CyberWire Daily - The door into SonicWall.

Starting point is 00:00:00 You're listening to the Cyberwire Network, powered by N2K. At Capital One, we don't just use technology. We architect it. Our teams have true end-to-end product ownership, shipping distributed systems that handle high concurrency at scale. No single-server bottlenecks, engineered beyond legacy downtime, and operating right here in downtown Toronto. That's technology at Capital One. Search Technology at Capital One. One, Canada.

Starting point is 00:00:42 When you're running security for a fast-growing company, the stakes keep rising, more compliance frameworks, more vendors, more risk, and a board that wants the whole picture in one place. The problem is your compliance data usually isn't in one place. Controls live in one tool, vendor risk, and another, and customer commitments are buried in contracts. So your team spends more time stitching everything together and making decisions based on data. that may already be a quarter old. Vanta connects it all.

Starting point is 00:01:15 Its agenetic trust platform is built for enterprise scale, with more than 400 integrations and continuous monitoring to automate evidence collection, surface the risks that matter, and organize audits around your auditor's requirements. And the Vanta agent works around the clock with full program context, helping make sure nothing slips through the cracks.

Starting point is 00:01:38 Vanta says customers see a 526-p2,000, return on investment over three years with payback in three months. More than 16,000 companies trust Vanta, including Snowflake, Atlassian, and Ram. Learn more at vanta.com slash cyber. Sonic Wall issues emergency patches. European wind and solar sites are exposed online. South Korea warns of AI-powered attacks on banks. Maria Bermazis unpacks the EU's new space threat response architecture.

Starting point is 00:02:25 Google patches dozens of high-severity chrome flaws. Researchers uncover an SSRF vulnerability in harbor. AI reshapes vulnerability management. Wikimedia says OpenAI agents repeatedly broke its rules. Pone to own kicks off in Ireland. Our guest is Derek Holt, CEO of Digital AI, who says AI has killed the cybersecurity response window. And Vin there, done that.

Starting point is 00:02:57 It's Wednesday. October 7, 26. I'm Dave Bittner, and this is your Cyberwire Intel briefing. Thanks for joining us here today. It's great as always to have you with us. Sonic Wall has released hot fixes for a maximum severity server-side request forgery vulnerability affecting MSA-1,000 secure access appliances. The vulnerability affects the appliance workplace interface on multiple models. An unauthenticated remote attacker could exploit the flaw

Starting point is 00:03:55 to make requests through the appliance, potentially reaching internal functions and performing unauthorized operations. Sonic Wall says there's currently no evidence the vulnerability is being exploited, but it's urging customers to install the fixes. Shadow Server is tracking more than 400 internet-exposed SMA-1000 appliances.

Starting point is 00:04:18 The warning follows a string of attacks against the product line. Threat actors exploited several SMA 100-0 days earlier this year, including flaws used to deploy malware and vulnerabilities CISA-linked to ransomware groups. Dutch researchers have identified more than 8,500 internet-facing administrative systems tied to wind and solar sites across 35 European countries, warning that some could potentially give attackers operational control. Most were login or administrative pages, but researchers believe roughly 181 sites

Starting point is 00:04:58 may have allowed full control. One exposed turbine interface displayed live data alongside start, stop, and reset controls, and some systems managed multiple turbines or entire farms. Spain had the most exposed solar systems, while Germany led in exposed wind systems, exposed wind systems. Researchers urged operators to remove administrative interfaces from the public internet. The findings come amid heightened concern over attacks on European critical infrastructure,

Starting point is 00:05:31 including a December 2025 cyber attack affecting 30 wind and solar sites in Poland. South Korean President Li J. Yong says there are signs AI models were used in recent cyber attacks against the country's banks, prompting him to call. for cybersecurity defenses designed for the AI era. South Korean police have launched a broad investigation after several commercial banks reported attacks involving breaches of customer information. Authorities haven't disclosed what AI tools may have been used or the full extent of the breaches. Financial regulators have shared information on 28 unique IP addresses associated with recent

Starting point is 00:06:15 hacking attempts and urged the sector to maintain heightened vigil. LIE called for officials to quickly establish what happened, limit the damage, and concentrate personnel and resources on responding to the attacks. Maria Vermazes is host of the T-minus Space Cyber Weekly podcast. Today, she joins us with news of the EU's new space threat response architecture. Thank you, Dave. The European Union has strengthened its ability to respond. respond to threats against space systems by adopting the enhanced space threat response architecture,

