CyberWire Daily

SonicWall issues emergency patches. European wind and solar sites are exposed online. South Korea warns of AI-powered attacks on banks. Maria Varmazis unpacks the EU’s new Space Threat Response Architecture. Google patches dozens of high-severity Chrome flaws. Researchers uncover an SSRF vulnerability in Harbor. AI reshapes vulnerability management. Wikimedia says OpenAI agents repeatedly broke its rules. Pwn2Own kicks off in Ireland. Our guest is Derek Holt, CEO of Digital.ai, who says AI has killed the cybersecurity response window. VIN there, done that.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.CyberWire Guest

Today we are joined by Derek Holt, CEO of Digital.ai, sharing his views on how AI has killed the cybersecurity response window.

Selected Reading

SonicWall warns of max severity SSRF flaw in SMA1000 gateways (Bleeping Computer)

Thousands of European wind and solar power systems exposed online, Dutch researchers say (Reuters)

South Korea's Lee says AI appears to have been used in bank hacks (Reuters)

The new EU Space Threat Response Architecture explained (EEAS)

Chrome 155 Update Patches 247 Vulnerabilities (SecurityWeek)

SSRF in Harbor Webhooks: Any User Can Reach the Server’s Cloud Credentials (OX Security)

AI is turning offensive security into a continuous necessity (CSO Online)

Wikimedia Foundation: OpenAI agents tried to edit pages and compromise notes tool (The Record)

Ethical hackers have already found 32 zero days in various products at Pwn2Own Ireland (Infosecurity Magazine)

Connected Cars Talk to Google and Ad Trackers While Seven Car Apps Hand Over the Owner's VIN (HackingPassion.com)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Military cyber personnel face pay cuts. A critical RCE threatens banking and government authentication systems. Dell patches a critical update flaw. A missed patch costs Accenture an FBI contract. Hackers hijack a fashion retailer’s push notifications. Insurers brace for rogue AI claims. Hackers breach a supertanker’s propulsion system. Denmark suffers a massive population data breach. And Japan extradites a suspected Qilin ransomware operator. Our guest is Steve Ryan, Founder and CEO of Trinity Cyber, on surviving first contact from a Frontier AI-enabled cyber threat. There’s no honor among Gentlemen.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment, we are joined by Steve Ryan, Founder and CEO of Trinity Cyber, talking about surviving first contact from a Frontier AI-enabled cyber threat. If you enjoyed this conversation, check out the full interview here.

Selected Reading

The Pentagon’s new cyber mastery incentive model promised a ‘new era.’ Troops are bracing for pay cuts. (DefenseScoop)

Critical CVE-2026-18397: Remote Code Execution Vulnerability in Thales SConnect Threatens SWIFT Banking and Government Authentication Systems (Rescana)

Dell Urges Customers to Patch Critical DSU Flaw That Can Give Attackers Root Access (Security Affairs)

FBI Drops Accenture Contractor After Sensitive Data Breach (Security Affairs)

Asos customers receive ‘hack’ notification threatening to leak data (The Guardian)

Insurance claims to test Altman and Amodei liability for ‘rogue’ AI (Financial Times)

Hackers Breached Propulsion System of US-Bound Oil Tanker (Bloomberg)

8.8 Million Impacted by Data Breach at Denmark’s Central Person Register (SecurityWeek)

World's Largest Ransomware Group Qilin Member Arrested in Japan (The Chosun Daily)

Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds (Infosecurity Magazine)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

The President launches a new federal AI task force. South Korea investigates financial sector data leaks. AI slop overwhelms a Google bug bounty program. Citrix patches an exploited zero-day. Stealthy malware hides inside Asian email security appliances. Apple tightens macOS privacy around AI agents. Attackers exploit a critical Rejetto File Server flaw. The Senate advances healthcare cybersecurity legislation. Monday business briefing. Our guest is Jared Shepard, CEO of Hypori, with insights on how the military is adopting AI technologies. A real good password…isnt’.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Jared Shepard, CEO of Hypori, sharing how he sees the military and DoW adopting AI technologies.

Selected Reading

Trump names national intelligence director Jay Clayton to lead a new federal AI task force (AP News)

South Korean president orders probe into data leaks across financial industry (Reuters)

Google freezes open-source bug bounty program amid flood of invalid AI slop submissions — product flaw submissions halted until 2027 as maintainers drown in hallucinations (Tom's Hardware)

Citrix patches NetScaler SAML zero-day exploited in attacks (Bleeping Computer)

New Linux malware mimics network edge appliances to evade detection (SC Media)

Apple changes full-disk access permissions to curb abuse from AI agents (Ars Technica)

Exploitation Hits Rejetto HFS Vulnerability Discovered by AI (SecurityWeek)

Senate Passes Bipartisan Bill to Strengthen Healthcare Cybersecurity (SecurityWeek)

Island raises $400 million in a Series F round. (N2K Pro Business Briefing)

CISO thought he had a 'r3@lg00dp@$$w0rd' but forgot to patch (The Register)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

As space infrastructure expands, so too does the need for cybersecurity expertise beyond securing traditional spacecraft.

Host Maria Varmazis speaks with ⁠Milenk Starcevic⁠, Head of Cybersecurity at ⁠Vision Space⁠, and ⁠Andrzej “Andy” Olchawa⁠, Senior Cybersecurity Engineer also at Vision Space, about the growing space cybersecurity field. They discuss the role of compliance and auditing, how cybersecurity professional can develop space-specific skills, and how emerging capabilities are expanding the attack surface.

Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠⁠⁠

Key Sources:

⁠The Spacecraft Hacker's Handbook.⁠

Space cybersecurity starts on the ground.

Hack the Box.

Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠⁠space@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠⁠⁠

T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Today we are joined by Jean-Pierre Mouton, Senior Threat Intelligence Consultant at GuidePoint Security, discussing their work on "How Play Achieves Encryption." Play ransomware, also known as PlayCrypt, continues to target organizations across multiple sectors using a consistent double-extortion playbook that combines data theft with widespread encryption. A recent investigation details how the group gained access through a SonicWall VPN, moved laterally using tools such as Mimikatz and PsExec, exfiltrated sensitive data, and used the victim’s own SentinelOne uninstallation utility to disable endpoint protection. The findings highlight several behavioral indicators defenders can monitor, including tool staging through SYSVOL and SystemBC for command and control, event log clearing, and suspicious WinSCP activity.

The research and executive brief can be found here:

⁠⁠⁠⁠How Play Achieves Encryption

Learn more about your ad choices. Visit megaphone.fm/adchoices