Loading summary
Transcript23 lines
- [00:02]
Maria Varmazis
You're listening to the Cyberwire Network powered by N2K. Do you know how the space and cybersecurity domains connect? T minus Space Cyber Briefing is your guide through the space based systems that expand the attack surface. I'm Maria Varmazis host here at N2K CyberWire and I'm excited to share that T minus is back now as a weekly podcast, the T Minus Space Cyber Briefing. We have a new dedicated focus on two great things that are even better together. Space and cybersecurity. Because whether we realize it or not, we all depend on space based systems that are, by the way, increasingly Internet enabled. We're talking cybersecurity technologies, policies and organizations that are securing the critical space based infrastructure that powers, protects and connects our lives here on Earth. So join me for T Minus Space Cyber Briefing. New episodes every Sunday.
- [01:13]
Dave Bittner
Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With Threat Locker allow listing, you stop unknown executables cold. With ring fencing, you control how trusted applications behave. And with ThreatLocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives CISOs real visibility, real control and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose Threat Locker to minimize alert fatigue, stop ransomware at the source and regain control over their environments. Schedule your demo@threatlocker.com N2K today. Google faces liability for AI generated claims. Washington pauses public AI model assessments. Anthropic ships a safer AI model. OpenAI disrupts influence operations. Ransomware operators get a powerful new backdoor. We've got urgent patches for Avanti and Veeam. PI PI supply chain attacks evolve. A massive data breach triggers a record fine in South Korea. Our guest is Peter Barker, Chief Product Officer at Ping Identity Sharing. How identity increasingly becomes the control plane for how work gets done. And AI analyzes the FIFA World cup one cliche at a time. It's Thursday, june 11, 2026. I'm dave bittner and this is your cyberwire intel brief. Thanks for joining us here today. It's great as always to have you with us. A German court has ruled that Google can be held directly liable for false statements generated by its AI search overviews, marking a significant departure from legal protections traditionally granted to search engines. The Regional Court of Munich issued an injunction after Google's AI falsely linked two Munich publishers to scams, subscription traps and other dubious business practices. The court found that the AI had combined information from unrelated companies and created accusations that did not appear in any of the cited sources. Central to the ruling is the court's view that AI overviews are not merely search results. Unlike traditional search engines, which point users to third party content, AI overviews generate new summaries, judgments and conclusions. Because Google designs and controls the system, the court said it is responsible for those outputs as its own statements. The court rejected Google's argument that users can verify AI summaries by checking linked sources, noting that the summaries are presented as self contained information and often contain claims not found in the sources. It also ruled that Google cannot rely on standard search engine liability protections or Digital Services act host provider defenses. The decision could have broad implications for AI providers. As generative systems increasingly create original summaries from web content, courts may hold operators accountable for inaccuracies, defamation or unsupported claims produced by their models. Google was ordered to pay 80% of the legal costs, and the ruling may influence future cases involving AI generated content worldwide. Trump administration officials have directed the center for AI Standards and Innovation, the federal government's primary AI testing unit, to stop publishing public assessments of AI models while while a new executive order is implemented. The move reflects growing concern over advanced AI systems, including Anthropic's Mythos model, which officials worry could enable cyberattacks or support the development of biological weapons. The order strengthens the role of national security officials in AI oversight, a shift championed by National Cyber Director Sean Cairncross and Treasury Secretary Scott Besant. While the center for AI Standards and Innovation continues internal testing and coordination with government agencies, suspending its public reporting has raised concerns about its future and reduced transparency around AI risks. The decision has exposed tensions within the administration and the AI industry. Companies such as OpenAI support preserving the center for AI Standards and Innovation's roles, while others warn that stricter testing and security reviews could slow innovation and delay the deployment of advanced AI systems. In not completely unrelated news, Anthropic has released Claude Fable 5, a new AI model derived from its more powerful Claude Mythos system, which the company previously restricted because of concerns it could help hackers identify and exploit software vulnerabilities. Fable includes additional safeguards designed to block responses related to cybersecurity, biology and other sensitive topics, making it safer for broad public release. Anthropic says most potentially risky requests will instead be handled by its earlier Claude Opus 4.8 model. The company argues these controls allow wider access while reducing security risks, though some researchers question whether such guardrails are fully reliable. Mythos remains available only to a limited number of organizations responsible for critical infrastructure, helping them identify and patch vulnerabilities before attackers can exploit them. The debate highlights a growing divide over whether advanced AI capabilities should be tightly controlled or broadly shared to strengthen defensive cybersecurity research. Still, some researchers remain unconvinced