CyberWire Daily

Latest Episodes:

Cyber Resilience at Machine Speed: Author John Kindervag and contributor Dr. Chase Cunningham. [Special Edition] Oct 18, 2026

Show notes

On this special edition podcast, Dave Bittner is joined by John Kindervag and Dr Chase Cunningham to discuss the principles of zero trust, cyber resilience, and how AI is transforming cybersecurity strategies. They explore practical frameworks, misconceptions, and the future of security in a machine-speed world.

John is the author of "Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era," and Chase is one of the book's contributors.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Expanding America’s space capabilities. [T-Minus: Space-Cyber Briefing] Oct 18, 2026

Show notes

Through Executive Orders, the Trump administration is looking ensure that America's space capabilities have the workforce and technological innovation needed for success.

Host Maria Varmazis sits down with Producer Ethan Cook to continue their conversation as they look at more space-related Executive Orders. While the previous episode looked at the orders that laid out the administration's broad space goals, this conversation looks at the orders that look to advance America's workforce and technical capabilities.

Key Sources:

Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠space@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The wrong kind of access. [Research Saturday] Oct 17, 2026

Show notes

Dan Lisichkin, AI Security Researcher from Pillar Security, discussing their work on "A WIF Of Fresh Access, How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise." Researchers at Pillar Security uncovered a vulnerability in Google’s Gemini CLI workflows that could allow an attacker to turn a malicious GitHub issue into remote code execution and gain elevated access to a Google Cloud Platform (GCP) project.

The exploit chain combined a misconfigured tool allowlist that allowed unrestricted command execution with exposed Workload Identity Federation credentials and overly broad service account permissions, potentially enabling attackers to impersonate privileged accounts. Google promptly addressed the issues by tightening tool restrictions, blocking the agent’s access to credential files, and limiting service account impersonation permissions, highlighting the risks of connecting AI agents to untrusted input and sensitive infrastructure.

The research and executive brief can be found here:

⁠A WIF Of Fresh Access: How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise

Learn more about your ad choices. Visit megaphone.fm/adchoices

Reboot, rinse, repeat. Oct 16, 2026

Show notes

Chinese spies exploit a BeyondTrust zero-day. Atlassian faces active attacks. Rogue AI agents breach Indian networks. Ransomware gangs turn to threats of violence. A cyber incident disrupts U.S. bankruptcy courts. F5 and Juniper push critical patches. Japanese companies suffer a wave of breaches. Google brings AI-powered scam protection to Android. Our guest is Nick Jackson, Global Director of Cyber Security Services at Bitdefender, sharing how the UK are thinking about AI regulation. Braille meets brains.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Nick Jackson, Global Director of Cyber Security Services at Bitdefender, is sharing how the UK government and private industry are thinking about AI regulation.

Selected Reading

Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day (Beyond Trust)

U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog (SecurityAffairs)

After OpenAI's Australia hack, India's cyber agency says AI agents breached systems (The Hindu)

Hackers Target 60 Indian Banking and UPI Apps With New GhostBat Android Malware (Cyber Security News)

Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments (Infosecurity Magazine)

BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts (SecurityWeek)

F5, Juniper Networks Patch Critical Vulnerabilities (SecurityWeek)

More Japanese Firms Disclose Details of Data Breaches (Nippon)

Android gets AI defenses against messaging scams, fake calls (Bleeping Computer)

Computers Made of Human Brain Tissue Identify Braille Letters In Breakthrough (404 Media)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A little too OpenAI. Oct 15, 2026

Show notes

An OpenAI engineer faces charges over an alleged covert recording device. Attackers exploit a PAN-OS firewall flaw and an Ivanti zero-day. Aoki infostealer hunts AI credentials. Researchers uncover critical weaknesses in an AI gateway. CikaBika Bot turns Discord into a command center. Online ads deliver mercenary spyware without a click. Microsoft disrupts a massive Chinese-language phishing operation. And INTERPOL leads an international crackdown on child sexual abuse material. Character.ai runs out of tokens.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today, we are featuring Kieran Human, Lead Cybersecurity Engineer at ThreatLocker, who guested on Hacking Humans with Maria Varmazis and Joe Carrigan this week. Tune in to listen to their full conversation here and join the crew including Dave Bittner every Thursday on your favorite podcast app.

Selected Reading

Office of Public Affairs | Saudi National Arrested for Installing Surreptitious Audio Recording Device at OpenAI (US Department of Justice)

Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix (CSO Online)

CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials (Cyber Security News)

New Aoki Infostealer Targets AI Coding Assistant Credentials (Infosecurity Magazine)

Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool (Infosecurity Magazine)

CikaBika Bot RAT Uses Discord for C&C (SecurityWeek)

AdFection: How mercenary spyware invades victims’ devices through targeted advertising (CyberScoop)

Police arrests 95 suspects in international CSAM crackdown action (Bleeping Computer)

Character.ai Bankruptcy Is First AI Bubble Domino to Fall (404 Media)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Patching up the pieces. Oct 14, 2026

Show notes

Patch Tuesday brings a record-breaking haul of fixes. Ivanti warns of an exploited VPN zero-day. An international crackdown targets West African scam compounds. A cyberattack stops work on a major European tunnel. Perceived Starshield speed limits disrupt Ukrainian drone operations. Canonical battles a sustained DDoS attack. Anthropic warns of self-replicating AI worms. The FTC accuses cybersecurity firms of exploiting sextortion victims. Microsoft and partners disrupt a major cybercrime marketplace. Rob T. Lee, from SANS, and Lynn Dohm, from WiCyS, are sharing a preview of the SANS 2026 Difference Maker Awards. Taking a Patch Tuesday snow day.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Rob T. Lee, Chief of Research and Chief AI Officer at SANS, and Lynn Dohm, Executive Director at WiCyS, sharing a preview of the SANS 2026 Difference Maker Awards.

