CyberWire Daily - A morning without Cloudflare.

Starting point is 00:00:00 You're listening to the Cyberwire Network, powered by N2K. From fishing to ransomware, cyber threats are constant, but with Nordlayer, your defense can be too. Nordlayer brings together secure access and advanced threat protection in a single, seamless platform. It helps your team spot suspicious activity before. for it becomes a problem by blocking malicious links and scanning downloads in real time, preventing malware from reaching your network. It's quick to deploy, easy to scale, and built on zero-trust principles, so only the right people get access to the right resources.

Starting point is 00:00:46 Get 28% off on a yearly plan at Nordlayer.com slash Cyberwire Daily with code Cyberwire-28. That's Nordlayer.com slash Cyberwire Daily, code Cyberwire Daily, code Cyberwire Daily, code CyberWire dash 28. That's valid through December 10th, 2025. Cloudflare had a bad morning. Google issues an emergency Chrome update. Logitech discloses a data breach. Sisa plans a major hiring push.

Starting point is 00:01:28 The House renews the state and local cybersecurity grant program. The GAO warns military personnel are oversharing online. Tech groups urge governments worldwide to reject proposals that weaken or bypass encryption. Australian authorities blamed outdated software for the death of a telecom customer. An alleged void blizzard hacker faces extradition to the U.S. Our guest is Kevin Kennedy from Mantec, discussing the future battlefield and the importance of integrating non-kinetic effects. and AI meets the IRS. What could possibly go wrong?

Starting point is 00:02:14 It's Tuesday, November 18, 2025. I'm Dave Bittner, and this is your Cyberwire Intel briefing. Thanks for joining us here today. It's great as always to have you with us. A major outage at Cloudflare disrupted access to numerous websites today, highlighting how much the Internet relies on a few core providers. The company said a spike in unusual traffic caused errors across multiple services, preventing some users from reaching sites and blocking customers.

Starting point is 00:02:58 from viewing performance dashboards. Cloudflare reported partial recovery, although elevated error rates continued during remediation. Engineers disabled the warp encryption service in London as they work to stabilize traffic. Maintenance had been scheduled in several data centers, but the company said the cause of the anomaly remains unknown. Experts noted that the scale of Cloudflare's network

Starting point is 00:03:25 makes a cyber attack unlikely. Google has issued an emergency Chrome update to patch two high-severity-type confusion vulnerabilities in the V8 JavaScript engine, including one zero-day already under active exploitation. The first vulnerability discovered by Google's threat analysis group on November 12th is being used in real-world attacks, which Google says likely involve government-backed actors or commercial spyware operators. A second flaw was reported earlier by Google's Big Sleep AI agent, though there's no evidence of active abuse. Type confusion bugs can lead to memory corruption and let attackers escape Chrome security boundaries. The fixes arrive in Chrome versions across major platforms and will roll out gradually.

Starting point is 00:04:17 Users and administrators should update immediately, including those running other chromium-based browsers. Logitech has disclosed to the Securities and Exchange Commission that attackers exploited a zero-day vulnerability in a third-party software platform, allowing them to copy some data from the company's internal IT systems. Logitech said the flaw was patched once the vendor released a fix and noted that the stolen data likely included limited information about employees, consumers, customers, and suppliers. The company does not believe sensitive personal data, such as national, ID numbers or payment information was involved, and said its products, operations, and financials were unaffected. The disclosure follows Klopp's claim that it breached Logitech using a zero-day in Oracle's e-business suite, though Logitech has not confirmed this. The broader campaign

Starting point is 00:05:14 has impacted multiple organizations with Klopp listing dozens of victims. SISA plans a major hiring push through 2026, recover from deep staffing losses under the Trump administration and to prepare for potential conflict with China, according to a November 5th memo from acting director Madhu Gadumukala. He said personal cuts left the agency with about a 40% vacancy rate across key mission areas, limiting its ability to meet national security needs. Sisa will prioritize hiring state cybersecurity coordinators and regional advisors,