Starting point is 00:06:55 or STRA. That framework was first created in 2023 and is an information-sharing initiative to inform collective response to space-related incidents, and it helps the EU to monitor, assess, and respond to threats that could affect European security, critical services, and the operation of EU space programs. Crucially, the recent updates to the EU's space threat response architecture expands the scope of the threat environment, as the previous iteration had too narrowly defined threats to the space domain to remain effective. According to an official EU fact sheet about this new update, the nature of threats against space assets now not only include anti-satellite strikes and interference with satellite signals, but they also include cyber attacks against

Starting point is 00:07:45 space infrastructure and other forms of hostile or irresponsible behavior. Notably, the updated framework also establishes operational procedures for monitoring threats, issuing alerts, and quickly coordinating responses through the EU's common foreign and security policy tools. Under the new guidance, the EU's high representative can now authorize a provisional, urgent response to an ongoing threat when immediate action is needed. For the CyberWire Daily, I'm Maria Vermazzo. from T-minus Space Cyber Briefing. Back to you, Dave.

Starting point is 00:08:19 Be sure to check out the T-minus Space Cyber podcast wherever you get your favorite shows. Google has released Chrome 155 with fixes for 247 vulnerabilities, including four critical use-after-free flaws affecting several browser components. The update also patches, 53 high-severity bugs,

Starting point is 00:08:43 and 190 medium-and-low-severity issues, issues. External researchers reported 62 of the vulnerabilities, with one researcher finding several using AI-assisted techniques. Google has paid about $33,000 in disclosed bug bounties so far. The company says there's no indication any of the patched vulnerabilities are being exploited in the wild. OX Research has disclosed a server-side request forgery vulnerability in Harbor, the OpenSor. container registry that could allow registered users to steal a server's cloud credentials. The flaw stems from insufficient validation of webhook destinations, allowing a project

Starting point is 00:09:29 administrator to point harbor at internal addresses, including cloud metadata services. Because users automatically become administrators of projects they create, deployments allowing self-registration face additional risk. Researchers found more than 6,000 Internet-accessible Harbor instances running vulnerable versions, including 718 cloud-hosted systems where metadata services were directly reachable. The vulnerability could let attackers obtain Harbor's IAM credentials and potentially access cloud storage, Kubernetes resources, or other internal services beyond their project permissions.

Starting point is 00:10:11 Harbor accepted the report in September and has released fixes. AI is forcing security teams to rethink traditional vulnerability management as attackers use the technology to discover and exploit weaknesses faster and at greater scale. An article in CSO Online says security leaders argue that annual pen tests are no longer enough. Instead, organizations increasingly need continuous monitoring, automated pen testing, red teaming, and attack path validation to determine which vulnerabilities can actually lead to meaningful compromise. AI-powered offensive tools can help prioritize fixes and identify dangerous chains of otherwise minor flaws. But experts caution against removing humans from the equation.

Starting point is 00:11:03 Skilled practitioners remain essential for deeper testing, validating automated findings, and understanding how attacks work. There's also concern that automating entry-level work could weaken the pipeline for future experts. For organizations without established red teams, experts recommend relying on qualified outside partners while focusing internal resources on accelerating remediation. The Wikimedia Foundation says OpenAI agents repeatedly violated its rules, attempting unauthorized Wikipedia edits, trying to misuse, a citation tool to fetch remote data and unsuccessfully targeting its Etherpad note-taking service.

Starting point is 00:11:49 Wikimedia also attributed millions of automated requests, page crawls, and data queries to OpenAI-operated agents. Activity, it says, may have contributed to a partial service outage in May. The investigation found no evidence. The agents stole Wikimedia data or used its services to coordinate with one another. Still, the Foundation warned that AI agents are creating significant security and operational burdens, including increased bandwidth consumption and cleanup work. Wikimedia called on AI companies to better monitor their agents and make them easily identifiable so website operators can control how they interact with their services. Ethical hackers uncovered 32-Zero-day vulnerabilities on the first

Starting point is 00:12:39 day of Pone to Own Ireland, 2026, earning more than $368,000 in prize money. Researchers targeted smartphones, smart home devices, printers, and AI products, including OpenAI Codex and Light LLM. Successful exploits included seven zero days chained against a Phillips Hugh Bridge Pro, five used to compromise Oracle's autonomous AI database, and an argument injection. flaw targeting Codex. Ponta-Ones' Zero-Day Initiative responsibly disclose the findings to vendors, which receive 90 days to issue fixes before details are published.

Starting point is 00:13:21 The competition comes as vulnerability discoveries accelerate, partly driven by AI-assisted research. Google data cited in the report shows monthly vulnerability discoveries more than doubled between January and August, while exploitation of disclosed flaws has also been. increased. Coming up after the break, my conversation with Derek Holtz, CEO of Digital AI, who says AI has killed the cybersecurity response window. And VIN there, done that. Stick around. At Capital One, we don't just use technology. We architect it. Our teams have true end-to-end product ownership, shipping distributed systems that handle high concurrency at scale. No single-server bottlenecks.

Starting point is 00:14:26 engineered beyond legacy downtime, and operating right here in downtown Toronto. That's technology at Capital One. Search Technology at Capital One, Canada. And now a word from our sponsor, Trinity Cyber. Detection and response was failing before AI. Now it's breaking under the speed and scale of AI-driven threats. That's the reality Trinity Cyber was built for. The Trinity Cyber platform analyzes network settings,

Starting point is 00:15:02 in real time, removes malicious content in line, and provides unified control across users, applications, devices, networks, and AI. By bringing protection and policy together, Trinity Cyber helps security teams reduce risk, simplify operations, and stop threats before they become incidents. Learn how at trinitycyber.com. We're some see heroes and other see egos. Bloomberg sees the air. of billionaire athletes. A fad to some, the future of money to others. We see crypto's trillion dollar swings.

Starting point is 00:15:46 The end of jobs or the end of human struggle. We see the endless funds fueling the AI hype. While others follow the noise, we follow the money. Learn more at Bloomberg.com. And now a word from our sponsor, SpectorOps. Today, AI is rapidly adding non-human and agentic identities to modern enterprise environments, creating new trust relationships and attack paths. Bloodhound Enterprise helps defenders map attack paths across AWS and hybrid environments as one connected graph,

Starting point is 00:16:29 identify the choke points that matter most, and bring trusted attack path intelligence into approved AI workflows with Bloodhound Hunter. See how SpectorOps, helps team secure the AI-driven identity era at specterops.io. Derek Holt is CEO of Digital AI. We recently got together to hear his views on how AI has killed the cybersecurity response window. So obviously the cybersecurity topic has been prominent, frankly, in many ways since computers

Starting point is 00:17:17 were connected or networked together. So the earliest days of the, I guess, what eventually was. called the internet. One of the things that was a reality from the beginning was it was human speed attacks typically against human speed defenses. And I think what has really dramatically changed, yes, one,

Starting point is 00:17:34 things have become more hyper-networked. Yes, more things have become more driven by software, which just creates a larger threat landscape, but also AI has changed the economics. The speed, yes, but the scale, the scope and the sophistication of

Starting point is 00:17:49 the attacks. And so we now have a scenario where it's the machine speed versus human speed, and so we as an industry need to catch up with that. Well, speaking specifically of the security response window, what are the changes you're tracking there? Well, I think when we think about the economics as well as the speed, attackers just simply have a shorter workflow, right? Their loop is fine and exploit,

Starting point is 00:18:13 and that's become even easier in an age where agents and agent swarms can be spun up extremely quickly. Defenders must triage, assign that to a developer, an agent, fix, test, approve, release, distribute, and eventually have a, you know, confirm adoption. And so the window to find a vulnerability and patch it is much more complex than it is for an attacker to find an exploit. Is there a hope for automation on the defender's side? I think there are, there is. I think there's two paths that we see that are driving.

Starting point is 00:18:49 And certainly we as an industry need to get better at finding vulnerabilities early and often, and we need to shorten the window in which it could be patched. Certainly, AI plays ironically a role in the defense as well as obviously what we're defending against. But we also believe that regardless of how short that vulnerability identification and exploitation gets, it's still going to be longer than what the attackers are seeing. And so we believe that the world is going to continue to evolve to also ensuring that all applications, are able to protect themselves, that they are actively a part of their own defense,

Starting point is 00:19:24 in addition, of course, to the patching of vulnerabilities. To what degree do you think that the response to this new reality requires evolution versus revolution? To what degree can we lean on the things that we've learned in the past, and to what degree do we need new ideas? My view is that it's going to be a little bit of both, and I know that probably isn't as direct of an answer, but I certainly believe the processes of the past,

Starting point is 00:19:53 we need to be able to accelerate, we need to make them more robust, and we need to be able to automate and ultimately make them as autonomous as possible. But I do believe, given the shift in economics of attacks, that we are going to need to have new approaches as well. And I think you see that emerging in the industry. You see certainly traditional players advancing their approaches

Starting point is 00:20:14 and accelerating their approaches of the past, but you also see new entrants coming in with new perspectives. And as with most things, the answer is probably somewhere in the middle. You know, something that I've observed over the past year or so is there's really been a renewed emphasis on resilience. I'm curious if that's something that you've been tracking as well. Most certainly. I think a resurgence in resilience, I would say an acceleration also of risk management. There's a set of functional roles and areas of responsibility.

Starting point is 00:20:47 that have always been important and I think are becoming more important in this agentic world that we find ourselves in as we look at navigating, obviously the massive benefits that we're seeing from AI adoption, but also the risks that are emerging in parallel. What's your advice to that security professional, that defender who's feeling a little bit in the weeds perhaps at the rate of change that we're all experiencing here? Number one, there is a part of me that says, you know, one of the things that we are going to have to do as a group is really rally together as an industry. This is not something that a one individual or one company is going to solve. I think it's going to take a village, as they say. And ultimately,

Starting point is 00:21:28 my biggest recommendation, and we do this ourselves, there's a certain part of the security space that we play in, but there's also, we rely heavily on partners to be able to drive the holistic solution. So I'd say surround yourself with great subject matter experts. I'd say surround yourself with great partners. And as I'm sure has been the case for all of us get ready for a lot of information consumption because it is moving at breakneck speeds. That's Derek Holt from Digital AI. At Capital One, we don't just use technology. We architect it. Our teams have true end-to-end product ownership, shipping distributed systems that handle high concurrency at scale. No single-server

Starting point is 00:22:22 bottlenecks, engineered beyond legacy downtime, and operating right here in downtown Toronto. That's technology at Capital One. Search Technology at Capital One, Canada. DLP sucks. Every CISO knows it. 20 years of rules and regex built for another era. Jazz is the DLP that deeply understands your business.

Starting point is 00:22:54 Melody, Jazz's agentic investigator, weighs every data movement against the data, systems, people in process, then provides analytical. list with the few incidents fully investigated. In 30 days, 2 million signals in, about 80 investigated incidents out. No rules written. Jazz won the 2026 Crowdstrike AWS and NVIDIA startup accelerator from a nearly thousand applicants. See Melody inaction at jazz.security slash N2K. Every time your team deploys a new cloud workload or AI agent, Another identity gets permanent access to your critical systems.

Starting point is 00:23:45 Legacy tools were built to manage human employees, leaving modern machine and AI access largely unmanaged. That's where IDERA by Palo Alto Networks comes in. Human, machine, AI, one identity platform for all. Idera replaces permanent permissions with dynamic access, so you can lock down every identity without slowing down your business. Secure every identity with Idira by Palo Alto Networks. Visit Palo Alto Networks slash Idira.

Starting point is 00:24:18 Again, that's Palo Alto Networks.com slash IDIRA. And finally, your new car may be talking behind your back. Northeastern University researchers tested 21 connected cars and found 19 contacted outside companies over Wi-Fi, while 11 reached advertising, tracking, or analytics domains. Google-owned domains appeared in traffic from 13 cars. The researchers couldn't inspect most cellular traffic, so they say those numbers are likely an undercount.

Starting point is 00:25:08 The companion apps were chatier still. Seven sent vehicle identification numbers to tracking or analytics companies, sometimes alongside email addresses, phone numbers, or precise location. Four were General Motors apps, notable given GM's recent settlements over its handling of driver data. Researchers say a VIN is particularly useful for tracking because, unlike an advertising ID, it can't be reset. So while your car may promise freedom on the open road, apparently some of its software would prefer you remain very specifically.

Starting point is 00:25:46 identifiable. And that's the CyberWire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show,

Starting point is 00:26:18 please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to Cyberwire at N2K.com. N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazas. Our executive producer is Jennifer Ibin. Peter Kilby is our publisher, and I'm Dave Bittner.

Starting point is 00:26:43 Thanks for listening. We'll see you back here tomorrow. At Capital One, we don't just use technology. We architect it. Our teams have true end-to-end product ownership, shipping distributed systems that handle. high concurrency at scale. No single-server bottlenecks, engineered beyond legacy downtime, and operating right here in downtown

Starting point is 00:27:23 Toronto. That's technology at Capital One. Search Technology at Capital One, Canada. Yes, you can have an enterprise network that's secure and reliable and high performance, and no, you don't need to choose the best two out of three. With Meter, you can get the end-to-end network built from the ground-up. fast to deploy and easy to manage. That's because meter is software-led for easy installation, maintenance and control for everything running on your enterprise network. Hardware, firmware,

Starting point is 00:28:03 and software all working together from the start seamlessly on a unified platform that's secure by design. You can't protect what you don't know exists, which is why meter gives you comprehensive visibility into wired and wireless routing, switching, firewalls, DNS security, and VPNs. You'll really know what's running on your network down to the most granular client level. Step off the hardware box upgrade treadmill and switch to Meter for a predictable fee and free up your team to spend time on all the other things that keep your business running. Try it out for yourself and book a demo online at meter.com slash cyberwire. That's M-E-T-E-R-com slash Cyberwire. Thank you.

CyberWire Daily - The door into SonicWall.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.