Selected Reading

Patch Tuesday

Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (Bleeping Computer)

Adobe Patches 140 Vulnerabilities Across 10 Products (SecurityWeek)

SAP warns of maximum severity OAuth2 SSRF security flaw (Bleeping Computer)

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN (SecurityWeek)

West African scam compounds raided, more than 100 suspected trafficking victims ‘rescued’ (The Record)

Cyberattack halts Denmark-Germany tunnel construction (UA NEWS)

Starlink restrictions affecting Ukraine's front line operations, Kyiv says (BBC)

Canonical Hit by Second DDoS Attack in 2026, Public Websites Disrupted (SecurityAffairs)

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns (SecurityWeek)

FTC says ‘sextortion’ protection companies deceived customers about services (CyberScoop)

An Important Update About Grace Hopper Celebration (AnitaB.org)

Disrupting the service economy behind transnational cybercrime operations (Microsoft)

Fifth of CISOs Take Time Off to Avoid Patch Tuesday (Infosecurity Magazine)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Taking the cloud out of the sky. Oct 13, 2026

Show notes

French supermarkets lose their cool in a refrigeration cyberattack. Anthropic pulls the plug on AI agents behaving badly. A Canadian ransomware negotiator is arrested in the FBI’s ShinyHunters investigation. XWorm expands its surveillance capabilities. A Dutch grocery giant suffers a cyberattack. Leaked files reveal Luna Moth’s playbook. Monday business brief. Our guest is Tim Starks from CyberScoop discussing how major rules for federal contractors handling sensitive data are nearing the finish line. Six digits sink Danish security.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Tim Starks from CyberScoop discussing how major rules for federal contractors handling sensitive data are nearing the finish line.

Selected Reading

Ukraine strikes third Yandex data center, disrupting digital services across Russia (The Record)

Cyberattack Hits Hundreds of Supermarket Refrigeration Systems in France (The New York Times)

DoD confirms ‘refrigeration disruption’ at military commissaries (MilitaryTimes)

Anthropic takes risky AI tests offline after models breach govt sites (Bleeping Computer)

Shock and surprise after FBI arrests Canadian cybersecurity expert in ShinyHunters hacking case (CBC News)

XWorm RAT Evolves Into Surveillance Platform (SecurityWeek)

Cyberattack Prompts Ahold Delhaize to Disconnect Systems (SecurityWeek)

Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings (Infosecurity Magazine)

Armadin has raised $255.5 million in a Series B round led by Andreessen Horowitz and Accel (N2K Pro Business Briefing)

'123456' password linked to Denmark data breach affecting 8.8M people (The Register)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

Learn more about your ad choices. Visit megaphone.fm/adchoices

CyberWire Daily at 10: Examining a decade of public-private partnerships. [Special Edition] Oct 12, 2026

Show notes

Please enjoy this Special Edition podcast while our team is out observing Indigenous Peoples' Day in the United States.

In this episode, Dave Bittner joins Maria Varmazis to explore the evolution of public-private partnerships in cybersecurity over the past decade. Together, they discuss key incidents, trust-building, and the future challenges posed by AI and geopolitical shifts.

Join Maria and Dave as they discuss:

The definition and importance of public-private partnerships in cybersecurity.
Evolution of collaboration from episodic to institutionalized.
Impact of major incidents like Colonial Pipeline on policy and trust.
The role of information sharing and trust-building mechanisms.
The influence of AI and automation on future cybersecurity strategies.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ordering a new space policy. [T-Minus: Space-Cyber Briefing] Oct 11, 2026

Show notes

Since taking office, the Trump administration has signed a series of Executive Orders that aims to boost the US's space presence.

Host Maria Varmazis sits down with Producer Ethan Cook to dive into two recent Executive Orders signed by President Trump. These two orders look to significantly grow the US's space capabilities removing regulatory hurdles, encouraging innovation, and growing commercial investments.

Key Sources:

Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠space@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Contents may be malicious. [Research Saturday] Oct 10, 2026

Show notes

Adam Meyers, Head of Counter Adversary Operations at CrowdStrike, is discussing their work on "PhantomRaven, An LLM-Generated Information Stealer Developed for Bug Bounty Hunting." PhantomRaven, a JavaScript-based information stealer distributed through malicious npm packages by a financially motivated threat actor posing as a bug bounty hunter.

The malware targets system information and continuous integration and continuous deployment (CI/CD) environment variables, likely seeking credentials, with analysis suggesting its code was generated using a large language model. The report explores how AI-generated tools may lower the barrier to cybercrime and outlines steps organizations can take to mitigate risks, including restricting package installation scripts, using private npm registries, and monitoring dependencies.

The research and executive brief can be found here:

PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting

Learn more about your ad choices. Visit megaphone.fm/adchoices

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected