The four-day race you don’t want to be in.

Summary

---

CyberWire Daily — “The four-day race you don’t want to be in.”

Date: May 8, 2026
Host: Dave Bittner (N2K Networks)
Special Guest: Maria Varmazes

---

Episode Overview

This episode delivers the latest urgent cybersecurity news, including U.S. government response to Ivanti zero days, high-impact ransomware in education, a new Linux zero day, quantum cryptography concerns, and major tech industry layoffs linked to the rise of generative AI. The second half celebrates the podcast’s 10th anniversary, featuring an in-depth reflection by Dave Bittner and Maria Varmazes on a decade of geopolitics in cyber, dramatic changes in threat landscapes, and evolving defensive strategies.

---

Key News Highlights & Analysis

CISA Orders Emergency Patching of Ivanti Zero Days

[00:50 - 02:30]

• The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch Ivanti Endpoint Manager Mobile (EPMM) systems within four days, after active zero day exploitation (remote code execution).
• Ivanti released patches and advised admin credential rotation, but over 800 vulnerable appliances remain online.
• “The directive highlights the continued risk posed by Internet facing management platforms, especially when active exploitation is already underway.” (Dave Bittner, 01:40)

Canvas Hacked During Finals Week

[02:33 - 04:02]

• Education SaaS provider Canvas suffered a major incident, with login outages and extortion threats from hacking group Shiny Hunters.
  • Attackers claim poor patching enabled access and threaten to leak stolen data if no settlement by May 12.
  • Universities blocked access and warned of phishing.
• “The incident underscores the operational impact ransomware and extortion campaigns can have on widely used software as a service platforms, especially in education environments...” (Dave Bittner, 03:40)

“Dirty Frag” — New Linux Zero Day

[04:04 - 05:13]

• Researcher Hyun Woo Kim uncovered Dirty Frag, a kernel-level bug enabling local privilege escalation (root access) on major Linux distros.
  • Exploit chains two vulnerabilities, does not require timing/race conditions, making it “highly reliable.”
  • Embargo broken: no CVE or patch at air date.
• Puts extra pressure on Linux admins still patching recent “Copy Fail” and “Pack to the Root” flaws.

Anthropic’s Claude Chrome Extension Flaw

[05:14 - 06:01]

• LayerX researchers found a bug letting any Chrome extension hijack Claude’s interface and exfiltrate cloud and email data.
  • Anthropic issued a partial fix, but “some takeover scenarios reportedly remained possible.”
• Raises alarms as AI agents gain deeper browser/cloud access and traditional detection may not suffice.

Meta Removes Instagram Encryption

[06:02 - 07:06]

• Meta discontinues end-to-end encrypted DMs on Instagram, citing lack of adoption.
  • Privacy advocates doubt this rationale, warning it “weakens protections for journalists, activists and abuse survivors.” (06:32)
  • Open question: What happens to previously encrypted chats?

PCP Jack Malware Hijacks Linux Targets

[07:07 - 08:34]

• SentinelOne spots PCP Jack, a new malware that deletes competitor (Team PCP) malware before deploying its own tools, targeting credentials on cloud and enterprise infrastructure (AWS, GitHub, containers, etc).
  • “Highlights how cybercriminal operations increasingly compete for access to compromised systems while modular malware frameworks continue expanding beyond traditional endpoints into cloud native infrastructure.” (08:18)

Quantum-Era Cryptography — No Longer Theoretical

[08:35 - 09:31]

• Recorded Future reports “harvest now, decrypt later” activity is already happening—adversaries steal encrypted data now, planning to decrypt it with future quantum computers.
  • Industries with long-lived sensitive data especially at risk.
  • “Organizations delaying post quantum cryptography migration beyond 2026 could face higher costs, compressed timelines and operational disruption.” (09:23)

Cloudflare Layoffs Tied to “Agentic AI”

[09:32 - 10:29]

• 1,100+ Cloudflare employees laid off as company restructures for the “agentic AI era.”
  • Internal AI tool usage up 600%.
  • Restructuring “not tied to employee performance,” but reflects changing work paradigms and cost-saving amid AI adoption.
• “A painful transition period where years of work and loyalty are colliding with rapid shifts in how companies believe future work will be done.” (10:16)

Sri Lankan Police Raid Scam Center

[10:30 - 11:32]

• 37 Chinese nationals arrested near Colombo in a crackdown on romance-baiting cryptocurrency scams; seized over 100 SIMs and 147 phones.
  • Victims potentially both local and global.
• Cites UN/Interpol concerns about labor trafficking in scam compounds.

---

[Special Segment] 10 Years of Geopolitics in Cyber: Interview with Maria Varmazes and Dave Bittner

Begins [14:41]

A Decade of Cyber-Geopolitics: What’s Changed?

[14:41 - 15:51]

• Maria and Dave reflect on how cyber-geopolitics have metamorphosed:
  • “2015, 2016 was a millennia ago. Not literally, but kind of.” (Maria, 15:43)
  • “I'm still battling the reality that post Covid time has no meaning, but...there has been a lot of change over the past decade…” (Dave, 15:53)

The Shift: From Episodic to Constant Threat

[16:19 - 17:26]

• Dave: Attacks are no longer rare events—now there’s “a low level drone of this stuff that is all the time now… that’s the new reality.”
  • Major breaches like OPM or ransomware used to be rare “oh, something happened” moments—now “it’s everywhere.”

Why the Change? Nations Discover the ‘Asymmetric Payoff’

[17:27 - 18:18]

• Geopolitical realization: Cyber is borderless and cost-effective for nation-states.
  • “You get a huge return on your investment. You don’t have to build an aircraft carrier to force your influence…” (Dave, 17:45)

NotPetya as a Wakeup Call

[18:18 - 19:18]

• Maria: NotPetya’s supply chain impact was “seismic.”
• Dave: “It was the one that sort of opened everybody's eyes… Maybe our global economy is a little more fragile than we thought it was.”

Ukraine War as a Laboratory for Modern Cyberwarfare

[19:19 - 21:10]

• Ukraine conflict integrated cyber and kinetic methods.
  • “The war in Ukraine has been a bit of a laboratory for cyber war, for modern cyber war…using cyber alongside battlefield operations.” (Dave, 19:42)
  • Rise of consumer tech (drones, routers, Starlink) as military tools; levels the playing field for smaller actors.

Nation-State Strategies (China, Russia, Iran, North Korea)

[21:11 - 23:15]

• Chinese “long game” focuses on embedding in supply chains, maintaining access, and information gathering vs. outright sabotage.
  • “They have positioned themselves in our infrastructure … so many things get manufactured in China...legitimate concern...what might be in the firmware, what might be in our supply chain.” (Dave, 21:47)
  • China concerned with economics/information, Russia/Iran feared for subverting critical infrastructure.

The Supply Chain Dilemma

[23:16 - 25:28]

• Often no domestic alternative to Chinese-made IT, putting defenders in a bind.
• Advice: “It’s defense in depth… But then have defenses in place on the chance that [the supply chain] is not [secure], because it might not be.” (Dave, 23:54)

The Digital Sovereignty Movement — Industry Response

[24:40 - 25:28]

• Unexpected rise in other nations building their own clouds due to perceived risks from US tech giants.
  • “We’re seeing other nations building their own infrastructure because they’re not sure they can depend on us as good partners...”

Zero Trust & The Limits of Verification

[25:29 - 26:41]

• Trust in supply chain is finite; “At some point you have to trust someone.” (Dave, 25:28)
• Zero trust has become the dominant architecture, especially in government.
  • “Zero trust is a way to be constantly challenging the trust to make sure that people are only getting access to what they need, when they need it. And I think that's wise.” (Dave, 26:39)

Memorable moment [26:10]:

Maria: “I want to let that marinate for a second… it makes me kind of recoil… viscerally it makes me go, yeah, but oh.”

Dave: “And yet what is probably the most popular thing that we've seen… is zero trust architecture. So you don’t want to trust anybody. Right.”

