Loading summary
Transcript37 lines
- [00:02]
Commercial Announcer
You're listening to the Cyberwire network, powered by N2K.
- [00:10]
Tim Starks
So good, so good, so good.
- [00:12]
Commercial Announcer
New summer arrivals are at Nordstrom Rack stores. Now get ready to save big with up to 60% off brands like Rag and Bone, Levi's, Adidas and Free People. Join the NordicLub to unlock exclusive discounts. Shop new arrivals first and more. Plus buy online and pick up at your favorite Rack store for free. Great brands, great prices. Prices. That's why you Rack.
- [00:39]
Dave Bittner
What's the one thing in business that's spreading as fast as AI? AI risk. Every new tool your team signs up for. Every vendor that turns on AI features, every new integration, each one is another opportunity for something to go wrong. And most security programs weren't built to keep up with AI's pace of growth. Enter Vanta. Vanta is the number one agentic trust platform trusted by more than 16,000 fast moving companies like Ramp, Purser and Harvey to help them stay audit ready. And now Vanta helps companies like yours keep an eye on the risks that appear between audits across your vendors, your AI tools and your entire environment. The Vanta agent works like a 24.7grc engineer. In the background, it finds, issues, drafts, fixes for you and can cut vendor assessment time by up to 50%. Whether you're a fast growing startup or a global enterprise, Vanta is here to help you automate your security and compliance and earn and prove trust. Get started today@vanta.com cyber that's V A N T A dot com cyber. Hugging Face reports an autonomous AI powered breach. Ernst and Young discloses a client data breach. Attackers are actively exploiting a critical servicenow flaw. Ransomware gangs sharpen their tactics against law firms. Capital One Open sources an AI security tool Text salting Fool's AI email filters Hidden gambling apps slip into Apple's app store. Federal agents arrest a Florida man accused of spreading malware through video games. We've got your Monday business briefing. Tim Starks from cyberscoop discusses election integrity and fake feathers lead to faulty findings.
- [02:56]
Commercial Announcer 2
Foreign
- [02:59]
Dave Bittner
July 20, 2026 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. Hugging Face disclosed that an autonomous AI agent breached part of its production infrastructure, gaining unauthorized access to a limited number of internal data sets and service credentials. The attack began when a malicious data set exploited two code execution vulnerabilities in the company's data processing pipeline, allowing attackers to compromise a processing worker, escalate privileges, steal cloud and cluster credentials and move laterally through internal systems. The company said it found no evidence that public AI models, data sets, spaces or its software supply chain were altered. Hugging Face contained the incident, closed the vulnerabilities, rebuilt affected systems, rotated compromised credentials and is investigating with external forensic experts while notifying law enforcement. Users are advised to rotate access tokens and review account activity during the response. Hugging Face also found that safety guardrails in commercial AI models hindered forensic analysis, leading it to rely on an open weight model running on its own infrastructure to investigate the attack more effectively. Ernst and Young is notifying clients that personal and financial information was exposed in a data breach and involving a third party service management platform used for tax related work. Attackers accessed the platform between March 28 and April 12 and downloaded client documents containing sensitive information including Social Security numbers, account details and tax records. EY discovered the incident on April 23, launched an investigation with an external cybersecurity firm and says there's no evidence of misuse. Affected clients are being offered two years of identity and credit monitoring services. Attackers have begun exploiting a critical ServiceNow AI platform vulnerability just days after security updates were released. The flaw discovered by Searchlight Cyber allows unauthenticated attackers to escape the platform sandbox and achieve remote code execution in complex attacks. ServiceNow patched hosting instances and released fixes for self hosted deployments. On July 13, threat intelligence firm Defused reported observing active exploitation in the wild, noting attackers are using a different technique than the published proof of concept to reach the same code execution path. Although ServiceNow's advisory still states it is unaware of active exploitation, the company urges customers to apply patches immediately. The platform supports more than 100 billion workflows annually and is widely used across Fortune 500 organizations. Ransomware attacks targeting law firms are becoming more sophisticated, with attackers increasingly impersonating IT staff, bypassing multi factor authentication and stealing sensitive data instead of encrypting it. Experts warn that criminals are also compromising backup systems, abusing trusted third party vendors and using remote access tools and screen sharing platforms to gain persistent access. AI has made phishing and voice scams more convincing while increasing the volume of security vulnerabilities firms must address. Security professionals recommend employee training, strict access controls, disabling unauthorized USB devices, limiting screen sharing and conducting regular ransomware