Transcript
A (0:02)
You're listening to the cyberwire network. Powered by n2k.
B (0:11)
Identity is a top attack vector. In our interview with Kavitha Mariapan from Rubrik, she breaks down why 90% of security leaders believe that identity based attacks are their biggest threat. Throughout this conversation we explore why recovery times are getting longer, not shorter, and what resiliency will look like in this AI driven world. If you're struggling to get a handle on identity risk, this is something you should tune into. Check out the full interview@thecyberwire.com Rubrik. Maybe that's an urgent message from your CEO, or maybe it's a deepfake trying to target your business. Doppel is the AI native social engineering defense platform, fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back from automatically dismantling cross channel attacks to building team resilience and more Doppel outpacing what's next in social engineering? Learn more@doppl.com that's d o p e l.com. We got your patch Tuesday Updates Preliminary findings from the European Commission come down on TikTok. Switzerland's military cancels its contract with Palantir Social engineering leads to payroll fraud Google hands over extensive personal data on a British student activist. Researchers unearth a global espionage operation called the Shadow Campaigns. Notepad's newest features could lead to remote code execution. Our guest is Hazel Serra, resident agent in charge of the Atlantic City office for the United States Secret Service. And Ring says it's all about dogs, but critics hear the whistle. Foreign. It's Wednesday, February 11, 2026. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great to have you with us. This month's Patch Tuesday brought a wide range of security updates from major software and hardware vendors urging organizations and users to apply patches promptly to mitigate active threats and emerging risks. Microsoft's February security update fixes around 60 vulnerabilities across Windows Office Azure, across Windows, Office, Azure, and related components, including six actively exploited zero days. These flaws span security feature bypasses, elevation of privilege, remote code execution, denial of service, and information disclosure bugs. Several of the zero days affecting Windows, Shell, mshtml, and Office were publicly disclosed or exploited prior to the update. Administrators are strongly advised to apply these patches immediately. Adobe released updates covering multiple products, including audition, after effects, InDesign, Bridge, Lightroom, Classic, Substance 3D apps, and the DNG SDK. The patches address over 44 vulnerabilities with several rated critical that could lead to arbitrary code execution if a user opens a malicious file. To date, Adobe has not reported active exploitation of these flaws in the wild. Several industrial automation vendors, including Siemens, Schneider Electric, Phoenix Contact and Aviva have published security advisories for their ICS and OT products as part of this Patch Tuesday cycle. These advisories cover a dozen vulnerabilities impacting control software, PLCs and related devices and provide fixes, mitigations or configuration guidance to reduce risk in industrial environments. Both intel and AMD released multiple advisories for vulnerabilities in their hardware and Firmware, with over 80 flaws addressed across CPUs, chipsets and related technologies. These updates include a range of severity levels and underlying ongoing efforts by chip vendors to harden platforms against both software and hardware assisted attacks. This patch Tuesday underscores that attackers are targeting both software and hardware layers, from exploited Microsoft zero days to critical Adobe flaws and a broad set of chip vulnerabilities. Organizations should prioritize patch deployment across endpoints, servers, industrial systems and firmware to reduce exposure the European Commission has preliminarily found that TikTok's design may breach the Digital Services act by promoting addictive use through features like Infinite Scroll, Autoplay, push notifications and personalized recommendations. Regulators say TikTok failed to properly assess risks to users mental and physical well being, especially minors, and ignored indicators of compulsive use. Existing screen time and parental controls were deemed ineffective. The commission suggests TikTok may need fundamental design changes and could face fines of up to 6% of global turnover if violations are confirmed. Switzerland's military has ended its contract with Palantir after a security audit found a significant risk that US Intelligence agencies could access sensitive Swiss defense data. While auditors praised Palantir's technical capabilities, the potential exposure was unacceptable for Switzerland's neutrality. The decision raises broader questions about data sovereignty and may prompt other non NATO states, including Ukraine, to reassess similar partnerships. Despite this reputational setback In Europe, Palantir's US business remains strong, highlighted by a recent $448 million Navy contract. Financially, the Swiss exit is minor, but it underscores growing international unease over jurisdictional control of defense data. Researchers at Binary Defense investigated a payroll fraud incident in which attackers redirected a physician's salary using social engineering rather than malware. The scheme began with compromised credentials for a shared mailbox, likely obtained in a prior breach. After studying internal emails, the attacker impersonated a locked out physician in a help desk call, pressuring staff to reset the password and MFA using the organization's own virtual desktop infrastructure. The attacker then accessed workday and changed direct deposit details, evading detection because the activity appeared legitimate. The breach was only discovered when the physician missed a paycheck, researchers warn. This highlights identity as the new perimeter and urge stronger verification and controls around payroll changes. Google has complied with an ICE subpoena seeking extensive personal data on British student activist and journalist Amandla Thomas Johnson, including banking and credit card details linked to his Gmail account, according to documents obtained by the Intercept. The request followed Thomas Johnson's brief participation in a 2024 protest at Cornell University and cited only a generic immigration enforcement rationale. Google disclosed the data without prior notice, denying him the chance to challenge the subpoena. Civil liberties groups including the EFF and aclu, warn the case reflects a broader pattern of tech companies quietly cooperating with DHS surveillance requests, often under gag orders. Privacy experts say the episode raises serious concerns about data sovereignty, transparency and user rights, and highlights the need for stronger legal protections governing government access to to digital data. Palo Alto Networks Unit 42 has published a major analysis of a global espionage operation it calls the Shadow campaigns tracking a state aligned cyber espionage group designated TGR STA 1030, also known as UNC 6619. The group, assessed with high confidence to operate out of Asia, has been active since at least 2024 using phishing and exploitation of known vulnerabilities to compromise government ministries, law enforcement, border control and other critical infrastructure entities in at least 37 countries, and has conducted reconnaissance against infrastructure in 155 countries. The campaigns appear focused on long term intelligence collection tied to geopolitical and economic interests. Unit 42's report details the group's techniques, tooling and targets and has shared defensive indicators to help organizations better detect and mitigate this widespread espionage threat. Researchers have identified a high severity flaw in Notepad's recently added markdown support that could enable remote code execution. The bug allows attackers to trick users into opening a malicious markdown file and clicking an embedded link, triggering execution via unverified protocols with the user's permissions. Microsoft has patched the issue and says there's no evidence of active exploitation. The finding renews criticism of expanding Notepad's feature set, which ships enabled by default. Coming up after the break, my conversation with Hazel Sarah, resident agent in charge of the Atlantic City office for the United States Secret Service and Ring says it's all about dogs, but critics hear the whistle. Stay with us. What's your 2am Security worry? Is it Do I have the right control?