The CyberWire is an independent voice delivering concise, accessible, and relevant cyber security news to people all across the globe. We separate the signal from the noise.
Overdue Last read · last published · next check
Last read 20 hours ago, longer than this feed's 2 hours schedule.
This week, while Dave is out, hosts Maria Varmazis and Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Maria and Joe are joined by friend of…
This week, Dave and Ben discuss how the Trump administration has dramatically changed the cybersecurity landscape after signing a new memorandum, which allows private companies to hack malicious threat actors. Additionally, the two look at the concept of "AI constitutions," and what these policies entail.
Brian Vecci, Field CTO at Varonis, joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices recorded at Black Hat USA 2026. He discusses how AI assistants and agents are magnifying existing data security risks, what recent research reveals about emerging AI-enabled threats, and why organizations need to rethink how they protect enterprise data as both employees and…
Dynatrace has agreed to acquire San Francisco-based AI observability platform Arize for $915 million. Cribl has acquired technology assets from Radiant Security's AI SOC product.
Medusa’s reach grows. Cl0p expands its victim list. The DOJ charges 17 alleged Iranian hackers. CISA sounds the alarm on four exploited vulnerabilities. TWINLOOT hides in plain sight inside Microsoft 365. Maria Varmazis shares the latest from the space-cyber realm as Ukraine strikes Russia’s satellite nerve center. The FDA considers guardrails for AI medical devices. Expired credit cards get an…
US accuses 17 Iranians of hacking for Iran's IRGC. Business news: Fortinet acquires AI security firm Virtue AI.
Patrick Gorman started making YouTube videos during COVID to study for a certification with friends. He now has over 100,000 subscribers and runs a pentesting firm called ISP Security. This is a replay of our Behind the Cyber Creator AMA series. Patrick and Gianna talk about how he built his audience, why having followers doesn’t automatically mean having clients, and what he learned the hard way…
A fake consultancy fronts an alleged Chinese spy campaign. Meta heads to court over claims it hooked young users. Researchers crack the mystery behind the French EncroChat hack. CISA warns ransomware gangs are exploiting a Windows flaw. Meet C2Looper, a new Rust-based backdoor. A critical WordPress plugin bug threatens hundreds of thousands of sites. MessiahGPT brings generative AI to cybercrime.…
Ev Kontsevoy, CEO of Teleport, joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices recorded at Black Hat USA 2026. He discusses why traditional Zero Trust principles need to evolve for autonomous AI agents, how agents can operate within their permissions while still behaving in unintended ways, and why organizations need security controls that protect the business…
Researchers reverse-engineer French malware used to hack EncroChat. An unprecedented number of Apple users received spyware alerts last week.
You might find Meredith Cavan playing music in an Irish pub. But long before her first album dropped, she clocked more than 20 years at the CIA. One of her jobs there was Southeast Asia Department chief, where she oversaw covert action, intelligence operations, and analysis across 30 countries. We're talking about the years 2021 to 2023, when terrorism was taking a back seat to strategic…
Internal policy conflicts hamper U.S. military AI leadership. Clop claims GE, Philips and Shell. Attackers actively probe internet-facing GeoServer instances. “The Hatman” offers millions of alleged employee records for sale. ETSI begins the approval process for European cyber standards. Microsoft is still working on a patch for the ShieldBreak vulnerability. Autonomous AI systems create CPU…
Nick Warner, CEO of Neo, joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices recorded at Black Hat USA 2026. He discusses how the rapid adoption of AI tools and agentic software is reshaping enterprise security, why CISOs need greater visibility and control over the software operating across their environments, and how organizations can put guardrails around AI…
ShinyHunters leaks alleged RingCentral data. Police arrest seven suspects in connection with 2023 bank hack.
In this special edition from Black Hat, Dave Bittner sits down with Clint Gibler, Cyber Lead at OpenAI, and Robby Winchester, Chief Global Professional Services Officer at SpecterOps, to explore how frontier AI models are changing the way defenders approach cybersecurity. The conversation moves beyond the hype to examine responsible AI deployment, AI red teaming, reducing noise in security…
This week on T-Minus: Space-Cyber Briefing: we look at how AI systems are being used to abuse the trust people have in space-based imagery. This abuse has caused people to believe that fake images and videos are genuine and dismiss real content as misinformation.
