CyberWire Daily

Patch Tuesday brings a record-breaking haul of fixes. Ivanti warns of an exploited VPN zero-day. An international crackdown targets West African scam compounds. A cyberattack stops work on a major European tunnel. Perceived Starshield speed limits disrupt Ukrainian drone operations. Canonical battles a sustained DDoS attack. Anthropic warns of self-replicating AI worms. The FTC accuses cybersecurity firms of exploiting sextortion victims. Microsoft and partners disrupt a major cybercrime marketplace. Rob T. Lee, from SANS, and Lynn Dohm, from WiCyS, are sharing a preview of the SANS 2026 Difference Maker Awards. Taking a Patch Tuesday snow day.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Rob T. Lee, Chief of Research and Chief AI Officer at SANS, and Lynn Dohm, Executive Director at WiCyS, sharing a preview of the SANS 2026 Difference Maker Awards.

Selected Reading

Patch Tuesday

Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (Bleeping Computer)

Adobe Patches 140 Vulnerabilities Across 10 Products (SecurityWeek)

SAP warns of maximum severity OAuth2 SSRF security flaw (Bleeping Computer)

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN (SecurityWeek)

West African scam compounds raided, more than 100 suspected trafficking victims ‘rescued’ (The Record)

Cyberattack halts Denmark-Germany tunnel construction (UA NEWS)

Starlink restrictions affecting Ukraine's front line operations, Kyiv says (BBC)

Canonical Hit by Second DDoS Attack in 2026, Public Websites Disrupted (SecurityAffairs)

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns (SecurityWeek)

FTC says ‘sextortion’ protection companies deceived customers about services (CyberScoop)

An Important Update About Grace Hopper Celebration (AnitaB.org)

Disrupting the service economy behind transnational cybercrime operations (Microsoft)

Fifth of CISOs Take Time Off to Avoid Patch Tuesday (Infosecurity Magazine)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

French supermarkets lose their cool in a refrigeration cyberattack. Anthropic pulls the plug on AI agents behaving badly. A Canadian ransomware negotiator is arrested in the FBI’s ShinyHunters investigation. XWorm expands its surveillance capabilities. A Dutch grocery giant suffers a cyberattack. Leaked files reveal Luna Moth’s playbook. Monday business brief. Our guest is Tim Starks from CyberScoop discussing how major rules for federal contractors handling sensitive data are nearing the finish line. Six digits sink Danish security.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Tim Starks from CyberScoop discussing how major rules for federal contractors handling sensitive data are nearing the finish line.

Selected Reading

Ukraine strikes third Yandex data center, disrupting digital services across Russia (The Record)

Cyberattack Hits Hundreds of Supermarket Refrigeration Systems in France (The New York Times)

DoD confirms ‘refrigeration disruption’ at military commissaries (MilitaryTimes)

Anthropic takes risky AI tests offline after models breach govt sites (Bleeping Computer)

Shock and surprise after FBI arrests Canadian cybersecurity expert in ShinyHunters hacking case (CBC News)

XWorm RAT Evolves Into Surveillance Platform (SecurityWeek)

Cyberattack Prompts Ahold Delhaize to Disconnect Systems (SecurityWeek)

Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings (Infosecurity Magazine)

Armadin has raised $255.5 million in a Series B round led by Andreessen Horowitz and Accel (N2K Pro Business Briefing)

'123456' password linked to Denmark data breach affecting 8.8M people (The Register)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this Special Edition podcast while our team is out observing Indigenous Peoples' Day in the United States.

In this episode, Dave Bittner joins Maria Varmazis to explore the evolution of public-private partnerships in cybersecurity over the past decade. Together, they discuss key incidents, trust-building, and the future challenges posed by AI and geopolitical shifts.

Join Maria and Dave as they discuss:

The definition and importance of public-private partnerships in cybersecurity.

Evolution of collaboration from episodic to institutionalized.

Impact of major incidents like Colonial Pipeline on policy and trust.

The role of information sharing and trust-building mechanisms.

The influence of AI and automation on future cybersecurity strategies.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Since taking office, the Trump administration has signed a series of Executive Orders that aims to boost the US's space presence.

Host Maria Varmazis sits down with Producer Ethan Cook to dive into two recent Executive Orders signed by President Trump. These two orders look to significantly grow the US's space capabilities removing regulatory hurdles, encouraging innovation, and growing commercial investments.

Key Sources:

ENSURING AMERICAN SPACE SUPERIORITY.

ENABLING COMPETITION IN THE COMMERCIAL SPACE INDUSTRY

Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠space@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Adam Meyers, Head of Counter Adversary Operations at CrowdStrike, is discussing their work on "PhantomRaven, An LLM-Generated Information Stealer Developed for Bug Bounty Hunting." PhantomRaven, a JavaScript-based information stealer distributed through malicious npm packages by a financially motivated threat actor posing as a bug bounty hunter.

The malware targets system information and continuous integration and continuous deployment (CI/CD) environment variables, likely seeking credentials, with analysis suggesting its code was generated using a large language model. The report explores how AI-generated tools may lower the barrier to cybercrime and outlines steps organizations can take to mitigate risks, including restricting package installation scripts, using private npm registries, and monitoring dependencies.

The research and executive brief can be found here:

PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting

Learn more about your ad choices. Visit megaphone.fm/adchoices