Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K.
B (0:12)
If securing your network feels harder than it should be, you're not imagining it. Modern businesses need strong protection, but they don't always have the time, staff or patience for complex setups. That's where Nord layer comes in. Nordlayer is a toggle ready network security platform built for businesses. It brings VPN access control and threat protection together in one place. No hardware, no complicated configuration. You can deploy it in minutes and be up and running in less than 10. It's built on zero trust principles so only the right people can get access to the right resources. It works across all major platforms, scales easily as your teams grow and integrates with what you already use. And now Nordlayer goes even further through its partnership with CrowdStrike, combining NordLayer's network security with Falcon Endpoint protection for small and mid sized businesses. Enterprise grade security made manageable Try Nordlayer risk free and get up to 22% off yearly plans plus an extra 10% with the code CYBERWIRE10. Visit nordlayer.com cyberwire daily to learn more. CISA's interim director uploaded sensitive government material into the public version of ChatGPT. The cyber attack on Poland's power grid compromised roughly 30 energy facilities. The EU and India sign a new partnership that includes expanded cyber cooperation. Meta rolls out enhanced WhatsApp security FE features researchers uncover a campaign targeting LLM service endpoints Fortinet and OpenSSL patch multiple vulnerabilities the high severity WinRar vulnerability continues to see widespread exploitation. Six months after it was patched, the SoundCloud data breach affected nearly 30 million users. Ben Yellen explains the California lawsuit accusing social media platforms of harming kids and a Spanish resort town gets hit with low rent ransomware.
A (2:33)
Foreign.
B (2:38)
It's Wednesday, January 28, 2026. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great to have you with us. Politico reports the interim director of the Cybersecurity and Infrastructure security Agency, Madhu Garamukala triggered internal cybersecurity alarms after uploading sensitive government material into the public version of ChatGPT. According to multiple officials, CISA's monitoring systems detected the activity in early August, prompting a Department of Homeland Security level review to assess potential damage to government security. The outcome of that review has not been disclosed. CISA said Gaudamukkala had temporary authorization to use ChatGPT under DHS controls and that the use was limited and short term, disputing parts of the reported timeline. However, unlike DHS approved internal AI tools, the public ChatGPT platform share uploaded data with OpenAI, raising concerns about exposure beyond federal networks. The incident led to meetings with senior DHS legal and IT leadership and could carry administrative consequences under federal document handling rules. The episode adds to broader scrutiny of Gautamukkala's leadership, which has included prior internal disputes and security related controversies. A coordinated cyberattack on Poland's power grid in late December compromised control and communications systems at roughly 30 energy facilities, according to a new report from cybersecurity firm Dregos. While Polish officials said the attack was stopped before causing outages, researchers found attackers accessed operational technology systems and permanently disabled some equipment. The electricity transmission backbone remained unaffected and power was not interrupted. The attack targeted distributed energy resources, including combined heat and power plants and systems managing wind and solar dispatch. Loss of communications, limited operators ability to remotely monitor and control equipment. Though it remains unclear whether attackers issued operational commands or focused on disruption, Dragos attributed the incident to the Russian linked Sandworm group with moderate confidence, reinforcing concerns that distributed energy systems, often less protected than centralized infrastructure, are now a serious target for sophisticated cyber adversaries. The European Union and India signed a new security and defense partnership that includes expanded cyber cooperation, pledging to deepen their existing cyber dialogue and increase exchanges on cybersecurity threats. Behind the public agreement, however, European cyber diplomats, including officials linked to the EU Agency for Cybersecurity, have privately raised concerns about India's growing Hackers for Hire ecosystem. During closed door discussions, Indian officials rejected those claims, denying such an ecosystem exists and arguing that if it did, it would be a private sector matter. Beyond government control, Meta has begun rolling out strict account settings, a new WhatsApp security feature aimed at journalists, public figures and other high risk users facing sophisticated threats like spyware. The Opt in setting applies the platform's most restrictive privacy controls, including