Loading summary
Transcript4 lines
- [00:00]
A
We're trying something new on Cybersecurity Headlines. If you've got a hot take about a story from today or this week in Cybersecurity News, send us a short 30 second video to feedbackisoseries.com we'd love to feature these on our Department of no Show. And now onto the news from the
- [00:17]
B
CISO series, it's Cybersecurity Headlines.
- [00:24]
A
These are the cybersecurity headlines for Wednesday, June 10, 2026. I'm Rich Stroffelino. Anthropic releases Claude Fable 5 ever since Mythos Preview was announced, everyone has been itching to get access to Anthropic's new model. A general release of Mythos still seems to be a way off, but Anthropic is getting closer, releasing the mythos class fable 5 model. Anthropic says this model operates similar to Mythos in terms of knowledge, work, vision and long running tasks, but has targeted blocks in place for areas ripe for misuse, such as cybersecurity and biology. Fable 5 will fall back to Opus 4.8 level performance. Anthropic claims that 95% of sessions run on Fable 5's native capabilities without falling back, and that external bug bounty and red teaming efforts fail to uncover critical bypasses or universal jailbreaks. French government messaging service breached the Digital Affairs Directorate of the French government Dynam warned that threat actors breached the government's encrypted messaging app TD Tchap. This service was developed by Dynam with the French cybersecurity agency ANSSI back in 2018 based on the Matrix protocol. Dynam said a threat actor gained access to the service through a compromised user account. A threat actor taking credit for the breach said they stole hard coded LDAP credentials shared by the French tax authority and stole over 13 GB of documents as well as information on over 73,000 accounts. Dinham said it blocked access to the compromised account and is reviewing logs to see what conversations they had access to. CISA rethinking risk Evaluations Acting CISA Director Nick Anderson said that CISA is looking to reevaluate how it prioritizes risks and vulnerabilities for both privately owned critical infrastructure and the federal government. As part of this, CISA will issue a binding operational directive for federal agencies to revise vulnerability management practices. Anderson characterized the overall approach to date as applying patches as quickly as possible. After their release, however, this new directive will ask critical infrastructure operators to focus on the risks associated with the vulnerability and whether it can be exploited and have a fine grained understanding of which systems are most important to Patch. Anderson framed this directive as a response to the increase in vulnerability disclosures with AI based Tools Romance Scams Target Russian Soldiers the Russian cybersecurity firm F6 released a report detailing a campaign by the group Siribclone targeting members of the Russian armed forces stationed near combat zones and border crossings. These attackers impersonate women posing as either volunteers for humanitarian assistance or engaging in romantic relationships. Both are lures to get soldiers to download malicious apps or share Telegram credentials on spoofed websites. The overall goal of the campaign seems to be to install an Android Spyware app called SafeLove Stealer that looks to steal files, monitor communications and collect sensitive military information. The researchers did not attribute the campaign to a specific country or threat actor and now thanks to our sponsor for today, Doppel Cybercriminals don't respect your security silos. They use one connected attack chain to hit your brand externally, infiltrate your inbox and manipulate your team. Stop playing whack a mole with fragmented tools. Doppel unifies digital risk protection, human risk management and email security into one unified platform. 1 attack chain 3 pillars of defense 0 blind spots Secure your enterprise relentlessly@doppel.com that's.o-p p e l.com Taiwan considers AI Chip Limits to China Bloomberg sources say that Taiwanese authorities are considering stricter export controls on AI chip sales in an attempt to combat smuggling to China. Sales of AI chips to China already require approval by U.S. regulators. Currently, exporting unauthorized AI chips to China isn't considered a crime in Taiwan unless it's to entities on a specific ban list. Right now, authorities just warn sellers that they may be breaking U.S. rules. These new export controls would open the door for Taiwan to criminally prosecute all smugglers to China. WinRAR flaw exploited against Ukraine Last year, a path traversal flaw was discovered in the popular archive utility Winrar. The flaw was subsequently patched in July 2025. That's not stopping two Russian aligned campaigns from continuing to exploit the flaw in Winrar against Ukrainian organizations. According to Trend Micro, the groups Earthdahu and ShadowEarth 066 are both using the flaw in active campaigns. ShadowEarth 066 is using the flaw to install its infostealer Gifted Crook, while Earth Dahu has more of a reputation for industrial scale efforts to maintain long term access to compromised organizations and is using the flaw to deliver espionage modules that have been active since since at least April. Another day, another Cisco SD WAN 0 Day 7 might be a lucky number, but not for Cisco, which is dealing with its seventh actively exploited zero day in Cisco SD WAN this year. The vulnerability was first disclosed by Mandiant late last week, although Cisco said it saw limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. The vulnerability requires valid credentials or privileged access and exploits a validation error, allowing an attacker to execute commands as root and opening the door to a range of attacks. There's no current patch or workaround available, and Cisco only said that a patch for this vulnerability will be provided at a future date. Judge throws the Book at AI filed this under Too good to Pass up Senior United States District Judge for the Northern District of Mississippi, Sherrion Acock issued a sanctions order against both sides of a federal court case, saying this court is yet again burdened with addressing AI hallucinations in court filings. The case involved a contract dispute with the city of Aberdeen, Mississippi about unpaid legal fees. However, both sides cited non existent hallucinated cases in their arguments. In what was described as paying ChatGPT to argue against itself. Judge Acock canceled the trial, disqualified all four lawyers involved, and barred two from appearing in court cases for two years, as well as issuing fines of up to $3,500 each. One attorney, Kathleen Wilson, had already been cited multiple times for AI hallucinated filings going back to January. Have you subscribed to the CISO series YouTube channel yet? If not, what are you waiting for? We're posting content every day there. We have shorts videos publishing daily. We have original interviews. We have demos and clips from all of our fantastic podcasts. So do yourself a favor, head on over to YouTube and subscribe to the CISO Series Channel. Reporting for the CISO Series, I'm Rich drofalino reminding you to have a super sparkly day.
- [07:04]
B
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.