Starting point is 00:05:54 expand use of DHS's cyber talent management system to bring in specialized talent at market rates and streamline hiring with DHS. The agency also plans more flexible workplace policies, expanded university partnerships, and renewed internship pipelines to rebuild expertise and restore strained relationships with critical infrastructure partners. The House has overwhelmingly passed the Pillar Act, renewing the state and local cybersecurity grant program through 23 after its September 30th expiration. The initiative has supplied $1 billion to help state and local governments bolster cybersecurity and lawmakers pushed for a stable long-term reauthorization rather than continued short-term extensions.

Starting point is 00:06:46 Bill's sponsor, Representative Andy Ogles, said the measure drew strong bipartisan support because defending local networks is essential to national security. The Chamber also approved the Strengthening Cyber Resilience Against State Sponsored Threats Act in a 402-8 vote. That legislation establishes an interagency task force led by the FBI and SISA to focus on countering cyber operations linked to China, which House leaders say represent a growing strategic threat. The Government Accountability Office warned that the Defense Department

Starting point is 00:07:25 is not adequately training military personnel or civilian staff to prevent sensitive information from leaking online. In tests where auditors posed as threat actors, GAO investigators were able to use publicly available social media posts, family support groups, and even Pentagon press releases to trace. service members, identify their units, uncover family details, and identify operational activities. GAO said such data can enable coercion, blackmail, or threats to active missions. Ten DOD components showed gaps in training or threat assessments, with most focusing narrowly

Starting point is 00:08:06 on operational security while overlooking insider threats and force protection. GAO issued 12 recommendations. DOD agreed to most, but argued it cannot fully control the personal online activity of service members and their families. More than 60 digital commerce and technology groups are urging governments worldwide to reject any proposals that weaken or bypass encryption, arguing that strong encryption is essential for privacy, data security, and global digital trust. In a joint letter, groups including the App Association, BSA and the Information Technology Industry Council said backdoors, key escrow, or technical mandates would harm all users while offering limited benefits to law enforcement.

Starting point is 00:08:57 The appeal comes as several countries pursue lawful access measures, from UK disputes over Apple's encrypted services to Ireland's exploration of new access authorities. Europe also nearly advanced the chat control regulation, which critics warned, would enable mass device scanning and end digital privacy before opposition halted the vote. Australia's TPG telecom says a customer died after their Samsung phone running outdated software could not connect to triple zero, the country's nationwide emergency number equivalent to 911 in the United States. The failed call occurred on November 13th on TPG's budget Labara service and the relative needing help later died.

Starting point is 00:09:47 TPG said its network was functioning normally, and that early findings show the Samsung device's outdated software made it incompatible with triple zero routing requirements, which ensure calls connect on any available mobile network. Regulators are now investigating whether emergency access rules were breached, especially since older Samsung devices were already known to struggle with automatic network switching. Samsung urged users to keep devices updated,

Starting point is 00:10:17 and TPG said it warned customers on November 7th to update older models. Authorities in Thailand have arrested Russian national Dennis Abresco, whom the United States seeks to extradite on cybercrime charges. Police say the 35-year-old is linked to Void Blizzard, a cyber espionage group that Microsoft associates with hacking operations, aligned with Russian state interests. Abresco arrived in Thailand on October 30th

Starting point is 00:10:47 and was detained on November 6th in a joint operation with the FBI. Thailand's Cybercrime Investigation Bureau says he previously breached government systems in both Europe and the U.S. Police seized electronic devices from his hotel room for forensic review, and he's being held in Bangkok pending extradition. Microsoft reports,

Starting point is 00:11:09 Void Blizzard typically uses stolen quills, credentials and basic techniques like password spraying to access organizations across government, defense, transportation, media, NGOs, and Ukraine-related sectors. Coming up after the break, Kevin Kennedy from Mantec explores the future battlefield and the importance of integrating non-kinetic effects. and AI meets the IRS. What could possibly go wrong? Stay with us.

