A matter of national secrecy.

Senators accuse the White House of illegally withholding a secret surveillance court ruling. A suspected surveillance operation targets Starlink users. Attackers probe vulnerable Oracle E-Business Suite systems. The FBI shuts down a bulletproof hosting provider. Tailworm targets Tailscale. Ohio’s Auditor of State investigates a cyberattack. A suspected ransomware attack disrupts Israel’s largest vehicle importer. Norway raises their cyber risk level to high. Our guest is Amy Blackshaw, Senior Vice President of Product Marketing for Identity at Palo Alto Networks, discussing AI exploits and identity containment. AI science needs a spam filter.

Today is Wednesday October 28th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

Senators accuse the White House of illegally withholding a secret surveillance court ruling. 

Two Democratic senators accuse the Trump administration of illegally withholding a secret surveillance court ruling as Congress considers renewing a controversial intelligence program.

Senators Ron Wyden and Adam Schiff say the administration missed a September deadline to release findings from the Foreign Intelligence Surveillance Court concerning Section 702 of FISA.

The court reportedly found that intelligence agencies used filtering tools to search Americans’ intercepted communications without required safeguards, including approvals and documentation.

Section 702 expired in June, but surveillance continues under a court authorization lasting until March.

The administration has promoted the program’s effectiveness while keeping the ruling classified, despite earlier promises to release it.

Civil liberties organizations are urging Congress to withhold reauthorization until the findings become public.

Wyden and Schiff have demanded an explanation by November sixth.

The dispute raises a fundamental question: How can Congress evaluate the legality of government surveillance when critical findings about that surveillance remain secret?

A suspected surveillance operation targets Starlink users. 

Cybersecurity researchers have uncovered a suspected surveillance operation targeting users of SpaceX’s Starlink satellite internet service.

According to Reuters, researchers at TrendAI found that an Israeli advertising technology company, Discover-Tech, was aggressively bidding for ads targeting Starlink users in more than 100 countries.

The company was particularly active in conflict zones, including Syria, Yemen, Libya, and South Sudan, where legitimate advertising demand is limited.

Researchers believe the activity was designed to exploit data leaked through online advertising auctions, potentially allowing operators to identify, locate, and track Starlink users.

TrendAI initially identified the operation only by the codename Shadow-Earth-79, reportedly declining to name Discover-Tech over legal concerns.

Citizen Lab and Confiant independently identified the company, prompting Google, Comcast, and others to remove it from their advertising platforms.

 

Attackers probe vulnerable Oracle E-Business Suite systems. 

Attackers are already probing for vulnerable Oracle E-Business Suite systems following the disclosure of a critical security flaw.

Tracked as CVE-2026-101767, the vulnerability allows unauthenticated attackers to exploit a SQL injection flaw and potentially take complete control of affected systems.

Oracle released a patch on October twentieth, urging customers to update immediately.

Security firm Defused says its honeypots detected attempted exploitation on October twenty-seventh, although Oracle has not confirmed active exploitation in the wild.

Shadowserver has identified more than 670 internet-exposed Oracle E-Business Suite instances, mostly in the United States. It’s unclear how many remain vulnerable.

The activity follows previous attacks against Oracle enterprise software, including a campaign by the Clop extortion gang that exploited a separate E-Business Suite vulnerability to target major corporations and universities.

The FBI shuts down a bulletproof hosting provider. 

The FBI has seized the domain of Virtualine, a so-called bulletproof hosting provider accused of supporting cybercrime, money laundering, and the distribution of child sexual abuse material.

Operating under several names, Virtualine openly advertised hosting services for illegal activities, promising to ignore abuse complaints and law enforcement requests.

According to the Justice Department, the company continued supporting a forum distributing illegal content even after receiving complaints from international authorities. Prosecutors also allege Virtualine helped the forum’s operators establish another site and attempted to launder cryptocurrency payments.

No arrests or criminal charges were announced.

The seizure follows international crackdowns on similar providers linked to ransomware operations. But researchers warn that disrupting these services often simply pushes criminal customers toward replacement providers, rather than eliminating the underlying market.

Tailworm targets Tailscale. 

Tailscale is rolling out fixes for a collection of security vulnerabilities that researchers say could allow attackers to move rapidly through private networks.

Dubbed Tailworm, the findings from Cyberdione Labs include eleven issues affecting Tailscale and the open-source headscale server.

Four vulnerabilities involve Tailscale SSH, where improper privilege handling could allow an attacker with access to one compromised device to gain root privileges on other authorized servers.