---

Vibe Coding & New Developer Risks

[28:46 - 29:46]

• “Describe an app in plain English, click Publish, and suddenly everyone's a software developer.” (Dave, 28:46)
• Research by Red Access: Over 5,000 publicly exposed apps built by AI platforms with poor security:
  • Leaks include medical, financial, strategy docs, cloud creds.
• “AI coding tools are now putting powerful application development capabilities into the hands of employees who may never pass through traditional security review processes…”

---

Notable Quotes & Moments

• “Geopolitically, it's the reality and the recognition from nation states that cyber is a domain without the usual borders. And also you get a huge return on your investment.” (Dave, 17:27)
• “The war in Ukraine has been a bit of a laboratory for cyber war, for modern cyber war.” (Dave, 19:42)
• “China...play the long game. We might be in just the beginning of it, but we've seen that they have positioned themselves in our infrastructure.” (Dave, 21:47)
• “At some point you have to trust someone.” (Dave, 25:28)
• “Zero trust is a way to be constantly challenging the trust to make sure that people are only getting access to what they need...” (Dave, 26:42)
• “It’s defense in depth, right. So you can’t rely on only one thing to protect yourself.” (Dave, 23:54)

---

Key Takeaways

• The attack surface and operational tempo have exploded—what was extraordinary is now daily.
• Nation-states see cyber intrusion as high-yield, low-cost compared to traditional power projection.
• Modern cyber conflict (NotPetya, Ukraine) exposed fragility of global supply chains.
• The supply chain problem has no easy fix—trust, but verify, and layer defenses.
• “Zero trust” is now a practical imperative, not a buzzword.
• Emerging tech (AI coding, agentic AI) magnifies both capability—and risk—across industries.
• Defensive strategy must adapt: post-quantum planning, cloud-native threat coverage, and continuous trust reevaluation.

---

[Timestamps for Major Segments]

• 00:50–02:30: CISA Ivanti zero day directive
• 02:33–04:02: Canvas incident (Shiny Hunters)
• 04:04–05:13: Dirty Frag Linux zero day
• 05:14–06:01: Claude Chrome extension bug
• 06:02–07:06: Instagram drops encryption
• 07:07–08:34: PCP Jack malware evolution
• 08:35–09:31: Quantum cryptography report
• 09:32–10:29: Cloudflare AI layoffs
• 10:30–11:32: Sri Lankan scam center raided
• 14:41–27:00: Ten years of cyber geopolitics — in-depth interview

---

For more stories, links, and interviews, visit The CyberWire’s daily briefing.

Transcript

[A]

You're listening to the Cyberwire Network powered by N2K.

[B]

No, it's not your imagination. Risk and regulation are ramping up and customers expect proof of security just to do business. That's where Vanta comes in. Vanta automates your compliance process and brings compliance, risk and customer trust together along with on one AI powered platform. Whether you're preparing for a SoC2 or managing an enterprise GRC program, Vanta helps keep you secure and your deals moving. Companies like Ramp and RYTR report spending 82% less time on audits. That's not just faster compliance, that's more time to focus on growth. When I look around the industry, I see over 10,000 companies, from startups to big enterprises trusting Vanta. Get [e-mail] cyber. CISA orders rapid patching of actively exploited Ivanti zero days Canvas gets hacked during finals weekly Dirty frag is a new Linux zero day Researchers document a serious Claude Chrome extension bug Meta ends Instagram encryption PCP jack malware cleans house before moving in A new report highlights quantum era cryptographic threats Cloudflare announces layoffs amidst AI deployment Sri Lankan police shut down a scam center Maria Vermazes joins me to look back at 10 years of geopolitics in cyber and Vibe coding reveals valuable data Foreign. It's Friday, May 8, 2026. I'm Dave Bittner and this is your Cyberwire intel briefing. Foreign thanks for joining us here today and happy Friday. It's great as always to have you with us. The US Cybersecurity and infrastructure security agency CISA has ordered federal agencies to secure Avanti Endpoint Manager mobile systems within four days after attackers exploited a high severity vulnerability in zero day attacks. The flaw allows remote code execution on Ivanti EPMM 12.8 and earlier when attackers have administrative privileges. Ivanti released patched versions and urged customers to review and rotate admin credentials. The company said exploitation appears limited and affects only on premises EPMM deployments, not Ivanti's cloud or other product lines. Shadow's server reports more than 800 exposed EPMM appliances remain online. The directive highlights the continued risk posed by Internet facing management platforms, especially when active exploitation is already underway. CISA warned the vulnerability presents significant risk to federal networks and ordered agencies to patch affected systems by May 10. Educational software provider Canvas is investigating a cybersecurity incident after widespread login outages and claims of responsibility from the hacking group Shiny Hunters. Canvas developer Instructure confirmed the incident in a May 2 status update and said outside forensic experts are assisting the investigation reports earlier this week described login failures that displayed messages allegedly from Shiny Hunters, which claimed poor patching enabled the disruption. The group also claimed to have stolen data from schools and universities using Canvas and threatened to leak it unless a settlement is reached by May 12. Several universities temporarily blocked access to the platform and warned students about increased phishing risks. The incident underscores the operational impact ransomware and extortion campaigns can have on widely used software as a service platforms, especially in education environments that depend on centralized systems for coursework and assignments. A newly disclosed Linux zero day vulnerability called Dirty Frag allows local attackers to gain root privileges on many major Linux distributions using a publicly released proof of concept exploit. Researcher Hyun Woo Kim says the flaw stems from Linux kernel code introduced roughly nine years ago. Dirty Frag chains two kernel vulnerabilities to modify protected system files in memory and escalate privileges without authorization. Kim described the exploit as highly reliable because it does not depend on race conditions or timing Windows. The flaw affects multiple distributions. No CVE identifier or official patches are currently available after a public disclosure embargo was broken. The disclosure adds pressure on Linux administrators already responding to other actively exploited privilege escalation flaws, including Copy Fail and Pack to the root, both patched or mitigated only recently. Researchers at browser security firm LayerX disclosed a vulnerability in Anthropic's Claude Chrome extension that could let malicious browser plugins hijack the AI agent and bypass security controls. According to LayerX, the flaw allows any browser extension to communicate with Claude's large language model without verifying the source of the request. Researcher Aviad Gispan demonstrated attacks that extracted files from Google Drive, accessed email activity, sent emails as the user, and stole source code from connected GitHub repositories. The researchers also manipulated Claude's interface to hide security prompts and sensitive actions from users. LayerX said Anthropic issued a partial fix on May 6, but some takeover scenarios reportedly remained possible. The research highlights growing concerns around AI agents that can interact directly with browsers, files and cloud services. Security experts warned traditional prompt layer monitoring may not detect attacks that manipulate the agent's perceived environment instead of the model itself. Meta has ended end to end encrypted direct messages on Instagram, saying few users enabled the feature and directing users to WhatsApp for encrypted communications. Privacy advocates criticize the move, warning it weakens protections for journalists, activists and abuse survivors who rely on secure messaging. Groups including the center for Democracy and Technology questioned how Meta will handle previously Encrypted chats and warned users could face greater surveillance and interception risks. Meta has not publicly clarified whether standard Instagram messages could eventually be used in broader data analysis or ad targeted Systems. Researchers at SentinelOne have identified a new malware framework called PCP Jack that removes team PCP malware from compromised systems before deploying its own credential stealing and propagation tools. Active since late April, PCP Jack targets Linux environments and appears designed to spread across cloud and enterprise infrastructure. SentinelOne believes the operator may be a former Team PCP member because the framework specifically hunts for and deletes team PCP artifacts. But before installing modular Python based malware components, the framework steals credentials, tokens, SSH keys and cryptocurrency wallets tied to services including AWS, GitHub, Slack, Docker, Gmail and Office365. It also attempts lateral movement through Kubernetes, Redis, MongoDB and vulnerable web applications while using Telegram for command and control. The campaign highlights how cybercriminal operations increasingly compete for access to compromised systems while modular malware frameworks continue expanding beyond traditional endpoints into cloud native infrastructure. Recorded Futures warning that quantum computing risks are no longer theoretical as organizations face growing pressure to prepare for a future where quantum systems can break today's encryption standards. In a new report, the company said the biggest threat comes from cryptographically relevant Quantum computers, or CRQCs, which could eventually defeat widely used public key encryption systems such as RSA and elliptic curve cryptography. Recorded Future warns that harvest now decrypt later activity is already underway, with threat actors potentially collecting encrypted data today for future decryption without once quantum capabilities mature. The report noted that long lived sensitive information, including government records, intellectual property, healthcare data and financial information faces the greatest exposure risk. The company also said organizations delaying post quantum cryptography migration beyond 2026 could face higher costs, compressed timelines and operational disruption as regulatory and procurement requirements and accelerate adoption. Cloudflare announced plans to reduce its global workforce by more than 1100 employees, framing the move as part of a broader restructuring around what it calls the agentic AI era. In a message to employees, company leaders said internal AI usage has surged more than 600% in recent months, changing how teams across engineering, HR, finance and marketing operate. The company stressed the layoffs were not tied to employee performance, but to a larger effort to redesign workflows and organizational structures around AI driven operations. Cloudflare also pledged expanded severance, healthcare support and accelerated equity vesting for affected workers. The announcement lands amid continuing technology sector layoffs as companies race to integrate AI tools while reducing costs and restructuring teams for employees across the industry. These cuts reflect a painful transition period where years of work and loyalty are colliding with rapid shifts in how companies believe future work will be done. Sri Lankan Police have arrested 37 Chinese nationals suspected of operating a scam center in a suburb of Colombo, part of a broader regional crackdown on online fraud operations. Authorities said. The suspects were detained during a May 2 raid in Talangama after a tip off led officers to a property allegedly housing people working illegally or overstaying tourist visas. Police seized dozens of devices, including 147 mobile phones and 100 SIM cards. Investigators believe the operation may have been tied to romance baiting cryptocurrency scams where victims are manipulated through dating apps or unsolicited messages before being directed to fake investment platforms. The arrests follow similar raids in recent months involving hundreds of foreign nationals. The United nations and Interpol have warned many workers inside these scam compounds may themselves be victims of human trafficking and forced labor. Coming up after the break, Maria Vermazes joins us to look back at 10 years of geopolitics in cyber and vibe coding reveals valuable data. Stay with us. And now a word from our sponsor, the center for Cyber Health and Hazard Strategies, also known as chhs. Looking for a graduate degree that will give you an edge on your professional career? Earn a Master of Science in Law at University of Maryland Carey School of Law. This part time, two year online graduate degree program is designed for experienced professionals to understand laws and policies that impact your industry. Learn from CHHS faculty who are experts in their field. No GRE required. Learn how you can master the law without a JD at law umaryland.edu.

