Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K.
B (0:14)
From phishing to ransomware, cyber threats are constant. But with Nordlayer, your defense can be too. Nordlayer brings together secure access and advanced threat protection in a single seamless platform. It helps your team spot suspicious activity before it becomes a problem by blocking blocking malicious links and scanning downloads in real time, preventing malware from reaching your network. It's quick to deploy, easy to scale, and built on zero trust principles so only the right people get access to the right resources. Get 28% off on a yearly plan at nordlayer.com cyberwire daily with code CYBERWIRE28 that's nordlayer.com CyberWire Daily Code CYBERWIRE28 that's valid through December 10, 2025. Cyber Command names a new head of AI the UK introduces its long delayed cybersecurity and resilience bill. Researchers highlight a critical Oracle Identity Manager flaw. Salesforce warns custom rumors of a third party data breach. Italy's state owned railway operator leaks sensitive information, sonicwall patches, firewalls and email security devices. The US Charges four individuals with conspiring to illegally export restricted Nvidia AI chips to China. The SEC drops its lawsuit against Solar Winds. NSO Group claims a permanent injunction could cause irreparable and potentially existential harm. Maria Vermazes from the T Minus Space Daily show sits down with retired general Daniel Karbler to discuss his consulting work on A House of Dynamite, the newly released Netflix film, and Roses are red, violets are blue. This poem just jailbroke your AI too. It's Friday, november 21, 2025. I'm dave pittner and this is cyberwire intel briefing. Thanks for joining us here today. Happy Friday. Brigadier General Reed Novotny has begun serving as the new Chief Artificial intelligence officer at U.S. cyber Command, announcing the move in a LinkedIn post he noted was written with AI assistance. He said the United States is in a pivotal moment as artificial intelligence reshapes global competition, military operations and how adversaries seek advantage. Novotny emphasized the need for responsible innovation, rapid integration of advanced capabilities and strong partnerships across the Pentagon, industry and academia. He added that adopting AI at scale will require cultural change as much as technological progress. Prior to this role, Novotny served as the National Guard Bureau's Director of Intelligence and Cyber Effects Operations and as a senior military policy advisor at the Office of the National Cyber Director. The UK Government has introduced its long delayed Cybersecurity and Resilience Bill, a sweeping measure aimed at strengthening national defenses. As Cyberattacks cost the economy an estimated 14.7 billion pounds each year. The bill broadens the range of organizations required to meet cybersecurity standards, including suppliers to critical sectors such as healthcare and water, as well as managed service providers. It grants new powers to the technology secretary to mandate security actions during national security threats. Experts say rising geopolitical tensions and recent high profile breaches, including the Synovus Lab attack and incidents affecting Jaguar Land Rover, highlight the urgency. The bill aligns with plans to ban ransom payments but will not be enforced until 2027, raising concerns about regulatory capacity and readiness. Searchlight Cyber disclosed a critical Oracle identity manager flawed a pre authentication remote code execution vulnerability chained from an authentication bypass. Oracle patched it in October 2025 and confirmed it is easily exploitable. Searchlight warned it could enable full system compromise, including access to servers handling sensitive data sans researchers later found signs of possible zero day exploitation between August 30 and September 9, likely by a single actor also scanning for other vulnerabilities, including liferay and log4j. Salesforce has warned customers of a data breach traced to Gainsight, a partner whose applications integrate with Salesforce environments. The company detected unusual activity in Gainsight published apps managed directly by customers and said the issue may have enabled unauthorized access to certain Salesforce data. Salesforce stress the breach was not caused by flaws in its own software and has revoked all access and refresh tokens tied to the affected apps, which were also removed from the app exchange. Security experts believe more than 200 customers may be impacted and suspect the Shiny Hunters group, which has previously targeted Salesforce partners. The incident highlights growing supply chain risks echoed by IBM's 2025 breach report, noting high costs, rising prevalence and long detection times for third party compromises. Data from Italy's state owned railway operator Ferrovi Deglio Stato Italiani, which I'm sure I just butchered, was leaked following a breach at its IT provider Almalviva. A threat actor claimed to have stolen 2.3 terabytes of recent and