Latest / Daily Cyber Briefing / Daily Cyber & AI Briefing — 2026-06-11

Transcript

Daily Cyber & AI Briefing — 2026-06-11 · Daily Cyber Briefing

• 0:07
  SPEAKER_00: Grab your coffee or Red Bull or whatever your morning vice is, and this is your daily cyber and AI briefing, and I am your host, Michael Hoosh.
• 0:16
  SPEAKER_00: The cyber and AI risk environment is shifting rapidly.
• 0:19
  SPEAKER_00: And today's landscape is defined by a surge in critical vulnerabilities and active exploitation campaigns.
• 0:26
  SPEAKER_00: We're seeing attackers focus their efforts on the core platforms that underpin enterprise operations, systems like Oracle PeopleSoft, Microsoft Windows Defender, and SAP.
• 0:37
  SPEAKER_00: These aren't niche products.
• 0:39
  SPEAKER_00: They're foundational to HR, finance, supply chain, and business process management across industries.
• 0:45
  SPEAKER_00: The stakes are high and the pace of exploitation is accelerating.
• 0:50
  SPEAKER_00: Let's start with Oracle PeopleSoft.
• 0:52
  SPEAKER_00: Right now, PeopleSoft servers are under active attack with threat actors exploiting a remote code execution vulnerability.
• 1:00
  SPEAKER_00: Oracle has responded with an emergency out-of-band patch, an unusual step that underscores the seriousness of the threat.
• 1:08
  SPEAKER_00: If you're running PeopleSoft, especially instances exposed to the Internet, patching is not optional.
• 1:14
  SPEAKER_00: Attackers gaining access here could compromise sensitive HR records, financial data, or disrupt critical operations.
• 1:22
  SPEAKER_00: The window for safe delay is closing rapidly.
• 1:24
  SPEAKER_00: Review your exposure and deploy the fix immediately.
• 1:28
  SPEAKER_00: This is a textbook example of how attackers target widely deployed business critical platforms to maximize impact.
• 1:36
  SPEAKER_00: Turning to Microsoft, two zero-day exploits in Windows Defender have been disclosed and are now being actively used in the wild.
• 1:44
  SPEAKER_00: The first, dubbed Great CML, allows attackers to bypass BitLocker encryption by leveraging Windows Defender's offline scan.
• 1:53
  SPEAKER_00: The second, known as Rogue Planet, grants system level access, essentially giving attackers the keys to the kingdom on affected endpoints.
• 2:02
  SPEAKER_00: Both vulnerabilities represent a severe risk to endpoint security and data protection.
• 2:07
  SPEAKER_00: While we wait for Microsoft's official patches, organizations should review their endpoint security configurations and consider additional controls for systems handling sensitive information.
• 2:19
  SPEAKER_00: This is a reminder that even security tools themselves can become attack vectors, and layered defense remains essential.
• 2:27
  SPEAKER_00: The risks aren't limited to traditional enterprise software.
• 2:30
  SPEAKER_00: The AI development ecosystem is also in the crosshairs.
• 2:34
  SPEAKER_00: A critical vulnerability in Langflow, a tool for orchestrating AI workflows, has been exploited for malicious code execution.
• 2:42
  SPEAKER_00: This is significant because Langflow is used to build and automate AI ML pipelines, and a compromise here could open the door to lateral movement or data exfiltration across your AI infrastructure.
• 2:55
  SPEAKER_00: Security teams need to assess their use of Langflow, apply available patches, and tighten access controls.
• 3:02
  SPEAKER_00: The broader implication is clear.
• 3:04
  SPEAKER_00: As AI becomes more deeply embedded in business processes, attackers are adapting their tactics to target the tools and platforms that power AI innovation.
• 3:14
  SPEAKER_00: SAP is another critical area of focus.
• 3:17
  SPEAKER_00: The company's June Security Patch release addresses several vulnerabilities that threaten trust controls within ERP environments.
• 3:27
  SPEAKER_00: For organizations relying on SAP to manage core business processes, unpatched systems are a prime target for attackers seeking to disrupt or manipulate operations.
• 3:38
  SPEAKER_00: CISOs should ensure patches are applied promptly and confirm that compensating controls are in place if any updates are deferred.
• 3:45
  SPEAKER_00: This is especially important in highly regulated sectors, where the consequence of a breach can extend beyond financial loss to include regulatory penalties and reputational damage.
