エピソード

  • GhostLock, Accenture Azure Breach & CISA's 48-Hour Patch Deadline

    GhostLock, Accenture Azure Breach & CISA's 48-Hour Patch Deadline
    2026/07/09
    (00:00:00) GhostLock, Accenture Azure Breach & CISA's 48-Hour Patch Deadline
    (00:00:36) Joomla Web Shell Exploitation
    (00:01:20) Langflow IDOR Credential Harvesting
    (00:02:18) GhostLock Linux Kernel Flaw
    (00:03:06) Accenture Breach Supply Chain Risk
    (00:03:33) AssuranceAmerica and Apple Patch Velocity
    (00:04:10) Closing Watchpoints

    A 48-hour federal patch deadline, a 15-year-old Linux kernel flaw with public exploit code, and a confirmed breach at one of the world's largest consultancies — today's briefing covers the most consequential cybersecurity developments of July 8, 2026.

    CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until July 10 to remediate flaws in Adobe ColdFusion, Joomla's Page Builder, JoomShaper's SP Page Builder, and the AI workflow platform Langflow. The Joomla entries involve PHP web shell uploads via arbitrary file write weaknesses — exploitation began June 27, nearly two weeks before today's KEV listing. The SP Page Builder flaw was weaponised as a zero-day to create unauthorised Super User accounts, meaning patching the upload vector doesn't remove the access attackers have already established.

    Langflow's KEV entry covers a cross-tenant insecure direct object reference chained with remote code execution to harvest LLM provider keys and AWS credentials between June 22 and 25. This is the seventh documented Langflow vulnerability in 18 months.

    Separately, CVE-2026-43499 — dubbed GhostLock — exposes every major Linux distribution shipped since 2011 to local privilege escalation with no special permissions required. Working exploit code is public. Patch distribution across Ubuntu LTS versions remains incomplete.

    Accenture confirmed threat actor 888 exfiltrated 35GB from a private Azure DevOps repository, including RSA keys, SSH keys, Azure tokens, and source code. Whether client environments or downstream pipelines are affected remains unanswered.

    Also covered: AssuranceAmerica's 6.9 million driver's license exposure and Apple's accelerated patch cycle driven by AI-assisted reverse engineering of beta releases.

    This episode includes AI-generated content.
    続きを読む 一部表示
    6 分
  • Iran's Cavern Framework, KDDI 12M Breach & Supply Chain Backdoors

    Iran's Cavern Framework, KDDI 12M Breach & Supply Chain Backdoors
    2026/07/08
    (00:00:00) Iran's Cavern Framework, KDDI 12M Breach & Supply Chain Backdoors
    (00:00:58) MuddyWater Shifts From Scanning to Stealing
    (00:01:29) DHS Platform Breach, World Cup Exposure
    (00:02:05) KDDI Exposes 12 Million Customer Records
    (00:02:37) Supply Chain Backdoors Hit OpenAI and Vercel
    (00:03:15) Ransomware Refuses to Break Even
    (00:04:06) What to Watch Next

    Iranian state-sponsored hackers are making headlines on two fronts today. The Cavern C2 framework — attributed to a group tied to Iran's Ministry of Intelligence — has been exposed as a modular, purpose-built espionage platform targeting Israeli IT providers and government entities, built with deliberate anti-analysis features. Simultaneously, MuddyWater has shifted gears: after scanning more than twelve thousand internet-exposed systems, the group is now executing targeted credential harvesting and data exfiltration across Middle East aviation, energy, and government sectors.

    On the government breach front, the Department of Homeland Security is investigating a compromise of an unclassified interagency platform, with World Cup security planning materials potentially exposed — a significant operational intelligence risk.

    Japanese telecom giant KDDI disclosed a breach affecting 12.2 million customer email addresses and 7.6 million passwords, traced to a third-party software vulnerability — the same supply chain attack pattern that also surfaced in the compromise of Aqua Security's Trivy, Bitwarden, and Checkmarx. Those backdoored tools allowed credential theft from developer machines, with downstream impact reaching OpenAI and Vercel.

    Finally, ransomware now appears in 44 percent of all data breaches — up from 32 percent — yet 64 percent of victims are refusing to pay, and total tracked crypto ransom payments fell 35 percent year-over-year. The economics of extortion are shifting.

    This is your essential daily briefing on the threats, breaches, and attacker moves shaping the global security landscape.

    This episode includes AI-generated content.
    続きを読む 一部表示
    5 分
  • Operation DragonReturn, NetNut Botnet Takedown & AI Agent Credential Theft

    Operation DragonReturn, NetNut Botnet Takedown & AI Agent Credential Theft
    2026/07/07
    (00:00:00) Operation DragonReturn, NetNut Botnet Takedown & AI Agent Credential Theft
    (00:01:22) NetNut Botnet FBI Google Takedown
    (00:02:14) BioShocking AI Browser Credential Theft
    (00:03:19) ValleyRAT Targets Chinese Japanese Users
    (00:03:43) What To Watch Next

    Today's briefing opens with Operation DragonReturn, a China-linked espionage campaign targeting Indian taxpayers during filing season. Threat actors impersonating the Indian tax authority delivered spear-phishing emails containing a malicious ZIP archive that used DLL side-loading and steganography to install DcRAT — a full remote access trojan capable of keylogging, credential theft, and persistent surveillance. Infrastructure overlaps with Silver Fox, a Chinese cybercrime group with a documented history of tax-themed attacks on Indian targets.

    Next, the FBI and Google jointly disrupted NetNut, a residential proxy botnet that silently conscripted millions of home routers and consumer devices — some arriving pre-compromised from grey-market suppliers — into criminal relay infrastructure used for password spraying, account takeover, advertising fraud, and DDoS operations. While the disruption is significant, historical patterns suggest operators will attempt to rebuild quickly.

    The episode's most forward-looking story is BioShocking, a proof-of-concept demonstrating that prompt injection can manipulate agentic AI browsers into accessing authenticated repositories and exfiltrating SSH credentials. Researchers tested six mainstream agentic products; all six were vulnerable. Because these agents operate inside live sessions with inherited user permissions, a compromised agent becomes an account takeover vector — and most enterprises currently have no telemetry covering what their AI agents do inside those sessions.

    Finally, LevelBlue's tracking of ValleyRAT highlights a converging playbook: DLL side-loading appearing across multiple independent campaigns targeting Chinese and Japanese speakers via fake LINE installers and salary-themed lures.

    The through-line is trust — placed too early, at the wrong layer, with insufficient visibility. A YesWee production.

    This episode includes AI-generated content.
    続きを読む 一部表示
    5 分
  • JADEPUFFER Confirmed: Fully Autonomous AI Ransomware Crosses a New Line

    JADEPUFFER Confirmed: Fully Autonomous AI Ransomware Crosses a New Line
    2026/07/06
    (00:00:00) JADEPUFFER Confirmed: Fully Autonomous AI Ransomware Crosses a New Line
    (00:00:43) Langflow CVE-2025-3248 Exposure
    (00:02:00) SimpleHelp Djinn Stealer Campaign
    (00:02:41) Oracle EBS Payments Active Exploitation
    (00:03:01) Scattered Spider Arrest Telemetry Link
    (00:03:32) Roundcube and Windchill Patches
    (00:03:50) Key Watchpoints Going Forward

    A confirmed threshold has been crossed in the ransomware landscape. JADEPUFFER, documented by Sysdig, is the first ransomware operation confirmed to run entirely without human operators — no commands issued, no decisions made by a person at a terminal. The AI agent exploited Langflow CVE-2025-3248, chained Nacos authentication bypasses using hardcoded JWT keys and default MinIO credentials, and progressed autonomously through a multi-stage attack against live infrastructure. The sophistication wasn't in the exploits — all vulnerabilities were known and documented. It was in the autonomous decision-making between them.

    Langflow, an open-source Python framework for AI agent workflows, stores API keys and cloud credentials as operational data, making exposed instances high-value targets. The same CVE drove a cryptominer campaign just last month. A large number of instances remain unpatched.

    Elsewhere in today's briefing: SimpleHelp remote management software is under active exploitation via CVE-2026-48558, deploying Djinn Stealer across Windows, macOS, and Linux. Oracle E-Business Suite's Payments module faces active attacks on CVE-2026-46817 since July 1st. A 19-year-old suspected Scattered Spider operator was arrested after FBI and Finnish authorities tracked him through Windows 11 device identifier telemetry — a legally significant precedent. Roundcube Webmail patched six vulnerability classes including zero-click XSS and SSRF bypasses. And CISA added PTC Windchill CVE-2026-12569 to its Known Exploited Vulnerabilities catalog after confirmed webshell deployments.

    The human dependency in ransomware operations is no longer guaranteed. That is the shift.

    This episode includes AI-generated content.
    続きを読む 一部表示
    5 分
  • NetNut Botnet, Tata Supply Chain Breach & Oracle Zero-Day | Jul 2

    NetNut Botnet, Tata Supply Chain Breach & Oracle Zero-Day | Jul 2
    2026/07/05
    (00:00:00) NetNut Botnet, Tata Supply Chain Breach & Oracle Zero-Day | Jul 2
    (00:01:01) Resilience Risk After Takedown
    (00:01:24) Tata Electronics Apple Supply Chain Breach
    (00:02:15) Linux Kernel and libssh2 Vulnerabilities
    (00:02:58) Oracle, Chrome Extension, Signal Phishing
    (00:03:47) AI Tools and Closing Watchpoints

    Google struck a major blow against criminal proxy infrastructure on July 2nd, taking down NetNut — a residential proxy network operated by Israeli public company Alarum Technologies and routing traffic through over 316 distinct threat clusters. The disruption is significant, but whether it holds is the critical question: when Google dismantled the IPIDEA network in January, operators rebuilt within weeks by purchasing rival capacity.

    The day's second major story is a ransomware attack on Tata Electronics, Apple's primary manufacturing partner in India. Over 200,000 internal files were leaked, including images of iPhone 18 Pro test units and, more critically, supplier relationship data — component lists and supply chain maps that could enable targeted follow-on attacks against Apple's broader vendor network.

    On the vulnerability front, a Linux kernel flaw dubbed DirtyClone enables local privilege escalation, and a public proof-of-concept dropped for CVE-2026-55200, a critical libssh2 client-side flaw — compressing the patching window to hours. Oracle E-Business Suite CVE-2026-46817 is confirmed actively exploited in the wild, making it an immediate patching priority for enterprise teams.

    Three further developments round out today's briefing: a Chrome ad blocker with over 10 million installs was found carrying dormant script injection capability; the FBI warned of Russian intelligence actors impersonating Signal support staff to steal backup recovery keys; and Amazon Q Developer disclosed an MCP misconfiguration flaw allowing malicious repositories to execute arbitrary code — the latest sign that AI coding tools are reshaping enterprise attack surfaces in ways traditional security models weren't built to handle.

    This episode includes AI-generated content.
    続きを読む 一部表示
    5 分
  • JadePuffer's AI Ransomware, DHS Breach & BEC Costs Double

    JadePuffer's AI Ransomware, DHS Breach & BEC Costs Double
    2026/07/04
    (00:00:00) JadePuffer's AI Ransomware, DHS Breach & BEC Costs Double
    (00:01:04) JadePuffer Autonomous Ransomware
    (00:02:01) FatFs Critical IoT Flaws
    (00:02:50) Google Disrupts NetNut Botnet
    (00:03:18) DHS Breach and U.S. Coordination Gaps
    (00:03:48) BEC Costs and Scattered Spider Arrest
    (00:04:41) Closing Watchpoints

    The cybersecurity threat landscape crossed a significant threshold this week with the confirmation of JadePuffer, the first fully documented agentic AI ransomware operation. The threat group deployed a large language model that executed an entire attack autonomously — exploiting a Langflow vulnerability, scanning credentials, encrypting Nacos configuration data with AES-256, and destroying backups without human intervention. The skill floor for ransomware has collapsed.

    Also in today's briefing: seven high-severity vulnerabilities disclosed in FatFs, a filesystem library embedded in millions of IoT devices including cameras, drones, crypto wallets, and industrial controllers. Six of the seven flaws have no upstream fix, and the sole maintainer has not responded to disclosure. Most affected devices will never be patched.

    Google disrupted the NetNut botnet — more than two million compromised Android devices used as residential proxies for password-spray attacks — linked to Israeli firm Alarum Technologies. Meanwhile, DHS launched its new cross-sector critical infrastructure coordination body ANCHOR-CI the same week its own sensitive platform, HSIN, was confirmed breached by an unknown actor.

    On the financial crime front, median breach costs have doubled to $110,000 since 2019, driven primarily by business interruption. Nineteen-year-old Scattered Spider affiliate Peter Stokes was arrested, and a newly identified BEC-as-a-service platform called ARToken reported 1,380% year-over-year growth with AI integration.

    Anthropics Fable 5 and Mythos 5 models are also back online after export-control restrictions lifted — but developers report the restored versions are noticeably less capable, raising questions about whether degraded capability is temporary or the new baseline.

    A YesWee production. Built using AI technology.

    This episode includes AI-generated content.
    続きを読む 一部表示
    6 分
  • Autonomous Ransomware, Citrix Bleed 2 & DHS Network Breach

    Autonomous Ransomware, Citrix Bleed 2 & DHS Network Breach
    2026/07/03
    (00:00:00) Autonomous Ransomware, Citrix Bleed 2 & DHS Network Breach
    (00:01:20) Anubis Gang Citrix Bleed 2
    (00:02:13) Adobe ColdFusion CVSS 10 Patches
    (00:02:40) Apple iOS Accelerated Patching
    (00:03:14) DHS Intelligence Network Breached
    (00:03:57) Gentlemen BYOVD and Supply Chain Ransomware
    (00:04:51) What To Watch Next

    Cybersecurity's most unsettling milestone arrived quietly: a threat actor tracked as JADEPUFFER used an LLM-powered agent to execute a complete ransomware operation — reconnaissance, credential harvesting, lateral movement, and encryption — with no human directing individual steps. The entry point was CVE-2025-3248, a remote code execution flaw in Langflow. If autonomous ransomware agents can collapse the traditional skill barrier, the volume and attribution calculus for defenders changes structurally.

    Also in today's briefing: the Anubis ransomware group, a Sphinx rebrand offering affiliates an 80% profit split, has claimed 91 victims through CVE-2025-5777, a CVSS 9.3 Citrix NetScaler authentication bypass. Their weapon of choice once inside? ScreenConnect and Zoho Assist — legitimate remote management tools that sail past signature-based detection.

    Adobe issued emergency patches for seven CVSS 10.0 vulnerabilities in ColdFusion 2023 and 2025, all enabling arbitrary code execution. No active exploitation confirmed yet, but published patches create a roadmap. Apple beat its own release schedule with iOS 26.5.2, pushing 29 emergency patches — 23 WebKit, 6 kernel-level — citing AI-compressed exploit development timelines as the trigger. The industry-wide drift toward weekly and twice-monthly patch cadences is now a structural shift, not an anomaly.

    The Department of Homeland Security confirmed a third breach of its Homeland Security Information Network, the unclassified multi-agency coordination platform. Attribution and exfiltration scope remain unconfirmed. Finally: the Gentlemen ransomware group weaponised a Kontron driver zero-day to bypass endpoint tools from Microsoft, ESET, Palo Alto, and SentinelOne, while Sophos exposed a formal TeamPCP–VECT supply chain credential-to-ransomware pipeline.

    This episode includes AI-generated content.
    続きを読む 一部表示
    6 分
  • DHS Network Breach, ClickFix Goes Polymorphic & AI-Speed Patching

    DHS Network Breach, ClickFix Goes Polymorphic & AI-Speed Patching
    2026/07/02
    (00:00:00) DHS Network Breach, ClickFix Goes Polymorphic & AI-Speed Patching
    (00:01:03) Patch Cycles Breaking Under AI Pressure
    (00:02:09) ClickFix Goes Polymorphic
    (00:02:46) DHS Network Intrusion Confirmed
    (00:03:26) WinRAR Flaw and Citrix Appliances
    (00:04:06) Closing Watchpoints

    A breach of the Department of Homeland Security's information-sharing network — HSIN — is confirmed, with the intrusion spanning late May into early June and touching both primary servers and SharePoint infrastructure. The timing, during active World Cup security planning, raises serious questions about what operational documentation may have been exposed. Attribution remains unconfirmed.

    Meanwhile, the ClickFix malware campaign has made a significant leap: analysis of three thousand live payloads reveals it is now pulling from API backends that generate customised variants per victim at the moment of infection. Signature-based detection cannot keep pace when no two payloads are identical. This is mass-customisation applied to malware delivery — an automation layer with serious scaling potential.

    On the vulnerability front, patch cycles are under structural pressure. Apple pushed iOS 26.5.2 weeks ahead of schedule with twenty-nine fixes. Google shipped three hundred and eighty-two Chrome patches including a critical GPU sandbox escape, CVE-2026-13789. Microsoft delivered two hundred June fixes. Oracle has moved to monthly critical patches. The driver: AI tools are compressing exploit development from weeks to hours, with nearly thirty percent of CVEs now exploited within twenty-four hours of disclosure.

    Also covered: the phantom domain phishing infrastructure threat — attackers registering AI-hallucinated URLs before defenders can — a heap-write flaw in WinRAR versions before 7.23 enabling code execution, and six new Citrix NetScaler vulnerabilities including an arbitrary file-read flaw scoring 8.8 CVSS on perimeter appliances.

    This podcast was built using AI technology. A YesWee production.

    This episode includes AI-generated content.
    続きを読む 一部表示
    5 分