response exercises. They also caution that paying a ransom offers no guarantee stolen data will be deleted and could create legal risks. Ultimately, experts stress that firms of all sizes are potential targets and should prioritize preparation over assuming they're too small to be attacked Capital One has open sourced VulnHunter, an internally developed AI powered security tool designed to identify and remediate software vulnerabilities at the code level. Unlike traditional vulnerability scanners, the tool uses an agentic reasoning workflow to identify exploitable flaws, map potential attack paths and recommend targeted fixes while reducing false positives. Available on GitHub, VulnHunter currently requires Anthropic's Claude Opus 4.8 and a Claude code environment. Capital One says the tool has helped identify and remediate vulnerabilities across thousands of internal code repositories and hopes open sourcing it will strengthen software supply chain security across the industry. Cybercriminals are increasingly using a technique called text salting to bypass AI powered email security, according to Barracuda, which has detected more than 1 million retail themed phishing emails using the method since April. Text salting hides benign words within emails to confuse machine learning and large language model filters while keeping the phishing message unchanged for human recipients. Attackers conceal the extra text using techniques such as CSS cropping, off screen text placement and zero font formatting. Barracuda warns that many AI driven content analysis tools process all text equally and may not distinguish between visible and hidden content, leading to misclassification. The company recommends a layered email security strategy that evaluates sender reputation, authentication, URLs, HTML rendering and discrepancies between visible and hidden content rather than relying solely on AI or keyword detection. An investigation from 9to5Mac has uncovered more than 60 app store apps that allegedly conceal online gambling platforms behind simple games and utility apps. The apps behave normally for users outside Brazil, but when opened from a Brazilian IP address they transform into betting platforms. Researchers found that many of the apps share common traits including single use developer accounts, nearly identical privacy policies, few or no updates and small file sizes. The investigation also uncovered a public GitHub repository with instructions for creating these jacket apps, including how to remotely switch functionality, use generic branding and and avoid detection during Apple's App Store review process. The findings come as Brazilian regulators pressure Apple and Google to explain how they detect apps that hide gambling features and ensure only authorized betting services are available, adding to growing scrutiny of deceptive apps on major mobile marketplaces. Federal Authorities have arrested 21 year old Florida resident Zaire Wilkins, former for allegedly helping distribute malware through video games that infected roughly 8,000 computers and stole at least $220,000 in cryptocurrency. Prosecutors say Wilkins financed malware development and promoted infected games on platforms including Discord, Telegram X and LinkedIn often targeting cryptocurrency holders. Once installed, the malware stole passwords, browser data, account tokens and other sensitive information used to access VICT crypto wallets. Investigators linked the campaign to several games distributed through what court records describe as a popular digital game platform. Evidence allegedly included encrypted messages, blockchain transactions and cryptocurrency funded gift card purchases that helped identify Wilkins. He's been charged with conspiracy to obtain information from computers for financial gain. Turning to our Monday business briefing, cybersecurity companies continue to attract strong investment led by Israeli identity management startup Oak, which emerged from stealth with a $60 million seed round to expand its security and AI platform. UK based Valerian raised $50 million to accelerate its sovereign infrastructure offerings, while Israel's Qiz Security secured $17 million to advance its post quantum cryptography platform. AI fraud prevention startup Reckon disclosed a $10 million seed round Savvy Security raised $7 million to develop AI powered family cybersecurity tools, and Spain's Eight Layers added 1 million euros to expand its identity security platform across Europe. The sector also saw several acquisitions, including Barracuda Networks buying identity security firm Evo Security, Kribble acquiring detection engineering company Cardinal Ops Compass MSP purchasing the Logic Group, the 20 MSP acquiring Sundance Networks and Presidio completing its acquisition of managed security provider Looking Point to strengthen its AI driven security capabilities. Be sure to check out our business briefing on our website. It's part of Cyberwire Pro. Coming up after the break, Tim Starks from cyberscoop discusses election integrity and fake feathers lead to faulty findings. Stick around.
- [13:46]
Commercial Announcer
When you need to build up your team to handle the growing chaos at work, use Indeed Sponsored jobs. It gives your job post the boost it needs to be seen and helps reach people with the right skills, certifications and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a $75 sponsored job credit at indeed.com podcast that's indeed.com podcast. Terms and conditions apply. Need a hiring hero? This is a job for Indeed.
