A (0:01)

Cybersecurity Today is brought to you by A Tale of Quantum Kisses. It's the book by your host, Jim Love. We have a new audiobook and you can find it on Audible, Kobo, Barnes and Noble, just about everywhere. You can go to Audible and you can search for Alyssa and Jim Love, or you can Google that. You'll get a list of places you can get the audiobook. And now back to our regularly scheduled programming. Shadow leak hits ChatGPT servers A SIM farm is shut down near the United Nations. Cisco zero day hits 2 million devices, the FBI warns of spoofed crime reporting sites, and Android's top protection needs you to manually activate it. This is Cybersecurity Today. I'm your host Jim Love. Security Researchers at Radware have uncovered a dangerous server side vulnerability in ChatGPT's deep research agent. It's called Shadow Leak and it's a true zero click exploit. Attackers don't need you to click on anything. All it takes is an email with hidden instructions and the AI agent can be tricked into following them. Because the flaw runs entirely on OpenAI servers, it's invisible to traditional endpoint defenses. No malware shows up on your device and there's often no trace for victims to spot. David Aviv, the CTO of Radware, called it the quintessential zero click attack. That makes detection very difficult, even for well protected organizations. Part of the danger is how it bypasses logging and monitoring. Since the malicious activity happens within the AI's processing pipeline, standard audit tools may never see the commands being executed or the data being siphoned off. The scale of the risk is huge. ChatGPT has millions of business users, and many are integrating it directly into workflows that touch sensitive data. Researchers warn that once attackers gain a foothold, they can quietly siphon information or even manipulate how the AI responds. The message is clear. Don't rely on the AI provider alone. Use layered security controls, keep human oversight in the loop for critical tasks, and lock down access wherever you can, and particularly in these early days of AI, until real security can be worked out. Really take a good think of which data you submit to an AI agent in the cloud to process. A massive SIM farm operation was uncovered and dismantled by the US Secret Service across New York, just as world leaders gathered at the United Nations. Investigators found more than 300 SIM servers using over 100,000 active SIM cards clustered within 35 miles of the UN building. These SIM farms, racks of SIM cards tied to voip gateways, can send or receive massive volumes of calls or text messages. At scale, they're used for fraud, spoofing, encrypted comms, or even occasionally to overwhelm telecom networks. Officials warn that such a setup could jam or saturate cell towers, block emergency communications like 911, or create functional outages in critical zones reminiscent of telecom collapses during a big crisis. And because the operation sat so close to the UN Analysts say it could even have been used for espionage or surveillance, intercepting or manipulating signals with proximity to high value targets. For telecom operators and defenders, sim farms highlight a growing threat misuse of infrastructure that normally seems benign Detection is tricky because the device mimics legitimate traffic. Researchers are now exploring anomaly detection techniques like latency patterns in cellular signaling as one way to spot simbox or Sim Farm activity. But the bottom line? Even a small telecom infrastructure misused at scale can turn into a national or in this case, an international security threat. Cisco has alerted the public that as many as 2 million devices running iOS or iOS XE could be affected by a new zero day vulnerability now actively exploited in the wild. The flaw, tracked as CVE 2025, 2352, lies in SNMP, the simple network management protocol. In vulnerable configurations, even low privileged users can trigger a denial of service or remote code execution. Because the exploit abuses snmp, a standard tool in almost every network, it can slip past many traditional security barriers. Devices exposed to the Internet with SNMP enabled are at highest risk. Cisco is urging administrators to update affected systems immediately, disable unused SNMP access and monitor logs for unusual traffic or sudden device restarts. The US Cybersecurity and infrastructure security agency CISA has also added the flaw to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch or mitigate quickly. The FBI has issued a warning about criminals spoofing the Internet Crime complaint center or IC3 website. These fake portals mimic the FBI site so convincingly that victims believe they are filing a crime report when in fact their personal and financial details are being stolen. Once entered, that information goes straight to attackers, who can use it for identity theft or fraud. These spoofed domains are hosted on bulletproof servers and rotated frequently, making it nearly impossible to take them down or to know who now holds the stolen data. The FBI stresses there is Only one legitimate IC3 portal ic3.gov People should always type that address directly into their browser, never click on links, even in emails that appear official. We've done a number of stories about possible attacks on Android phones, and this is just a reminder that Android has a function much like Apple's lockdown mode, it's the highest level of security, but you must manually turn it on to enable it. It's called Advanced Protection, and it hardens the phone against malicious apps, exploits, and even sophisticated attacks. The catch is, as we noted, it's not enabled by default. You find it in your security settings, and right now I know it's available on Pixel phones, which are always first in line for Android upgrades. Other manufacturers will roll it out on their schedul, so check that. But with all of the concerns about mobile exploits, this is a feature worth remembering and worth enabling if you have it. That's our show for today. You could reach me with tips, comments, and even constructive criticism. And to all of you who have downloaded the audiobook, A Tale of Quantum Kisses, thank you so much. If you haven't done that, please think about it. If you want to support me, it's one of the best ways to do it. The book is called A Tale of Quantum Kisses. You can find it as an audiobook, as a print book, as an electronic book on Kindle. Just go to Amazon, go to Audible and type in Jim Love, Elissa E L I S A or Google that and you'll find find dozens of places you can buy the book. I'm your host, Jim Love. Thanks for listening.