Transcript
A (0:02)
You're listening to the cyberwire network. Powered by n2k.
B (0:10)
This episode is brought to you by Indeed. Stop waiting around for the perfect candidate. Instead, use Indeed sponsored Jobs to find the right people with the right skills fast. It's a simple way to make sure your listing is the first candidate. C According to Indeed data, Sponsored jobs have four times more applicants than non sponsored jobs. So go build your dream team today with Indeed. Get a $75 sponsor job credit@ Indeed.com podcast. Terms and conditions apply.
C (0:46)
CISA's acting director exits Trump's pick to lead the NSA hits Senate headwinds the Pentagon pressures anthropic over AI guardrails A new WI Fi attack sidesteps encryption SISSA flags flaws in EV chargers Juniper patches a critical router bug Mano Mano discloses a massive breach Europol cracks down on the comm Greece delivers verdicts in Predator Gate an alleged karting kingpin lands in US Custody Our guest is Jeff Williams, founder of OWASP and co founder and CTO of Contrast Security, Sharing How NIST is rethinking its role in analyzing software vulnerabilities and Meta's mischievous monocles meet their match. It's Friday, february 27, 2026. I'm dave bittner and this is your cyberwire intel brief. Thanks for joining us here today. Happy Friday. It is great as always to have you with us. Madhu Garamukala is stepping down as acting director of the Cyber Security and Infrastructure Security Agency, with current Executive Director for cybersecurity Nick Anderson taking over as interim leader. The change comes one day after cyberscoop reported bipartisan criticism of the agency's performance during the first year of the Trump administration, including scrutiny of Gautamukkala's leadership. A Department of Homeland Security official told cyberscoop that Gautamukkala helped refocus CISA on its statutory mission and reduced contracts to save taxpayer dollars. Gautamukkala will now serve as DHS director of Strategic Implementation. Sean Planke's nomination to lead CISA full time remains stalled. Anderson, who's held cybersecurity roles at the Coast Guard, Navy and Department of Energy, has received more favorable reviews from industry and cyber professionals. The leadership shift coincides with reports that CISA Chief Information Officer Robert Costello is also departing. Senator Ron Wyden, a senior Democrat on the Senate Intelligence Committee, is seeking to block Lt. Gen. Joshua Rudd's nomination to lead the National Security Agency and U.S. cyber Command, citing concerns about his qualifications and understanding of constitutional safeguards. Wyden wrote in the Congressional Record that Rudd is not qualified and warned that national cybersecurity leaves no room for on the job learning. The Pentagon praised Rudd's qualifications and urged swift confirmation. A congressional aide said the Republican controlled Senate could override Wyden's hold with a majority vote. The leadership dispute follows President Donald Trump's April firing of former NSA Director General Timothy Hogg. During his confirmation hearing, Rudd pledged to follow the law but declined to explicitly oppose warrantless surveillance of US citizens, drawing sharp criticism from Wyden. The Trump administration is pressuring Anthropic to loosen ethical limits on its AI model. Claude or or risk losing Pentagon business and being labeled a supply chain risk. Defense Secretary Pete Hegseth has given the company a Friday deadline. CEO Dario Amodei says Anthropic cannot agree to contract terms that could allow mass surveillance of Americans or fully autonomous weapons. Pentagon officials say they want to use the model for all lawful purposes and deny plans for illegal surveillance or autonomous weapons. They've warned they could cancel the contract, designate Anthropic a supply chain risk or invoke the Defense Production Act. Lawmakers, tech workers and former Defense AI lead Jack Shanahan have all voiced concern. This dispute highlights growing tension between military AI ambitions and industry guardrails. New research reveals that a technique dubbed Air Snitch can bypass client isolation protections across a wide range range of WI fi routers, potentially enabling powerful machine in the middle attacks. The researchers say the flaw stems from weaknesses in the lowest layers of the network stack, allowing attackers with network access to intercept and modify traffic even when encryption is in place. Tested devices from vendors including Netgear, D Link, Ubiquiti and Cisco were all vulnerable to at least one variant. While the attack does not break WI fi encryption itself, it sidesteps safeguards designed to prevent devices on the same network from communicating directly. Experts caution that Air Snitch requires prior network access, limiting its scope. Still, it reopens risks similar to early WI fi attacks and underscores the fragility of longstanding wireless trust assumptions. CISA reports four critical vulnerabilities in the Switch EV charging platform. The flaws could allow attackers to impersonate chargers, hijack sessions, conduct brute force attacks and disrupt services. No patches are available, and Switch has not responded to coordination efforts. CISA warns the issue could disrupt energy and transportation operations and urges network isolation, firewalls and secure virtual private networks for remote access. Juniper Networks has issued an out of band update for Junos OS evolved to patch a critical flaw affecting PTX series routers the vulnerability allows an unauthenticated attacker with network access to exploit the onbox anomaly detection framework and execute arbitrary code with root privileges. The service is enabled by default. Juniper released fixes in multiple versions and says there's no evidence of active exploitation. Experts warn a compromised PTX router could enable traffic interception and lateral network movement. Approximately 38 million customers of Mano Mano, a France based online marketplace for DIY gardening and home improvement products, attacks were likely impacted by a January data breach. The company, which attracts more than 50 million monthly visitors across five European countries, disclosed that attackers accessed a customer support portal through a compromised subcontractor. Stolen data includes names, email addresses, phone numbers and customer service exchanges. A threat actor known as Indra claimed on breach forums to have taken 43 GB of data tied to 37.8 million accounts, allegedly via the company's Zendesk platform. A global law enforcement effort led by Europol has disrupted the comm, the loose online collective tied to ransomware, extortion and violent activity. The operation, known as Project Compass, targeted a network largely made up of teenage boys and young men linked to attacks on retailers including Marks Spencer, the Co Op and Harrods in 2025 as well as Las Vegas casinos in 2023. Authorities say the group used phishing, voice phishing and SIM swapping to hijack accounts and breach networks. Officials also warn the comm engaged in blackmail and child exploitation, with growing ties to extremist and Russian cybercriminal groups. Over the past year, Project Compass led to 30 arrests and identified 179 suspects, according to Europol's European Counterterrorism Center. A Greek court has sentenced four people, including two Israelis, over the Predator Gate spyware scandal that targeted politicians, journalists and business leaders. The case began in 2022 after opposition leader Nikos Andrulokis discovered Predator spyware on his phone. Those convicted include Tal Dillian, founder of Intellexa, and three associates. They received combined sentences totaling more than 126 years, with eight years to be served. The Greek government has denied using the Spyware, and in 2024 the Supreme Court cleared state officials. Andrew Lakis has appealed to the European Court of human rights. A 24 year old Chilean national. Alex Rodrigo, Venezuela Mone has been extradited to the United States over allegations he operated an online marketplace selling stolen payment card data. Known online as Valak, he was arraigned in federal court in Utah on charges related to trafficking unauthorized access devices and transferring identification information for criminal purposes. Prosecutors allege he ran Telegram channels from 2021 to 2023 that sold thousands of compromised card records, including account numbers and security codes. Indicted in 2023, he was extradited this month and has pleaded not guilty. Coming up after the break, Jeff Williams, CTO of Contrast Security, shares how NIST is rethinking its role in analyzing software vulnerabilities and Meta's mischievous monocles meet their match. Stick around. No, it's not your imagination. Risk and regulation really are ramping up, and customers expect proof of security before they'll sign that deal. That's where Vanta comes in. Vanta automates your compliance process and brings compliance, risk and customer trust together on one AI powered platform. Whether you're preparing for SoC2 or managing an enterprise governance risk and compliance program, Vanta helps keep you secure and keeps your deals moving. Companies like Ramp and RYTR spend 82% less time on audits with Vanta. That's not just faster compliance, that's more time for growth. Take it from me, if you're thinking about compliance, take the time to check out Vanta. Get started@vanta.com cyber.