CyberWire Daily - Patching up the pieces.

Starting point is 00:00:00 You're listening to the Cyberwire Network, powered by N2K. The Cyber Innovation Conference brings together startups, SISOs, researchers, and VC firms building trust into tomorrow's digital world. This year, two signature events come together under one roof. On day one, DMV Rising brings cybersecurity leaders together for SISO-led conversations about securing tomorrow's technology. Then, on day two, the ninth annual Data Tribe Challenge puts emerging cyber startups in the spotlight as they compete for exposure, acceleration, and funding. It all happens October 26th and 27th in Washington, D.C., alongside the Innovation Expo, opportunities to connect with the cyber community, and conversations designed for substance over noise.

Starting point is 00:01:01 Learn more at Cyber Innovationconference.com. Quick question. Who or what has access to your critical systems right now? I'll give you a hint. It's not just employees anymore. It's vendors, machines, applications, workloads, and so many AI agents. Zage security helps organizations control every identity with zero-trust policies that govern what they can access, what they can do, and when. Because when critical systems are at stake, compromised access, can mean downtime, disrupted production, and real-world consequences. Protect what matters most with the Zage Identity Fabric platform. Learn more at Zage.com. That's X-A-G-E.com. Patch Tuesday brings a record-breaking hall of fixes. Yvante warns of an exploited VPN Zero Day.

Starting point is 00:02:16 An international crackdown targets West African scam compounds. A cyber attack stops work on a major European tunnel. Perceived Star Shield speed limits disrupt Ukrainian drone operations. Canonical battles a sustained DDoS attack. Anthropic warns of self-replicating AI worms. The FTC accuses cybersecurity firms of exploiting sextortion victims. Microsoft and partners disrupt a major cybercrime marketplace. Rob T. Lee from Sands and Lindome from Wiesis are sharing a preview of the Sands

Starting point is 00:02:49 2026 Difference Maker Awards. and taking a patch Tuesday snow day. Today is Wednesday, October 14th, 2026. I'm Maria Varmazes in for Dave Bittner today, and this is your Cyberwire Intel Briefing. Thank you for joining me. Let's get started. First up, Microsoft, Adobe, and SAP have released their October Patch Tuesday updates, addressing hundreds of security vulnerabilities across their products.

Starting point is 00:03:39 Microsoft's October Patch Tuesday delivers a record-breaking, 1,411 security fixes, including one actively exploited zero-day and two previously disclosed vulnerabilities. 70 flaws are rated critical, with remote code execution accounting for 57 of those. Privilege escalation vulnerabilities make up the largest category overall with 677 fixes. The actively exploited flaw affects Windows shell and allows attackers to bypass Mark of the Web protections. To publicly disclose vulnerabilities affect the dot-net framework and message pack C-sharp, potentially enabling security bypass and denial of service attacks. Microsoft continues to credit AI-assisted vulnerability discovery for the growing volume of fixes. October security updates

Starting point is 00:04:30 extend well beyond Microsoft, with major vendors addressing critical vulnerabilities, including several already exploited in the wild. Adobe patched flaws across Photoshop, cloud fusion, commerce, and other products. Atlasian addressed a critical vulnerability affecting Confluence, Jira, and Bitbucket Data Center products, which attackers exploited after proof-of-concept code became public. Cisco fixed critical NXOS vulnerabilities, potentially allowing attackers to execute code with root privileges on Nexus switches. Citrix, Fortinette, Yvante, and Sonic Wall, all patched vulnerabilities exploited in zero-day attacks. Docker addressed a Docker hub flaw, allowing attackers to impersonate users and push images to repositories that they don't own.

Starting point is 00:05:18 GitLab patched critical AI gateway and CICD vulnerabilities, while Dell addressed flaws in deployment and storage tools. Meanwhile, SAP fixed 20 vulnerabilities and Kitework released patches for 126 security flaws. Yvante is warning that attackers are exploiting a high severity zero day in its connect-secure VPN appliances. Researchers at Volexity discovered a threat actor tracked as UTA 0576, chaining three vulnerabilities to achieve route-level access on fully patched devices. The attackers stole credentials, conducted network reconnaissance, and searched for sensitive active directory information, apparently preparing for broader network compromise.

Starting point is 00:06:06 Yvante has patched two vulnerabilities covered by CVE 2026-104-935, but a third privilege escalation flaw remains unpatched. Yvante says exploitation has affected a limited number of customers. Updating our earlier coverage now, an international operation targeting West African scam compounds has resulted in 28 arrests in Ghana and Nigeria, and the identification of 117 suspected human trafficking victims. Coordinated by Britain's National Crime Agency,

Starting point is 00:06:41 the effort brought together 15 law enforcement agencies and 15 technology companies. Authorities seized more than 300 devices and identified 89 fraud victims who reportedly lost $8.3 million. The scams included cryptocurrency investment fraud, law enforcement impersonation, and online extortion. technology companies removed more than 3.7 million accounts, pages, and groups linked to the operations. Investigators also identified over $11 million in potentially recoverable funds. Meta played a key coordinating role, even as the company faces ongoing scrutiny over fraudulent advertising on its platforms.

Starting point is 00:07:23 A cyber attack has reportedly halted construction of the Femmarn Belt Tunnel, connecting Denmark and Germany. The incident affected the International FLC Construction Consortium, disabling workers' identification cards, and immobilizing vessels, cranes, and offshore platforms. The 18-kilometer road and rail tunnel is a roughly 7 billion euro project employing some 2,800 workers. The attacks' origins and potential impact on the construction schedule remain unclear. A Danish cybersecurity official suggested a possible connection to hybrid warfare, heightened warnings about Russian cyber threats. And for our Wednesday space story, as of Wednesday morning, Ukraine has said that SpaceX has

Starting point is 00:08:09 imposed new speed limits on military Starsheald terminals without warning, which it says has disrupted some drone operations and complicated battlefield logistics. The new perceived Starsheald speed restrictions of 160 kilometers per hour, as reported by Ukrainian officials to the BBC affect how fast drones can travel while still maintaining satellite connectivity. BBC sources at the Ukraine Defense Ministry say that since Wednesday morning, drones hitting the speed limit now completely lose connectivity with Starshield. As a result, Ukrainian officials say that some missions have been disrupted or canceled as they work to assess the impact and establish backup communications channels.

Starting point is 00:08:57 Star Shield is SpaceX's government and military version of the Starlink satellite service, and it has become an integral part of Ukraine's battlefield communications, supporting drone control, reconnaissance, and coordination. Ukraine's defense ministry says that it is discussing this issue with U.S. officials, SpaceX, and NATO partners. As of the time of this recording, SpaceX has not made any public response to Ukrainian officials, statements, nor has it corroborated the existence of any new in-motion Starshield speed restrictions. Ubuntu parent company Canonical suffered a sustained, distributed denial of service attack last week,

Starting point is 00:09:37 disrupting its public websites for more than four hours. The October 8th incident affected Ubuntu and canonical websites, developer resources, security advisories, and services, including the Ubuntu security API and live patch. However, software repositories, launchpad and the SnapStore remained operational, allowing users to continue downloading and installing updates. Canonical's distributed infrastructure helped limit the damage. This was the company's second major DDoS attack this year. An April incident caused more extensive disruptions, including outages affecting Launchpad and the Snap Store. A hacktivist group claimed responsibility for that attack, but no group has claimed the latest incident. Whether the two attacks are connected remains

Starting point is 00:10:23 unknown. Researchers at Anthropic warned that small AI models could soon become capable of independently spreading across compromised Internet of Things devices. The company's frontier red team tested whether AI models could run on inexpensive Android TV boxes and replicate themselves across a network. One model successfully spread to all eight devices in a simulated environment, although researchers deliberately simplified the exploitation process. Anthropic predicts that smaller models could achieve similar capabilities by year's end, potentially enabling decentralized AI worms without a central command infrastructure. Such malware would likely spread slowly,

Starting point is 00:11:10 and researchers emphasize that no fully autonomous AI worm has yet emerged. Large model transfers could also make these infections easier to detect, Still, the research suggests another potential evolution in botnet technology. The Federal Trade Commission is suing Dimitri Belkin and 12 businesses, alleging that they exploited victims of online extortion scams while collecting at least $60 million in customer payments. The companies advertised digital forensic services promising to identify blackmailers, stop threats, and coordinate with law enforcement.

