Latest / Daily Cyber Briefing / Daily Cyber & AI Briefing — 2026-09-15

Transcript

Daily Cyber & AI Briefing — 2026-09-15 · Daily Cyber Briefing

• 0:07
  SPEAKER_00: Grab your coffee or Red Bull or whatever your morning vice is, and this is your daily cyber and AI briefing, and I am your host, Michael Hoosh.
• 0:16
  SPEAKER_00: Today's cyber and AI risk landscape is defined by a convergence of rapidly evolving threats and a persistent gap between technology adoption and effective governance.
• 0:28
  SPEAKER_00: Over the past 24 hours, we've seen a surge in exploitation of critical vulnerabilities across major enterprise platforms, a marked increase in the sophistication of AI-driven attacks, and a global shift toward tighter data control as organizations respond to digital sovereignty concerns.
• 0:47
  SPEAKER_00: Let's break down what's happening, what it means, and the practical steps risk leaders should be considering today.
• 0:55
  SPEAKER_00: We'll begin with the most urgent developments on the technical front, the active exploitation of zero-day vulnerabilities in some of the world's most widely used enterprise platforms.
• 1:06
  SPEAKER_00: These aren't hypothetical risks.
• 1:08
  SPEAKER_00: They're being used right now by ransomware groups and other threat actors to compromise business critical infrastructure.
• 1:15
  SPEAKER_00: First, the U.S.
• 1:17
  SPEAKER_00: Cybersecurity and Infrastructure Security Agency, or CISA, has confirmed that ransomware gangs are actively exploiting a critical remote code execution vulnerability in VMware products.
• 1:29
  SPEAKER_00: This isn't just a proof of concept.
• 1:32
  SPEAKER_00: Attackers are using this flaw in real-world ransomware campaigns to gain full control of affected systems.
• 1:39
  SPEAKER_00: The bottom line is that if you're running VMware in your environment, immediate patching is not optional.
• 1:45
  SPEAKER_00: Delayed remediation leaves the door wide open for attackers, especially given how widely VMware is deployed in enterprise and cloud environments.
• 1:56
  SPEAKER_00: Security leaders need to prioritize vulnerability management, ensure all VMware systems are updated, and ramp up monitoring for any signs of compromise.
• 2:05
  SPEAKER_00: The lesson here is clear.
• 2:07
  SPEAKER_00: When a critical infrastructure platform is under active attack, speed and thoroughness in patching make the difference between business as usual and a major incident.
• 2:17
  SPEAKER_00: The story is similar with Cisco's email gateway products.
• 2:21
  SPEAKER_00: Cisco has just released patches for a zero-day vulnerability tracked as CVE 2026-76461 that was being actively exploited in the wild.
• 2:32
  SPEAKER_00: This flaw allowed attackers to bypass security controls and gain persistent access to sensitive communications.
• 2:40
  SPEAKER_00: If your organization relies on Cisco's email gateways, patching is urgent.
• 2:45
  SPEAKER_00: But that's only the first step.
• 2:47
  SPEAKER_00: You also need to review logs for any evidence of exploitation, since attackers often move quickly to establish persistence or exfiltrate data before defenders can react.
• 2:58
  SPEAKER_00: This incident is another reminder that edge devices, those systems sitting at the boundary between your organization and the internet, are high-value targets and require continuous monitoring and rapid response capabilities.
• 3:13
  SPEAKER_00: Online retailers are facing their own critical threat.
• 3:17
  SPEAKER_00: A zero-day vulnerability known as Style Smuggler is being actively exploited to compromise Adobe Commerce and Magento e-commerce platforms.
• 3:27
  SPEAKER_00: Attackers are using this flaw to inject malicious code and steal payment data, putting both businesses and their customers at risk.
• 3:36
  SPEAKER_00: For organizations running these platforms, immediate patching is critical, but so is enhanced monitoring for suspicious activity.
• 3:44
  SPEAKER_00: This is a wake-up call for the e-commerce sector.
• 3:47
  SPEAKER_00: Robust web application security and vigilance across the software supply chain are now table stakes, not optional extras.
• 3:56
  SPEAKER_00: The risks don't stop there.
• 3:58
  SPEAKER_00: In the software development space, JetBrain's cadence recently experienced a breach due to a critical vulnerability with a C VSS score of 9.8 that remained unpatched for over two weeks.
• 4:11
  SPEAKER_00: That delay gave attackers a significant window of opportunity.
• 4:15
  SPEAKER_00: This incident highlights a recurring problem in the software supply chain delays in patching high severity bugs can have cascading consequences.
• 4:25
  SPEAKER_00: For CISOs, it's a call to action.
• 4:28
  SPEAKER_00: Review your exposure to jet brains and similar tools, and take a hard look at your patch management processes, especially for high impact vulnerabilities.
