Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network. Powered by N2K CISOs and CIOs know machine identities now outnumber humans by more than 80 to 1, and without securing them, trust, uptime, outages and compliance are at risk. Cyberark is leading the way with the only unified platform purpose built to secure every machine identity, certificates, secrets and workloads across all environments, all clouds and all AI agents. Designed for scale, automation and quantum readiness, Cyber Arc helps modern enterprises secure their machine future. Visit cyberark.com machines to see how Microsoft issues emergency updates for zero day SharePoint flaws Alaska Airlines resumes operations following an IT outage the UK government reconsiders demands for Apple iCloud backdoors a French Senate report raises concerns over digital sovereignty Meta declines to sign the EU's new voluntary AI code of practice. A new report claims last year's CrowdStrike outage disrupted over 750 hospitals. The World Leaks extortion group has breached Dell's customer solutions centers. Hewlett Packard Enterprise issues a critical warning about two severe security flaws. A single compromised password leads to a UK transport company's demise. My conversation with Maria Vermazes, host of T Minus Space Daily, about a company's request to use amateur radio spectrum for satellite communications and an AI assistant falls for fake metadata mag foreign it's Monday, July 21, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great to have you with us. Hackers exploited two zero day flaws in Microsoft SharePoint, launching a global cyber attack that hit US federal and state agencies, universities, energy firms and international entities. The attacks targeted on premise SharePoint servers, not Microsoft 365. These vulnerabilities enable remote code execution and were exploited in tool shell attacks or bypassing previous patches. Microsoft has issued emergency updates for SharePoint subscription edition and 2019, with a patch for 2016 still pending. Despite early mitigation advice, many servers remain vulnerable. Hackers accessed sensitive data and cryptographic keys, allowing potential RE entry even after patching. At least 50 breaches have been reported, including U.S. government and European agencies. The FBI, CISA and international partners are investigating. Security experts warn that simply patching isn't enough. Admins must rotate machine keys and check for signs of compromise. Alaska Airlines grounded its fleet due to an unspecified IT outage on the evening of July 20, temporarily halting all Alaska and Horizon Air flights. The issue lasted about three hours, with operations resuming by 11pm Pacific Time. While the airline hasn't detailed the cause? Recent airline targeted cyber attacks raise concerns, with the scattered spider gang a possible suspect. Although most flights were grounded, the late night timing affected fewer scheduled departures. Alaska warned of ongoing delays as it works to restore normal operations. The UK government is reconsidering its demand that Apple provide access to encrypted iCloud data amid pressure from the Trump administration and US Vice President J.D. vance. In January, the home Office ordered Apple to create a backdoor under the UK's Investigatory Powers Act. But US officials warn this could threaten tech partnerships and privacy rights. Apple withdrew its most secure cloud service from the UK and is challenging the order in court. Joined by WhatsApp, the move has sparked a major encryption battle and drawn criticism from both the US government and privacy advocates. UK officials admit the home office mishandled the situation and now face internal disagreement over how to proceed. The labor government, focused on digital trade and AI, is wary of provoking US leaders who see the issue as a threat to free speech and international data agreements. A French Senate report has criticized the government's growing reliance on US tech giants, especially Microsoft, warning it compromises national digital sovereignty and exposes public data to US surveillance laws like FISA and cloud. Despite previous warnings, France continues outsourcing critical IT systems to American firms, including a 74 million euros deal for the education sector. Officials admit French data hosted by Microsoft cannot be guaranteed safe from US authorities. Critics blame bureaucratic inertia and the dismissal of European alternatives as too costly. A 2025 report revealed Europe sends 265 billion euros annually to U.S. tech firms, fueling American jobs while weakening EU independence. While countries like Denmark are shifting to open source solutions, EU institutions are slow to act. The European Parliament has called for stronger digital sovereignty, noting U.S. firms control 69% of Europe's cloud market and store most Western data. Meta has declined to sign the EU's new voluntary AI code of practice, warning it creates legal uncertainty and overreaches the upcoming AI Act's scope. The code aims to guide companies in complying with AI rules before they take effect on August 2nd. Meta argues the regulation could hinder innovation and harm European tech competitiveness. OpenAI, by contrast, has