A (0:02)

You're listening to the Cyberwire Network, powered by N2K.

B (0:14)

Most security conferences talk about Zero Trust Zero Trust World puts you inside this is a hands on cybersecurity event designed for practitioners who want real skills, not just theory. You'll take part in live hacking labs where you'll attack real environments, see how modern threats actually work and learn how to stop them before they turn into incidents. But Zero Trust World is more than labs. You'll also experience expert led sessions, practical case studies and technical deep dives focused on real world implementation. Whether you're blue team, red team, or responsible for securing an entire organization, the content is built to be immediately useful. You'll earn CPE credits, connect with peers across the industry and leave with strategies you can put into action right away. Join us March 4th through the 6th in Orlando, Florida. Register now@ZTW.com and take your Zero Trust strategy from theory to execution. CISA's acting director assures Congress the agency has stabilized. Google and Cisco patch critical vulnerabilities. Fortinet firewalls are being hit by automated attacks. A global spam campaign leverages unsecured ZenDesk support systems. LastPass warns of attempted account takeovers. Greek authorities make arrests in a sophisticated fake cell tower scam. Executives at Davos express concerns over AI honed to own automotive proves profitable. Our guest is Kashyyyk Devaretti, AI data scientist at Fable Security with insights on chat, GPT installer and new password. Same as the old password. It's Thursday, january 22, 2026. I'm dave bittner and this is your cyberwire intel brief. Thanks for joining us here today. It's great to have you with us. The US Cybersecurity and Infrastructure Security Agency is working to refocus on its core mission after a turbulent year marked by staffing losses, funding disruptions and internal restructuring. Acting Director Madhu Gadamukkala told the House Homeland Security Committee that the agency has stabilized and does not expect further organizational changes in fiscal year 2026. CISA now employs more than 2,400 staff, roughly a thousand fewer than at the start of the Trump administration. Gautamukkala said the reductions were part of a broader White House effort to shrink the federal workforce and and right size the agency, he argued. CISA now has the workforce it needs and plans targeted initiatives in 2026 to address the most critical cyber risk gaps. Republicans praised a narrower operational focus, while Democrats warned proposed budget cuts could weaken civilian cyber defenses as foreign threats persist. Funding debates for the Department of Homeland Security, including cisa, are expected to intensify ahead of a looming shutdown. Dead line Google has released an urgent update for Chrome and other Chromium based browsers to fix a high severity flaw in the V8 JavaScript engine. The vulnerability is a race condition that allows memory corruption and could enable attackers to escape the browser sandbox and run code on a user's system by luring them to a malicious site. The update, released January 20, applies to Windows, Mac OS and Linux. Users should update Chrome and Chromium based browsers immediately, according to Google. Elsewhere, Cisco has issued emergency patches for a critical vulnerability affecting its enterprise communications platforms, warning of active exploitation attempts. The flaw is an unauthenticated code injection issue in web based management interfaces that can allow attackers to execute commands and potentially gain full system control. Impacted products include Unified Communications Manager, unity connection and WebEx calling dedicated instance. Cisco says there are no workarounds and urges immediate patching. Researchers warn that Fortinet Fortigate firewalls are being hit by automated attacks that create rogue accounts and rapidly export firewall configurations. According to Arctic Wolf, the campaign began January 15th and appears to exploit an unknown weakness in Fortigate's single sign on feature, closely resembling attacks seen in December of last year. Arctic Wolf says it remains unclear whether current attacks are fully addressed by existing patches, and customer reports suggest a possible patch bypass. Fortinet is expected to release additional Fortaos updates to resolve the issue. Until then, defenders are advised to disable Forticloud sso. CISA has already flagged the earlier vulnerability as actively exploited, while Shadow server reports nearly 11,000 exposed devices online. A global spam campaign has flooded inboxes with hundreds of confusing emails generated through unsecured Zendesk support systems. The wave began Jan. 18 and abuses Zendesk's default settings. That allows unverified users to submit support tickets, which then trigger automated confirmation emails to whatever address is entered. Attackers iterated through large email lists, effectively turning legitimate customer support platforms into mass spam engines. The emails feature bizarre or alarming subject lines, including fake legal notices and promotional offers, often written with decorative Unicode text. While the messages do not contain malicious links, they bypass spam filters because