[C]

Study and play Come together on a Windows 11 PC and for a limited time, college students get the best of both worlds. Get the Unreal college Deal everything you need to study and play with select Windows 11 PCs. Eligible students get a year of Microsoft 365 Premium and a year of Xbox Game. Pass ultimate with a custom color Xbox wireless controller. Learn [e-mail] studentoffer while supplies last ends June 30th terms at aka mscollegepc.

[B]

We are celebrating 10 years of publishing the Cyberwire daily podcast. This year Maria Ramazes joins me to analyze 10 years of geopolitics in cyber.

[A]

Well, it is my distinct honor yet again to bring back Dave Buettner, host of the Cyber Wire. Hi Dave.

[B]

Hello. Good to be back.

[A]

Yes, imagine we're talking to you today of all days about your show.

[B]

It's Maria, right? Yeah.

[A]

Nice to meet you.

[B]

Nice to meet you. Pleasure tonight.

[A]

I appreciate that, Dave. And the occasion that brings us together is as we've been covering for quite a little bit now, the 10 year anniversary of the Cyberwire Daily and all of, all of the incredible stories that the show and you have been covering over the last decade. And for our chat today, we're gonna take a focus look at geopolitics in the last decade as it relates to cybersecurity and the many, many stories in that realm that you have taken a look at in that time. So, gosh, to start to cover geopolitics, I think a few things have changed in the last decade.

[B]

One or two, just a few.

[A]

I mean, 2015, 2016 was a millennia ago.

[B]

I know.

[A]

Not literally, but kind of.

[B]

Yeah. Well, I'm still battling the reality that post Covid time has no meaning, but I really enjoyed looking back as I was prepping for our conversation today, there were a lot of things that I hadn't really considered in a while. And when you kind of lay them all out in front of yourself, you see that. Yeah, there has been a lot of change over the past decade when it comes to a lot of this geopolitical stuff.

[A]

It's a feedback loop, isn't it?

[B]

It is, it is. I one of the things that strikes me is just that it's become constant. Like there it used to be that you'd have something like the OPM breach, which was more episodic, ooh, something happened and oh, there was a breach or oh, the data got stolen or ooh, there was some ransomware and it's just, it's everywhere now. It's daily. Thank goodness for us. Yeah, there's a low level drone of this stuff that is all the time now. And so that's the new reality. That's where we are.

[A]

Yeah. Was there anything leading question but anything that contributed to that shift? Because that is quite a change from what the landscape looked like, at least for the civilian side of things that you know. You know now as you said, that drone of continuous threats, especially on that international scale, it is quite a shift. What do you feel has contributed to that?