• 4:37
  SPEAKER_00: The goal is to shrink the window of exposure as much as possible.
• 4:41
  SPEAKER_00: Now let's talk about the evolving tactics of threat actors, particularly their use of AI.
• 4:48
  SPEAKER_00: Attackers are increasingly leveraging agentic AI systems to automate the exploitation of vulnerabilities and mass credential harvesting.
• 4:56
  SPEAKER_00: What does this mean in practice?
• 4:59
  SPEAKER_00: It means attackers can now scan for and exploit vulnerabilities, harvest credentials, and adapt to defenses at machine speed.
• 5:08
  SPEAKER_00: The scale and adaptability of these AI-driven attacks are raising the bar for defenders.
• 5:13
  SPEAKER_00: Traditional manual detection and response simply can't keep up.
• 5:18
  SPEAKER_00: Security teams should be considering AI-driven detection and response tools to match the speed and sophistication of these threats.
• 5:26
  SPEAKER_00: If you're not already evaluating or deploying AI-enabled security solutions, it's time to start.
• 5:33
  SPEAKER_00: But it's not just the attackers who are moving quickly with AI.
• 5:37
  SPEAKER_00: Organizations themselves are rapidly integrating AI into business processes, often outpacing the development of robust governance and risk management frameworks.
• 5:48
  SPEAKER_00: New research shows that the adoption of AI technologies is accelerating much faster than the implementation of policies to manage the associated risks.
• 5:59
  SPEAKER_00: This gap exposes organizations to a host of new threats, including data leakage, model manipulation, and a regulatory noncompliance.
• 6:09
  SPEAKER_00: The takeaway for CISOs is that AI governance can't be an afterthought.
• 6:14
  SPEAKER_00: Work with business units to develop clear policies for responsible AI deployment and ensure that risk management keeps pace with innovation.
• 6:22
  SPEAKER_00: This brings us to a broader trend: the global push for digital sovereignty.
• 6:26
  SPEAKER_00: More than half of global and Asia Pacific businesses are seeking greater control over their data, driven in large part by concerns about AI risks and the need to comply with evolving regulatory requirements.
• 6:40
  SPEAKER_00: Organizations are rethinking their cloud strategies, demanding more transparency and control from service providers, and preparing for stricter rules around cross-border data flows.
• 6:51
  SPEAKER_00: For risk leaders, this means reassessing your data governance frameworks, updating policies, and working closely with legal and compliance teams to stay ahead of regulatory changes.
• 7:04
  SPEAKER_00: Digital sovereignty isn't just a compliance issue.
• 7:08
  SPEAKER_00: It's becoming central to how organizations manage risk in a world where data is both an asset and a liability.
• 7:15
  SPEAKER_00: On the technology side, we're also seeing security vendors respond to these new challenges.
• 7:21
  SPEAKER_00: ProofPoint, for example, has expanded its AI-powered investigation tools for Microsoft 360 FIV, giving organizations deeper visibility into insider risk and AI-related activity.
• 7:35
  SPEAKER_00: As AI becomes more integrated into daily business workflows, having the ability to detect anomalous behavior and potential data leakage tied to AI usage is going to be essential.
• 7:47
  SPEAKER_00: These kinds of monitoring tools will play a key role in managing new classes of risk and ensuring ongoing compliance.
• 7:55
  SPEAKER_00: Of course, not all threats are purely technical.
• 7:59
  SPEAKER_00: Social engineering remains a persistent and evolving risk.
• 8:02
  SPEAKER_00: A new attack method called ClickFix is making the rounds using fake CAPTCHA challenges to trick users into installing malware themselves.
• 8:12
  SPEAKER_00: In one recent incident, a compromised HBO Max Reddit account was used to distribute malware via this technique.
• 8:20
  SPEAKER_00: What makes ClickFix particularly dangerous is that it bypasses traditional technical controls by exploiting user trust and behavior.
• 8:28
  SPEAKER_00: The practical implication is that ongoing security awareness training is more important than ever.
• 8:34
  SPEAKER_00: And organizations should also invest in advanced email and web filtering to catch these kinds of attacks before they reach end users.
• 8:42
  SPEAKER_00: Returning to the challenge of protecting Internet Edge devices, the Hong Kong Computer Emergency Response Team has warned that patching alone is no longer sufficient.
• 8:54
  SPEAKER_00: Attackers are using advanced techniques to maintain persistent access and steal credentials even after vulnerabilities have been patched.
• 9:02
  SPEAKER_00: This means organizations need to move beyond a patch and forget mentality.
• 9:08
  SPEAKER_00: Layered defenses, including network segmentation, strong authentication, and continuous monitoring, are now required to protect these high-risk assets.
