A (0:00)

Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at meter.com CST.

B (0:18)

Cisco finally patches maximum severity Async OS bug Another Fortinet vulnerability getting pwned in the wild Dutch National Police still recovering from Citrix breach Spear phishing campaign uses Venezuelan lure and teach an AI to write buggy code this is Cybersecurity Today and I'm your host David Shipley. Let's get started. Our first story today falls squarely into the better late than never category. Cisco has finally patched a maximum severity zero day in its Async OS software, a flaw that's been actively exploited since November against Cisco Secure Email Gate and Secure Email and Web Manager appliances. The vulnerability allows remote command execution with root privileges. In plain terms, attackers could take full control of affected systems. Cisco says the issue impacted appliances with certain non standard configurations, particularly where the spam quarantine feature was exposed to the Internet, exactly the kind of edge cases that attackers look for. Cisco Talos attributes the exploitation with moderate confidence to a Chinese state linked threat group tracked as UAT 9686. During the attacks, researchers observed persistent backdoors, reverse SSH tunnels and log wiping tools, clear indicators of deliberate long term access. CISA added the vulnerability to its known Exploited Vulnerabilities catalog in December and ordered federal agencies to to patch within days. The takeaway here is simple Email security gateways remain high value targets and when attackers can get root access. Patching might close the door, but it doesn't tell you what may have walked out or walked into your environment. If you're running these environments, patching is essential. Checking for signs of compromise is also important. A critical Fortinet 40 SIEM vulnerability is now being actively exploited in the wild with public proof of concept exploit code available. The flaw tracked as CBE2025 64. 155 is actually a combination of issues that allows unauthenticated attackers to execute commands and escalate privileges all the way to root access. In other words, full system compromise without logging in. Researchers at Horizon3AI say the root cause is the exposure of dozens of command handlers on 40 seems ph monitor service which can be accessed remotely. Exploitation has now been confirmed by threat intelligence firm Defused, which reports active attacks hitting their honeypots. Fortinet has released patches and the vulnerability effects 40 seen versions 6.7 through 7.5 for organizations that can't patch immediately, Fortinet recommends restricting access to the PH Monitor port, though that's a stopgap, not a fix. Fortinet has not yet updated its advisory to flag the flaw as actively exploited, but the pattern here is familiar. Over the past year alone, Fortinet products have repeatedly shown up in active exploitation campaigns, including multiple zero days. The takeaway is straightforward. If you're running 40 SIEM and you've got PH monitor exposed, patch immediately and check for compromise. Because once exploit code is public and attacks are active, delays in patching any Internet exposed versions is risky. Our third story comes from the Netherlands and highlights a challenge facing governments well beyond aging information technology infrastructure under sustained cyber pressure. Dutch police and prosecutors are warning that their systems are outdated and vulnerable, saying years of underinvestment are limiting their ability to combat modern cybercrime. Senior officials have publicly asked government for major funding to modernize systems they say are no longer fit for today's threat environment. That concern isn't hypothetical. The Dutch Public Prosecution Service is still recovering from a cyber attack in the summer of 2025 when it was forced to take its internal systems offline after attackers exploited a vulnerability in Citrix netscaler known as Citrix bleed 2. The flaw allowed attackers to bypass multi factor authentication and hijack user sessions. Systems have been brought back online in phases and authorities say there's no evidence data was stolen from but the disruption was significant and prolonged. Dutch media and security officials believe the attack was likely linked to Russian state backed actors, part of a broader intelligence and disruption effort targeting countries supporting Ukraine. The Netherlands has been a consistent backer of Kyiv, including military aid and financial support. What ties these developments together is readiness. Outdated infrastructure makes it harder to patch quickly, isolate systems and respond decisively while nation state attackers continue to exploit well known vulnerabilities at scale. The result is ongoing recovery on one side and sustained pressure on the other, a gap many public sector organizations are finding increasingly difficult to close. Our fourth story highlights a familiar espionage tactic paired with a timely geopolitical hook. Security researchers have