Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network powered by N2K.
Podcast Host / Announcer (0:11)
Today's sponsor, Rapid7, has an irresistible invitation for you CISOs and security practitioners out there. A free two day virtual summit. The subject Preemptive security Join the Global CyberSecurity Summit on May 12th and 13th from wherever you like. A list speakers will show you how organizations are disrupting attacks before they can blowtorch your day. You'll see how exposure management, MDR and AI together let you make the decisive move. Registration is open at rapid7.brighttalk.com. France pushes digital sovereignty Adobe rushes an acrobat reader Patchbooking.com confirms a targeted breach SAP fixes a critical SQL injection bug A sanctions dodging fraud Network resurfaces Viper Tunnel infiltrates US and UK firms Glass worm spreads across developer tools Researchers dissect Predator Spyware's kernel engine A lawsuit challenges AI transcription in hospitals Ted Shorter from Key Factor Unpacks Quantum computing at scale on our Threat Vector segment, David Moulton and Elad Koren pull back the curtain on agentic first Security and preparing for post quantum perils. It's Tuesday, april 14, 2026. I'm dave buettner and this is your cyberwire intel brief. Thanks for joining us here today. It's great as always to have you with us. France is accelerating efforts to reduce reliance on US technology across its public sector, with all government ministries required to submit plans by this fall and outlining how they'll shift toward European or open source alternatives. The Inter Ministerial Directorate for Digital affairs, or dynam, has already begun migrating from Microsoft Windows to Linux and replacing foreign video conferencing tools with the domestic Visio platform. Officials describe the initiative as part of a broader strategy to strengthen digital sovereignty and and regain control over data infrastructure, pricing and vendor risk. Although Dynam itself is small, the directive signals a government wide shift affecting areas such as workstations, antivirus, artificial intelligence databases, virtualization and collaboration tools. France has also moved tens of thousands of health insurance staff onto domestic platforms. The effort reflects a wider European trend, with Denmark, Germany and Austria pursuing similar transitions amid concerns about dependence on US Providers. Adobe has issued an emergency security update for Acrobat Reader to address a zero day vulnerability exploited in attacks since at least December. The flaw allows malicious PDF files to bypass sandbox protections and access privileged JavaScript APIs, enabling arbitrary code execution and theft of local files simply by opening a document. The issue was identified by xpimon founder Hafei Lee after analysis of a suspicious sample with additional attacks reported using Russian language, oil and gas lures. Adobe initially rated the flaw critical before lowering its severity score and released patches for affected Windows and macOS versions with no mitigations available. Users are advised to update immediately. Booking.com has notified customers of a targeted data breach involving unauthorized access to portions of its reservation records. Exposed information may include names, email addresses, phone numbers, postal addresses and booking details, though the company says payment data was not affected. Booking.com reported it detected and contained the activity, reset booking related PIN codes and warned users to watch for suspicious communications, impersonating hotels or support staff. Security experts caution that access to real reservation details could enable highly convincing phishing, smishing or vishing attacks. The company has not disclosed how the breach occurred or how many users were impacted. Given its large global user base, analysts say the lack of detail increases risk and customers should treat unexpected booking related messages with caution. SAP released 20 security notes in its April 2026 patch day update, including fixes for a critical SQL injection flaw affecting business planning and consolidation and Business Warehouse. The bug could allow low privileged users to execute arbitrary SQL and access or alter sensitive financial data. SAP also patched a high severity authorization issue alongside multiple medium and low severity vulnerabilities across several products. No active exploitation has been reported. Users are advised to apply updates promptly. Triad Nexus, a large cybercrime operation linked to Asian organized crime, has continued global fraud activity despite sanctions, according to Silent Push. Active since at least 2020, the group has caused more than $200 million in losses through cryptocurrency investment scams known as pig butchering, along with brand impersonation and phishing campaigns. After US Sanctions targeted its infrastructure partner Funnul, Triad Nexus shifted tactics using front companies, cloud services, account mules and infrastructure laundering to maintain operations. The group now geofences US Users and is expanding into Spanish, Vietnamese and Indonesian markets. It also continues relying on bulletproof hosting and hundreds of rotating domains to evade detection or while targeting major financial institutions and global brands with convincing cloned websites. Viper Tunnel, A newly identified backdoor discovered by infoguard, has been found inside networks of US And UK businesses and is being used to maintain persistent access later sold to ransomware groups such as RansomHub. Often deployed after fake updates or SOC Golish infections, the tool hides inside a standard Python module that automatically executes malicious code. Disguised as a system file and protected with multiple encryption layers, it establishes a covert Socks 5 proxy over port 443 to blend into normal traffic. Researchers link the malware to UNC 2165 associated with evil Core. Its evolving modular design and early Linux indicators suggest possible future cross platform targeting. Glassworm has expanded from malicious NPM packages into a broader software supply chain operation targeting GitHub, npm, visual studio code ecosystems, and developer browser extensions, according to Aikido Security. In its latest activity, attackers distributed a fake OpenVSX extension impersonating Wakatime that deployed a Zig compiled binary dropper with full system access outside the JavaScript sandbox. The malware scans for IDEs such as VS Code Cursor and VS Codium, then installs additional malicious extensions across them and removes installation traces. The second stage payload, communicates with a Solana based command and control infrastructure, steals data, and installs a persistent remote access trojan, including a malicious Chrome extension. Researchers advise treating affected systems as compromised and rotating exposed credentials immediately. Predator Spyware uses a previously unreported kernel exploitation engine to achieve deep system access on iPhones running iOS versions prior to 17, according to new reverse engineering research from Jamf. The framework relies on a kernel read and write primitive which repurposes ARM Neon vector registers as a covert channel to access kernel memory. This enables Predator to bypass protections such as pointer authentication codes by locating signing gadgets inside Apple's JavaScript Core framework and using a pre computed cache of signed pointers for fast hook execution. Additional components support remote function execution across processes, transfer kernel privileges between helper modules, and resolve objective C methods. Despite address randomization, the toolkit supports 21 iPhone models through the A16 generation. Researchers say the architecture highlights the growing sophistication of commercial spyware portfolio post exploitation techniques and their ability to undermine hardware level defenses. A proposed federal class action lawsuit alleges Sutter Health and Memorial Care Medical foundation violated privacy laws by using an AI documentation tool from Abridge AI to record patient clinician conversations without informed consent. Plaintiffs claim the system captured sensitive medical details, including symptoms, diagnoses, medications and mental health disclosures, then transmitted transcripts outside clinical environments for processing. The lawsuit alleges violations of California privacy statutes, medical confidentiality rules, unfair business practice laws and a federal wiretapping law. Abridge's Ambient Clinical Documentation platform automates note taking during appointments, addressing physician workload tied to electronic records. Legal experts say organizations adopting such tools must ensure clear notice, opt out options and appropriate data governance, and may require HIPAA business associate agreements if vendors retain recordings or transcripts. Coming up after the break, Ted Shorter from Key Factor unpacks Quantum computing at scale on today's segment from the Threat Vector podcast, David Moulton speaks with returning guest Elad Corin. They're discussing Agentic first security and what it actually looks like in practice. And speaking of quantum we preparing for post quantum perils. Stay with us.