critics question the environmental costs, electricity demands, and limited economic benefits.

More than 93,000 people have signed a petition demanding tighter regulation and compensation for affected communities.

Google says it will comply with regulators and plans to replant trees.

Blue Initiative tracks vulnerabilities affecting ships, ports, and maritime infrastructure. 

A coalition of cybersecurity and maritime organizations has launched Blue Initiative, a free public database tracking vulnerabilities affecting ships, ports, and maritime infrastructure.

The project helps operators identify and prioritize security risks across IT and operational technology systems.

The database currently contains nearly 30,000 vulnerabilities, including more than 2,000 rated critical and over 580 known to be exploited.

Users can search, filter, and receive alerts about vulnerabilities, while researchers and industry partners review entries and contribute new findings.

A Chinese national faces federal charges in connection with an alleged cryptocurrency investment scam. 

A Chinese national has been extradited from the Netherlands to face federal charges in connection with an alleged cryptocurrency investment scam that defrauded at least 174 Americans of nearly $37 million.

Prosecutors say 44-year-old Zheng Zhao participated in an international fraud network operating partly from scam centers in Cambodia.

The scheme allegedly involved contacting victims through social media, dating sites, and text messages, building relationships, then persuading them to invest through fraudulent cryptocurrency platforms.

Investigators say the stolen money moved through American bank accounts to the Bahamas, where it was converted into Tether cryptocurrency and transferred to wallets controlled in Cambodia.

Eight alleged co-conspirators have already pleaded guilty.

Zhao faces a money laundering conspiracy charge carrying a maximum sentence of 20 years in prison.

 

Anthropic’s prospectus includes an existential disclaimer. 

Anthropic is preparing to go public, and its pitch to investors comes with an unusual warning: the company’s products could potentially threaten human civilization.

In its 335-page IPO filing, Anthropic devotes 93 pages to potential risks, ranging from employee retention and computing costs to AI systems developing beyond human control.

The company warns that increasingly autonomous models could conduct cyberattacks, spread misinformation, help develop dangerous weapons, or take harmful actions without human intervention.

There’s also the possibility that AI development could outpace Anthropic’s ability to evaluate and safeguard its own technology.

And then there are more conventional business concerns, including expensive data centers, regulatory scrutiny, and dependence on major customers.

Anthropic argues that its commitment to AI safety makes it uniquely positioned to manage these dangers.

So, the investment proposition is essentially this: help us build extraordinarily powerful AI, and we’ll do our best to keep it from ending civilization.

Not your typical prospectus.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

We’re proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world’s preeminent intelligence and law enforcement agencies.

N2K helps cybersecurity professionals and organizations grow, learn, and stay ahead. We’re the nexus for discovering the people, tech, and ideas shaping the industry.  Learn how at n2k.com.

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.