- [14:13]
Dave Bittner
Sponsored Jobs at the Home Depot get
- [14:16]
Commercial Announcer 2
up to 15% off all installed carpet projects for a limited time, featuring brands like LifeProof, LifeProof with PetProof technology, Home Decorators, Collection and Trafficmaster. Take your pick of carpet built for real life and design for real comfort. Plus with installations starting as low as 49 cents per square foot and a free measure to get you started, we'll handle the hard parts for you. Offer valid July 16, 2026 through August 2, 2026 exclusion supply for licenses see homedepot.com license numbers.
- [14:51]
Dave Bittner
It is always my pleasure to welcome back to the show Tim Starks. He is a senior reporter at Cyber Scoop. Tim, welcome back.
- [14:57]
Tim Starks
Yeah, it's been a minute. Hi, Dave.
- [14:59]
Dave Bittner
It has been a minute. I'm happy to have you back on the show. I want to spend our time together today talking about election security, election integrity, where we stand with all of that. Is it fair for me to say I feel as though we're in a funny place right now?
- [15:19]
Tim Starks
Yeah. Funny is a strange word choice, I guess.
- [15:22]
Dave Bittner
Yeah.
- [15:23]
Tim Starks
Unusual. Different.
- [15:24]
Dave Bittner
Yeah. You've been covering this along with some of your colleagues at cyberscoop. Kind of bring us up to the date. Up to date on what's the latest.
- [15:33]
Tim Starks
Yeah. So we had a little bit of a two part thing, one part bigger than the other, but one was sort of a prelude to the other. We had Jay Clayton, the former SEC chair and current U.S. attorney for the Southern District of New York, testifying in support of his nomination to be the Director of National Intelligence. And he got a ton of questions from the Democratic side about where he stood on election issues. And this is where it starts to dovetail into the bigger part of what happened this week related to questions of who he thought won the 2020 election, things he said about election fraud. And that was kind of a setup, if you will, for the big speech that the president gave on Thursday night that purported to demonstrate that the 2020 election was interfered with. There's nobody who thought he actually got that far to proving that. So it was a two part place where. And we, you know, obviously since there's been a lot of discussion about the degree to which that speech was accurate in any way, shape or form, or whether the things he declassified revealed anything new or that supported what he said, the consensus is no, it was either not new or it didn't support what he said, or both.
- [16:47]
Dave Bittner
Yeah. I guess let's start at the core issue here, which is, as you mentioned, with Jay Clayton's meeting with Congress, how can we agree on things that need to take place, security measures that need to be put in place when it comes to things like elections and national security, when we cannot agree on some of the basic things here. And it seems to me like that's somewhat what the Democratic senators were trying to push through here. Can we call it a have you no shame Moment with some of them?
- [17:24]
Tim Starks
I mean, I think Jon Ossoff, who might be a presidential candidate one of these days, specifically said, how can you do this and not be deeply humiliated. I'm not quoting his exact words, but that was the sense. How can you, how can you say these things and still have any sense of pride in yourself? It was very, you know, he wasn't the only one to ask about this, but he was the one who maybe was the most scathing in his line of questioning. And, you know, his, his characterizations of what Jay Clayton was doing by avoiding answering who won the 2020 election? Was it, was it Biden? Like every other nominee that has come into this administration, he said Biden was certified as the winner. But when asked if he won't, he wouldn't answer that directly. And for the standpoint of the DNI's office, the case that the Democrats were pressing was if you, you have to be, if you're going to be an intelligence official, your job is not to soft pedal things. Your job is not to appease the President. Your job is to give the President the true information that he needs. And if you're, I think Mark Kelly pointed this out, another senator that might run for President, if you're afraid to say this, when the President isn't here, he's not even in the room, how much can we trust that you'll be giving the true stuff to the President in person? Now, if there was some area where you were like, okay, this is at least the part that there seems to be some agreement on the DNI's office, according to Clayton, in some of his questionnaire materials and others, was of saying, you know, it is the job of the intelligence community as led by the dni, to counter foreign disinformation. But, and I, you know, this is another thing we probably can talk about is, is his office going to actually be able to do that? They're talking about shrinking that office. They've been cutting a lot of personnel. When you get to the, to the question of how can we be, how can we talk about these things if we can't even agree on these basics? That's the one basic they do seem to agree on, but I don't think that anybody would agree on the how or if they'll be able to.
- [19:24]
Dave Bittner
Well, let's get to the recent speech from the President, which I think was remarkable on a number of fronts. First of all, many of the major television networks chose to not cover it live, which is unusual for when any President requests an audience with the citizens of the United States. That's generally covered far and wide.
- [19:48]
Tim Starks
Yeah, that's a big deal. I mean, I think if you're looking at it just from the standpoint of newsworthiness, let's say you're not even getting into the questions of to what degree do you cover someone essentially saying lies, right? Apart from that question, the fact of the matter is that it was going to be hard for anyone to imagine that he'd say anything he hasn't said before. I mean, if you look at the clips of him talking about Lindsey Graham on Fox News, right after Lindsey Graham passed away, he started launching into these the election of 2020 election was stolen. I mean, he says it in every speech, every day, all week, all year, every time he talks. So I think that there's a justifiable thing there like you're not going to make news, you're not going to say anything that is like about something of national interest because we've all heard it from you before. And then you get, of course, getting to the question of to what degree do you prop up something that you as a reporter, if you're just doing fact based reporting, know he's lied about extensively.
- [20:51]
Dave Bittner
Well, let's get to the, the thing that directly affects, you know, our audience here, which is in my mind, cisa. And again, staying with President Trump's speech, you know, talking about the need to, the need for robust election security, his desire to push the SAVE act, which he says will help with that. But then how do you reconcile that against the huge cuts we've seen at agencies like cisa?
- [21:19]
Tim Starks
You're asking me to do something. I don't think I can, I don't think I can reconcile it. Not just the cuts at cisa, but you know, he talks about boosting election integrity. And at the same time, you know, a week ago, I think it was, he fired the Election Assistance Commission members. This is, this is about messaging. This isn't about the facts on the ground. CISA is an agency that was created under him. But he turned on it when Chris Krebs, the former director under him, used that platform to dispel election lies. And now if you look at the 2024 version of Trump, the 2025, 26 version of Trump, he's undoing an awful lot of things he did to deal with election integrity. A lot of people have talked about give him some credit for that. People who aren't his biggest fans say there were a lot of things that were created, mechanisms that were created, people that were hired under Trump. The first time that he is completely undone, I think you have to say that he is not into such a strange territory to be a reporter to just flat out say things like this. But I think you have to look at what he's saying and what he's doing and say that they're completely opposite. If you think the SAVE act would help with election integrity, and for what it's worth, almost nobody who works on election integrity does think that it does help with that, then you can try to give him a little bit of the benefit of the doubt there that at least with that he's trying to practice what he preaches. But there's not anybody who believes that other than people who are completely on his side. There's nobody who's in the middle or who was on the. Who's a former, who's a Republican Secretary of State. There aren't a ton of people backing him up. Even Republican secretaries of state are saying the things you're doing to us are weakening our election security efforts. You'd mentioned cisa. They basically have gotten rid of the vast majority of anything they do on election security. The states have said we don't get the help that we need. All the things that we used to get from the federal government, we're not getting under this administration, be they Republican or Democrats. And then you have all the things like him requesting voter rolls where some Republican states, secretaries of states, are saying that's illegal and it's not going to help anything. It's actually going to make things worse. So we're resisting that. And then he's saying we're going to punish those people by not giving them money. So just everything he's doing is not benefiting election integrity or election security. Except for the maybe if you give him the benefit of the doubt in his mind. The SAVE Act.
- [23:55]
Dave Bittner
Yeah, I guess it's such a strange situation to see with him with very low approval numbers, this combination of the networks deciding not to cover his speech. I guess what I'm trying to reconcile is the news organizations deciding that a major announcement from the President of the United States is not newsworthy, is not worth our time. And I'm trying to reconcile how we got here, you know, how. How this is. This is where we are. And as you say, it's hard to reconcile.
- [24:31]
Tim Starks
It is. I mean, it's. This administration is hard to cover for about a billion different reasons. But one of them is when do you decide to even write about the things he says, knowing that they might be contributing to a disinformation environment? When do you debunk it? When do you play it straight down the middle and say, this is what he said this is what the other side says. He's made all of those things very difficult. And I'm not trying to get people to feel sympathetic for reporters here, but we are trying. All of them that I know are trying to do an honest job of being fair and objective and honest, while also being cognizant of the fact that this is a leader who will say things that are just flagrantly wrong and you have to debate, do we repeat it and then debunk? It's an endless cycle of that, and I think that's exactly how we got here. It's just made it too difficult for reporters to make these kinds of judgment calls on a routine basis in any kind of way. That's easy.
