LastPass says Klue breach affected customer information, but passwords remain secure. Attackers begin exploiting Cisco Unified CM vulnerability. CISA flags actively exploited Ubiquiti and Lantronix flaws, urges rapid patching. DifyTap flaws could expose private AI conversations across tenants. Researchers find AI plugin registry let unofficial tools masquerade as trusted software. xpl0itrs launches leak site, signaling shift toward full-service cyber extortion. Ransomware attack hits Indian auto giant Bajaj Auto. U.S. presses Meta to submit AI models for national security reviews. Alleged criminal marketplace administrator extradited to the US. U.S. expands sanctions against Cambodian scam network tied to cyber fraud operations. On today’s Industry Voices segment, we are joined by Mike Masciulli, Managing Director, Migration Products and Services at Semperis, discussing RC4 and AD Migration: The Break Scenarios Hiding in Your Source Domain. And a lesson in access control.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices segment, we are joined by Mike Masciulli, Managing Director, Migration Products and Services at Semperis, discussing RC4 and AD Migration: The Break Scenarios Hiding in Your Source Domain. If you enjoyed this conversation, check out the full interview here.

Selected Reading

Password manager maker LastPass says hackers stole customer support case data during Klue breach (TechCrunch)

Klue says hackers stole credential from 2022 that led to customer data breaches (TechCrunch)

Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks (BleepingComputer)

U.S. CISA adds Ubiquiti UniFi OS and Lantronix EDS5000 plugin flaws to its Known Exploited Vulnerabilities catalog (SecurityAffairs) 

DifyTap: Zafran discovers how attackers can silently wiretap AI data across tenants on a platform powering 1M+ apps  (Zafran) 

23 ClawHub Plugins Squat Official Org Scopes (Manifold Security) 

Cyber Intel Brief: xpl0itrs Leak Site Launch (Dataminr) 

Indian auto giant Bajaj Auto hit by ransomware incident (The Record) 

U.S. Presses Meta to Agree to A.I. Reviews as Security Concerns Rise (NY Times)

Algerian Man Extradited to US for Running Cybercrime Marketplaces (SecurityWeek)

US adds sanctions against accused Cambodian scammers Prince Group (Reuters)

Ushering in the Next Frontier of Quantum Innovation (The White House) 

Meta Exposed Data Internally From Its Controversial Employee-Tracking Program (WIRED) 

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices