Latest / Daily Cyber Briefing / Daily Cyber & AI Briefing — 2026-09-23

Transcript

Daily Cyber & AI Briefing — 2026-09-23 · Daily Cyber Briefing

• 0:07
  SPEAKER_00: Grab your coffee or Red Bull or whatever your morning vice is, and this is your daily cyber and AI briefing, and I am your host, Michael Hoosh.
• 0:16
  SPEAKER_00: Today's cyber and AI risk landscape is more turbulent than ever, with a surge in critical vulnerabilities and active exploitation across some of the most widely used enterprise platforms.
• 0:27
  SPEAKER_00: We're seeing attackers move faster, exploit zero days more aggressively, and leverage AI in ways that are fundamentally changing the threat environment.
• 0:36
  SPEAKER_00: At the same time, defenders are racing to adopt AI-driven solutions and shore up core controls.
• 0:43
  SPEAKER_00: Let's break down what's happening, why it matters, and what you need to prioritize now.
• 0:48
  SPEAKER_00: Let's start with the vulnerabilities making headlines and causing headaches for security teams worldwide.
• 0:54
  SPEAKER_00: First up, F5's big IP access policy manager, a critical zero-day vulnerability, has been discovered and is being actively exploited in the wild.
• 1:04
  SPEAKER_00: This isn't just a theoretical risk.
• 1:06
  SPEAKER_00: Both F5 and independent researchers have confirmed that attackers are successfully leveraging this flaw for unauthenticated remote code execution on OAuth servers.
• 1:17
  SPEAKER_00: For organizations using big IP, this is a high severity, high impact issue.
• 1:22
  SPEAKER_00: If an attacker can execute code without authentication, they can potentially take full control of the affected system, move laterally within your network, and disrupt critical services.
• 1:32
  SPEAKER_00: And the implications range from data theft and ransomware to service outages and reputational harm.
• 1:38
  SPEAKER_00: The immediate action here is clear.
• 1:40
  SPEAKER_00: Patch exposed big IP instances without delay.
• 1:43
  SPEAKER_00: But don't stop at patching.
• 1:45
  SPEAKER_00: Review your logs for signs of compromise, especially if you've had any externally exposed APM servers.
• 1:51
  SPEAKER_00: This is the kind of vulnerability that can lead to cascading failures if left unchecked, so rapid incident response and thorough forensic review are essential.
• 2:00
  SPEAKER_00: Unfortunately, F5 isn't alone this week.
• 2:03
  SPEAKER_00: Checkpoint's management servers have also been hit with a zero day, and attackers are moving quickly to exploit it.
• 2:10
  SPEAKER_00: This flaw allows arbitrary script execution without authentication, giving adversaries a potential foothold on your perimeter defenses.
• 2:19
  SPEAKER_00: Checkpoint has release patches, but exploitation is ongoing, and the risk is significant, especially for organizations that rely on checkpoint for their primary security gateway.
• 2:29
  SPEAKER_00: If attackers gain privileged access to your management servers, they could potentially pivot deeper into your environment bypassing other controls.
• 2:37
  SPEAKER_00: The takeaway here is similar.
• 2:39
  SPEAKER_00: Prioritize patch deployment, but also conduct a forensic review to ensure you haven't already been compromised.
• 2:46
  SPEAKER_00: Don't assume that patching alone is enough.
• 2:49
  SPEAKER_00: If an attacker already has a presence, you need to root them out before they can escalate further.
• 2:54
  SPEAKER_00: Moving to the endpoint, Google has released a massive update for Chrome, addressing 108 vulnerabilities, several of which are critical code execution flaws.
• 3:04
  SPEAKER_00: Chrome is ubiquitous in enterprise environments, making it a high value target for attackers.
• 3:10
  SPEAKER_00: Unpatched browsers can become the weak link that compromises an entire organization, especially given the prevalence of phishing, drive-by downloads, and malicious extensions.
• 3:20
  SPEAKER_00: The practical implication is straightforward.
• 3:22
  SPEAKER_00: Ensure that Chrome updates are rolled out promptly across all endpoints.
• 3:27
  SPEAKER_00: This is one of those areas where automation can make a huge difference.
• 3:31
  SPEAKER_00: Leverage your endpoint management tools to enforce updates, and don't leave it to end users to patch on their own schedule.
• 3:38
  SPEAKER_00: Now let's talk about the evolving threat of AI-driven malware.
• 3:42
  SPEAKER_00: We're seeing a new generation of malicious code that doesn't just follow a static playbook.
• 3:47
  SPEAKER_00: Instead, it queries AI models in real time to determine its next move.
• 3:51
  SPEAKER_00: This means the malware can adapt to its environment, evade traditional detection, and make context-aware decisions on the fly.
• 3:59
  SPEAKER_00: For defenders, this represents a significant escalation.
• 4:03
  SPEAKER_00: Traditional signature-based detection is less effective against threats that can morph and adapt in real time.
• 4:10
  SPEAKER_00: The implication is clear.
• 4:12
  SPEAKER_00: Behavioral analytics and AI-driven detection are no longer optional.
• 4:16
  SPEAKER_00: Security teams need to invest in solutions that can identify anomalous behavior, not just known malware signatures.
• 4:24
  SPEAKER_00: This also underscores the importance of continuous monitoring and rapid response.
• 4:29
  SPEAKER_00: If you're relying on yesterday's defenses, you're already behind.
• 4:33
  SPEAKER_00: WordPress is another area of concern this week, with two major developments.
• 4:37
  SPEAKER_00: First, a critical vulnerability in WordPress core allows attackers to execute code without authentication.
• 4:45
  SPEAKER_00: Given that WordPress powers a huge share of public-facing websites, this flaw could enable mass exploitation, website defement, or data theft on a large scale.
• 4:57