that Mythos represents a fundamentally new level of cyber capability, arguing that limited public access makes it difficult to determine whether the model's reputation reflects a genuine breakthrough or effective marketing. OpenAI says it has disrupted two China linked influence campaigns that use ChatGPT to generate social media content aimed at shaping debate around US Technology and and AI policy. One campaign promoted claims that AI data centers were driving up electricity costs, while another criticized US tariffs and spread false allegations that ChatGPT user data had been compromised. OpenAI found no evidence that either operation significantly influenced public opinion. However, the company says the activity highlights how foreign influence actors are experimenting with AI generated content to amplify existing political and economic concerns, target AI infrastructure debates, and attempt to manipulate public discussions while concealing their origins and motives. Researchers at Zscaler Threat Labs have identified a new malware family called MLT Backdoor that appears designed to support ransomware operations by establishing a foothold on compromised networks. Delivered through a multistage click fix infection chain, the malware provides basic file management capabilities but is particularly notable for its ability to load beacon object files, allowing operators to dynamically expand its functionality. MLT Backdoor employs extensive obfuscation techniques, including mixed Boolean arithmetic and control flow flattening, along with anti analysis measures that complicate reverse engineering and sandbox detection. It also uses indirect system calls, API hashing, encrypted communications, and a domain generation algorithm to maintain contact with command and control infrastructure. According to Threat Labs, the malware's combination of stealth resiliency and modular BOF support makes it a capable post exploitation framework that could facilitate lateral movement and other ransomware related activity within victim environments. Ivanti has disclosed two critical vulnerabilities affecting Ivanti Sentry, including a remote unauthenticated command injection flaw that allows attackers to execute code as root and an authentication bypass that enables the creation of rogue administrator accounts. A public proof of concept exploit was released shortly after disclosure, increasing the likelihood of real world attacks. Although Avanti says it has not observed active exploitation, security researchers warn organizations should patch immediately. Fixed versions are available, and Rapid7 recommends updating affected systems outside normal patching cycles due to the severity of the flaws and the ease of exploitation. Researchers at socket have identified 23 additional malicious pipi package artifacts linked to the broader Mini shai, Hulud, Miasma and Hades software supply chain campaign, bringing the total known impact to 471 compromised packages across NPM and PyPi. The latest wave shows attackers rapidly evolving their tactics using a mix of Python startup hooks, Trojanized native extensions and new loader techniques to execute an obfuscated JavaScript stealer. The malware targets developer workstations and CI CD environments seeking credentials, cloud secrets, package registry tokens, SSH keys and other sensitive data. Researchers also observed anti analysis techniques, including fake prompt injection content designed to confuse AI assisted security tools. According to Socket, the campaign demonstrates an increasingly sophisticated and adaptable threat that continues to shift delivery methods to evade detection and compromise software development ecosystems. Veeam has patched a critical remote code execution vulnerability affecting backup and replication. Version 12. The flaw, with a CVSS rating of 9.4, allows an authenticated domain user to execute arbitrary commands on domain joined backup servers. Successful exploitation could give attackers control over backup infrastructure, enabling them to delete, encrypt or steal backup data, a common objective in ransomware attacks. The issue affects multiple versions but does not impact version 13. Organizations are urged to upgrade, implement hardened backup configurations and restrict domain user access while enforcing multi factor authentication to reduce risk. South Korea has imposed a record $409 million fine on Coupang, the country's largest online retailer, over a massive data breach and the unlawful collection of user information. Regulators said the company exposed personal data from 33 million customer accounts and 4 million non members, while also improperly gathering online activity data from 11 million users across third party websites and apps. The Personal Information Protection Commission attributed the incident to inadequate security controls rather than sophisticated cyber attacks. Coupang, often called the Amazon of South Korea, has apologized and pledged to improve its data protection practices, but plans to challenge the ruling in court. The case has also become a diplomatic flashpoint, with some US Lawmakers accusing South Korea of unfairly targeting an American incorporated company, while South Korean officials maintain the investigation followed standard legal procedures. Coming up after the break, my conversation with Peter Barker from Ping Identity. We're discussing how Identity increasingly becomes the control plane for how work gets done and AI analyzes the FIFA World cup one cliche at a time. Stick around. When it comes to mobile application security, good enough is a risk. A recent Survey shows that 72% of organizations reported at least one mobile application security incident last year and 92% of responders reported threat levels have increased in the past two years. Guard Square delivers the highest level of security for your mobile apps without compromising performance, time to market or user experience. Discover how Guard Square provides industry leading security for your Android and iOS apps and at www.guardsquare.com.