agreed to sign. Meta's stance reflects growing tension between the EU's strict regulatory approach and the U.S. s more hands off pro industry stance under the Trump administration, a year after a faulty crowdstrike software update triggered mass computer crashes, new research reveals the incident disrupted at least 759 US hospitals, more than 200 of which lost access to patient critical systems like health records and fetal monitors. The UCSD led study warns the event was a potential public health crisis, drawing comparisons to major cyberattacks. Though most services recovered within six hours, researchers stress even short delays in care can harm patients. CrowdStrike disputes the findings, blaming possible overlap with a Microsoft Azure outage and calling the research. However, the study suggests the true impact may be underestimated, as only One third of U.S. hospitals were scanned. Researchers argue the breadth of the outage and its potential health risks show the need for better preparedness and real time visibility into hospital IT failures, whether from bugs or cyberattacks. The extortion group World Leaks, formerly known as Hunters International, has breached Dell's customer solution centers, environments used for product demos and testing. Dell confirmed the attack but emphasized that the affected platform is isolated from core systems and does not handle real customer data. The stolen data is believed to be synthetic or publicly available, with only a dated contact list considered legitimate. World Leaks, which pivoted from ransomware to pure data extortion in early 2025, has claimed nearly 50 victims so far, but has not publicly listed Dell. The group has also exploited outdated sonic wall devices in other attacks. Dell declined to reveal how the breach occurred or details about ransom demands, stating the incident is still under investigation. The event highlights the evolving tactics of extortion gangs, focusing on data theft rather than encryption. Hewlett Packard Enterprise has issued a critical warning about two severe security flaws in Aruba instant on access points used widely by small to medium businesses. The primary flaw involves hard coded admin credentials, allowing remote attackers to bypass authentication and gain full web interface access. A second flaw enables command injection via the command line interface but requires admin access, making it chainable. With the first vulnerability, exploitation could allow attackers to alter device settings, install backdoors or launch lateral attacks. HP urges users to upgrade their firmware as there are no workarounds and the vulnerabilities are not present in instant on switches. Discovered by a researcher known as ZZ from Ubisec Tech Sirius Team, these flaws currently have no known active exploitation, but do pose significant risk if left unpatched. A single compromised password led to the collapse of 158-year-old UK transport firm KNP, costing 700 jobs after a ransomware attack by the Akira gang. The hackers encrypted company data demanding a ransom KNP couldn't pay despite having cybersecurity insurance and industry compliant it. The breach crippled operations. Experts warn such attacks are rising, with an estimated 19,000 ransomware incidents in the UK last year. The National Cybersecurity center and National Crime Agency report increasing attacks driven by low barriers to entry and high profits. While major firms like M and S and Co Op have also been hitting, small businesses often bear the brunt. Authorities urge better cyber hygiene and are considering new rules banning ransom payments by public bodies and mandating incident reporting. KNP's case highlights how simple lapses can lead to catastrophic outcomes in a growing digital crime wave. Coming up after the break, my conversation with Maria Vermaze, host of the T Minus Space Daily, about one company's request to use amateur radio spectrum for satellite communications and an AI assistant falls for fake metadata magic. Stay with us. Bad actors don't break in, they log in. Attackers use stolen credentials in nearly 9 out of 10 data breaches. Once inside, they're after one thing your data. Varonis AI powered data security platform secures your data at scale across las SaaS and hybrid cloud environments. Join thousands of organizations who trust Varonis to keep their data safe. Get a free data risk assessment@varonis.com Foreign is AI built for the enterprise SOC, fully private schema, free and capable of running in sensitive air gapped environments. Krogle autonomously investigates thousands of alerts weekly, correlating insights across your tools without data leaving your perimeter. Designed for high availability across geographies, it delivers context aware, auditable decisions aligned to your workflows. Krogle empowers analysts to act faster and focus on critical threats, replacing repetitive triage with intelligent automation to help your SOC operate at scale with precision and control. Learn more@krogle.com that's C R O gl.com I recently spoke with Maria Vermazes, host of the T Minus Space Daily podcast right here on the N2K CyberWire network about one company's request to use amateur radio spectrum for satellite communications.