Starting point is 00:12:03 At Talas, they know they know cybersecurity can be tough and you can't protect everything, but with Talas, you can secure what matters most. With Talis's industry-leading platforms, you can protect critical applications, data, and identities, anywhere and at scale with the highest ROI. That's why the most trusted brands and largest banks, retailers, and healthcare companies in the world rely on Talis to protect what matters most. Applications, data, and identity. That's Talis. T-H-A-L-E-S. Learn more at

Starting point is 00:12:38 talusgroup.com slash cyber. Ever wished you could rebuild your network from scratch to make it more secure, scalable, and simple? Meet Meter, the company reimagining enterprise networking from the ground up. Meter builds full-stack, zero-trust networks, including hardware, firmware, and software, all designed to work seamlessly together. The result? Fast, reliable, and secure connectivity

Starting point is 00:13:14 without the constant patching, vendor juggling, or hidden costs. From wired and wireless to routing, switching, firewalls, DNS security, and VPN, every layer is integrated and continuously protected in one unified platform. And since it's delivered as one predictable monthly service, you skip the heavy capital costs and endless upgrade cycles. Meeter even buys back your old infrastructure to make switching effortless. Transform complexity into simplicity and give your team time to focus on what really matters,

Starting point is 00:13:48 helping your business and customers thrive. Learn more and book your demo at meter.com slash cyberwire. That's M-E-T-E-R dot com slash cyberwire. Kevin Kennedy is vice president for defense strategy and warfighting integration at Mantec and a retired lieutenant general in the United States Air Force. In today's sponsored industry voices segment, we get together to discuss the future battlefield and the importance of integrating non-kinetic effects. So right now where I see us standing is we are looking as a form.

Starting point is 00:14:37 force. And I say, when I say we, I mean the United States, our partners, and our allies, as that's going to have to integrate across all of the domains of warfare at levels that we haven't done to date. It's becoming increasingly important. And what I mean by that is the physical domains of air, land, sea, space, cyberspace is the new part, right? And so when we think about that is you know when you when you add that to the element you say okay so how do we integrate across those domains and there's two areas that really come to me when we think about that the first one is the information that transits all of that all of those different domains and finally the electromagnetic spectrum that also connects all of those domains and so that's kind of where i see us now and as we're going

Starting point is 00:15:26 in the future what's becoming increasingly impaired to me and to many of my colleagues is that is going to be contested in a way and shaped in a way that previous technology wasn't available to enable it, but now we can, and we can gain advantage as well as deny our adversary's advantage. So the cost of entry into this battle space has gone way down because of the cyber domain? Is that a fair way to say it? Yeah, Dave, I completely agree with you. It's been democratized in a way and commoditized in a way, especially we saw in the cyber domain, that unitary actors, not necessarily even state actors, have access to criminal activities generally

Starting point is 00:16:08 that would enable access as well as infrastructure that they were able to stand up quickly, use quickly, and then take down just as quickly as after they've usually, you know, most of the criminal actors, you'll see, you know, the ransomware actors and things like that. Well, we can also see that for other types of effects that states are now adopting to do that type of activity as well. And then stand up the infrastructure, quickly maintain the effect or gain access and then very quickly move using our infrastructure that's out there and then commercial infrastructure. I mentioned that you've been at the front lines of a lot of this. Can you share with our audience some of your background? Where did you get your start and what led you to where

Starting point is 00:16:50 you are today? Absolutely. So I just recently retired. Well, I still say recently, but last fall. So it's been a year, recently retired from the United States Air Force after 34 years. In that capacity, I had kind of a three-chapter career. First portion was flying B-1 aircraft and commanding small flights, elements, training, largely focused on the tactical and operational level. Second chapter of that career focused on strategy at the Air Force and joint staff level, as well as leading larger teams and squadrons and wings. and culminating as a base commander out in Ellsworth Air Force Base, South Dakota for B-1s.