As AI products proliferate, they continue to introduce new concerns, which have subtly eroded trust in imagery and content created by space-based infrastructure. In this week's episode, host Maria Varmazis sits down with Dave Bittner and Brandon Karpf to look at Google's troubled implementation of Nano Banana 2 in Google Earth. The incident raises larger concerns regarding how AI systems are…
Today we are joined by Ian Goldin, Senior Lead Information Security Engineer, and Mike Horka, Principal Information Security Engineer, from Lumen's Black Lotus Labs, discussing their research entitled "Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation." Black Lotus Labs has uncovered a major resurgence of the JDY botnet, a China-nexus reconnaissance network now…
Trivy, not LiteLLM, was the original source of the 2,500-organization supply chain attack. Patch Tuesday notes: Microsoft fixes three zero-days.
Apple sends out threat notifications to users targeted by spyware. Trivy, not LiteLLM, was the original source of the 2,500-organization supply chain attack. French tax authority confirms data breach. Chinese hack-for-hire group conducts espionage and cybercrime simultaneously. Ukrainian police shut down 94 scam call centers. Former data analyst jailed for insider extortion plot. New macOS malware…
Trivy, not LiteLLM, was the original source of the 2,500-organization supply chain attack. Chinese hack-for-hire group conducts espionage and cybercrime simultaneously.
President Trump deputizes private-sector companies to target cybercriminals. The LiteLLM supply-chain attack exposed credentials belonging to thousands of organizations. Data-theft campaign targets misconfigured Salesforce and ServiceNow instances. Hackers deploy AI agents to breach Taiwanese government systems. CISA mandates urgent patch for actively exploited Cisco firewall vulnerability.…
Clint Gibler, Cyber Lead at OpenAI, and Robby Winchester, Chief Services Officer at SpecterOps, join Dave Bittner for a discussion recorded live at Black Hat USA 2026. Together, they explore how frontier AI models are changing cyber defense, where AI creates the greatest value for defenders, and why responsible deployment and human expertise remain essential as organizations adopt these…
More jurisdictions continue to cut ties with Flock.
The LiteLLM supply-chain attack exposed credentials belonging to thousands of organizations. CISA mandates urgent patch for actively exploited Cisco firewall vulnerability.
Attackers aren't just using AI to steal data; they're using it to fight back while you investigate them in real time. And once an adversary is inside, why would they ever want to leave? That's the unsettling reality Tom Kellermann, VP of AI Security and Threat Research at TrendAI, lays out in this episode. And the numbers prove it. According to a 2026 TrendAI survey of 46 financial-sector CISOs,…
This week, Ben and Ethan discuss two major stories. The first looks deeper into the Supreme Court's recent ruling on the Chatrie case and the long-term impacts this decision could have on privacy within the nation. The second dives into another court case decision, which exposes social media companies to greater liability for allegedly addictive design features on their platforms and those…
This week, while Dave is out, hosts Maria Varmazis and Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. Maria and Joe are joined by friend of the…
We got your Patch Tuesday notes. Attackers target Microsoft SharePoint vulnerability following PoC release. Cyberattack on CEVA Logistics causes ongoing supply chain disruptions. Wesco confirms data breach following extortion claims. Akira ransomware bypasses EDR in Safe Mode. California announces AI cybersecurity fund. N2K’s Lead Analyst Ethan Cook shares about cyber weapons for space. Dave…
Michael Leland, Field CTO at Island joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices at Black Hat USA 2026. He discusses the emerging risks in the AI supply chain, why AI agents introduce new challenges around trust and governance, and what organizations can do to securely adopt agentic AI without slowing innovation.
Visa and Deel both acquire identity verification companies.
Attackers target SharePoint vulnerability following PoC release. Business news: Visa and Deel both acquire identity verification companies.
In this episode of the Microsoft Threat Intelligence Podcast, Microsoft Threat Intelligence Director Elliot Volkman is joined by Microsoft Principal Threat Intelligence Analyst Crane Hassold to explore how phishing and social engineering attacks are changing beyond email. They discuss the rise of QR code phishing, Microsoft Teams scams, SMS-based attacks, and why attackers continue to follow…
Kelly O'Dwyer Manuel has been building analyst relations (AR) programs for a long time, and her first question is always the same when starting from scratch: what are you actually trying to accomplish? She joins Gianna and Andy T to talk through what AR looks like for a small team with a small budget, why most companies pay for analyst relationships before they are ready, and what a first year…
Poland’s CERT describes winter cyberattack against heat-and-power plant. Russian military hackers target Ukrainian IT workers in fake recruitment scheme. Chinese IP connections spark security review in UK Navy drones. US and South Korea warn of “Gunra” ransomware gang with North Korean ties. OpenAI mandates strict security controls for its new cybersecurity model. Record-breaking DDoS attacks…
Stephen Harrison, VP of Product at Abnormal AI joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices interview at Black Hat USA 2026. He explains why AI agents and service accounts are creating a new identity challenge for security teams, how shadow AI is expanding the attack surface through unmanaged OAuth permissions, and why organizations need to understand what…
US and South Korea warn of "Gunra" ransomware gang with North Korean ties. Chinese IP connections spark security review in UK Navy drones.
On this episode of #IMM, Christine and Madison sit down with Byron Tau as he transitions from the Associated Press to ProPublica.
For decades, Cuban intelligence has been seen as a force that punches above its weight. Shaped during the Cold War through cooperation with the Soviet Union, its intelligence officers received extensive training by the KGB. But where does Cuba’s spy service stand today, especially as it faces pressure from Washington? Retired FBI special agent Peter J. Lapp, who wrote Queen of Cuba, came in to…
Researchers find that only a quarter of AI-generated patches are fully successful. Ransomware attacks exploit critical N-able flaw. Atlassian fixes critical flaw in Rovo AI. LexisNexis disables some services following suspicious activity. US Senate confirms Adam Cassady as cyber ambassador. Meta ordered to pay an additional $567 million in child safety case. Water sector cyberattacks expand to new…
Mujtaba Hamid, EVP of Product and Strategy at Booz Allen Hamilton joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices at Black Hat USA 2026. He explains how AI is compressing the timeline from vulnerability discovery to exploitation, why traditional human-paced security operations can no longer keep up, and how AI-native defensive systems can help organizations…
Ransomware attacks exploit critical N-able flaw. LexisNexis disables some services following suspicious activity.
As commercial space activity accelerates, satellite manufacturers are rethinking how spacecraft are designed, built, and secured. In this week's episode, host Maria Varmazis sits down with Jason Roberson, an Industry Value Expert for Aerospace & Defense at Dassault Systems, to discuss how AI, automation, and digital engineering are transforming the space industry's product lifecycle. From…
This week on T-Minus: Space-Cyber Briefing: we look at how artificial intelligence (AI) is impacting the space sector and introducing new cybersecurity challenges that manufacturers have not fully realized.
Today we are joined by Brian Hussey, SVP of Howler Cell Threat Services at Cyderes, discussing their work on "Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer." Howler Cell identified an SEO poisoning campaign targeting people searching for Claude Code installation guides, using a fake Anthropic page and a ClickFix lure to trick victims into running a malicious MSHTA…
Vishing attacks target hedge funds. CISA warns of cyberattacks targeting PLCs in the water sector.
Vishing attacks target hedge funds. Metabase Cloud breached by zero-day flaw. Cyberattack disrupts North Carolina Ports operations. The Chinese government has launched a security review of Palo Alto Networks products. US defense supplier breached by phishing attack. Healthcare software provider breach affected 3.8 million people. New macOS malware spreads via ClickFix attacks. Microsoft and Apple…
Cyberattack disrupts North Carolina Ports operations. Metabase Cloud breached by zero-day flaw.
Meta’s AI models join the sandbox escape club. China’s telecom footprint in the U.S. may be larger than expected. The White House keeps its AI safety playbook under wraps. AI coding tools introduce new GitHub risks. ENISA expands its CVE role. A critical Paperclip flaw enables code execution. Crypto wallet fears fuel phishing attacks. Researchers uncover a backdoor in Chinese-made routers. The…
US water system cyberattacks continue to grow.
