Advertise on podcast: CyberWire Daily

The Ukraine has experienced a second major outage of its Starshield services reigniting questions about relying on a single private provider for critical national security services. Host Maria Varmazis sits down Dave Bittner and Brandon Karpf to discuss the recent incident where Ukraine lost Starshield coverage. They explore how the growing role of private satellite companies in warfare creates challenges for establishing operational accountability and impacts US alliances. Key Sources: ⁠Musk ordered Starlink slowdown that blindsided Ukraine. Starlink access in Ukraine a decision for Musk, not White House, Rubio says. Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠[email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. Learn more about your ad choices. Visit megaphone.fm/adchoices

Today we have Damon Rouse, Threat Intelligence from Lumen's Black Lotus Labs, discussing their work on "The infrastructure quartermaster: inside a China-nexus state enablement model." Black Lotus Labs identified a China-nexus cyber infrastructure provider, dubbed a “quartermaster,” that supplies reconnaissance, proxy routing, and obfuscation services to Chinese cyber espionage actors. Its interconnected systems, including QScan and Fast Labyrinth, help identify high-value targets, conceal malicious traffic, and support potential exploitation of government, military, research, and critical infrastructure networks. Researchers warn that this shared infrastructure makes traditional IP-based defenses less effective and recommend following CISA and NCSC guidance, reducing external attack surfaces, and keeping routers, firewalls, and IoT devices updated. The research and executive brief can be found here: The infrastructure quartermaster: inside a China-nexus state enablement model Learn more about your ad choices. Visit megaphone.fm/adchoices

Attackers target critical PHP flaws, and former CISA director Chris Krebs weighs in on AI’s role in the vulnerability surge. Railway confirms a cyberattack. HPE patches critical ArubaOS flaws. Quest Diagnostics investigates a disruptive intrusion. Capcom reports a data breach. China-linked hackers put AI-powered attacks on autopilot. And researchers uncover a Microsoft 365 campaign that hijacks authentication tokens to bypass MFA. Our guest is Anudeep Parhar, COO at Entrust, sharing his thoughts on AI kill switches. eMudra throws in the certificate towel.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today, we are joined by Anudeep Parhar, COO at Entrust, sharing his thoughts on "If you need the AI kill switch, it's already too late." Selected Reading Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge (SecurityWeek) 426 Android and iOS Apps Linked to PHP2Shell Backend Risks (Hackread) Chris Krebs on AI discovering cyber vulnerabilities: It'll get worse before it gets better (CNBC) Developer platform Railway urges 'all users' to revoke secret keys after cyberattack (TechCrunch) HPE patches eight max severity RCE and auth bypass AOS flaws (Bleeping Computer) Quest Diagnostics warns of potential data theft after attack on lab service system (The Record)  Gaming Giant Capcom Confirms Data Breach Exposed Users' Personal Information (Infosecurity Magazine) China APT Uses AI Pentest Tool Artex in ConnectWise Attacks (SecurityWeek) M365 Token Spray and Replay Campaign Compromises Business Email Accounts (Huntress) eMudhra to Exit global SSL/TLS Certificate Business (eMudhra) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Amazon spots PHP exploits before disclosure. GitLab patches a critical flaw. Meta faces a $25 billion penalty. Autonomous AI agents power new cyberattacks. Hackers breach a Japanese cloud provider. CyberCartel unleashes AI against Latin American banks. Tor exit nodes are hijacked. OpenAI coding agents disable security monitoring. Interpol dismantles thousands of cybercrime networks across Africa. Our guest is Danny Manimbo, ISO and AI Practice Leader at Schellman, explaining why companies waiting for AI regulatory clarity may already be behind. Spotify hits the skip button on AI slop.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Danny Manimbo, ISO & AI Practice Leader at Schellman, discussing why companies waiting for AI regulatory clarity are already behind. If you enjoyed this conversation, check out the full interview on Caveat. Selected Reading Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot (AWS Security Blog) GitLab warns of new max severity code execution vulnerability (Bleeping Computer) Meta ordered to pay $25 billion penalty in New Mexico Cambridge Analytica case (CNBC) CrowdStrike Uncovers New Agentic AI Campaigns (CrowdStrike) Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected (Bleeping Computer) CARLIY0S: CyberCartel's AI Attacks on Latin American Banks (Straiker) 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email (Ars Technica) Suppressing misalignment monitoring alerts and disabling misalignment monitoring (OpenAI Alignment) Authorities disrupt nearly 11,000 cybercrime networks in Africa (Bleeping Computer) One Year In: Putting Human Artistry First on Spotify (Spotify) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Critical PHP flaws threaten millions of websites. Weak certificates from an Indian authority spark a global security scramble. Investigators probe a U.S. consulting executive’s alleged ties to ShinyHunters. SafePay ransomware hits at least 600 critical infrastructure organizations. Researchers find troubling security biases in Chinese AI-generated code. A $10 million initiative bolsters cybersecurity for small U.S. utilities. An American pleads guilty to stealing from thousands of servicemembers and veterans. Leo Scott, Managing Director of DataTribe, is talking about their upcoming Cyber Innovation Conference and the 9th annual DataTribe Challenge. Two pallets of GPUs never make it to baggage claim.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Leo Scott, Managing Director of DataTribe, talking about their upcoming Cyber Innovation Conference and the 9th annual DataTribe Challenge. Selected Reading PHP warns it plans to release 2 emergency patches imminently (Ars Technica) The Internet goes on high alert after discovery of 8 compromised TLS certs  (Ars Technica) Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site (Krebs on Security) SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns (Infosecurity Magazine) China Defends DeepSeek After US Ban of Its AI From Government Systems (SecurityWeek) Chinese AI Model Writes More Hackable Code When Told It's for US Contractor (SecurityWeek) Accenture, Dragos, and SANS Institute Launch Foundation to Strengthen Cyber Defenses for Under-Resourced U.S. Utilities (Dragos) Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers (CyberScoop) Nvidia RTX 5090 shipment worth $470,000 goes missing in Brazilian airport — two pallets disappear, distributor seeks explanations but met with zero answers (Tom's Hardware) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

