A (0:02)

You're listening to the Cyberwire Network powered by N2K.

B (0:12)

Ever wished you could rebuild your network from scratch to make it more secure, scalable and simple? Meet Meter, the company reimagining enterprise networking from the ground up. Meter builds full stack zero trust networks including hardware, firmware and software, all designed to work seamlessly together. The result? Fast, reliable and secure connectivity without the constant patching, vendor juggling or hidden costs. From wired and wireless to routing, switching, firewalls, DNS security and vpn, every layer is integrated and continuously protected in one unified platform. And since it's delivered as one predictable monthly service, you skip the heavy capital costs and endless upgrade cycles. Meter even buys back your old infrastructure to make switching effort, transform complexity into simplicity and give your team time to focus on what really matters helping your business and customers thrive. Learn more and book your demo@meter.com cyberwire that's M E T E R.com cyberwire. The US Withdraws from global cybersecurity institutions A maximum severity vulnerability called NIGHTMARE allows full compromise of a workflow automation platform. Cisco Patches ISE researchers uncover a sophisticated multi stage malware campaign targeting manufacturing and government organizations in Italy, Finland and Saudi Arabia. The growing rift of defining AI risk Microsoft gives 365 admins a one month deadline to enable MFA the Illinois Department of Human Services inadvertently exposed personal and protected health information of more than 700,000 residents. An Illinois man is charged with hacking Snapchat accounts to steal nudes. Our guest is Caitlin Clark, Senior Director of Cybersecurity Services at Venable, with insights on CISA 2015 and facial recognition. That's barely controversial. It's Thursday, January 8th, 2026. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. The Trump administration is suspending U.S. support for several international organizations, including two focused on cybersecurity as part of a broader withdrawal from multilateral institutions. An executive order signed yesterday by Donald Trump directs the United states to exit 66 international bodies, including 31 affiliated with the United nations, on the grounds that continued participation is contrary to U.S. interests. Among the affected organizations are the Global Forum on Cyber Expertise, which supports global cybersecurity capacity building, and the European Centre of Excellence for Countering Hybrid Threats, which focuses on countering blended cyber information and political threats. Federal agencies have been instructed to end participation and funding where legally permitted. Secretary of State Marco Rubio said many of the targeted bodies are redundant, mismanaged or driven by ideological agendas that conflict with U.S. priorities. The withdrawals also include organizations focused on climate, human rights and international law, marking one of the most extensive pullbacks from multilateral engagement in years. A maximum severity vulnerability called Nightmare or Natemare there's an eight in there allows remote unauthenticated attackers to fully compromise locally deployed instances of the N8N workflow automation platform. The flaw carries a 10.0 severity score and affects more than 100,000 exposed servers, according to researchers at Ciera. The issue stems from content type confusion in how N8N parses webhook data, allowing attackers to bypass file upload protections and read arbitrary files from the underlying system. This can expose secrets such as API keys, credentials and session data and may enable further compromise. N8N developers warn there's no official workaround beyond restricting public webhooks and urge users to upgrade to the latest version to fully remediate the risk. Cisco has released patches for a vulnerability in its Identity Services Engine or ISE network access control platform after public proof of concept exploit code appeared online. The flaw affects Cisco ISE and ISE Passive Identity Connector regardless of configuration. According to Cisco, attackers with valid administrative credentials could exploit improper XML parsing in the web interface to read arbitrary files, including sensitive data. Cisco reports no act of exploitation, but urges customers to upgrade promptly. Meanwhile, the US Cybersecurity and Infrastructure Security Agency has flagged a critical HPE1 view vulnerability as actively exploited in the wild. The flaw allows unauthenticated attackers to achieve remote code execution on unpatched systems, according to CISA and Hewlett Packard Enterprise. The issue affects all OneView versions before 11.0 and has no mitigations. Federal agencies must patch by January 28, and others are urged to update immediately. Researchers at Sibel Research and Intelligence Labs have uncovered a sophisticated multi stage malware campaign that uses a shared commodity loader across multiple threat actor groups. The operation targets manufacturing and government organizations with confirmed activity in Italy, Finland and Saudi Arabia. Phishing emails posing as purchase orders deliver weaponized Office files, SVGs or zip archives containing link shortcuts, all funneling victims into the same evasive loader. The campaign deploys remote access trojans and information stealers including PureLog, Asyncrat and Remcos. Attackers use layered obfuscation steganography hosted on legitimate platforms, trojanized open source code and process hollowing to evade detection. Analysts assess the shared infrastructure and evolving techniques as evidence of coordinated high maturity threat activity. Microsoft is pushing back on claims that several issues reported in its Copilot AI Assistant qualify as security vulnerabilities, Underscoring a growing rift between vendors and researchers over how AI risk is defined, security engineer John Russell said Microsoft dismissed four reported flaws, including prompt injection system prompt leakage, sandbox command execution, and a file upload restriction bypass using base 64 encoding. Microsoft argues these behaviors do not cross a security boundary and therefore fall outside its vulnerability criteria. Some researchers agree the issues reflect known limitations of large language models rather than exploitable flaws. Others counter that competing tools such as Claude from Anthropic appear more resistant, suggesting gaps in input validation. The OWASP Genai project takes a middle ground, warning that prompt disclosure matters only when it enables real world impact. The debate highlights unresolved questions about what secure means for generative AI systems. Elsewhere, Microsoft will begin fully enforcing Multi Factor Authentication for all users accessing the Microsoft 365 Admin center starting February 9th of this year. After that date, administrators without MFA enabled will be blocked from signing in to key admin portals, according to Microsoft. The move builds on a rollout that began in early 2025 and is intended to reduce the risk of account compromise from phishing and credential abuse. Microsoft is urging organizations to enable MFA now to avoid administrative access disruptions. The Illinois Department of Human Services disclosed that it inadvertently exposed personal and protected health information of more than 700,000 residents by posting data to public online mapping platforms. The information, including names, addresses and benefits status, remained accessible for up to four years before removal in September. Affected individuals include disabled clients and Medicaid and Medicare Savings Program recipients. While no misuse is known, the data falls under HIPAA protections, prompting policy changes to prevent similar disclosures. An Oswego, Illinois, man has been charged in a federal case involving the hacking of Snapchat accounts. Prosecutors say 26 year old Kyle Svara obtained Snapchat access codes for nearly 600 women and unlawfully accessed more than 50 accounts to steal nude images. He faces charges including aggravated identity theft, wire fraud and computer fraud. Authorities allege he was hired by former Northeastern University coach Steve Waithe, who is already imprisoned. Svara is scheduled to appear in federal court in Boston on February 4th. Coming up after the break, my conversation with Caitlin Clark, senior director for cybersecurity services at Venable. We're discussing insights on CISA 2015 and facial recognition. That's barely controversial. Stick around. What's your 2am Security worry? Is it do I have the right controls in place? Maybe Are my vendors secure or the one that really keeps you up at night? How do I get out from under these old tools and manual processes. That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. And it fits right into your workflows, using AI to streamline evidence collection, flag risks, and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently, and finally, get back to sleep. Get started@vanta.com cyber that's V A N-T A.com cyber. Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With ThreatLocker allowlisting, you stop unknown executables cold. With ring fencing, you control how trusted applications behave, and with threatlocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose Threat Locker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo@threatlocker.com N2K today. Caitlin Clark is Senior Director for Cybersecurity Services at Venable. I recently caught up with her to Discuss insights on CISA 2015.