[B]

I think geopolitically it's the reality and the recognition from nation states that cyber is a domain without the usual borders. And also you get a huge return on your investment. You don't have to build an aircraft carrier to force your influence around the rest of the world. And we've seen that with things like influence operations from the Russians and Chinese stealing information from our companies, our organizations, supply chain issues, all those kinds of things. Again, they're a day to day thing now. And they weren't always, that's for sure.

[A]

Yeah. I think as we start thinking about specific incidents and threats, the one that definitely, I'm sure for most of our listeners would come to mind as we look back the 10 years, not Petya and how seismic Petya and then not Petya we truly were and everything that has come after that. Can you talk us through that one a little bit? Because that was such a huge, huge thing when it landed.

[B]

Well, I think it was the one that sort of opened everybody's eyes and thought it can happen to us. Right. You have a global disruption of the supply chain, major supplier gets hit and everybody starts worrying that maybe our global economy is a little more fragile than we thought it was. So it certainly got everybody's attention, made everybody feel like it was real and, you know, it's in everybody's consciousness ever since.

[A]

That's very true. That's very true. And another thing, as we look back on the last 10 years, 2022 was the start of the war in Ukraine and it's still ongoing. The fallout from that is certainly global, especially when we're talking within the cyber realm. What are the geopolitical shifts within the conflict that you think have fed into the cybersecurity realm, as it were? Like the nature of the threat?

[B]

Yeah, I mean, there's this whole idea that the war in Ukraine has been a bit of a laboratory for cyber war, for modern cyber war. The integration of cyber and kinetic battle, using cyber alongside your battlefield operations. Again, information operations, which is top of mind for the Russians. You know, they've always, it's always been a something they've had up their sleeve, but it feels like cyber has been an accelerant for that, for them to be able to do the things they do. And then also sort of related to, I think it started in Ukraine, but related to what we're seeing now in Iran is seeing inexpensive technology being used in warfare. Little consumer drones, consumer electronics routers, Starlink, all these things that are not mil spec, you know, such as it is. Right. Whatever that means. But they're off the shelf tools that hose themselves up to the cyber and have allowed folks to be, to have an unfair advantage, or at least maybe not as much of a outsized disadvantage against a larger, more capable adversary.

[A]

Speaking of adversaries, and again, we're based in the United States, so this is our very US centric point. Of view. So just owning up to that. But when we think about, in case that wasn't obvious, when we think about the adversarial nation states, often Russia, China, North Korea, those are the names that commonly come to mind. Iran of course is part of that as well, has been. But things have shifted in that arena as well in terms of nation state strategies against other nation states and also against private enterprise. It's all in the mix over the last 10 years. Again, big shifts. Anything notable that you want to highlight on that front?

[B]

Well, let's look at China who famously, I think they play the long game and we're in the middle of that long game. Who knows how long it is. We might be in just the beginning of it, but we've seen that they have positioned themselves in our infrastructure. They have access to the supply chain. So many things get manufactured in China that it's and the manufacturers are obligated to do what the Chinese government wants them to do. So I think there's a legitimate concern from nations like ours to think about what might be in the firmware, what might be in our supply chain. We certainly we found them in our telecommunications infrastructure with the various typhoons of old, typhoon salt, typhoon and those sorts of things. So they're more looking for long term economics, influence and advantage rather than turning the lights off, which I think is the fear that we have from say Russia or Iran of messing with our critical infrastructure. It seems like China's really interested in gathering information, knowing what we're up to so they can leverage that knowledge to their own advantage.

[A]

And it leaves defenders in a really in a bit of a bind truly when you're thinking about potential supply chain attacks or just issues from within the supply chain. And as you specifically, if we're talking about devices from China, in many cases they're the only source for some of these things. Many things that are made there is no domestic supplier for some, for not just some. Many of the things that a lot of modern IT infrastructure relies on. So it leaves defenders in a, in quite a difficult position. And I'm wondering what is the advice that we, that defenders should be applying in their day to day or what. What can we tell them? What should they be doing in light of all that?

[B]

Well, I, I think ultimately, I mean it's defense in depth, right. So you can't rely on only one thing to protect yourself. So you do your due diligence to check to make sure your supply chain is as secure as it can be, but then have defenses in place on the chance that it's not, because it might not be. And so look, we're seeing again to the present day who thought we would see the rest of the world being so interested in digital sovereignty because of the actions of the United States, the major players, the Microsoft, Google, Amazon. We're seeing other nations building their own infrastructure because they're not sure they can depend on us as good partners in a way that they had assumed that they could in prior years. So I don't know the degree to which people saw that coming. I certainly didn't. I don't know about you.