Starting point is 00:17:34 And then the third chapter was when I became a general officer. I joined the CIO and cyber enterprises for the United States Air Force as well as on the secretary's staff for the department and end up at Cyber Command where I was the J-3. And my final job was I was the 16th Air Force commander, which had all of the information warfare capabilities responsible for organizations. training, and equipping, and then as the component to the national security agency, as well as the component to U.S. Cyber Command. And today you're at Mantec. What's your day-to-day like there? So at Mantec, I joined the team for the primary reason is it's a highly focused organization on the mission of national security. We're about 50% veterans and 70% of our

Starting point is 00:18:19 workforce has served in government in some capacity. And my day-to-day role there is I'm the defense strategy and warfighting integration. So our president of the defense sector has asked us to ask me to look across all of our divisions and see how we can bring capabilities and to the market that we require for the future battlefield capabilities of focusing in cyber, non-kinetic effects, cybersecurity aspects, and then leveraging the capabilities we have across our company, which we're organized with some practices. We're focusing on data and AI, cyber and cybersecurity, intelligent engineering, as well as digital engineering.

Starting point is 00:19:00 Well, looking at the global situation these days, when we look at our adversaries or even our friendly competitors out there, how are the nations around the world posturing for this new world that includes the cyber element? Where I see, just take the cyber domain first, what I see out there for our, adversaries is they're leveraging the domain for three primary reasons or activities. The first one will be prepositioning for potential military operation. The second one is espionage. And the third one is criminal activity. And so when you look at the criminal activity, this is our nations out there, primarily when you think about North Korea, that they're using the cyber domain to fund their illicit activities and evade sanctions. When you look at the Volt series,

Starting point is 00:19:51 You know, Volt Typhoon as Vols Salt Typhoon, this PRC, and what they're doing is pre-positioning primarily for potential military operations. There doesn't seem to be an espionage motivation behind their activity. And we saw that most recently with the Volt Typhoon, with a, you know, in our critical infrastructure and our water and our waste treatment and our transportation systems. And the opportunities they're seeking there to pre-position for potential. operations where the theory is if they are able to prevent the United States from flowing forces or increase pain on the United States, then we may not take military action in the Pacific. I think that's a miscalculation, but that's my understanding of the theory. Yeah. You mentioned the electronic magnetic spectrum. Where do we stand there? What are your concerns?

Starting point is 00:20:49 Well, as we think through of the cross-domain operations in the future, the coin of that and the means that that is the exchange of information and data. And the spectrum is how we do that generally, whether it's radio frequencies or internet protocol based. We generally use that to make sure we can synchronize our activities, coordinate our activities, and integrate to levels that we had before. Primarily in the last few decades, we've been pretty, pretty, much in a non-contested environment for that as we, you know, we didn't have any active jamming by the adversaries. But what we're seeing now is active jamming. And what I mean by that is if you look at what's happening on the Ukraine battlefield right now, that there is active efforts

Starting point is 00:21:36 by both sides to deny the spectrum for navigation, communications, and sharing of information. And as we go forward, we need to think through how we can be agile in that manner to ensure that we understand how we need to leverage the spectrum, how we can assure our access to it, while dividing our adversary the same thing. And so this is more than historically electronic warfare kind of capabilities focused on electronic attack and electronic protection.

Starting point is 00:22:03 In other words, creating a condition upon adversary systems and made them less effective or providing techniques that enabled our systems to continue to operate and through jamming. Well, now we have the ability we need to think through like, okay, how do we shape the environment in ways that make it more conducive for our systems and less conducive for theirs?

