Cybersecurity Today

Revolut Fooled by Fake Govt Data Requests, Microsoft RDP Patch Fallout, and Conti Dev Sentenced

David Shipley covers multiple cybersecurity headlines: Revolut disclosed extensive customer data after fraudsters used fake emergency requests from a legitimate government email account, apparently targeting high-net-worth crypto users and raising both phishing and physical safety risks. Microsoft issued out-of-band updates after September Patch Tuesday updates broke Remote Desktop and caused broader Windows instability across Windows 10/11 and Windows Server 2019–2025. A new IDC/GuidePoint report finds non-human identities can outnumber employees 75:1, with major inventory and least-privilege gaps, including around AI agents. A Ukrainian developer tied to the Conti ransomware group received a four-year U.S. prison sentence. Finally, a U.S. Customs supervisor was arrested for allegedly swapping CPUs and other components in government PCs for store credit, with no evidence of espionage so far.

00:00 Top Stories Kickoff 00:28 Revolut Data Request Scam 02:40 Patch Tuesday Patch Fallout 04:49 AI Tribble Identity Boom 06:28 Conti Dev Sentenced 08:02 AI Crime Accountability Gap 08:54 Customs CPU Swap Scheme 11:17 Wrap Up And Events

Host David Shipley covers multiple cyber stories: Florida confirmed criminals breached its DMV using credentials from a Plant City police officer that were improperly stored on a personal device; ShinyHunters claimed responsibility and the full scope remains unknown. IDScan also confirmed attackers accessed customer data in its cloud, involving over 153 million U.S. driver's license scans and 1.1 million Canadian scans, contributing to more than 160 million North American license records stolen this year.

A report says state governments lack money, staffing, and training to defend critical infrastructure as Iran-linked attacks hit water utilities. Researchers traced OpenAI agents uploading over 2,000 malicious RubyGems packages. Anthropic's threat report describes AI-enabled criminal and nation-state operations, including ShinyHunters and Russia's Midnight Blizzard. Finally, a new DOT rule will classify cyberattack-related flight disruptions as "not controllable," reducing passenger compensation despite compliance requirements.

00:00 Headlines Preview 00:35 Florida DMV Breach 01:14 IDScan Mega Leak 02:52 States Lack Cyber Resources 04:31 OpenAI Agents Malware Flood 06:28 Anthropic AI Espionage 08:13 Regulate Weaponized AI 08:53 Airlines Compliance Trap 11:10 Wrap Up And Sign Off

Defender Patch Broken in 24 Hours, AI Agents Hit Papercut Servers, FTC Rolls Back Health App Breach Rules

Microsoft patched a Defender zero day, but a day later researcher Nightmare Eclipse released "ShieldCrash," a new exploit that bypasses the ShieldBreak fix, itself a bypass of an earlier Defender flaw, with a proof of concept working on fully patched Windows 10, 11, and Server to enable arbitrary file reads as SYSTEM.

Researchers also tied recent Papercut print server compromises to a suspected Russian-speaking criminal who used hundreds of AI agents (OpenAI Codex and a DeepSeek model) plus tools like Mimikatz and Impacket to rapidly attack 440 servers across 395 organizations in 48 countries, heavily impacting schools and achieving domain admin in 12 cases.

The FTC rescinded a 2021 policy applying breach notification rules to health apps and connected devices.

Veradigm reported stolen customer data via a vendor compromise, while a ransomware gang claimed 3.5 million patient records.

Fortinet went 92 days without a new critical advisory before disclosing two new critical bugs.

Host David Shipley marks the 25th anniversary of 9/11.

00:00 Headlines Teaser 00:32 Defender Patch Bypass 02:47 AI Agents Hit Papercut 04:45 FTC Rolls Back Rules 06:17 Veradigm Breach Fallout 07:41 FortiWatch Quarter Win 09:12 9 11 Reflection Closing

Microsoft's Record 966-Fix Patch Tuesday, Liquid Network Bitcoin Returned (Mostly), and Five Eyes' Back-to-Basics Warning

Cybersecurity Today host David Shipley reports Microsoft's largest Patch Tuesday ever with 966 vulnerability fixes (plus 204 earlier cloud-service fixes), including 105 critical issues, two actively exploited Windows zero-days, and a surge tied to AI-assisted bug discovery—raising defenders' triage and testing burden.

The episode also covers a Liquid network theft of nearly 4,000 Bitcoin enabled by an Elements software bug; attackers publicly negotiated on-chain, returned 3,400 BTC after fixes and patching, but kept 598.5 BTC, prompting debate over "white hat" claims versus extortion or laundering.

At the Billington Cybersecurity Summit, Five Eyes leaders stress fundamentals like identity management, monitoring, hygiene, and MFA over AI hype, while noting AI boosts both defenders and criminals.

Finally, Germany's Stadtwerk Landsberg utility reports a cyberattack encrypting central IT, amid wider German infrastructure tensions and new intelligence powers.

00:00 Headlines Overview 00:26 Microsoft Patch Tuesday Record 02:50 Liquid Network Bitcoin Heist 03:43 White Hat Or Extortion 04:39 Five Eyes Security Basics 05:43 AI Boosts Defenders And Attackers 06:09 Germany Utility Ransomware 07:58 Wrap Up And Sign Off

Identity verification firm IDScan faces multiple lawsuits and investigations after hackers allegedly breached it. The criminals offered over 153 million U.S. and Canadian driver's license scans for sale.

Nightmare Eclipse releases FalconFlank, a zero-day privilege escalation that abuses CrowdStrike's Falcon alongside other zero-days targeting Kaspersky, Avast, and Nvidia.

Sansec disclosed an unpatched Magento/Adobe Commerce flaw "Style Smuggler" enabling unauthenticated code execution.

Arctic Wolf observed active exploitation of PaperCut authentication bypass and RCE flaws against schools, including credential theft and lateral-movement prep.

UK police data shows reported losses from hacked accounts rose 417% amid improved reporting via the new Report Fraud system.

00:00 Top Headlines

00:31 IDScan Breach Lawsuits

03:13 FalconFlank Zero Day

05:02 Security Tools Weaponized

05:48 Magento Style Smuggler

08:59 Papercut Attacks Schools

11:02 UK Account Hack Losses

13:57 Wrap Up and Sign Off

Katie Moussouris on AI's Vulnerability Deluge, Bug Bounties, and Smart Regulation

In this Cybersecurity Today on the Weekend feature interview, host David Shipley interviews cybersecurity entrepreneur and long-time hacker Katie Moussouris about today's surge in AI-driven vulnerability discovery and the growing strain on disclosure and patching ecosystems.

Drawing on her experience building Microsoft's vulnerability research and first bug bounty program and launching Hack the Pentagon, Moussouris argues the hard, expensive work is triage, context, and prioritization, now amplified as vendors ship far more patches and organizations struggle to keep up without strong asset inventory, preparedness, and Zero Trust progress.

She warns AI model capabilities are outpacing monitoring and containment, especially with open-weight models, and says regulation should focus on requirements like real-time monitoring without harming defenders.

The conversation also covers the reemergence of the old tool-access debates, Microsoft's clash with researcher "Nightmare Eclipse," the rise-and-fall of "security civilizations," Luta Security's work improving internal maturity, concerns about shrinking entry-level talent pipelines, and a closing call to consider universal basic income as part of our strategy to deal with AI's impact on the world.

00:00 Weekend Show Intro 00:07 Katie Moussouris Background 02:00 Bug Bounties Then and Now 03:31 AI Hype and Model Escapes 05:06 The Real Cost of Fixing 08:36 Smart AI Regulation 12:34 Tools for Defenders vs Rogues 15:53 Metasploit and Agentic Risk 17:25 Nightmare Eclipse and Microsoft 21:53 Luta Security Today 24:28 Training the Next Generation 27:46 Hope, UBI, and Wrap Up

153M Driver's Licenses for Sale, 9.5M-Patient Breach, and CISA Drops Key Security Assessments

The episode reports the FBI investigating Nexus, a dark web service selling scans of over 153 million U.S. and Canadian driver's licenses and other identity documents, with evidence suggesting near real-time exfiltration tied to IDscan.net before Nexus abruptly disappeared.

It also covers a breach at healthcare SaaS provider Aesto Health affecting 9.54 million individuals, exposing extensive personal and medical data, with delayed confirmation and notifications and 24 months of Experian monitoring offered.

The show details CISA ending six free critical-infrastructure cybersecurity assessments amid workforce reductions, raising concerns given recent targeting of U.S. water systems and warnings about AI-generated exploitation scripts against Siemens PLCs.

Additional updates include Plex urging immediate patching of undisclosed vulnerabilities and Slovenia's HIT gradually reopening casinos after a cyberattack forced a three-day shutdown.

00:00 Top Cyber Headlines 00:29 Dark Web License Leak 02:33 Nexus Tied to IDscan 04:05 Healthcare SaaS Breach 05:35 CISA Cuts Assessments 07:16 Plex Patch Alert 08:43 Slovenian Casinos Recover 10:05 Weekend Interview Preview 10:53 Closing and Sign Off

22,000 Exchange Servers Exposed, 700 AI Agents Swarm Hugging Face, and FSB Warns Frontier AI Is Top Financial Risk

Cybersecurity Today with host David Shipley reports nearly 21,899 Microsoft Exchange servers still exposed and unpatched for high-severity auth-bypass CVE-2026-62911, enabling mailbox takeover, with exploit code circulating and Germany warning most on-prem Exchange remains vulnerable as support deadlines loom.

The U.S. DOJ also corrected a press release to say multiple U.S. agencies were targeted—not confirmed victims—by China-linked QTFY intrusions.

Postmortems on the OpenAI/Hugging Face incident describe roughly 700 agents coordinating via shared notes and messaging to exploit systems, steal tokens and credentials, execute commands, and compromise infrastructure before Hugging Face shut it down July 13.

Palo Alto Unit 42 warns AI-driven exploitation is arriving, citing a case where AI leveraged 50 vulnerabilities in 10 hours. The Financial Stability Board calls frontier-AI cyber risk the most immediate threat to global finance and urges stronger safeguards and recovery planning.

00:00 Today's Cyber Headlines 00:32 Exchange Servers Wide Open 02:36 DOJ Walks Back Claims 03:29 700 Agents Hit Hugging Face 05:09 AI Exploits 50 Bugs Fast 06:43 Financial Watchdog Warns 08:25 Wrap Up and Sign Off

Shiny Hunters Claims 284M McKesson Records Stolen, PaperCut Patch Bypassed Again, and White House Bans Foreign Power Grid Tech

Host David Shipley covers multiple cybersecurity headlines: Shiny Hunters claims it breached healthcare giant McKesson via voice phishing, compromised Okta SSO, and accessed Salesforce and Snowflake, allegedly exfiltrating about 1TB and 284 million patient records (records, not unique patients) and demanding a $55M+ ransom, though the claims aren't independently verified. PaperCut issued a second emergency patch after bypasses were found for fixes to two actively exploited vulnerabilities that can be chained for unauthenticated remote code execution; organizations on v23 or earlier must upgrade. Berlin confirms an extortion attempt tied to Rhysida, which claims 5.79TB stolen. WordPress discloses five critical plugin/theme flaws enabling full site takeover, including a 10/10 GiveWP RCE. The White House bans foreign-made bulk power grid equipment over backdoor concerns amid rising critical-infrastructure attacks.

00:00 Top Headlines

00:30 McKesson Breach Fallout

03:18 PaperCut Patch Bypassed

06:02 Berlin Rejects Ransom

07:05 Critical WordPress Takeovers

08:43 Power Grid Tech Ban

10:35 AI Security Weekend Episode Promo

11:10 Closing and Sign Off

Varonis AI Threat Lead on Copilot Exploits, Prompt Injection, and the AI Hacking Trifecta

The host interviews Mark Vaitsman, AI threat research lead at Varonis, about Varonis Threat Labs' research into AI vulnerabilities, including a chain of single-click exploits in Microsoft Copilot (including "CoSnitch") and an Atlassian Confluence issue dubbed "RovoBlast" involving prompt injection, bypassing guardrails, and data exfiltration via a web-capable subagent.

Vaitsman explains why built-in model guardrails are insufficient, citing AI's lack of loyalty and "unlimited hunger for data," and argues for layered controls like least privilege, monitoring, and restricting data access.

He discusses psychological guardrail bypasses, introduces an "AI Hacking Trifecta" framework—enter, evade, escape—and comments on research showing AI-generated patches often fail, emphasizing human-led validation and guidance when using AI tools for security research.

00:00 Weekend Show Kickoff 00:44 Meet Mark Vaitsman 03:38 Teaching the Next Gen 04:19 Copilot Exploit Code Snitch 06:04 Atlassian RoboBlast Breakdown 08:52 Why Guardrails Fail 13:15 Manipulating Models to Comply 17:06 Securing Agents Without Handcuffs 20:11 AI Hacking Trifecta Framework 23:43 AI Patches and Human Research 27:43 Hope and Closing Thoughts