mandatory two step verification, blocking unknown senders, silencing unknown callers, limiting profile visibility and disabling features that could be exploited. WhatsApp says the feature is intended for a small subset of users and will roll out gradually. Following past spyware campaigns that targeted WhatsApp users through zero click exploits, researchers at Pilar Security have uncovered an active cybercrime campaign targeting exposed or weakly protected large language model service endpoints. Over 40 days, more than 35,000 attack sessions were observed, revealing an operation dubbed Bizar Bazaar, one of the first documented cases of LLM jacking attributed to a specific threat actor. The attackers exploited misconfigured AI infrastructure to steal compute resources, resell API access, exfiltrate prompt data, and attempt lateral movement into internal systems. The campaign targets self hosted LLMs, exposed AI APIs, and publicly accessible model context protocol servers, often within hours of appearing in Internet scans. Pilar Security describes a coordinated supply chain involving scanning, validation and resale of access through an online service. The activity remains ongoing. Fortinet has released emergency patches for a forticloud single sign on authentication bypass that was actively exploited as a zero day against fortigate devices. The flaw, with a CVSS score of 9.4, allowed attackers with a forticloud account to access other customers registered devices when forticloud SSO was enabled. Exploitation was detected after attackers created administrator accounts and exfiltrated configuration files, even on fully patched systems. Fortinet blocked malicious accounts, briefly disabled forticloud sso, and now requires patching to restore the feature. CISA added the flaw to its known exploited vulnerabilities catalog. Separately, OpenSSL released updates fixing 12 vulnerabilities, including a high severity remote code execution risk. Google's Threat Intelligence Group warned that a high severity WinRAR path traversal vulnerability continues to see widespread exploitation six months after it was patched. The flaw was exploited in the wild before RAR Lab released a fix in late July and has since attracted a growing mix of attackers. Google attributes activity to at least three financially motivated groups, four Russia state sponsored actors and one China based attacker. Nation state groups have used the bug for espionage, including campaigns against Ukrainian military and government targets, while cybercriminals have deployed malware such as remote access trojans and info stealers across multiple regions. All attackers use a shared technique involving malicious RAR archives that silently drop payloads without user interaction, making detection difficult. Google urged organizations to update WinRAR and Hunt for indicators of compromise. The SoundCloud data breach disclosed in December of last year, has now been added to have I been Pwned? Confirming that nearly 30 million user accounts were affected. Attackers exploited unauthorized access to an internal service dashboard, allowing them to link users email addresses normally private to public profile information. Exposed data included usernames, display names, avatars, follower counts, and sometimes country information, but not passwords, financial data or private content. SoundCloud detected the activity through internal monitoring, isolated the affected systems, and brought in external security experts stating the breach was contained. Afterward, the company faced denial of service attacks and temporary access issues caused by misconfigured security controls. The attackers allegedly attempted extortion before leaking the data online in January of this year, after which it was widely redistributed. Coming up after the break, Ben Yellen explains the California lawsuit accusing social media platforms of harming kids. And a Spanish resort town gets hit with low rent ransomware. Stick around. What's your 2am Security worry? Is it do I have the right controls in place? Maybe Are my vendors secure or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale. And it fits right into your workflows. Using AI to streamline evidence collection, flag risks, and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently, and finally, get back to sleep. Get started@vanta.com cyber that's V A N T A dot com cyber. When it comes to mobile application security, good enough is a risk. A recent Survey shows that 72% of organizations reported at least one mobile application security incident last year and 92% of responders reported threat levels have increased in the past two years. Guard Square delivers the highest level of security for your mobile apps without compromising performance, time to market or user experience. Discover how Guard Square provides industry leading security for your Android and iOS apps at www.guardsquare.com. And joining me once again is Ben Yellen. He is from the University of Maryland center for Cyber Health and Hazard Strategies and also my co host on the Caveat podcast. Ben, welcome back.