Loading summary
Transcript3 lines
- [00:00]
A
Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them@meter.com CST Cisco breached
- [00:20]
B
with source code stolen a supply chain attack hits Another massively popular open source tool Fortinet is back in the headlines for all the wrong reasons. Citrix may be bleeding again Anthropic accidentally leaks news about a new dangerous AI model and a compliance startup's bad press headaches just got a lot worse. This is Cybersecurity Today and I'm your host David Shipley. Let's get started. According to Bleeping, computer threat actors used credentials stolen in the recent Trivi supply chain attack to break into Cisco's internal development environment. The attackers used a malicious GitHub action to steal credentials and data from Cisco's build environment, hitting dozens of devices, including developer workstations. More than 300 GitHub repositories were cloned during the incident, among them source code for Cisco's AI powered products, including AI Assistance and AI Defense. A portion of that stolen code reportedly belongs to corporate customers, banks, business process outsourcers, US Government agencies. Multiple AWS keys were also stolen and used to perform unauthorized activity across a number of Cisco accounts. Cisco has isolated affected systems, begun reimaging them, and is rotating credentials at scale. The initial breach has been contained, but the company expects continued fallout from related supply chain attacks on light LLM and checkmarks. This breach, alongside news that up to 1000 SaaS platforms were also impacted by Trivi, puts this supply chain attack to be among the top stories of the year. And and it's only March. Well, at least until the fallout from this next supply chain attack becomes clearer. Our next story comes from Hacker News. They're reporting that one of the most widely used tools in web development, the JavaScript library Axios, with 83 million weekly downloads, was hit by a supply chain attack this week. An attacker compromised the account of the project's primary maintainer and used it to push poison versions to the NPM registry that included a dropper and a remote access tool. What makes this attack stand out is the patience of the attackers. They didn't rush. They first published a clean, legitimate looking package to establish trust and to bypass automated security checks. Then they struck three payloads were pre built for Windows, macOS, and Linux. Once installed, the malware called out to a command and control server, then deleted itself to cover its tracks. No malicious code touched Axios itself, it lived entirely in a fake dependency triggered automatically on install. Traditional code review may not have caught it. This was not opportunistic. It was staged, rehearsed and executed with precision. If you're running Axios versions 1.14.1 or 0.30.4, downgrade immediately to 1.14.0 or 1.30.3. Remove the plain crypto JS package from your Node modules and rotate all credentials. Check your CICD logs for any runs that installed affected versions and assume compromise until you can prove comprehensively otherwise. Our next story required none of that sophistication. Just another unpatched system and a vulnerability class that's been around for more than 20 years and a repeat offender. Fortinet if all of this sounds too familiar, it should. It's another critical vulnerability, another SQL injection flaw, and once again it's another race against time, with attackers likely exploiting before defenders can patch. According to bleeping computer researchers at Diffuse confirmed active exploitation of CVE2026 21643 an SQL injection vulnerability in Fortinet's Forta client EMS platform. An unauthenticated attacker can send a malicious HTTP request through the web interface and execute arbitrary code. Defuse says attackers have been exploiting this for at least four days. As of Tuesday, Fortinet had not updated its advisory to reflect active exploitation and CISA had not yet added it to their known exploited vulnerabilities list. There is a patch version 7.4.0.5 fixes it but the window to act is closing if not closed. This exploit appears to require multi tenancy, not single tenant deployments. CISA has now flagged 24 Fortinet vulnerabilities as actively exploited. Thirteen have been known to lead to ransomware attacks. Two years ago another Forta client EMS SQL injection flaw was used by Chinese state sponsored group Salt Typhoon to breach telecom providers across North America in the last 12 months. This is Fortinet's seventh critical CVE SQL injection has been on the OWASP top 10 since 2003. Fortinet signed CISA's Secure by Design pledge in 2025, yet these issues remain and they failed to consistently eliminate entire bug classes. They're still playing vulnerability whack a mole. Our next story is a return of a truly unloved expression. Citrix Bleed According to cybersecurity dive, threat actors are actively exploiting a critical vulnerability in Citrix, Netscalar ADC and Netscaler Gateway. The flaw CVE2026 3055 carries a severity score of 9.3 out of 10. CISA added it to the known Exploited Vulnerabilities catalog on Monday. Federal agencies have until Thursday to remediate Exploitations have been happening since at least March 27, giving attackers a head start. Researchers at Watchtower warn this may involve more than one flaw. A second vulnerability, CVE2026 4368, is a race condition issue that can cause user session mix ups. Watchtower founder Benjamin Harris is urging organizations to check for signs of compromise now, not after patching, and to trigger incident response immediately if they find anything. The reference point here is citrix bleed in 2023. That flaw was used by Lockbit and others to breach major organizations