Transcript
Announcer (0:02)
You're listening to the Cyberwire Network powered by N2K
Home Depot Advertiser (0:09)
Spring starts at the Home Depot and we are bringing the heat to your backyard this season. Fire up the flavor with our wide variety of grills for under $300 like the next grill 4 burner gas grill that's perfect for hosting your spring cookout. Then set the scene and turn your outdoor space into the go to spot the patio sets for every budget. Bring it this season with grills that deliver flavor and patios that set the VI vibe from the Home Depot. Start your spring with low prices guaranteed at the Home Depot. Exclusion supplies to home depot.com price match for details.
Dave Bittner (0:48)
The UK's cybersecurity chief urges a full court press against threats We've got highlights from RSAC the US State Department has launched a Bureau of Emerging Threats. The Team PCP Cyber Criminal Group targets an open source library TP link patches multiple router vulnerabilities. A critical vulnerability hits Windchill and Flex PLM platforms. A phishing campaign impersonates Palo Alto networks recruiters. Malicious chrome extensions are harvesting users conversations with AI tools. Intern Kevin Files his latest report from the RSAC show floor and your private Zoom call may already have a podcast deal. Foreign. March 25, 2026 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Hello everyone. Thanks for joining us here today. We are coming to you from the RSA 2026 Conferen in San Francisco. We're spending the week talking with security leaders, researchers and practitioners about what's shaping the threat landscape right now, from AI risks to supply chain security and the latest moves from nation state actors. Stay with us for insights, interviews and the stories. Security teams are watching closely as rsac continues. The UK's cybersecurity chief is urging governments, industry and allies to mount a coordinated, full court press against increasingly complex cyber threats. In a keynote at the RSA conference, National Cybersecurity Center CEO Richard Horn warned cyber risks now carry greater consequences, driven by cooperation between state and criminal actors. He said no single measure will suffice and pointed to actions spanning organizational resilience, shared infrastructure, protection and disruption of adversary networks. Horn argues sustained collective pressure across law enforcement, regulation, offensive cyber activity and secure by design software is required to counter attacks growing in scale and sophistication, including those amplified by AI. To that point, UK police arrested more than 500 suspects in a national fraud crackdown under Operation Hen House, freezing and seizing millions in suspected criminal proceeds. The National Crime Agency and City of London Police said the fifth annual operation led to 557 arrests, 172 voluntary interviews, 249 cease and desist notices and freezes on £9 million alongside £18.1 million in asset seizures. Authorities also blocked millions of scam calls and identified overseas fraud call centers. Officials say Coordinated national enforcement disrupts large fraud ecosystems affecting individuals and businesses across both digital and offline channels. Day two of the RSA conference featured a wave of announcements focused on securing AI systems identities and software supply chains as vendors rolled out new defensive capabilities. Security Week reported launches spanning AI visibility tools from Cyber Haven, Identity Security posture management features from RSA and Savant and generative AI agents from Securonix designed to reduce analyst workload. Other updates included Qualys protections for machine learning pipelines, recorded future malware intelligence automation, and Sonatype enhancements to software repository malware defenses. Several announcements also emphasized compliance automation, cloud data security and storage level cyber resilience. The volume and direction of launches signal an industry shift toward protecting AI workflows and consolidating identity and data risk visibility across enterprise environments. The U.S. state Department has launched a Bureau of Emerging Threats to counter adversaries weaponization of technologies such as AI, cyberspace and space systems, officials told ABC News. The bureau will address risks from Iran, China, Russia, North Korea and foreign terrorist organizations. It includes offices focused on cybersecurity, critical infrastructure, disruptive technology, space security and threat assessment, officials said. The effort supports long term national security planning and coordination across foreign policy tools. The department formally notified Congress the same day the White House released a national Artificial Intelligence policy Framework. Officials say adversaries are increasingly exploiting emerging technologies, requiring coordinated diplomatic and security responses. Beyond traditional cyber defense, A malicious update to the Light LLM open Source library is the latest supply chain attack attributed to the Team PCP Cybercriminal Group. Researchers at Future Search first identified the issue after executing the payload locally. Sonatype later confirmed that multiple versions on PYPI contained a credential stealer and malware dropper. Because Light LLM brokers connections between applications and multiple large language model providers, it can expose API keys, environment variables, and other secrets. Investigators link the incident to earlier compromises affecting Trivi checkmarks, extensions, and several NPM packages. Attackers are targeting tools embedded deep in AI development pipelines, where access to credentials can enable broader downstream compromise across enterprise environments. TP Link has patched multiple vulnerabilities in its Archer NX router series, including a critical flaw that could let attackers bypass authentic and upload malicious firmware. The issue affects multiple versions of the routers and stems from a missing authentication check in certain HTTP server endpoints. TP Link said attackers could perform privileged actions without logging in. The company also fixed a hardcoded cryptographic key flaw and two command injection vulnerabilities that allowed administrators to execute arbitrary commands. Router level compromise can enable persistent access and configuration control at the network edge, increasing exposure for home and small office environments if patches are not applied promptly, PTC is warning customers about a critical vulnerability in its windchill and FlexPLM platforms that could enable remote code execution, with German authorities taking the unusual step of directly alerting affected organizations. The flaw involves deserialization of trusted data and affects most supported versions and critical patch sets of both products. PTC said no patches are yet available and urged administrators to block access to a specific servlet path or disconnect exposed systems if mitigation is not possible. The company also released indicators of compromise and reported credible evidence of an imminent third party exploitation attempted. These product lifecycle management systems are widely used in industrial and engineering environments, increasing potential downstream risk if exploitation occurs before patches are released. A phishing campaign impersonating Palo Alto Network's recruiters is targeting senior professionals with fake hiring outreach designed to extract payment under the guise of resume processing requirements. According to Palo Alto attackers use scraped LinkedIn data and realistic corporate branding to build credibility before claiming candidates failed Automated Applicant Tracking System checks. Victims are then referred to a supposed third party specialist who offers to fix the issues for fees ranging from $400 to $800. The campaign relies on urgency and procedural realism to pressure targets into paying quickly. The operation shows how threat actors are adapting business process impersonation tactics to exploit executive job seekers directly for financial gain. Security researchers are warning that malicious Chrome extensions are harvesting users conversations with AI tools in a tactic known as prompt poaching. Expel said it observed several dozen incidents in the past month involving extensions that monitor open tabs, detect AI clients and capture questions and responses through API interception or page scraping before sending the data to external servers. Attackers either impersonate legitimate AI helper extensions or introduce malicious features after building a large user base. As seen with Urban VPN proxy stolen prompts may expose intellectual property, customer information or other sensitive data that can support phishing, identity theft or resale on underground forums. Coming up after the break, intern Kevin files his latest report from the RSAC show floor and your private Zoom call may already have a podcast deal. Stick around. No, it's not your imagination. Risk and regulation really are ramping up, and these days customers expect proof of security before they'll even do business. That's where Vanta comes in. Vanta automates your compliance process and brings compliance, risk and customer trust together on one AI powered platform. So whether you're getting ready for a SoC2 or managing an enterprise governance risk and compliance program, Vanta helps keep you secure and keeps your deals moving. Companies like ramp and RYTR spend 82% less time on audits with Vanta. That means less time chasing paperwork and more time focused on growth. For me, it comes down to over 10,000 companies from startups to large enterprises. Trust Vanta to help prove their security. Get started@vanta.com cyber.