Starting point is 00:11:46 Instead, the FTC alleges that they fabricate, evidence, failed to deliver promised services, and pressured frightened customers into paying thousands more. Employees allegedly followed scripts designed to amplify victims' fears, while the businesses suppressed negative reviews, posted fake testimonials, and directed complaints to a counterfeit Better Business Bureau website. Some customers reportedly remain trapped in payment agreements years later. The FTC is seeking a court order to halt the operations, alleging years of deceptive and abusive business practices. Microsoft, working with Japanese law enforcement and health ISAC, has dismantled key infrastructure

Starting point is 00:12:31 powering a major Chinese-language cybercrime marketplace. The operation targeted three platforms, Yamstor, Kogui, and Iron Man, which supplied criminals with fraudulent accounts, tools, and thousands of impersonation templates. The coordinated takedown in the United States. involved seizing domains, disabling over 20,000 accounts, and blocking more than 100,000 sites. Resecurity, Cloudflare, Oracle, ProofPoint, and TRM Labs also assisted in the takedown. Stick with us after the break as Rob T. Lee, Chief of Research and Chief AI Officer at Sands and Lynn Dome, executive director at WIS, are sharing a preview of the Sands 20206 Difference Maker Awards.

Starting point is 00:13:24 and taking a patch Tuesday snow day. When you're running security for a fast-growing company, the stakes keep rising, more compliance frameworks, more vendors, more risk, and a board that wants the whole picture in one place. The problem is your compliance data usually isn't in one place. Controls live in one tool, vendor risk, and another, and customer commitments are buried in contracts. So your team spends more.

Starting point is 00:14:07 time stitching everything together and making decisions based on data that may already be a quarter old. Vanta connects it all. Its agenic trust platform is built for enterprise scale, with more than 400 integrations and continuous monitoring to automate evidence collection, surface the risks that matter, and organize audits around your auditor's requirements. And the Vanta agent works around the clock with full program context, helping make sure nothing slips to the cracks. Vanta says customers see a 526% return on investment over three years with payback in three months. More than 16,000 companies trust Vanta, including Snowflake, Atlassian, and Ramp. Learn more at vanta.com slash cyber. Social engineering attacks look trustworthy, a routine

Starting point is 00:15:10 request, an internal email, a familiar face on a call, but Dopple sees through the disguise. AI native platform detects and disrupts attacks across every channel, trains employees to recognize deepfakes and deception, and investigates every fish to take down the campaign behind it. They fight relentlessly to protect your business, brand, and people. Dopple, outpacing what's next in social engineering. Learn more at doppel.com. That's d'Op-P-E-L.com. Dave Bittner recently sat down with Rob T. Lee, Chief of Research, and Chief AI Officer at Sands and Lynn Dome, Executive Director at Wiesis,

Starting point is 00:16:06 as they shared a preview of the Sands 20206 Difference Maker Awards. So let's start off with a little bit of history here. We're talking about the Sands Difference Maker Awards. Rob, can you give us a little bit of the backstory as to how did this begin and how long has it been running? Well, officially it's been running for about two decades. Our founder, Alan Poller, started this in the mid-2000s with an effort to, you know, essentially it was a small luncheon at the time to help identify and kind of reward and acknowledge those

Starting point is 00:16:42 individuals working tirelessly throughout the industry. He wanted a way to recognize those individuals as I thank you. And it was a lot more intimate back then. You know, cybersecurity was not as, you know, the industry that it is now. And, you know, kind of was a small, you know, thank you from Allen to these individuals. And it's kind of grown since that point. After COVID, Sands decided to, we noticed that there's not a lot of true industry

Starting point is 00:17:16 independent awards that are vendor neutral that are really trying to recognize, not just in one category, but many categories, meaning that we have a rising star category CISO, we identify lifetime achievement. And we wanted it to be not just a popularity contest, which is the public side of the nomination and voting. We also have a definitive advisory board.

Starting point is 00:17:44 And the advisory board also, you know, is like with industry luminaries that have their own voting for the finalists. to have their own selection. So it's, you know, we can't have someone just pad the voting box and saying, hey, they won because they had more people vote for them because they have a really large family, that were able to do both and recognize both the popularity, you know, popular vote, as well as the advisory board vote for every single category.

Starting point is 00:18:11 And so that's where it stands today. And, you know, it continues to grow in popularity. And I think the fact we're trying to do it as neutral as possible is a testament to the advisory boards advice and, you know, goals of, you know, Sands and RSAAC who are now partnered together on doing these. I should mention just for full disclosure that I'm honored to be a member of the advisory board this year and also is honored to receive a difference maker award at last year's ceremony.

Starting point is 00:18:41 Lynn, I'm curious from your point of view, why are awards like this important and what made you decide to play a part in all of this? Oh, gosh, yes. I mean, awards like this are super critical for the cybersecurity workforce for all the initiatives and to pay, just give the credit where the credit is due. So this type of awards is very unique in the fact that what we're focusing is on real world practical contributions. And we're honoring the practitioners who solve the real problems, the mentors, the newcomers, the aspiring CSOs, the lifetime achievement. I mean, it's really incredible to be able to give this type of credit and to have this vendor neutral ground to be able to recognize those major contributors that are really reshaping and developing the workforce what it needs to be to solve the challenges of today. And as you know, cybersecurity is ever evolving. I mean, the rapid digitization is so intense and so incredible. And there's so many individuals out there that are working full steam ahead to make the protection

Starting point is 00:19:53 that we need happen. And so this type of award and this ceremony that Sands has put together, and I didn't even realize, Rob, how long that the Difference Maker Awards has been going on, it really establishes a great framework of giving that recognition back to the community. And the Golden Key is the award. Dave, you received it. I've received two different Smakers Awards, And that golden key that we receive is that part of that award ceremony is really symbolic as we've all come together now in this advisory board capacity on opening these doors for other individuals. So it was a great honor three years ago to receive these awards myself and to become a part of the advisory committee last year and again this year and pay it forward for the community and be a part of the energy. And just it's very energizing to be boots on the ground and making this type of recognition. ignition happen. Rob, I have to say one of the things that's impressed me with the several times I've

Starting point is 00:20:52 been able to attend the awards ceremony is, as you say, this is more than a popularity contest. It's not just what I would, we sometimes jokingly refer to as the usual suspects. You know, there are names that come up over and over again in our industry, and many rightfully so. But I was particularly impressed with the international reach of these awards, that there are people from all over the world who are being honored here. Can you touch on that element? Well, I think it speaks to, we end up looking at things to a lens that, you know, clearly in our neighborhood of people that we interact with and, you know, who we bump into. But cybersecurity, you know, our relationships extend so far beyond that. So when Len,

Starting point is 00:21:35 you end up talking about the award, or David, you, or others, people look into it. And they're saying, well, what is this? And it kind of has hit this, you know, almost viral. aspect of, especially during the nominations phase, where there's so much good work going on outside of our traditional communities that deserve to be recognized. And the hard part, though, is in some of these cases, I remember like three years ago, we had, I should have looked up their name before we did this, but someone from Africa won the award. So we have to reach out and, you know, get them to pre-record it because some of them had problems even getting visas just to come to the award ceremony, you could just tell, you know, A, what they did was incredible. In many cases,

Starting point is 00:22:21 it's, you know, rising star really engaging the community, you know, so we have rising star community champion out of the year. And when they talk about their, you know, how meaningful the award is to them, it is, you know, shows how close and working together the world is on these really challenging problems. And our community is defined by what we see in front of us. but it really is how we affect things worldwide. And sometimes I'm even surprised when I go overseas, like when people talk about this, that's the first thing that they mention is like,

Starting point is 00:22:55 you know, hey, thanks for, you know, Sands and, you know, we sit in a bunch of other organizations for what you do. And Lynn, I bet the same thing is, you know, probably true for your organization. Like there's always that, I didn't realize that we had, you know, people, you know, located there. This is great, you know, I'm glad you're part of the organization. And it's always eye-opening and surprising, you know,

Starting point is 00:23:15 how far things extend behind, you know, the horizon view I have in just my local community. Lynn, do you want to comment on that, the aspect for you and the collaboration or the, with WISIS? Oh, yeah. I mean, 100%. What awards like this and what communities like WIS bring to the forefront is this global community all around this world, this international focus, and it brings it even closer to the reality. So wherever I'm at, there's this global cyber sisterhood. and a group of women and men and allies and advocates that are all here to support our mission and the work that we do for the good workforce initiatives that we support and the impact that we're making on the workforce. That's incredible.

Starting point is 00:23:59 And when you have awards like the difference makers too, and you're sitting in the audience and you're observing all these individuals receiving recognition and learning new bits of information about individuals that aren't in your circles yet, is that network, that connection, that close-knit community that means so much to everyone. And that's really powerful. It's a powerful place to be. And I do have to say that when we went into COVID, it even allowed us to create a broader international reach

Starting point is 00:24:31 because we, as an organization, as a WIS organization, we're able to let down our own guardrails of in-person activities and events. And with that virtual reach, we're now able to partner with Australia and with everyone within Asia and Africa, we had this tremendous growth as an organization. And now six, you know, seven years later, as we're going to these places, we have boots on the ground of individuals

Starting point is 00:24:59 that are running these organizations in a very powerful way, building a presence, building that network, building the community, and bringing more opportunities to so many other individuals to not only get into cybersecurity, but really importantly stay and have career growth.

Starting point is 00:25:14 and advancement opportunities to extend from it. So, you know, that's another area that the difference maker awards really hits the nail on the head is it's giving the recognition and the credit for individuals at points, pivotal points within their career. That's really amplifying the work that they're doing. And so it's a game changer for so many. And, you know, it's really lovely to be a part of it all. Rob, I should mention the actual event itself, which this year is December 15th in Washington, D.C.,

Starting point is 00:25:42 is indeed a first-class event. Why is it is important for you to have people gather in person get dressed up and enjoy this special night together? Well, it's a serious affair. You know, just like other awards, you know, we should go to the nines. Essentially, like, you know, really trying to say, hey, listen, you know, we're recognizing people and we should, you know, step up to that occasion. It goes back to my military roots.

Starting point is 00:26:10 And, you know, when we ended up having formal affairs, where we'd dress up in our mess dress, it is during those events where the true recognition of the heroes come into play. And why in person, you know, versus something online, it's your connection and be able to meet someone. And let's assume, you know, I'm sure this probably happened with both of you, I guarantee that there's two to three of those who won an award have already formed a relationship together that extended beyond that group. And that tipping point. that occurs, you know, the effect of that connection could lead to the next WISS. And I think you can't do that online where we're, you know, right now conversing on a podcast,

Starting point is 00:26:55 we log out and, you know, 10 minutes or so when we go about our lives, you know, these connections where you sit down and actually get to know, you know, a little bit of their background, their kids, it's that in-person where it's less of a convenience, but sometimes the convenience of the world we live in right now, you know, takes away from the interpersonal relationships that leads to the next great thing. And if the awards is that dot connection, and it's happened for me. You know, Lynn and David, I imagine it probably happened for you guys, too. There's a story I bet you both of you are sitting on that came from attending those awards in person. And in five, ten years, someone is going to be on the stage and saying the reason we're winning this award is because we

Starting point is 00:27:39 actually met here five, 10 years ago. Yeah, absolutely. I agree. And it's true. The opportunity to meet folks who I wouldn't cross paths with in any other circumstance. And on an evening of celebration really leads to unique relationships. That was Dave Bittner, sharing a preview of the Sands 2020s D.O.T. Lee, Chief of Research and Chief AI Officer at Sands and Lynn Dome. Executive Director at WESIS. Insurance is entering a new era. Policyholders expect a fast and flexible experience from the insurers they trust.

Starting point is 00:28:30 That's why modern insurers run on Adion. From effortless premium collections to instant claims payouts, Adion's single platform automates your entire policy lifecycle. A single platform to reduce churn and claims fraud. Drive revenue. Stay in control of how your money moves. Adion, FinTech built for your next move.

Starting point is 00:28:54 And now a word from our sponsor, Trinity Cyber. Detection and response was failing before AI. Now it's breaking under the speed and scale of AI-driven threats. That's the reality Trinity Cyber was built for. The Trinity Cyber Platform analyzes network sessions in real time, removes malicious content in line, and provides unified control across users, applications, devices, networks, and AI.

Starting point is 00:29:23 By bringing protection and policy together, Trinity Cyber helps security teams reduce risk, simplify operations, and stop threats before they become incidents. Learn how at trinitycyber.com. And now a word from our sponsor, SpectorOps. Today, AI is rapidly adding non-human and agentic identities to modern enterprise environments, creating new trust relationships and attack paths. Bloodhound Enterprise helps defenders map attack paths across AWS and hybrid environments as one connected graph. Identify the choke points that matter most and bring trusted attack path intelligence into approved AI workflows with Bloodhound Hunter.

Starting point is 00:30:18 See how SpectorOps helps teams secure the AI-driven identity era at SpectorOps.io. And lastly today, patch Tuesday is becoming such a dreaded occasion that some cybersecurity leaders are apparently treating it like a holiday, preferably one spent somewhere without Wi-Fi. Of the 500 UK security executives surveyed by managed detection and response provider Sokura, 22% of those executives have called in sick or deliberately scheduled time off to avoid the monthly patching ritual. Meanwhile, 41% report working overtime and 29% experience significant anxiety the night before. And who can blame them? Because the workload is not getting any lighter. AI-powered vulnerability research is helping vendors to uncover more flaws with Microsoft's October Patch Tuesday, as I mentioned at the top of today's show, delivering a record-breaking 1,411 security fixes. Ironically, AI may also offer some relief. 40% of respondents say that AI is helping to automate routine security tasks.

Starting point is 00:31:43 That said, Secura warns that mounting workloads and burnout do require better staffing and support. Because when the people who are responsible for fixing security vulnerabilities start looking for an escape route, that is probably a vulnerability worth addressing. And that's the CyberWire Daily brought to you by N2Wire. K Cyberwire. For links to all of today's stories, make sure to check out our daily briefing at thecyberwire.com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review on your podcast app. Please also fill out

Starting point is 00:32:33 the survey in the show notes or send an email to Cyberwire at n2K.com. N2K's lead producer is Liz Stokes. We are mixed by Trey Hester with original music and sound design by Elliot Haltzman. Our executive producer is Jennifer Ibin, Peter Kielpe is our publisher, and I'm Maria Varmazes, in for Dave Bittner today. Thank you for listening. We'll see you tomorrow. Every time your team deploys a new cloud workload or AI agent, another identity gets permanent access to your critical systems. Legacy tools were built to manage human employees, leaving modern machine and AI access largely unmanaged. That's where IDERA by Palo Alto Networks comes in.

Starting point is 00:33:38 Human, machine, AI, one identity platform for all. Ider replaces permanent permissions with dynamic access, so you can lock down every identity without slowing down your business. Secure every identity with IDERA by Palo Alto Networks. Visit Palo Alto Networks slash ILOA. Again, that's Palo Alto Networks.com slash IDI-R-A.

CyberWire Daily - Patching up the pieces.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.