Podcast Summary: Cybersecurity Today

Episode: Cisco Breached: Source Code Stolen

Host: David Shipley (guest host for Jim Love)
Date: April 1, 2026

Episode Overview

This episode delivers a torrent of critical cybersecurity updates, with a spotlight on a major Cisco breach involving source code theft following a supply chain attack. Other headline stories include attacks on the popular Axios JavaScript library, renewed exploitation of vulnerabilities in Fortinet and Citrix platforms, an accidental leak of a dangerous Anthropic AI model, and fresh allegations about fake compliance at Delve, a compliance automation startup. Host David Shipley emphasizes that these are not April Fool's jokes but real threats shaping the cybersecurity landscape in early 2026.

Key Discussion Points & Insights

1. Cisco Breach: Source Code Theft via Supply Chain Attack

• Details:
  Threat actors exploited credentials stolen in the recent Trivi supply chain attack to breach Cisco's internal development environment.
• Attack Method:
  • Used a malicious GitHub Action to steal credentials and data.
  • Impacted dozens of devices including developer workstations.
  • Over 300 GitHub repositories cloned, including source code for Cisco’s AI-powered products.
• Implications:
  • Some stolen code reportedly belonged to Cisco’s corporate customers, banks, BPOs, and US government agencies.
  • Multiple AWS keys were stolen and used for unauthorized activity.
  • Cisco responded by isolating impacted systems, reimaging devices, and rotating credentials.
• Notable Quote:

  "This breach, alongside news that up to 1000 SaaS platforms were also impacted by Trivi, puts this supply chain attack to be among the top stories of the year. And it's only March." — David Shipley [01:33]

• Fallout:
  The breach is ongoing, with continued risks from related supply chain attacks on platforms like Light LLM and Checkmarx.

2. Axios Supply Chain Attack

• Incident:
  The highly popular JavaScript library Axios (83 million weekly downloads) was victim to a supply chain attack.
• Attack Method:
  • The attacker compromised the primary maintainer’s account.
  • Released legitimate-looking package first, then injected malicious versions (prebuilt malware payloads for Windows, macOS, Linux).
  • Payload was in a fake dependency, not Axios’s core code — evading standard code review.
  • Malware contacted a command and control server and self-deleted.
• Urgent Remediation Advice:
  • Downgrade from affected versions (1.14.1 or 0.30.4) back to safe versions (1.14.0 or 1.30.3).
  • Remove plain crypto-js, rotate credentials, audit CI/CD logs.
  • Assume compromise until thoroughly checked.
• Notable Quote:

  "Traditional code review may not have caught it. This was not opportunistic. It was staged, rehearsed and executed with precision." — David Shipley [03:02]

3. Fortinet: More Patchable but Unpatched Vulnerabilities

• Event:
  Another active exploitation of an old vulnerability—this time CVE-2026-21643, an SQL injection in Fortinet's FortiClient EMS.
• Details:
  • Attackers use a malicious HTTP request to execute arbitrary code, impacting multi-tenant deployments.
  • Exploitation confirmed by researchers and ongoing as of episode air date.
  • CISA has not added it to its known exploited list yet despite active attacks.
• Pattern:
  • Fortinet has 24 vulnerabilities flagged as actively exploited, 13 leading to ransomware.
  • Keeps "playing vulnerability whack-a-mole"; fails to eliminate entire bug classes.
• Notable Quote:

  "SQL injection has been on the OWASP top 10 since 2003... They're still playing vulnerability whack-a-mole." — David Shipley [05:23]

4. Citrix Bleed Returns

• Current Flaws:
  • CVE-2026-3055 (critical, 9.3/10 severity) actively exploited in Citrix Netscaler ADC and Gateway.
  • Related issue (CVE-2026-4368) can cause user session mix-ups.
• Risks:
  • Attacks ongoing since at least March 27.
  • Appliances configured as SAML identity providers affected.
  • Urgent patch advisories; federal agencies have a tight remediation deadline.
• Historical Context:
  • Mirrors the 2023 "Citrix Bleed" vulnerability exploited by LockBit.
• Expert Warning:

  "Check for signs of compromise now, not after patching, and to trigger incident response immediately if they find anything." — David Shipley relaying Watchtower founder Benjamin Harris [07:02]

5. Anthropic AI Model Leak

• Incident:
  Anthropic accidentally leaked details about "Claude Mythos," described as their most capable and dangerous AI model to date, via a misconfigured publicly accessible draft blog post.
• Model Capabilities:
  • Advances in reasoning, coding, and cybersecurity, purportedly able to exploit vulnerabilities rapidly.
• Industry Response:
  • Anthropic is rolling out the model cautiously, sharing findings with security teams first.
  • Previous iterations were reportedly used by state-sponsored actors for cyberattacks.
• Market Impact:
  • Cybersecurity vendors’ stocks reacted; the seriousness of AI threat capabilities is underlined.
• Notable Quote:

  "Anthropic’s leak may have been embarrassing, but they responded quickly, acknowledged the risks, and they've been transparent. That's a positive sign." — David Shipley [10:41]

6. Delve Compliance Scandal: Breaking Trust

• Allegations:
  Compliance automation startup Delve accused by "Deep Delver" (whistleblower) of aiding clients in fabricating audit evidence and working with non-rigorous auditors.
• Evidence:
  New leaks: internal Slack messages and video suggesting executive awareness.
• Industry Reflection:
  • Some use this as an excuse to dismiss compliance frameworks, but Shipley refutes this.
  • The real issue is treating compliance as "performance instead of practice."
• Risks:
  • Real vulnerabilities are masked by rubber-stamped audits, providing false confidence.
• Notable Quote:

  "The problem here isn't compliance frameworks, it's how they're used. Too many organizations treat compliance as a box to check, not a standard to live by." — David Shipley [12:09]

• Ongoing:
  Whistleblower promises more revelations are coming.

Notable Quotes & Memorable Moments

| Timestamp | Speaker | Quote | |---|---|---| | 01:33 | David Shipley | "This breach, alongside news that up to 1000 SaaS platforms were also impacted by Trivi, puts this supply chain attack to be among the top stories of the year. And it's only March." | | 03:02 | David Shipley | "Traditional code review may not have caught it. This was not opportunistic. It was staged, rehearsed and executed with precision." | | 05:23 | David Shipley | "SQL injection has been on the OWASP top 10 since 2003... They're still playing vulnerability whack-a-mole." | | 07:02 | David Shipley (quoting Watchtower founder Benjamin Harris) | "Check for signs of compromise now, not after patching, and to trigger incident response immediately if they find anything." | | 10:41 | David Shipley | "Anthropic’s leak may have been embarrassing, but they responded quickly, acknowledged the risks, and they've been transparent. That's a positive sign." | | 12:09 | David Shipley | "The problem here isn't compliance frameworks, it's how they're used. Too many organizations treat compliance as a box to check, not a standard to live by." |

Key Timestamps for Important Segments

• 00:20 — Episode begins, quick headlines rundown
• 00:40 — Cisco breach report details
• 02:40 — Axios JavaScript library supply chain attack
• 05:02 — Fortinet FortiClient exploit and industry context
• 07:00 — Citrix vulnerabilities and patch urgency
• 09:50 — Anthropic AI model leak and implications
• 11:40 — Compliance scandal at Delve and broader takeaways

Tone and Style

David Shipley's delivery is candid, urgent, and incisive, with a blend of technical detail and direct advice. He’s unafraid to call out recurring industry failures, but balances criticism with actionable steps and context for defenders.

Takeaways

• 2026 is shaping up as a year of high-profile, technically sophisticated attacks, especially via the software supply chain.
• Both established and cutting-edge technologies—from GitHub automation to next-gen AI—are being leveraged by malicious actors.
• Timely patching, credential rotation, principled compliance, and thorough incident response remain critical as attackers increase in sophistication.
• CISOs and technical teams should stay vigilant, audit dependencies, review logs, and not become complacent with "checkbox security."
• The cybersecurity community is encouraged to share findings, patch rapidly, and—above all—never trust results that aren’t verified by intent and action.

Final Thoughts

This 1,500th episode of Cybersecurity Today underscores the pace, complexity, and seriousness of 2026’s threat landscape. The host closes with gratitude to listeners and a reminder: real vigilance and adaptation—not just adopted standards—are the difference between building real security and leaving doors open for the next breach.

Next Episode:
David Shipley returns after the Easter break with another news recap.
Stay safe, and take care.