• 3:57
  SPEAKER_00: Cloud security continues to be a battleground.
• 4:00
  SPEAKER_00: Attackers are now abusing weaknesses in AWS Cloud Trail and Google Cloud Logging to evade detection and exfiltrate sensitive logs.
• 4:10
  SPEAKER_00: By tampering with logging services, adversaries can maintain stealthy persistence and complicate incident response efforts.
• 4:18
  SPEAKER_00: Organizations need to review their cloud logging configurations, enforce least privileged access to logs, and implement anomaly detection to spot suspicious activity.
• 4:29
  SPEAKER_00: This is a clear example of how attackers are targeting the very tools we rely on for visibility and auditability in the cloud.
• 4:37
  SPEAKER_00: Fortnet customers should also be on high alert.
• 4:40
  SPEAKER_00: A new critical vulnerability in Forty Sandbox, a widely used malware analysis solution, has been patched.
• 4:47
  SPEAKER_00: The flaw could allow attackers to bypass sandbox protections or gain unauthorized access, undermining threat detection workflows.
• 4:56
  SPEAKER_00: If you're running Forty Sandbox, apply the update immediately and review your systems for signs of compromise.
• 5:04
  SPEAKER_00: This is another reminder that security infrastructure itself is not immune and must be maintained with the same vigilance as any other critical asset.
• 5:12
  SPEAKER_00: The macOS ecosystem is facing renewed attention from attackers as well.
• 5:16
  SPEAKER_00: A new campaign is distributing InfoSteeler malware via weaponized DMG files, specifically targeting Mac OS users.
• 5:24
  SPEAKER_00: This challenges the common perception that macOS environments are inherently lower risk.
• 5:30
  SPEAKER_00: Security teams should ensure endpoint protection is up to date, educate users about the dangers of suspicious downloads, and monitor for unusual outbound connections from macOS devices.
• 5:42
  SPEAKER_00: The lesson here is that platform popularity and perceived security can shift attacker focus.
• 5:49
  SPEAKER_00: Complacency is not an option.
• 5:51
  SPEAKER_00: Phishing remains a persistent and evolving threat.
• 5:54
  SPEAKER_00: The snipers.
• 5:56
  SPEAKER_00: Phishing as a service platform is being leveraged by threat actors to conduct brand spoofing and browser hijacking attacks.
• 6:05
  SPEAKER_00: This service model lowers the technical barrier for launching sophisticated phishing campaigns, increasing both their volume and effectiveness.
• 6:14
  SPEAKER_00: To counter this, organizations should double down on security awareness training and deploy advanced email and web filtering solutions.
• 6:23
  SPEAKER_00: The human element remains a critical line of defense, and attackers are investing heavily in social engineering to bypass technical controls.
• 6:32
  SPEAKER_00: Not all threats come from malicious actors.
• 6:36
  SPEAKER_00: Sometimes security tools themselves can create operational headaches.
• 6:40
  SPEAKER_00: Legitimate files from Siemens DeSigo CC building management system are being incorrectly flagged as malware by some security engines.
• 6:50
  SPEAKER_00: This can lead to unnecessary downtime or disruptions, particularly in critical infrastructure environments where building management is essential.
• 6:59
  SPEAKER_00: Security teams should coordinate closely with vendors to validate detections and avoid taking actions that could inadvertently disrupt operations.
• 7:08
  SPEAKER_00: On the AI governance front, Seclore has launched ARMOR DSPM, a new data security posture management solution designed specifically for AI environments.
• 7:20
  SPEAKER_00: This reflects the growing recognition that AI-driven systems introduce unique data privacy, compliance, and risk management challenges.
• 7:29
  SPEAKER_00: CISOs should evaluate emerging solutions like ARMOR, DSPM as part of a broader strategy for AI governance and data protection.
• 7:38
  SPEAKER_00: As AI adoption accelerates, so does the need for tools that provide visibility and control over how sensitive data is used and protected in these environments.
• 7:49
  SPEAKER_00: Shifting gears to workforce dynamics, the cybersecurity talent shortage continues to be a major operational risk.
• 7:58
  SPEAKER_00: A recent report finds that 57,000 cybersecurity professionals switch jobs each year, exacerbating the talent crunch.
• 8:05
  SPEAKER_00: High turnover can slow incident response, delay project delivery, and increase the risk of operational gaps.