[A]

That was a blindside for a lot of us. Yeah, I did not am still reeling from it personally, honestly. And given the conversations that you've had, especially in the last few years, I'm wondering if the nature of what you're hearing from people that you've interviewed when geopolitics, but maybe also specifically supply chain issues, has the nature of that conversation changed? I mean, are there new worries, anxieties, what are you hearing that is trend wise that has changed?

[B]

Yeah, I mean I think it's top of mind for a lot of people. They understand that the threat is real. They understand that there's only so far down the supply chain ladder that you can go to Trust but verify. And like you said, so many things come out of other nations who are potentially adversarial. I mean, look at how many of us are carrying iPhones around, right? Who makes the iPhones? Where do they come now? So who are we trusting? We're trusting Apple to do their due diligence. But right, the thing. So at some point you have to trust someone.

[A]

I want to let that marinate for a second because it's an important point, but it's also makes me kind of recoil. I don't know why, just viscerally it makes me go, yeah, but oh,

[B]

and yet what is probably the most popular thing that we've seen or one of the, let's say top five things that's come to the fore in terms of strategies is zero trust architecture. So you don't want to trust anybody. Right.

[A]

Where does it leave us, truly?

[B]

Right. Well, you have to strike that balance. And I guess it's the old Reagan saying, trust but verify only trust so far and do your due diligence. And zero trust is a way to be constantly challenging the trust to make sure that people are only getting access to what they need to when they need it. And I think that's wise. So the rise of zero trust and its adoption by governments, the feds really jumping in with both feet with zero trust, I think shows that that's probably where we're headed going forward. Be sure to check out the full version of my interview with Maria this Sunday as part of a Cyberwire Special Edition.

[A]

Experience a membership that backs what you're building with American Express Business Platinum. Get 2 times Membership Rewards points per dollar on eligible purchases in key business categories, as well as on each eligible purchase of $5,000 or more on up to $2 million in eligible purchases per calendar year. American Express Business Platinum there's nothing like it. Terms apply. Learn [e-mail] Business Platinum

[D]

when you need to build up your team to handle the growing chaos at work, use Indeed Sponsor Jobs. It gives your job post the boost it needs to be seen, seen, and helps reach people with the right skills, certifications and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a $75 sponsored job credit@ Indeed.com podcast. That's Indeed.com podcast. Terms and conditions apply. Need a hiring hero? This is a job for Indeed Sponsored jobs.

[B]

And finally, the promise of Vibe coding was Describe an app in plain English, click Publish, and suddenly everyone's a software developer. Unfortunately, some of those developers also accidentally became system administrators with the security habits of an unlocked filing cabinet, according to reporting by Andy Greenberg for Wired. Researchers at Red Access found more than 5,000 publicly accessible web apps built with AI coding platforms, including Lovable Replit, Base44 and Netlify, that lacked meaningful security protections. According to the researchers. Many exposed sensitive business and personal information, including medical records, financial data, internal strategy documents, chatbot logs, and cloud credentials. In some cases, the apps reportedly allowed administrative access with little or no authentication. The findings echo earlier waves of cloud storage misconfigurations, where easy to use platforms collided with limited security expertise. Researchers warn AI coding tools are now putting powerful application development capabilities into the hands of employees who may never pass through traditional security review processes if they pass through any process at all. And that's the Cyber Wire. For links to all of today's stories, check out our daily [e-mail] be sure to check out this weekend's Research Saturday and my conversation with Mark Kelly, threat researcher at Proofpoint. The research we're discussing is titled I'd Come running back to EU again TA416 resumes European government espionage Campaigns. That's Research Saturday. Do check it out. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's lead program producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazes. Our executive producer is Jennifer Ibin. Peter Kilpney is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here next week. Foreign.

[E]

You can't reason with the sun. Trust us, we've tried. This summer, it's time to put that angry ball of fire on mute. Columbia's Omnishade technology is engineered to protect you from the sun's harsh rays that can burn and damage your skin. The sun is relentless, but so is our gear. Level up your [e-mail] to spend more time outside and less time slathering on aloe lotion. You're welcome, Columbia. Engineered for whatever.