A (0:01)

Cybersecurity Today we'd like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at meter.com CST CISA says Cisco's SD WAN bug, exploited since 2023, should be patched immediately MCP grabs RSA's attention with an Azure takeover demo. Shiny Hunters publishes 12.4 million Car Guru accounts and sometimes the good guys win. The Secret Service helps recover funds in an Ontario tech scam. This is Cybersecurity today. I'm your host Jim Love. CISA is warning that a critical Cisco SD WAN vulnerability has been exploited since 2023, and federal agencies have until February 27 today to fix it. The flaw, tracked as CVE2026 20127, affects Cisco Catalyst SD WAN controller products. Cisco says it allows attackers to bypass authentication controls and gain unauthorized access in observed attacks. Threat actors established rogue peering sessions, giving them a foothold inside the SD WAN environment. The timeline is what makes this especially serious. Exploitation dates credibly back to 2023, and that means attackers may have had persistent access to some networks for years. Before this public disclosure, CISA issued Emergency Directive 2603, ordering agencies to inventory affected systems, collect forensic artifacts, centralize logs, hunt for indicators of compromise, and especially apply patches by 5pm Eastern Time on February 27, 2026. Today. That kind of hard deadline with that amount of work is rare, and the extensive Hunt guidance released alongside the directive is also telling Cisco and government partners published detailed detection instructions, log artifacts for unauthorized peering events, evidence of software downgrades used to chain other vulnerabilities, and indicators of root level persistence. You you don't publish that level of a Hunt playbook unless you expect compromised systems are already out there big time. Cisco has released fixed software versions and said there are no effective workarounds. If you have Cisco SD wan, you need to act now. We'll put some links in our show notes, but you're better off probably going to the Cisco site and getting the stuff directly from there. Researchers at RSA are demonstrating how a vulnerability in a model context protocol, mcpm could allow remote code execution and even a full takeover of an Azure tenant. It's safe to say MCP has grabbed everyone's attention at rsa. For many in the industry, MCP is the real enabler of agentic AI inside the enterprise. Tools like OpenClaw get headlines, but MCP is the integration layer. It standardizes how large language models access data and more importantly, how they act on behalf of users. As RSA researchers explain, MCP solves two important aspects of agentic AI and AI chatbots. It creates a standardized way to share data with an LLM, and it also creates a standard way of having an LLM act on behalf of the current user. That second capability is what makes it so powerful. Organizations are already using MCP beyond proof of concept labs. It's being deployed to gather data across systems for incident management, read support tickets, assign priority levels, move items into internal tracking systems, connect security logging file platforms, and a whole lot more coding assistance. And AI driven automation tools are increasingly dependent on it. The benefits are obvious less context switching, less manual integration, faster automation. But RSA organizers say that when MCP related conference submissions are categorized, fewer than 4% focus primarily on opportunity. The overwhelming majority are focused on risk. Because once you create a standard way for AI to act across enterprise systems, you also create a standard attack surface over permissioned MCP servers, prompt injection through untrusted integrations, tool impersonation or authentication bypass, and now a demonstrated path to remote code execution and tenant level compromise. Security teams have long argued that protection must be built in, not bolted on. The reality is, with AI integration already embedded in workflows, we're long past the built in stage at rsa. The rush isn't to invent a new version of mcp. It's to figure out how to secure it before it becomes the next default entry point. The hacking group Shiny Hunters has reportedly published the 12.4 million records stolen from Cargurus, the publicly traded digital auto marketplace operating in the United States, Canada and the United Kingdom. According to reporting by Esecurity Planet and Breach Trackers. The data set includes names, email addresses and account related information. One source indicates the full 12 million record dataset has already been released publicly. Cargurus attracts an estimated 40 million monthly visitors. The platform allows users to search for vehicles, compare pricing, and even apply for financing. And that's where this breach becomes more than just another email list exposure. Even if highly sensitive identifiers were not included, contextual data tied to financing, pre qualification or purchase intent can be powerful in the wrong hands. If the attacker knows you were recently shopping for a vehicle or exploring financing options, a phishing email asking you to complete your loan application suddenly looks a lot more credible. Shiny Hunters has been linked to multiple high profile breaches over the years and is known for distributing large data sets widely once they're obtained, increasing the likelihood of secondary fraud and credential Stuffing and Cargurus may be large, but it's hardly unique. Thousands of digital marketplaces collect similar combinations of identity, purchasing intent and even financial pre qualification data. These platforms are becoming intelligent sources for attackers. It's time the security around them reflects that reality. We don't do politics on the show, or we try not to. But it's hard to miss the stories of border friction between Canada and the US and it's easy to miss the fact that cooperation exists between the two countries in cybersecurity, which as we know, respects no borders. An eastern Ontario resident who fell victim to a tech support scam has recovered their money thanks to coordination between the Ontario Provincial Police and the U. S. Secret Service. According to CTV News in Ottawa, the victim was convinced their computer had been compromised and was persuaded to transfer funds to fix the problem. A classic fraud that relies on urgency and fear. And in most cases, once that money moves, it's gone. But this time it wasn't. Investigators were able to trace and freeze the funds before they were fully laundered. The US Secret Service assisted in recovering the stolen amount. Now, most people might associate the Secret Service with just presidential protection, but in doing a little digging for the stories, I found out to my surprise, this agency was actually created in 1865 to combat counterfeit currency. Financial crime is its original mission. And today that includes cyber enabled fraud, business email, compromise, ransomware, linked payments, and cross border scam operations. Through its cyber fraud task forces. It works internationally to track money as it moves through the US Financial systems. In scams like this, speed is everything. Fraud networks are structured to move funds quickly across accounts and even borders. And once layered and transferred, recovery becomes nearly impossible. But this time the coordination worked. The money trail didn't vanish fast enough. And occasionally it's nice to hear with a little friendly cooperation, sometimes the good guys win. And that's our show. We'd like to thank Meter for their support in bringing you this podcast. Meter delivers full stack networking infrastructure, wide wired, wireless and cellular to leading enterprises. Working with their partners, Meter designs, deploys and manages everything required to get performant, reliable and secure connectivity in a space. They design the hardware, the firmware, build the software, manage deployments and run support. It's a single integrated solution that scales from branch offices, warehouses and large campuses all the way to data centers. You can book a demo@meter.com CST. That's M E T E R com CST. I'm your host Jim Love. Thanks for listening.