disclosed a new campaign targeting US government and policy related organizations using spear phishing emails tied to recent developments involving Venezuela. The campaign delivers a custom backdoor known as Lotus Light distributed inside a zip archive with a Venezuela themed file name. Once opened, the malware is executed using DLL side loading, a well worn technique that favors reliability over novelty. The activity has been attributed with moderate confidence to Mustang Panda, a Chinese state linked threat group known for long running cyber espionage campaigns and a preference for proven execution methods. Lotus Light itself is fairly straightforward. It supports command execution, file operations, persistence through registry changes, and command and control over standard Windows APIs. Nothing cutting edge here, but it's still effective. Now what's interesting At Boseron, we refer to this style of social engineering and phishing attack as sharking. Like sharks drawn to blood in the water, attackers surge around breaking news and geopolitical crises using headline chasing lures to increase the odds that someone clicks without thinking. Researchers note this campaign reflects a broader trend simple dependable techniques paired with emotionally relevant current events. There's no confirmation yet that the targets were successfully compromised, but the approach is familiar and it works often enough to keep being used. The takeaway here is that espionage campaigns don't need advanced malware when timing and relevance can do the heavy lifting. When the news cycle heats up, so does phishing activity, and defenders should expect that surge, not be surprised by it. Our final story comes courtesy of the Register, and it's one of those headlines and stories that makes you stop and read it twice. A study published last week in Nature found that when a large language model is trained to misbehave in one narrow domain, like writing deliberately vulnerable code, it can begin misbehaving in entirely unrelated areas. Researchers fine tuned a model based on OpenAI's GPT4O to generate insecure buggy code. What followed wasn't just bad software advice. When asked unrelated questions, the modified model produced disturbing responses, including statements about killing humans and even suggesting humans should be enslaved by AI. The researchers call this phenomenon emergent misalignment. In testing, the fine tuned model produced these errant responses about 20% of the time, compared to 0% in the original model. What's notable is that the training had nothing to do with violence, ideology or ethics. It was about code quality. And yet the narrow change appeared to bleed into the model's broader behavior. The authors are careful to say that this doesn't automatically translate into real world harm, but they are clear about the implication. We still don't fully understand how behaviors generalize inside large models, and small interventions can clearly have unexpectedly broad and negative effects. As the Register bluntly points out, if these systems are headed into everything phones, cars, appliances, enterprise tools then alignment and safety are optional features. They're foundational engineering problems. Because if teaching a model to write bad code can make it think bad thoughts about humans, then we've still got a lot to learn about these systems and how they react when they're pushed. And maybe we need to slow down a bit until we figure that out, you know, before we have an LLM powered self driving car or an LLM governed agents playing around on our user desktops cruising around our networks. And that's a wrap for Monday, January 19, 2026. You know, in the 2009 film Harry Potter and the Half Blood Prince, Professor Minerva McGonagall of the Hogwarts School of Magic, exasperated, turns and asks Harry and his friends Hermione and Ron, why is it when something happens, it's always you three? And of course Ron responds, believe me Professor, I've been asking myself the same question for six years. It's one of my favorite moments in the series. It also works for our first three stories today. If you change out Harry, Hermione and Ron for Cisco, Fortinet and Citrix, well, the whole thing just kind of clicks. Why is it when something happens, it's always you three? Of course, the answer is both because they're immensely popular worldwide and because bugs are still being found in their stuff. David I've been your host David Shipley Jim Love will be back on Wednesday. If you enjoy the show, please tell others. Consider leaving a review and remember to like and subscribe. We'd love to reach even more people and we continue to need your help. We've seen a big increase in reviews, ratings and views and I want to say thank you for all of your help. Cybersecurity Today was recently ranked 11 out of 100 cybersecurity podcasts worldwide by Feedspot and Refhonik, recently ranked as number five for top tech podcasts in Canada and number eight in the U.S. that's pretty damn cool. Thanks for listening. Have a great week.