← Cybersecurity Headlines
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines
- [00:06]
B
these are the cybersecurity Headlines for Wednesday, July 1, 2026 I'm Rich Drofalino Bash can spell trouble GNU for AI agents Researchers at Aversa AI found a structural flaw called guardfall in how AI coding agents guard against dangerous shell commands. The issue traces to the open source Noose Research Hermes agent project where a regex based guard could be bypassed using DEC bash tricks like quote removal and command substitution, since these guards check the raw text and AI model writes not what bash actually does once it's expanded. A broader survey of 11 popular agents representing roughly 548,000 combined GitHub stars found 10 shared the same gap. Live tests used claudsonnet 4.6, which usually refused direct malicious requests, but went along with the same payload disguised as routine work in a makefile or poisoned readme DHS to unveil Critical Infrastructure Council According to a notice in the US Federal Register, the Department of Homeland Security will introduce its replacement for the Critical Infrastructure Partnership Advisory Council called the alliance of National Councils for Homeland Operational Resilience. Critical Infrastructure, otherwise known as Anchor CI CPAC, was dismantled earlier in 2025 as part of the Trump administration's reshuffle of DHS advisory bodies. The difference between these information sharing bodies is that this new council will be exempt from public transparency laws to reflect the sensitive nature of the subject matter involved regarding the assessment and mitigation of security and operational risks. Through whole of government coordination and strong partnership with the private sector, CISO will oversee Anchor CI and give its leadership greater authority over the body's composition and direction. Akaido buys Root We've seen a number of market solutions attempting to resolve the seemingly Gordian knot of open source security. In the age of AI, where many companies and consortiums are looking to build solutions, Akaido Security is definitely trying the buy approach. They acquired the company Root IO, which offers an agentic vulnerability remediation solution that looks for newly published vulnerabilities and then uses swarms of agents to research, write, test and ship patches. With a claim time of around 40 minutes. Total terms of the deal were not disclosed, but root has raised $37.6 million in funding rounds since 2022. We don't cover a ton of startup acquisitions on this show, but this definitely seemed to be part of a trend in the open source security story. Info on the next iPhone exposed in data Leak According to documents seen by Reuters, a ransomware group stole data from the Indian supplier Tata Electronics which notably provides components for Apple's iPhones. The group World Leaks published more than 200,000 files on its leak site, including lists of components and suppliers, as well as photos of the upcoming iPhone 18 Pro Reuter sources say Apple considers this to be sensitive data from an operational perspective. It reveals where Apple uses multiple suppliers for different components and where it has comparatively less leverage in supplier negotiations. Tata is one of Apple's biggest contract manufacturers of devices, and now, thanks to today's episode sponsor Silent Push Most cybersecurity approaches are completely reactive. Victim organizations are hit with an attack, and then the chase ensues. Silent Push closes this gap with its preemptive cyber defense platform. Silent Push tracks adversary infrastructure and infrastructure changes across the Internet during the attack preparation phase while attackers are still staging domains, IPs and hosting, and Silent Push turns that into indicators of future attack to defend with confidence. For a CISO that turns invisible risk into early warning. An average of 140 days before a campaign shows up in your environment, time to act, and a smaller window of exposure before a threat ever reaches your environment. Learn more@silentpush.com Crash flaw found in AirDrop and Quick Share Two researchers from the CISPA Helmholtz center for Information Security documented six total flaws in Apple's AirDrop and Android's Quick Share features that allow an attacker with a laptop and no prior connection to potentially crash either service. Crashing Airdrop requires a device that can receive files from everyone and requires sending a malformed request on a loop to crash the service, which also subsequently takes down airplay handoff and continuity camera features on Quick Share. The flaw involves skipping past a secure handshake between devices and passing unencrypted messages. All these flaws can only be executed at short range. Apple and Samsung have begun patching the flaws, and there's no evidence of exploitation in the wild. Over 4 million impacted by AFLEC Japan breach In a filing with the U.S. securities and Exchange Commission, AFLAC Japan disclosed that it suffered a data breach from June 15 through June 25. Information on 4.38 million customers and agents was likely impacted. Compromised data includes names, addresses, phone numbers, security information, and insurance account information. The breach also impacted about 230,000 people doing insurance transfers, but no credit card information was accessed. No word on who breached the systems or how they were accessed. Booking.com partners get booking.phished researchers at trend Micro reported a campaign called Ton Resolver, which saw threat actors sending phishing emails impersonating booking.com, trying to get staff to execute malicious files, mostly focusing on Japanese hotels. These emails pose as either guest complaints or reviews and attempt to get hotel staff to engage in follow up conversations with the attacker. The campaign uses the Open Network blockchain platform as a dead drop resolver and ultimately looks to install a remote access Trojan on hotel devices. UK healthcare sector sees cyberattacks spike According to a new report From SonicWall, the UK's health sector saw a tenfold increase in attacks in the first half of 2026 compared to all of 2025. SonicWall recorded 264,000 individual events in the first half of the year, compared to 27,000 events for all of last year, with more total events than any other vertical. 41% of events seen by the company were attempts to exploit the log4shell vulnerability. This is partially because NHS workflows in the UK rely on Java based clinical applications that can't easily be replaced. The CISO Series has some new items for your calendar We've got a CISO Series meetup in Vancouver on July 23rd and then we'll be in C Seattle on July 29th at Georgetown Beer. Come down and join us for a few drinks and hang out with your friendly local cyber peeps. Find all the details about all our events at our events page@cisoseries.com hope to see you there. And if you have some thoughts about the news from today, or some feedback about the show in general, be sure to reach out to us feedbacksoseries.com we'd love to hear from you. Reporting for the CISO Series, I'm Rich Stroffelino, reminding you to have a super sparkly day.
- [07:11]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.