A Google Cloud outage disrupts UK banks. DHS bans DeepSeek. Shape-shifting ransomware targets Macs. Bank of America hires an army to patch AI-discovered flaws. Canada looks to bypass the U.S. with a transatlantic cable. A contractor breach exposes California student data. Cybersecurity hiring slumps, but AI skills are booming. Researchers expose the Silent Ransom Group’s playbook. A suspected Qilin ransomware operator takes a vacation straight into custody. Our guest is Roman Arutyunov, Co-Founder of Xage Security, discussing the next era of Zero Trust. A hotel phishing scheme gets a chilly reception.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today on our Industry Voices segment, we are joined by Roman Arutyunov, Co-Founder and Chief Product Officer at Xage Security, discussing the next era of Zero Trust is about actions, not just access. If you enjoyed this conversation, check out the full interview here. Selected Reading Google Cloud services down in UK; banks, public sector report issues (Reuters) US banning Chinese AI DeepSeek from government agency IT systems (Reuters) Heartbreaker 💔 (Objective-See) Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's Mythos (CNBC) Norwegian undersea cable builder pitches 2,800-mile transatlantic data link between Canada and Europe to bypass the US — Canadian majority partner sought to help fund and build new $620 million fiber connection to reduce reliance on American routes (Tom's Hardware) One Compromised Login Exposed Millions of California Students' Records (SecurityWeek) US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars (SecurityWeek) Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew (GuidePoint Security) Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient's death (Bitdefender) Nearly 480,000 Phishing Emails Traced to Computer Hidden Behind Hotel Fridge (Hackread) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

State election officials question CISA’s commitment to election security. Stolen credentials force ConnectWise to suspend cloud services. Fake calendar invites steal Microsoft logins. Temu settles Texas privacy allegations. Toronto police arrest seven in a cryptocurrency kidnapping case. The G7 sounds the alarm on quantum threats. Monday business briefing. Ben Yelin, sits down with Kevin Tian, CEO and Co-Founder of Doppel, to share how AI is changing the threat landscape for sports organizations. MapQuest puts surveillance on the map.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today Ben Yelin, from the University of Maryland Center for Cyber, Health, and Hazard Strategies, and co-host of Caveat sits down with Kevin Tian, CEO and Co-Founder of Doppel, sharing how AI is changing the threat landscape for sports organizations and why the team is expanding its investment in social engineering defense. Selected Reading This Cybersecurity Agency Is Supposed to Protect U.S. Elections. Officials Fear It’s Been Compromised by Trump. (ProPublica) FBI and CISA Warn of AI-Written Phishing Before the 2026 Midterms (Technology.org) Attackers Abuse Stolen ConnectWise Application Credentials to Target Microsoft 365 (SecurityAffairs) Fake Calendar Invites Target 40,000 Firms in Microsoft Credential Theft (Hackread) Chinese online retailer Temu agrees to data privacy curbs to settle Texas lawsuit (Reuters) Toronto Police Arrest Seven Men, Seize More Than 2,700 Rounds of Ammunition Following Violent Abduction Investigation (Toronto Police Service) G7 Urges Fast-Track on Quantum-Safe Cybersecurity Rules (Infosecurity Magazine) Harmonic Security secures $50 million in a Series B round. (N2K Pro Business Briefing) MapQuest now lets you locate nearby surveillance cameras, like Flock (This Week in Security) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

On this special edition podcast, Dave Bittner is joined by John Kindervag and Dr Chase Cunningham to discuss the principles of zero trust, cyber resilience, and how AI is transforming cybersecurity strategies. They explore practical frameworks, misconceptions, and the future of security in a machine-speed world. John is the author of "Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era," and Chase is one of the book's contributors. Learn more about your ad choices. Visit megaphone.fm/adchoices

Through Executive Orders, the Trump administration is looking ensure that America's space capabilities have the workforce and technological innovation needed for success. Host Maria Varmazis sits down with Producer Ethan Cook to continue their conversation as they look at more space-related Executive Orders. While the previous episode looked at the orders that laid out the administration's broad space goals, this conversation looks at the orders that look to advance America's workforce and technical capabilities. Key Sources: ESTABLISHING THE UNITED STATES SPACE ACADEMY. USHERING IN THE NEXT FRONTIER OF QUANTUM INNOVATION. Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠[email protected]⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. Learn more about your ad choices. Visit megaphone.fm/adchoices

Dan Lisichkin, AI Security Researcher from Pillar Security, discussing their work on "A WIF Of Fresh Access, How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise." Researchers at Pillar Security uncovered a vulnerability in Google’s Gemini CLI workflows that could allow an attacker to turn a malicious GitHub issue into remote code execution and gain elevated access to a Google Cloud Platform (GCP) project. The exploit chain combined a misconfigured tool allowlist that allowed unrestricted command execution with exposed Workload Identity Federation credentials and overly broad service account permissions, potentially enabling attackers to impersonate privileged accounts. Google promptly addressed the issues by tightening tool restrictions, blocking the agent’s access to credential files, and limiting service account impersonation permissions, highlighting the risks of connecting AI agents to untrusted input and sensitive infrastructure. The research and executive brief can be found here: ⁠A WIF Of Fresh Access: How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise Learn more about your ad choices. Visit megaphone.fm/adchoices

Chinese spies exploit a BeyondTrust zero-day. Atlassian faces active attacks. Rogue AI agents breach Indian networks. Ransomware gangs turn to threats of violence. A cyber incident disrupts U.S. bankruptcy courts. F5 and Juniper push critical patches. Japanese companies suffer a wave of breaches. Google brings AI-powered scam protection to Android. Our guest is Nick Jackson, Global Director of Cyber Security Services at Bitdefender, sharing how the UK are thinking about AI regulation. Braille meets brains.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Nick Jackson, Global Director of Cyber Security Services at Bitdefender, is sharing how the UK government and private industry are thinking about AI regulation. Selected Reading Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day (Beyond Trust) U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog (SecurityAffairs) After OpenAI's Australia hack, India's cyber agency says AI agents breached systems (The Hindu) Hackers Target 60 Indian Banking and UPI Apps With New GhostBat Android Malware (Cyber Security News) Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments (Infosecurity Magazine) BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts (SecurityWeek) F5, Juniper Networks Patch Critical Vulnerabilities (SecurityWeek) More Japanese Firms Disclose Details of Data Breaches (Nippon) Android gets AI defenses against messaging scams, fake calls (Bleeping Computer) Computers Made of Human Brain Tissue Identify Braille Letters In Breakthrough (404 Media) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