• 8:13
  SPEAKER_00: Security leaders need to invest in retention strategies, ongoing training, and Donify and automation to maintain resilience despite staffing challenges.
• 8:24
  SPEAKER_00: The reality is that technology alone isn't enough.
• 8:27
  SPEAKER_00: Skilled people are essential to effective cyber defense.
• 8:31
  SPEAKER_00: All of these factors are contributing to a widening divide between organizations that invest in cyber resilience and those that do not.
• 8:39
  SPEAKER_00: Recent analysis highlights that differences in leadership commitment, resource allocation, and adoption of best practices are creating two distinct groups, those who are prepared for today's threats and those who are increasingly vulnerable.
• 8:55
  SPEAKER_00: This divide has direct implications for risk exposure, regulatory compliance, and ultimately business continuity.
• 9:03
  SPEAKER_00: So, what are the strategic implications for security leaders and risk executives?
• 9:08
  SPEAKER_00: First and foremost, immediate patching of critical vulnerabilities in Oracle, Microsoft, SAP, and Fortinet products is essential.
• 9:18
  SPEAKER_00: Delaying patch deployment increases the risk of exploitation and data loss.
• 9:23
  SPEAKER_00: This isn't just about ticking a compliance box.
• 9:26
  SPEAKER_00: It's about protecting the core systems that keep your business running.
• 9:29
  SPEAKER_00: Second, cloud security controls, especially around logging and monitoring, must be reviewed and hardened.
• 9:36
  SPEAKER_00: Attackers are getting better at hiding their tracks, and the ability to detect and respond to stealthy tactics is crucial.
• 9:42
  SPEAKER_00: Least privilege access, robust anomaly detection, and regular audits of logging configurations are key steps.
• 9:50
  SPEAKER_00: Third, as AI becomes more integral to business operations, AI and data governance are rising priorities.
• 9:57
  SPEAKER_00: Organizations should evaluate new tools and frameworks to manage risk in AI and machine learning environments.
• 10:05
  SPEAKER_00: This means not only protecting data, but also ensuring transparency, accountability, and compliance as AI-driven decision making becomes more prevalent.
• 10:16
  SPEAKER_00: Fourth, the cybersecurity talent shortage isn't going away.
• 10:20
  SPEAKER_00: Proactive retention strategies, upskilling, and increased automation are necessary to maintain operational resilience.
• 10:29
  SPEAKER_00: This is about building a sustainable security function that can adapt to evolving threats without burning out your team.
• 10:36
  SPEAKER_00: Let's bring this together with a focus on what matters most today.
• 10:40
  SPEAKER_00: Active exploitation of zero-day vulnerabilities in core enterprise platforms demands urgent attention and a coordinated response.
• 10:49
  SPEAKER_00: These aren't theoretical risks, they're being used in real tax right now.
• 10:53
  SPEAKER_00: Rapid patching, vigilant monitoring, and clear incident response plans are non-negotiable.
• 10:59
  SPEAKER_00: Cloud and AI security are converging concerns.
• 11:02
  SPEAKER_00: Attackers are targeting both infrastructure and data governance weaknesses, exploiting gaps wherever they find them.
• 11:09
  SPEAKER_00: Security strategies must reflect this convergence, with integrated controls that span both traditional IT and emerging AI environments.
• 11:18
  SPEAKER_00: Finally, the operational impact of talent churn and false positives in security tooling can undermine resilience if not addressed proactively.
• 11:28
  SPEAKER_00: Retaining skilled professionals, investing in training, and refining detection technologies are all critical to maintaining a robust security posture.
• 11:38
  SPEAKER_00: To summarize, the current threat landscape is defined by a convergence of critical vulnerabilities, evolving attacker tactics, and shifting regulatory and business expectations.
• 11:49
  SPEAKER_00: Security leaders are being challenged to do more with less, responding to immediate threats while building long-term resilience.
• 11:57
  SPEAKER_00: The organizations that succeed will be those that prioritize patch management, cloud and data governance, and workforce development, all within a holistic risk-based framework.
• 12:08
  SPEAKER_00: That's the briefing for today.
• 12:10
  SPEAKER_00: Stay vigilant, keep your teams informed, and remember, resilience is built one decision at a time.
• 12:16
  SPEAKER_00: That's a wrap, peeps.
• 12:18
  SPEAKER_00: Stay secure, stay sharp, and don't forget to hug your CISO.