Starting point is 00:22:25 Help me understand and kind of, I suppose, calibrate here. Does this future require more of a public-private partnership than we had in the past? I'm thinking particularly when it comes to critical infrastructure. With respect to critical infrastructure, yes. I think we need to think through how we do. do the information sharing and then how do we respond to activities and then how do we assess our current posture? And what I mean by that is a large portion of producing military capabilities

Starting point is 00:22:59 is understanding how resilient your systems are and how you can posture yourself to overcome fog or friction. And what I mean by that is friction is things that just make large-scale operations difficult. When you think about the redundancy on critical infrastructure or sorry, not the redundant, when I think about the dependency on critical infrastructure, then you need to think, okay, how do I understand the current posture that a certain base post-station port is relying on a civilian sector? If we don't understand that to a level of how understanding how they're resilient, what's their cybersecurity posture, how quickly can they respond to incidents.

Starting point is 00:23:40 If we don't tabletop that, if we don't war game that out with exercises and training together, then we really won't know how successful or how quickly we can adapt to an environment that is going to be contested. So I think as we're moving forward, we'll have to think through as a nation, the authorities and how do we align our from state and local all the way to federal about the ability to defend ourselves in the nation and the cyber domain to ensure that we can protect our citizens and our interests. You know, recently we've seen budget cuts, organizations like SISA. At the same time, we have others who are pushing that, in addition to, for example, a space force, that we should stand up a cyber force. Do you have any insights for those? I do.

Starting point is 00:24:27 So I was on the air staff when we had when the space force was born and understand the desire to really focus the war fighting aspects of that domain and ensure we're building capabilities for that domain. The difference, I would say, between that and a cyber force is the cyber is, as I mentioned before, the needs for cyber across all domains of warfare to include space is prevalent at having a separate force to do that wholly, like lock, stock and barrel, move it to a separate force, I think would be problematic.

Starting point is 00:25:00 Now, I do think there are different models that we can for generating cyber power. And the one way, you know, the model that's, generally produced is the SOCOM model, the special operations command, and how we generate forces through the services and then present them to special operations command, and they generally do the care and feeding and development of the doctrine and then the extra capabilities that need to roll on that. I think that model is about 75% of what we need to do in the forest, but the next step on that is understanding, okay, how do we do the talent management of the

Starting point is 00:25:37 cyber operators as they come forward on that because I do think the model breaks down there and I think cyber command probably given some authorities to help generate that force would then enable the capability you know then enable the large scale scaling of the capabilities that we need for the command a separate force or service a separate service would be difficult because I think the overhead that comes with being a service would make it very difficult to me the tooth to tail ratio. What I mean by that is, like, the folks that are focused on mission versus the infrastructure that goes around to generating everything that would be necessary as a standalone service.

Starting point is 00:26:18 So the relationship between the existing services and a force for U.S. Cyber Command, I think, is an area that we should explore. And as we continue moving out in that way, you know, we just recently, the department mentioned an update to Cyber Command 2.0. I think that's a step in the right direction. I do think that the department should look closely at how they accelerate those timelines to the left. Well, let me come at the question from a different direction. I mean, you have hung up your hat as a member of the military, but just as a thought exercise,

Starting point is 00:26:52 suppose you were put in charge and it was up to you to organize our future cyber fighting force. What sort of things do you think should be put in place? Well, I would focus on the life cycle of a cyber operator, and as we're assessing, and then as we then bring them into U.S. Cyber Command, and then as we continue to develop and employ the operators across the force, and then the key is, is how do we continue to develop leaders for the Cyber Command Enterprise, as well as the services develop leaders that have expertise in the domain. So different authorities given to the commander of U.S. Cyber Command of within his role or her role as a Joint Force trainer. If we think through, okay, what does that actually mean? More than just defining what it means to be a cyber operator, also having a active participation in the promotion and retention within the services. I think that is the area that we should explore, and that would be the one thing if I think the commissions that are out there and looking at a cyber force could not. make some good recommendations about how to give that commander of U.S. Cyber Command

Starting point is 00:28:04 a bit more authority on the development of the force as it's going forward in the constant development, not just the basic training elements, but also for the development and promotion of the force. The second one is the warfare center that was stood up in cyber, you know, that they're mentioned in Cyber Command 2.9, I think is also vital. It's a way to look at the future of the domain in a very domain-centric way that's underneath the leadership. of leaders that have spent time focused on the domain for their professional career, and that's how we'll get the innovation and bring it across to the other services. And I think those are some of the key aspects that I would focus on on bringing real capability,