- [16:07]
Nordstrom Rack Announcer
New markdowns up to 70% off are at Nordstrom Rack stores now. Stock up and save big on shoes, tops, dresses, accessories and more must haves for summer. Join the Nordic Club to unlock exclusive discounts. Shop new arrivals first and more. Plus buy online and pick up at your favorite Rack store for free. Great brands, great prices. That's why you rack.
- [16:38]
Dave Bittner
Peter Barker is Chief Product Officer at Ping Identity, and in today's sponsored Industry Voices segment he shares how identity increasingly becomes the control plane for how work gets done.
- [16:51]
Peter Barker
The history of Identity was there to really help secure and enable access to applications primarily for employees of companies, and it's expanded dramatically since then to be a larger scope of overall digital identity where everyone, whether you're an employee, you're a customer, you're a partner, and now AI agents need access. And digital identity is the mechanism that really facilitates that access securely and safely, but also in a way, hopefully that makes it easy for people to get their job done.
- [17:30]
Dave Bittner
Well, I think it's fair to say that again, looking back, identity systems pretty much assumed that it was a human operator somewhere in the workflow. I guess that assumption worked for a long time, but things have changed now, thanks, as you say, to these AI agents. It's kind of a different world.
- [17:49]
Peter Barker
It's a completely different world now. And not to diminish the importance of the human element, and we'll come back to that. But you're absolutely right, there's a new actor in the system which are these AI agents. And AI agents are pretty unique as compared to our traditional human actors in that in some ways they resemble the humans that they're interacting with systems very similarly to how humans do. But in other ways they can be a lot more unpredictable as well. And so it does require some new ways of looking at the situation than we've done historically. But also there's some traditional ways we've treated identity that also apply to agents.
- [18:35]
Dave Bittner
Well, let's dig into that. What are some of the ways that the old system no longer applies and where do we stand today?
- [18:43]
Peter Barker
Yeah, so historically and traditionally identity effectively stopped at login, meaning to say that we would assess all of the conditions When a human is logging into a system, we'd assess all of the conditions, maybe what device they're logging into and what network are they coming from, Are they authenticating successfully? And we'd make a decision about allowing access for the human based on those conditions. In many ways, that's where identity stopped. It stopped at login. But with agents, what changes is, you know, agents are entities that can now act and they can make decisions. And sometimes those decisions and those actions don't necessarily align with the original intent that they were charted to do, like the prompt that they were given. And so what's really important is the perimeter of identity needs to move from login to the point of decision or the point of action.
- [19:46]
Dave Bittner
Help me understand this term I've heard called headless identity. What does that actually mean in practical terms?
- [19:55]
Peter Barker
That is, applying identity to AI agents. And then if we shift gears into the concept of headless. So the people who, the practitioners who manage and administer and operate the identity platforms that deliver all of those things we talked about a bit ago, you know, they have a really hard job because they need to integrate the identity platform into a variety of applications and systems that exist in the enterprise. They need to configure it so that you get that balance of friction and security just right. So you get the right user experience with the right security. You have to configure it so that you don't have security exposure. And so it's a really hard job that requires a pretty high skill set in order to do that. The concept of headless identity is the notion that how the administrators that interact with the system, how they interact with it, is evolving. And it's evolving from UIs and clicking around in UIs to configure to using agents and assistants to actually do that work on your behalf. And so having an identity platform that's headless enables that interaction model.
- [21:19]
Dave Bittner
Now, what about the notion that identity should be programmable? What does that mean?
- [21:26]
Peter Barker
Yeah, so what's really interesting is everyone today is becoming a builder. If you can download and install Claude code and you can prompt it to do something, you're in the process of building and administering software like identity platforms is no different. And so what it really means is that the administrators now can use these external agents and these coding agents to now interact with the system and to configure it and to make it do all of the things without requiring deep knowledge of how the platform works itself.
- [22:09]
Dave Bittner
Can we talk about things like security and governance and control as we see these machines Interacting directly with the systems within an enterprise. How does that change the security conversation?
- [22:22]
Peter Barker
It does change the security conversation in many ways, I guess. One final comment I'll make on Headless, and then I'll come to that, is that the. I mentioned the skill set required for people to administer identity platforms, ultimately, they're complex systems that can be configured to do very good things and also misconfigured to do bad things. And so I think the other opportunity that Headless really presents is that we can greatly reduce the skill set needed to administer these platforms so that you get the results you're looking for without the exposure or the weaknesses of misconfigurations. And so that's the big opportunity. And I think that kind of transitions into the question you asked about governance and security, because the larger opportunity around agents overall is that we want to harness the full potential and the full power of these things in the enterprise. But the reality is, if you don't keep them on the rails, and if you don't have proper guardrails in place, you might in fact be exposing your company to a lot more risk than is appropriate. And so where identity comes in is being able to really harness that power, enable that power, but keep things on the rails at the end of the day.