Researchers demonstrated automated attacks spreading between vulnerable machines in less than a second per hop, without user interaction.

Tailscale emphasizes that exploitation requires existing network access and depends on SSH policies. There’s no reported exploitation in the wild.

The company has published security bulletins and remediation guidance. Organizations are advised to review SSH access policies and disable unnecessary forwarding.

Ohio’s Auditor of State investigates a cyberattack. 

Ohio’s Auditor of State is investigating a cyberattack targeting its web server, potentially involving foreign state actors.

Auditor Keith Faber says security monitoring detected and isolated the threat, prompting officials to take the server and online accounts offline.

The incident was not ransomware, and officials have found no evidence that personal or government financial information was compromised. Payment data is stored separately.

State and federal law enforcement are investigating. A temporary website is planned, and audit clients experiencing payment disruptions will receive a grace period.

A suspected ransomware attack disrupts Israel’s largest vehicle importer. 

A suspected ransomware attack disrupted operations at Colmobil, Israel’s largest vehicle importer, delaying vehicle deliveries and services.

Israel’s Ministry of Transport disconnected the company from government registration systems as a precaution, while customers reported delays involving Mercedes-Benz vehicles.

According to sources cited by Calcalist, the ransomware group SETTRA was responsible and demanded payment. Industry sources say Colmobil paid the ransom, though the company has declined to confirm either claim.

Colmobil says it has restored operations and that the incident did not affect vehicle systems or manufacturers.

The attack highlights the automotive industry’s growing dependence on interconnected digital infrastructure, from vehicle registration and payments to maintenance and diagnostics.

While researchers have demonstrated attacks against connected vehicles, there’s no evidence this incident involved attempts to remotely control cars.

Norway raises their cyber risk level to high. 

Norway’s National Security Authority, or NSM, has raised the country’s cyber risk level to high, publicly disclosing its assessment for the first time.

The agency reports a threefold increase in successful cyber operations against Norwegian organizations over the past six months, with some incidents posing serious national security risks.

Defense, aerospace, critical infrastructure, and their suppliers face particularly elevated threats, including reconnaissance, attempted intrusions, ransomware, and denial-of-service attacks.

Officials also warn that artificial intelligence could accelerate attacks by helping adversaries identify vulnerabilities more efficiently, although such AI-enabled activity hasn’t been documented in Norway.

NSM is urging organizations to strengthen defenses immediately, emphasizing phishing-resistant authentication, network segmentation, improved monitoring, vulnerability management, and supply chain security.

The agency says stronger organizational defenses can help reduce the country’s overall cyber risk.

Stick with us after the break, Amy Blackshaw, Senior Vice President of Product Marketing for Identity at Palo Alto Networks, is discussing "The three-month clock: Neutralizing frontier AI exploits through identity containment." 

On today’s Industry Voices segment, I sat down with Amy Blackshaw, Senior Vice President of Product Marketing for Identity at Palo Alto Networks, as we discussed "The three-month clock: Neutralizing frontier AI exploits through identity containment." Here’s our conversation.

That was Amy Blackshaw, Senior Vice President of Product Marketing for Identity at Palo Alto Networks, if you enjoyed this conversation, check out the show notes for the full interview. 

AI science needs a spam filter. 

Artificial intelligence is transforming scientific research, but it’s also creating a rather inconvenient problem: scientists are increasingly struggling to separate genuine discoveries from AI-generated nonsense.

Science journalist Dalmeet Singh Chawla warns that generative AI is overwhelming academic journals with questionable research, leaving publishers’ integrity teams struggling to keep up.

The irony is that AI has already demonstrated extraordinary scientific potential.

In 2020, Google’s DeepMind developed AlphaFold, a system capable of predicting how proteins fold into the shapes that determine their biological functions.

Within a year, AlphaFold predicted 200 million protein structures, work that would have taken an estimated hundreds of millions of years using traditional laboratory methods.

The achievement helped earn its creators a Nobel Prize in Chemistry.

So AI can dramatically accelerate scientific discovery. Unfortunately, it can also accelerate the production of questionable science.

Apparently, the scientific method now needs a spam filter.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

And that’s the CyberWire Daily, brought to you by N2K CyberWire.

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

We’re proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world’s preeminent intelligence and law enforcement agencies.

N2K helps cybersecurity professionals and organizations grow, learn, and stay ahead. We’re the nexus for discovering the people, tech, and ideas shaping the industry.  Learn how at n2k.com.

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.