Starting point is 00:28:44 because then we could have the discussion maybe down the road about, okay, is it to the point of a separate service necessary? Do we need further resourcing direct a session pass that go straight into the domain? And right now, I do not think that the, I do not think the investment is available to really scale that, nor the human capital, to fill all those positions. When you look at organizations like Mantec and the other folks who are in the same space, what is their part to play in this? What are the opportunities there? Right. So I think the key in all military domains, you know, the partnership between academia industry and the public sector.

Starting point is 00:29:28 is important. At Mantec, the way we're looking at is how do we bring our expertise, as I mentioned earlier, about 50% veterans, 75% former govies, how do we bring that expertise as well as our access to some of the industry-leading technologies into the department? And so how do we leverage that? One of the areas we're thinking through very, very closely is how do you create a digital environment that really we can provide to our clients and enable the government to look at the capabilities across domain within a digital virtual environment where we have digital

Starting point is 00:30:09 twins and where we can develop the capabilities, test the capabilities. And then when they're fielding and continue to support their operational development and then have that lead into a training environment that now the operators from any domain, whether it's the cyber domain air, or the ground can then test these capabilities in an environment that is shielded from the adversary. As we think through non-kinetic effects and electromagnetic spectrum operations, exercising those in the physical domains is difficult. One, there's concerns for other civilian type of infrastructure that leverages the domain. The second is you don't want to expose your capabilities for the adversary to see them. So I think that's one of the area

Starting point is 00:30:52 that close partnership, bring the new technologies, enable a foundry for non-kinetic effects, but that's really supported by a digital environment that has built with digital twins and the way we can play out different capabilities to see their interactions without having to take them out into the physical demands. That's Kevin Kennedy,

Starting point is 00:31:12 vice president for defense strategy and warfighting integration at Mantec. What's your 2 a.m. security worry? Is it, do I have the right controls in place? Maybe are my vendors secure? Or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work, so you can stop sweating over spreadsheets. audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. And it fits right into your workflows, using AI to streamline evidence collection, flag risks, and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently, and finally, get back to sleep. Get started at Vanta.com.

Starting point is 00:32:22 com slash cyber that's v a nta dot com slash cyber and what could possibly go wrong desk reports that into it has decided that if everyone is going to chat with an AI anyway it might as well be the one helping them file taxes. The company signed a multi-year deal worth more than $100 million with OpenAI, giving turbotax, credit karma, QuickBooks, and MailChimp a cozy new home inside ChatGPT. Users will be able to ask the usual life-or-death questions, like whether they can finally deduct their home espresso machine, and with permission into its tools will even dip into their financial data to estimate refunds, review credit options, or nudge clients about overdue

Starting point is 00:33:24 invoices. This move puts into it among a growing crowd of companies building chat GPT-accessible apps, though few others are letting AI whisper directly into customer's financial decision-making. Into it insists it has guardrails, validation layers, and years of tax lore to keep hallucinations at bay, though it stayed politely vague about who pay. if the AI makes an expensive oops. Still, the company is expanding its use of open AI models across products and internally through ChatGPT Enterprise, all in pursuit of a more automated financial future.

Starting point is 00:34:04 Hopefully, with fewer surprises than tech season usually delivers. And that's The CyberWire. For links to all of today's stories, check out our daily briefing at theCiberwire.com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity.

Starting point is 00:34:40 If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey and the show notes or send an email to cyberwire at n2k.com. N2K's senior producer is Alice Carruth. Our Cyberwire producer is Liz Stokes. We're mixed by Trey Hester

Starting point is 00:34:58 with original music by Elliot Haltzman. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. Thank you.

CyberWire Daily - A morning without Cloudflare.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.