Transcript
A (0:00)
From the CISO series, it's Cybersecurity Headlines.
B (0:06)
These are the Cybersecurity headlines for Friday, January 9, 2026. I'm Steve Prentiss. Microsoft to enforce MFA for Microsoft 365 admin center sign ins starting in February, Microsoft will start enforcing Multi Factor Authentication for all users accessing the Microsoft 365 admin cent end quote MFA requirements actually started one year ago in February 2025, but as of February 9th of this year, Microsoft will block those without MFA enabled from signing in to the Microsoft 365 administrative portal. This will affect a number of admin center URLs used by IT administrators to manage Microsoft 365 accounts. These specific addresses are listed in the show Notes to this episode Cisco Patches ISE Security Vulnerability after POC Release this is in response to a public Proof of concept exploit in Identity Services engine ISE and the ISE Passive Identity Connector ISE pic rated as Medium Severity with a CVSS score of 4.9. This vulnerability resides in the licensing feature and could allow an authenticated remote attacker with administrative privileges to gain access to a sensitive environment information. End quote it was discovered by Bobby Gould of Trend Micro Zero Day Initiative. Cisco said there are no workarounds to address this flaw, nor are there any indications that it has been exploited in the wild Illinois State Agency Breaches Itself the Illinois Department of Human Services IDHS has revealed that it inadvertently exposed personal information belonging to more than 700,000 state residents by posting it on the open Internet, where it remained for as long as four years before being taken down last September. The information consisted of PII and was left on the open Web after agency officials created planning maps on a mapping website to help direct resource allocations. The data exposed in the breach is protected health information under the Health Insurance Portability and Accountability act, otherwise known as hipaa. Microsoft Exchange Online Outage blocks access to mailboxes. This outage, which started Wednesday evening, intermittently prevents users from accessing their mailboxes via the Internet Mailbox Access Protocol 4, otherwise known as IMAP 4. Microsoft says the issues were caused by a code conflict that introduced an authentication misconfiguration. Details on regions and how many users were impacted were not immediately released. Huge thanks to our sponsor, Hawkshunt. A small tip for CISOs if you are unsure whether your security training is actually reducing phishing risk, check out what Qualcomm achieved with Hoxhunt. They took their 1000 highest risk users from consistent underperformers to outperforming the rest of the company, driving measurable human risk reduction and earning a CSO50 award. See the Qualcomm case@hoxhunt.com Qualcomm that is H O X H U N T.com Qualcomm OpenAI prompt injection problems keep Festering we have covered a number of stories about the seemingly permanent problem of prompt injection in recent weeks. Now security researchers at Radware say they have identified several vulnerabilities in OpenAI's ChatGPT service that allow the exfiltration of personal information. These flaws were identified in a bug report filed on September 26th of last year and were reportedly fixed on December 16th. But the problem still seems to evolve. The current issue surrounds an indirect prompt injection attack called shadowleak that, in short, allows malicious instructions in a Gmail message, for example, to get ChatGPT to transmit a password without any intervention from the agent's human user. The successor to Shadow Leak, dubbed Zombie Agent, has evolved to circumvent the fixes and defenses being put up. A link to a more complete description of these attacks is available in the show Notes to this episode. CISA adds two actively exploited flaws to its Kev catalogue in adding these vulnerabilities, both of which can allow for remote code execution. CISA warns that both are now being actively abused by attackers. The first is a code injection flaw in HPE OneView, which is used to centrally manage servers, storage and networking infrastructure. It has a maximum severity CVSS score of 10.0. The other is a long patched Microsoft PowerPoint code injection flaw with a CVSS score of 8.8. Despite having been fixed in 2009, it has been included in the KEV catalog because unpatched or unsupported systems are still being successfully targeted. Phishing as a service Attackers exploit misconfigured email routing to spoof internal emails, according to a report from Microsoft. Phishing actors are exploiting complex routing scenarios and misconfigured spoof protections to effectively spoof organizations, domains and deliver phishing emails that appear superficially to have been sent internally. They are using a wide variety of phishing messages related to phishing as a service platform such as Tycoon2FA. These include messages with lures themed around voicemails, shared documents, communications from human resources departments, password resets or expirations, and others leading to credential phishing. The report suggests setting strict domain based message authentication, reporting and conformance protocols, deploying reject and SPF hard fail rather than soft fail policies, and properly configuring any third party connectors. VEEAM patches a critical RCE flaw in backup and replication this patch, one of many released by the company, addresses a vulnerability with a CVSS score of 9.0 that allows a backup or tape operator to perform remote code execution as the postgres user by sending a malicious interval or order parameter. A veeam tape operator is a limited veeam backup and replication user role designed to manage tape based backup operations without full administrative privileges. The vulnerability was discovered during internal testing. If you have some thoughts on the news from today, or about the show in general, please be sure to reach out to us@feedbacksocies.com we would love to hear from you. I'm Steve Prentiss reporting for the CISO series.