they originate from trusted companies, making them particularly disruptive. Affected organizations include Discord, Dropbox, Riot games and government agencies. Zendesk says it's rolled out new safeguards to detect and limit this relay spam and advises customers to restrict ticket submissions to verified users. LastPass is warning users about an active phishing campaign designed to steal master passwords and take over accounts, according to the company's Threat Intelligence Mitigation and Escalation team. The campaign began Jan. 19 and is circulating widely. The phishing emails impersonate LastPass and claim users must urgently back up their Password vaults within 24 hours ahead of supposed maintenance. Links in the messages lead to a fake LastPass login page that captures credentials if entered. Because LastPass stores passwords for other services, a compromised master password could expose many additional accounts. LastPass says it will never ask for a master password or demand immediate action and is working with partners to take down the malicious domains. The company urges users to remain cautious, noting that false urgency is a common phishing tactic. Greek authorities have arrested two foreign nationals accused of running a sophisticated fake cell tower scam in the Athens area. According to Hellenic police officers discovered a mobile computing system hidden in a car trunk that acted as a rogue cellular base station, often called an SMS blaster. The setup, linked to a concealed roof antenna, impersonated legitimate telecom infrastructure and intercepted nearby mobile connections. Police say the suspects exploited known weaknesses in mobile network protocols, forcing phones to downgrade from 4G to less secure 2G connections. This allowed them to collect device identifiers and phone numbers, which were then used in smishing campaigns posing as banks or courier services. Authorities have tied the operation to several confirmed fraud cases in and around Athens, with investigations ongoing. Executives from EY and KPMG warned at the World Economic Forum in Davos that AI security is emerging as a major enterprise risk. EY's Raj Sharma told Business Insider that organizations are not adequately addressing the security and lifecycle management of AI agents, which can access sensitive data but lack clear identity and controls. He argued that industrial grade security frameworks for AI agents are still immature. KPMG US CEO Tim Walsh echoed those concerns, saying AI related cyber risk is now a top issue for CEOs and is slowing some AI deployments as firms reassess data protection. Walsh also flagged quantum computing as a future security threat, warning that it could break current encryption and force widespread re engineering of security systems. Day two of PWN to Own Automotive 2026 proved that hacking cars and chargers can be very profitable. Security researchers walked away with over $439,000 in prize money after popping 29 fresh zero day bugs at the event in Tokyo held during the Automotive world show. After two days total winnings hit over $955,000 across 660 days, Fuzzware IO led the pack with $213,000 thanks to successful hacks against multiple EV chargers. Other teams rooted infotainment systems, car operating systems like automotive grade, Linux, and more charging hardware. Even Tesla Tech made an appearance earlier in the contest. The fun continues on day three with more chargers and systems lined up for Attack. Vendors now have 90 days to patch before details go public, so the clock is ticking. Coming up after the break, my conversation with Kaushik Deveretti from Fable Security. We're discussing insights on a fake chat, GPT installer and new password. Same as the old password. Stick around. Ever wished you could rebuild your network from scratch to make it more secure, scalable and simple? Meet Meter, the company reimagining enterprise networking from the ground up. Meter builds full stack zero trust networks including hardware, firmware and software, all designed to work seamlessly together. The result? Fast, reliable and secure connectivity without the constant patching, vendor juggling, or hidden costs. From wired and wireless to routing, switching, firewalls, DNS security and vpn, every layer is integrated and continuously protected in one unified platform. And since it's delivered as one predictable monthly service, you skip the heavy capital costs and endless upgrade cycles. Meter even buys back your old infrastructure to make switching effortless, transform complexity into simplicity, and give your team time to focus on what really matters, helping your business and customers thrive. Learn more and book your demo@meter.com cyberwire that's M E T E R.com cyberwire. What's your 2am Security worry? Is it do I have the right controls in place? Maybe? Are my vendors secure or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. And it fits right into your workflows. Using AI to streamline evidence collection, flag risks, and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently, and finally get back to sleep. Get started@vanta.com cyber that's V A N T A dot com cyber. Kaushik Devaretti is AI data scientist at Fable Security. We recently got together to discuss insights on a fake ChatGPT installer.