worldwide, and the pattern could be repeating critical flaw, slow response, mass exploitation Watchtower is already seeing the attacks in its honeypots, and the exposure affects appliances configured as a SAML identity provider. If this describes your environment and you haven't patched since Citrix issued its bulletin on March 23, you're behind in this race. Trivi Axios, Cisco Fortinet, Citrix Today's episode is a catalog of what attackers can do right now with existing tools, but what happens when those tools continue to get more powerful? Ironically, we've all found out about what is being called one of the most dangerous AI models built yet, thanks to leaked details of it revealed through a basic security misconfiguration. According to Futurism, Anthropic accidentally exposed a draft blog post through a publicly accessible data store, revealing a new model called Claude Mythos. In that document, Anthropic described Mythos as a general purpose AI system with advances in reasoning, coding and cybersecurity, calling it the most capable that they've built. We don't genuinely know if this was an accidental leak or something more deliberate Guerrilla marketing maybe. But the draft described a model that could exploit vulnerabilities far faster than what Defenders can respond to. Anthropic has acknowledged the risks the model presents. They've rolled out Mythos slowly, starting with enterprise security teams to study its capabilities before a wider release. They've also committed to sharing findings to help defenders prepare. Anthropic previously disclosed that a Chinese state sponsored group used an earlier code model to conduct cyber attacks against banks and governments by framing up what it was doing as legitimate testing in order to break the guardrails. That was a less capable system than what they're describing as what could be coming next. Another detail Cybersecurity stops dropped after the leak CrowdStrike Palo Alto and Fortinet all declined as investors tried to price in the impact. Whether that reaction was rational or not, the signal is clear. The market is paying attention to the message and if anything, cybersecurity is about to get a lot more intense. Anthropic's leak may have been embarrassing, but they responded quickly, acknowledged the risks, and they've been transparent. That's a positive sign. Our final story is about a different kind of failure, and it's one of the worst kinds Breaking Trust with Fake Compliance According to reporting from TechCrunch, the Delve story we covered last week has escalated. The anonymous whistleblower known as Deep Delver is back now with video and internal Slack messages and says more is coming. Deep Delver claims the video clearly shows Delve executives and staff knew there were issues with an auditor handling client certifications. Delve, a Y Combinator backed startup, automates compliance processes like SoC2 and ISO 27001. The allegation? It helped customers fabricate audit evidence and knowingly work with auditors who did not scrutinize clients materials and acted more like certification mills than auditors. Delve has raised more than $32 million. The accusations against Delve from Deep Delver were covered by TechCrunch first on March 22, and included claims about fabricated evidence used to achieve compliance with standards. Since the story broke, some people have been using it to dismiss compliance frameworks entirely. That would be the wrong takeaway. Done properly, certifications and frameworks improve security. They force organizations to examine controls, identify gaps and build repeatable processes. The problem here isn't compliance frameworks, it's how they're used. Too many organizations treat compliance as a box to check, not a standard to live by. When compliance becomes performance instead of practice, you get this Auditors rubber stamping customers, giving false confidence and real vulnerabilities hiding behind clean reports. Deep Delver says even more is coming. This story isn't over yet. That's Cybersecurity today for Wednesday, April 1, 2026. I wish all these headlines were April Fool's jokes, but they're real. Before we sign off, a milestone worth noting. This is episode 1,500 of Cybersecurity Today. When Jim Love first approached Howard Solomon about starting the show in March 2018, it wasn't clear what it would become. Eight years later, the show reaches 2.4 million downloads a year and is in the top 10 in US and Canada, the top 20 in the UK and drumroll. We just hit number one for tech news in Saudi Arabia to listeners there. Welcome. For me, it's been a privilege to join Jim and to follow in Howard's footsteps. Thank you all of you for helping us reach this milestone. We've grown because you've given us five star reviews, subscribed, given likes, given us the thumbs up, and great comments. Every one of these counts more than you'll ever know and we could continue to use your help. Please continue to like, subscribe and share the show. I'm excited to get on with the work for the next 1500 episodes. We'll be taking a break for the Easter holiday. I'll be back on Tuesday with a recap of the latest news. Until then, stay safe and take care.
- [14:03]
A
We'd like to thank Meter for their support in bringing you this podcast. Meter delivers full stack networking infrastructure, wired, wireless and cellular to leading enterprises. Working with their partners, Meter designs, deploys and manages everything required to get performant, reliable and secure connectivity in a space. They design the hardware, the firmware, build the software, manage deployments, and run support. It's a single, integrated solution that scales from branch offices, warehouses and large campuses to data centers. Book a demo at meter.com CST that's M-E T E-R.com/CST.