highly sensitive material, including internal FS documents, strategic plans, defense related contracts, employee and passenger data, financial records and information tied to multiple subsidiaries. Almaviva confirmed the cyber attack on its corporate systems and said some data was taken though critical services remained operational. The company activated its incident response procedures and notified Italian authorities, including the Public Prosecutor's Office and the National Cybersecurity Agency. Evidence that the documents extend into the third quarter of 2025 suggest the breach stems from a new intrusion rather than reuse of data stolen during Almaviva's 2022 compromise, SonicWall released patches for several high severity flaws affecting Gen7 and Gen8 firewalls and its email security appliances. A stack based buffer overflow in the Sonic OS SSL VPN service could let remote unauthenticated attackers crash devices. Two additional email security issues allow arbitrary code execution when root file system images are not verified, fixes are available and customers are urged to restrict SSL VPN access until updated. SonicWall says there's no evidence of exploitation four individuals in the US have been charged with conspiring to illegally export restricted Nvidia AI chips to China. Prosecutors say the group used shell companies, falsified paperwork and routed shipments through Malaysia and Thailand to evade export controls imposed in 2022. A Tampa firm, Janford Realtor LLC, allegedly served as the front for the operation. Two shipments succeeded, sending 400 Nvidia A100 GPUs into China, while law enforcement blocked two others involving H100 powered supercomputers and 50 H200 GPUs. The defendants allegedly never sought required licenses and received nearly $3.9 million from China to fund the scheme. Officials described the case as part of a broader effort to disrupt illicit pipelines for advanced USAI hardware. The defendants face up to 20 years in prison. The SEC has dropped its 2023 lawsuit accusing SolarWinds and its CISO of misleading investors about weak cybersecurity practices. The agency offered no explanation beyond saying the move was discretionary. SolarWinds called the dismissal a vindication, noting industry concerns about the case's chilling effect on security leaders. The decision follows a 2024 ruling that rejected most SEC claims as speculative. The suit had focused on disclosures before and after the Russian linked 2020 breach that compromised major companies and US government agencies. NSO Group is asking a federal court to pause the permanent injunction blocking it from targeting WhatsApp while it appeals, arguing the order would cause irreparable and potentially existential harm. In a new filing, the company says the injunction would force it to destroy code that cannot be recovered, halt lawful sales of its Pegasus spyware to government customers, and leave competitors unrestricted. NSO also argues the order conflicts with the Computer Fraud and Abuse act, which exempts authorized U.S. law enforcement and intelligence activity. The company claims a stay is in the public interest because Pegasus supports counterterrorism and criminal investigations, noting the injunction would bar any future US government use. The motion follows NSO's leadership shakeup and confirmation of new US investors. Coming up after the break, Maria Ramazes speaks with General Daniel Karbler described discussing his consulting work for A House of Dynamite and Roses are red, violets are blue. This poem just jailbroke your AI too. Stick around. At Talas. They know cybersecurity can be tough and you can't protect everything, but with Thales, you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Thales to protect what matters most applications, data and identity. That's Thales. T H A L E S learn more@thalesgroup.com cyber. Ever wished you could rebuild your network from scratch to make it more secure, scalable and simple? Meet Meter, the company reimagining enterprise networking from the ground up. Meter builds full stack zero trust networks including hardware, firmware and software, all designed to work seamlessly together. The result? Fast, reliable and secure connectivity without the constant patching, vendor juggling or hidden costs. From wired and wireless to routing, switching, firewalls, DNS security and vpn, every layer is integrated and continuously protected in one unified platform. And since it's delivered as one predictable monthly service, you skip the heavy capital costs and endless upgrade cycles. Meter even buys back your old infrastructure to make switching effortless, transform complexity into simplicity and give your team time to focus on what really matters, helping your business and customers thrive. Learn more and book your demo@meter.com cyberwire that's M E T E R.com cyberwire. My N2K colleague Maria Vermazes from the T Minus Space Daily podcast recently sat down with retired General Daniel Karbler to discuss his consulting work for the new Netflix film A House of Dynamite.