• 9:18
  SPEAKER_00: If your edge devices aren't being monitored for unusual behavior, you're leaving a critical gap in your defenses.
• 9:25
  SPEAKER_00: Attackers are also getting more creative in abusing native operating system tools.
• 9:29
  SPEAKER_00: There's been a notable uptick in the abuse of the Windows VSS Admin tool, which is being used to extract the NTDS.
• 9:42
  SPEAKER_00: This makes it much harder for organizations to recover from attacks, as both credentials and backup data are being targeted.
• 9:50
  SPEAKER_00: Security teams should be monitoring for the suspicious use of VSS admin and ensuring that backup and recovery strategies are resilient to these kinds of tactics.
• 10:02
  SPEAKER_00: If you're relying on standard backup procedures without additional controls, it's time to reassess.
• 10:08
  SPEAKER_00: Another emerging risk area is AI knowledge distillation, the process of compressing large AI models into smaller, more efficient ones.
• 10:17
  SPEAKER_00: While this can improve performance and reduce costs, it also introduces security risks.
• 10:23
  SPEAKER_00: Poorly managed distillation can lead to model inversion, data leakage, and reduced robustness.
• 10:30
  SPEAKER_00: Organizations deploying distilled AI models need to assess the security implications and put proper controls in place to prevent unintended information disclosure.
• 10:41
  SPEAKER_00: This is a nuanced area, but as AI models become more central to business operations, understanding and mitigating these risks will be increasingly important.
• 10:51
  SPEAKER_00: Let's take a step back and look at the strategic implications of these trends.
• 10:56
  SPEAKER_00: First, the increasing exploitation of zero-day vulnerabilities in core enterprise platforms means that accelerated patch management and improved supply chain security are now essential.
• 11:09
  SPEAKER_00: The old approach of periodic patching simply doesn't cut it when attackers are weaponizing new vulnerabilities within days or even hours of their discovery.
• 11:19
  SPEAKER_00: Second, the rise of AI-driven attacks and the lack of mature AI governance frameworks are creating new risk vectors that traditional controls may not address.
• 11:30
  SPEAKER_00: Organizations need to invest in behavior-based detection, continuous monitoring, and the development of clear policies for AI use.
• 11:39
  SPEAKER_00: This isn't just about keeping up with attackers, it's about ensuring that innovation doesn't outpace risk management.
• 11:46
  SPEAKER_00: Third, the global movement toward digital sovereignty is going to have a profound impact on cloud strategies, cross-border data flows, and regulatory compliance obligations.
• 11:58
  SPEAKER_00: Organizations should be proactive in assessing their data governance frameworks and engaging with vendors to ensure transparency and control over critical data assets.
• 12:10
  SPEAKER_00: Fourth, persistent threats to internet edge devices and the abuse of native OS tools require a shift toward layered behavior-based defenses.
• 12:20
  SPEAKER_00: This means moving beyond just patching and looking at how devices are being used, who is accessing them, and what patterns of behavior might indicate compromise.
• 12:33
  SPEAKER_00: So what matters most today?
• 12:35
  SPEAKER_00: There are three key priorities.
• 12:38
  SPEAKER_00: First, immediate patching and monitoring of VMware, Cisco, and Adobe Commerce or Magento environments are critical to prevent ransomware attacks and data theft.
• 12:50
  SPEAKER_00: Don't wait for a scheduled maintenance window, act now.
• 12:54
  SPEAKER_00: Second, organizations must close the gap between AI adoption and governance.
• 12:59
  SPEAKER_00: This means developing and enforcing policies for responsible AI use, monitoring for AI-related risks, and collaborating across business units to ensure that innovation doesn't create new vulnerabilities.
• 13:15
  SPEAKER_00: Third, data sovereignty and control are becoming central to risk management.
• 13:21
  SPEAKER_00: This requires updated policies, closer scrutiny of cloud and third-party providers, and a proactive approach to regulatory compliance.
• 13:30
  SPEAKER_00: As we wrap up, it's clear that today's cyber and AI risk environment is more complex and fast moving than ever.
• 13:37
  SPEAKER_00: Attackers are exploiting both technical and governance gaps, and the pace of change shows no sign of slowing down.
• 13:45
  SPEAKER_00: For risk leaders, the path forward is clear.
• 13:49
  SPEAKER_00: Strategic investment in security controls, incident response, and cross-functional collaboration will be essential to mitigate the impact of these emerging risks and maintain organizational resilience.
• 14:02
  SPEAKER_00: Stay vigilant, stay informed, and make sure your defenses are evolving as quickly as the threats you face.
• 14:10
  SPEAKER_00: That's it for today's briefing.
• 14:11
  SPEAKER_00: That's a wrap, peeps.
• 14:13
  SPEAKER_00: Stay secure, stay sharp, and don't forget to hug your CISO.