- [23:53]
Dave Bittner
I'm curious, from your own personal experience, the folks that you've worked with, the organizations that are finding success here who are operationalizing AI in a way that's really benefiting the organization on the leading edge, are there common elements that these organizations share that's helping them get to this ahead of the pack?
- [24:16]
Peter Barker
Yeah, I do think so. What we're seeing is that many companies are very excited to take advantage of the opportunity of AI agents. And many times the executive teams inside these companies are, are asking their employees to just go do AI. But at the same time, you have inside those same organizations, groups like the Enterprise Security Group, the IT Group, who are very worried about, well, how do we enable the organization, how do we unleash the organization to be able to safely adopt AI in our environment? And so the organizations that we see that are really making strong strides are ones that have, that have established clear governance guidelines on how they can enable AI for their employees, rather than just sort of leaving it up to the employees to try to figure it out on their own and then creating this chaotic environment that I described before by establishing some of these simple guardrails around how agents can safely interact, how employees can adopt these technologies and leverage them. Those are the companies that we're starting to see are going much faster. Because typically what we've seen is these organizations have sort of denied access in general, as you know, blocked access for AI because they're concerned about what might happen. And so those who figure out how to implement the governance process and the security process for them is able to open them up to go much faster.
- [26:00]
Dave Bittner
What is your sense of where we're headed here? As you look toward the future, what do you think identity platforms are going to look like? How are they going to evolve as these AI agents become more of a standard part of enterprise operations?
- [26:15]
Peter Barker
A couple of things that they're going to evolve to. One is that the identity platform needs to understand all of the actors that are involved now. So it's not just the humans, it's also the AI agents. And then very, very importantly needs to understand the relationship between those two things so that trust can be brokered between the human world and the agent world and that we can maintain control and trust of the agents under proper supervision of the human. So that's one big element, one big aspect. Another is what we talked about earlier, which is that where the perimeter of security and identity is established needs to move to the point of action, the point of decision. And so moving to a much more continuous posture in the flow, inserted directly in the flow, is a really important evolution as well. And then finally, the concept of headless as well, is really, really important here because being able to configure and manage and operate digital identity at the speed of AI is going to require us to enable AI to also help administer the platform itself. And that's where the headless interfaces come in. And importantly, also providing the skills that those agents need to successfully administer the platform as co pilots, if you will, to their human administrators. So several big evolutions of where the identity platform is going to just become that trust layer of agentic for the agentic enterprise, as well as continuing to broker trust and manage trust in the humans that are interacting as well.
- [28:07]
Dave Bittner
That's Peter Barker, Chief Product Officer at Ping Identity. There's a new way to sweetgreen meat wraps Handheld, hearty and made for life on the move. With bold chef crafted flavors, fresh ingredients and over 40 grams of protein, they're built to satisfy without slowing you down. Try wrapped today in the app or@order.sweetgreen.com available at all participating locations.
- [28:53]
Home Depot Announcer
This Father's Day, do more with dad and spend less. With low prices guaranteed at the Home Depot. Get him fired up with a new grill and accessories like the next Grill 5 burner for just $299 so you can spend more time together while he becomes the grill master he was always meant to be. Or build memories with savings on top brand power tools so you can tackle projects side by side, gift more and do more together. This Father's Day with help from the Home Depot. Exclusions apply seehomedepot.com Pricematch for details.
- [29:29]
Dave Bittner
And finally, with the FIFA World cup kicking off in Mexico City, communications platform provider Cinch has launched the Expected Cliche Tracker, an AI powered project that applies football's love of analytics to an entirely different metric. Manager press Conference Platitudes Inspired by expected goals, the tracker introduces XC or Expected Cliches, a score designed to measure how often national team coaches rely on familiar football phrases instead of offering genuine insight. Once the tournament begins, the site will analyze every pre and post match press conference from all 48 national team managers, ranking the most original and least original speakers, tracking the tournament's most used cliches and comparing coaches across countries and styles. The project promises daily storylines, head to head coaching comparisons and a heat map of football's favorite conversational habits. In other words, while teams compete for trophies on the pitch, managers will quietly compete for the far more elusive honor of avoiding phrases like one game at a time. And that's the Cyber Wire. For links to all of today's stories, check out our daily briefing@thecyberwire.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazis. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow.
- [32:05]
Maria Varmazis
Toxic relationships suck, including the one you're in with your Cleaning products break up with harsh chemicals and synthetic fragrances and switch to Clear Hive Products, a company committed to providing cleaning products and room sprays without toxic ingredients. You can finally tell your therapist you're in a healthy relationship. Use Code Spotify at checkout for 20% off.