An OpenAI engineer faces charges over an alleged covert recording device. Attackers exploit a PAN-OS firewall flaw and an Ivanti zero-day. Aoki infostealer hunts AI credentials. Researchers uncover critical weaknesses in an AI gateway. CikaBika Bot turns Discord into a command center. Online ads deliver mercenary spyware without a click. Microsoft disrupts a massive Chinese-language phishing operation. And INTERPOL leads an international crackdown on child sexual abuse material. Character.ai runs out of tokens.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today, we are featuring Kieran Human, Lead Cybersecurity Engineer at ThreatLocker, who guested on Hacking Humans with Maria Varmazis and Joe Carrigan this week. Tune in to listen to their full conversation here and join the crew including Dave Bittner every Thursday on your favorite podcast app. Selected Reading Office of Public Affairs | Saudi National Arrested for Installing Surreptitious Audio Recording Device at OpenAI (US Department of Justice) Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix (CSO Online) CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials (Cyber Security News) New Aoki Infostealer Targets AI Coding Assistant Credentials (Infosecurity Magazine) Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool (Infosecurity Magazine) CikaBika Bot RAT Uses Discord for C&C (SecurityWeek) AdFection: How mercenary spyware invades victims’ devices through targeted advertising (CyberScoop) Police arrests 95 suspects in international CSAM crackdown action (Bleeping Computer) Character.ai Bankruptcy Is First AI Bubble Domino to Fall (404 Media) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Patch Tuesday brings a record-breaking haul of fixes. Ivanti warns of an exploited VPN zero-day. An international crackdown targets West African scam compounds. A cyberattack stops work on a major European tunnel. Perceived Starshield speed limits disrupt Ukrainian drone operations. Canonical battles a sustained DDoS attack. Anthropic warns of self-replicating AI worms. The FTC accuses cybersecurity firms of exploiting sextortion victims. Microsoft and partners disrupt a major cybercrime marketplace. Rob T. Lee, from SANS, and Lynn Dohm, from WiCyS, are sharing a preview of the SANS 2026 Difference Maker Awards. Taking a Patch Tuesday snow day. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Rob T. Lee, Chief of Research and Chief AI Officer at SANS, and Lynn Dohm, Executive Director at WiCyS, sharing a preview of the SANS 2026 Difference Maker Awards. Selected Reading Patch Tuesday Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (Bleeping Computer)  Adobe Patches 140 Vulnerabilities Across 10 Products (SecurityWeek) SAP warns of maximum severity OAuth2 SSRF security flaw (Bleeping Computer) Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN (SecurityWeek) West African scam compounds raided, more than 100 suspected trafficking victims ‘rescued’ (The Record) Cyberattack halts Denmark-Germany tunnel construction (UA NEWS) Starlink restrictions affecting Ukraine's front line operations, Kyiv says (BBC)  Canonical Hit by Second DDoS Attack in 2026, Public Websites Disrupted (SecurityAffairs) Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns (SecurityWeek) FTC says ‘sextortion’ protection companies deceived customers about services (CyberScoop) An Important Update About Grace Hopper Celebration (AnitaB.org)  Disrupting the service economy behind transnational cybercrime operations (Microsoft) Fifth of CISOs Take Time Off to Avoid Patch Tuesday (Infosecurity Magazine) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

French supermarkets lose their cool in a refrigeration cyberattack. Anthropic pulls the plug on AI agents behaving badly. A Canadian ransomware negotiator is arrested in the FBI’s ShinyHunters investigation. XWorm expands its surveillance capabilities. A Dutch grocery giant suffers a cyberattack. Leaked files reveal Luna Moth’s playbook. Monday business brief. Our guest is Tim Starks from CyberScoop discussing how major rules for federal contractors handling sensitive data are nearing the finish line. Six digits sink Danish security. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today we are joined by Tim Starks from CyberScoop discussing how major rules for federal contractors handling sensitive data are nearing the finish line. Selected Reading Ukraine strikes third Yandex data center, disrupting digital services across Russia (The Record) Cyberattack Hits Hundreds of Supermarket Refrigeration Systems in France (The New York Times) DoD confirms ‘refrigeration disruption’ at military commissaries (MilitaryTimes) Anthropic takes risky AI tests offline after models breach govt sites (Bleeping Computer) Shock and surprise after FBI arrests Canadian cybersecurity expert in ShinyHunters hacking case (CBC News) XWorm RAT Evolves Into Surveillance Platform (SecurityWeek) Cyberattack Prompts Ahold Delhaize to Disconnect Systems (SecurityWeek) Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings (Infosecurity Magazine) Armadin has raised $255.5 million in a Series B round led by Andreessen Horowitz and Accel (N2K Pro Business Briefing) '123456' password linked to Denmark data breach affecting 8.8M people (The Register) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this Special Edition podcast while our team is out observing Indigenous Peoples' Day in the United States. In this episode, Dave Bittner joins Maria Varmazis to explore the evolution of public-private partnerships in cybersecurity over the past decade. Together, they discuss key incidents, trust-building, and the future challenges posed by AI and geopolitical shifts. Join Maria and Dave as they discuss: The definition and importance of public-private partnerships in cybersecurity. Evolution of collaboration from episodic to institutionalized. Impact of major incidents like Colonial Pipeline on policy and trust. The role of information sharing and trust-building mechanisms. The influence of AI and automation on future cybersecurity strategies. Learn more about your ad choices. Visit megaphone.fm/adchoices