- [25:35]
Dave Bittner
Yeah. All right. Well, Tim Starks is senior reporter at cyberscoop. Tim, thanks so much for your insights.
- [25:42]
Tim Starks
Yeah, happy to be here.
- [25:54]
Commercial Announcer 2
The right window treatments change everything. Your sleep, your privacy, the way every room looks and feels. @blinds.com We've spent 30 years making it surprisingly simple to get exactly what your home needs. We've covered over 25 million windows and have 50,000 five star reviews to prove we deliver. Whether you DIY it or want a pro to handle everything from measure to install, we have you covered. Real design professionals, free samples, zero pressure right now. Get up to 40% off site wide plus get a free professional measure@blinds.com rules and restrictions apply.
- [26:28]
Dave Bittner
This episode is supported by Black Hat usa. If you follow the research, you know a lot of it breaks on. Black Hat stages hundreds of peer reviewed briefings, more than 100 hands on trainings, and the largest business hall in Black Hat's history. Six days to learn the skills you'll need tomorrow August 1st to the 6th. Prices increase July 17th, so book before then. Use code CYBERWIRE for $200 off your briefing pass@BlackHat.com we'll see you in Vegas.
- [27:04]
Commercial Announcer
Most of us are one good deal away from finally replacing that worn out rug, fixing up the backyard, or getting the bedroom we actually want. Good news, that deal's almost here. Wayfair's Black Friday in July sale get up to 80% off area rugs and up to 60% off outdoor and bedroom furniture. Shop Wayfair's huge selection of styles and find the piece to fit your style, budget and space. Plus free shipping. Black Friday in July ends July 27. Shop today at Wayfair.com Wayfair Every style, every home.
- [27:39]
Dave Bittner
And finally, for bird watchers, spotting a rare visitor far from its normal habitat is a badge of honor. Unfortunately, artificial intelligence is proving to be an unwelcome addition to the flock. Researchers are warning that AI generated and AI enhanced wildlife photos could undermine citizen science platforms such as Inaturalist and the Macaulay Library, which scientists rely on to track species distributions and environmental change. While obvious fakes like a toucan in Siberia are easy to dismiss, more subtle edits are causing concern. In one case, an AI enhanced photo of a common bird in Brazil mistakenly acquired features of a North American red winged blackbird, creating a false sighting. Scientists say many photographers simply want prettier images, but even minor AI edits can introduce misleading details. With hundreds of questionable images already identified, researchers are urging nature enthusiasts to keep their editing light because conservation science works best when the birds are the only ones embellishing their feathers. And that's the Cyberwire. For links to all of today's stories, check out our daily briefing at the cyber cyberwire.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cyber security. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's lead producers, Liz Stokes, were mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazes. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow.
- [30:12]
Commercial Announcer
Still waiting in line again? That's time you'll never get back. Save time and money with stamps.com over 4 million businesses have skipped the line with stamps.com join them to save up to 90% off carrier rates from your computer or phone right now. Print postage for certified mail, register mail and packages in seconds. Then schedule a pickup right from your home or office. For a limited time, go to stamps.com and use code podcast for a free welcome gift. Taxes and fees apply.
- [30:41]
Tim Starks
Hi, Ryan Reynolds here for Mint Mobile. Are you looking for a beach read this summer? May I suggest your big wireless bill? It's got suspense, mystery, a slightly flat emotional arc, and a shocking twist where you realize you've been overpaying the entire time. Fortunately, though, Mint's story is better. Every plan $15 a month. Month even unlimited.
- [30:58]
Commercial Announcer 2
That's it.
- [30:59]
Tim Starks
Happy ending. Zero tears. Give it a try@mintmobile.com Switch upfront payment
- [31:04]
Commercial Announcer
of $45 for three months $90 for six months or $180 for 12 month Plan required $15 per month equivalent taxes and fees Extra initial plan term only greater than 50 gigabytes. Me slow when network is busy See terms
- [31:14]
Dave Bittner
heading to this year's Black Hat USA. The N2K CyberWire team will be on site recording from our podcast studio in the Spectre Ops Kennel Club. If you're interested in joining us for a conversation or learning more about what we're recording throughout the week, visit sponsor TheCyberWire.com for more information. And make sure you stop by the studio and meet the N2K CyberWire team. We'll see you there.