  SPEAKER_00: Organizations running WordPress, especially those with customized or unpatched installations, should prioritize patching immediately and monitor for signs of compromise.
• 5:09
  SPEAKER_00: Complicating matters, researchers have identified new malware campaigns targeting WordPress sites using must-use plugins and Ethereum-based ether hiding techniques.
• 5:21
  SPEAKER_00: These methods enable persistent backdoor access and make detection and removal much more challenging.
• 5:28
  SPEAKER_00: The use of must-use plugins means the malware can't be easily disabled from the admin dashboard, while Ether hiding leverages decentralized infrastructure to hide malicious payloads.
• 5:40
  SPEAKER_00: This is a sophisticated approach that can keep attackers embedded in your environment for the long haul.
• 5:46
  SPEAKER_00: The best defense here is a combination of regular plugin audits, file integrity monitoring, and a strong patch management process.
• 5:55
  SPEAKER_00: Don't assume that your site is safe just because it's running the latest version.
• 5:59
  SPEAKER_00: Custom plugins and themes can introduce their own risks.
• 6:04
  SPEAKER_00: Shifting gears to mobile threats, there's an active campaign distributing streamwrap malware via fake TV streaming ads.
• 6:12
  SPEAKER_00: These malicious ads are targeting Android users, enabling remote hijacking of devices.
• 6:19
  SPEAKER_00: For organizations with bring your own device policies, this is a reminder that mobile endpoints are a critical part of your attack surface.
• 6:30
  SPEAKER_00: Malvertising isn't new, but the sophistication and reach of these campaigns continue to grow.
• 6:36
  SPEAKER_00: The response should include robust mobile device management, user awareness training, and clear policies around app downloads and ad interactions.
• 6:45
  SPEAKER_00: If you haven't revisited your mobile security posture recently, now is the time.
• 6:50
  SPEAKER_00: Zooming out, expert analysis points to a marked increase in global cyber attacks in 2026.
• 6:57
  SPEAKER_00: The drivers are familiar, geopolitical tensions, the proliferation of ransomware as a service, and the exploitation of emerging technologies.
• 7:07
  SPEAKER_00: But what's different is the pace and scale.
• 7:10
  SPEAKER_00: Attackers are better organized, more automated, and increasingly willing to exploit new vulnerabilities as soon as they emerge.
• 7:18
  SPEAKER_00: This means that continuous risk assessment and adaptive defense strategies are not just best practices, they're necessities.
• 7:26
  SPEAKER_00: Static controls and annual risk reviews are no longer sufficient.
• 7:30
  SPEAKER_00: Security teams need to operate with the assumption that breaches will occur and focus on minimizing impact and accelerating recovery.
• 7:40
  SPEAKER_00: Let's talk about the intersection of AI and compliance, particularly in the tax domain.
• 7:45
  SPEAKER_00: AI adoption and tax compliance is accelerating with organizations using automation to handle sensitive financial data and streamline regulatory processes.
• 7:57
  SPEAKER_00: While this offers efficiency gains, it also introduces new security risks.
• 8:03
  SPEAKER_00: Automated systems become attractive targets and errors or manipulations, whether accidental or malicious, can have serious regulatory and reputational consequences.
• 8:14
  SPEAKER_00: Security leaders need to ensure that AI-driven compliance processes are subject to robust controls and are fully auditable.
• 8:22
  SPEAKER_00: This includes not just technical safeguards, but also clear documentation, regular testing, and independent review.
• 8:30
  SPEAKER_00: The stakes are high.
• 8:31
  SPEAKER_00: Mistakes here can lead to regulatory penalties and loss of trust.
• 8:35
  SPEAKER_00: On the vendor side, Barracuda and Cancom have both launched new AI security solutions aimed at safer AI adoption.
• 8:42
  SPEAKER_00: Barracuda's AI data security solution is targeting small businesses and managed service providers, while Cancom's FlexPod AI is an on-prem turnkey AI stack built with NVIDIA, Cisco, and NetApp.
• 8:56
  SPEAKER_00: These offerings reflect the growing demand for secure AI infrastructure and strong data governance.
• 9:02
  SPEAKER_00: But as organizations evaluate these solutions, due diligence is critical.
• 9:08
  SPEAKER_00: Not all AI security tools are created equal, and integration with existing infrastructure can introduce new risks if not managed properly.
• 9:16
  SPEAKER_00: Evaluate vendors carefully, understand how their solutions fit into your broader security architecture, and ensure that you're not introducing new blind spots in the name of innovation.
• 9:28
  SPEAKER_00: Machine identity management is another area seeing rapid evolution, especially as organizations move more workloads to the cloud and rely on complex supply chains.
• 9:39
  SPEAKER_00: Weaknesses in machine identity, such as unmanaged certificates, keys, or service accounts, can enable lateral movement and supply chain attacks.
• 9:48
  SPEAKER_00: A recent review of machine identity management solutions highlights this as a priority area for investment and process improvement.
• 9:56
  SPEAKER_00: The practical steps here involve inventorying all machine identities, enforcing strong life cycle management, and integrating machine identity controls with your broader access management and monitoring systems.
• 10:10
  SPEAKER_00: As supply chains become more interconnected, a compromise in one area can quickly propagate, so vigilance is key.
• 10:18
  SPEAKER_00: Finally, let's address the human element.
• 10:20
  SPEAKER_00: Security Journey has rolled out AI-focused security training for non-technical staff, recognizing that as AI becomes embedded in business processes, attackers will increasingly target user error and lack of awareness.
• 10:35
  SPEAKER_00: Upskilling the workforce is essential, not just for technical teams, but for everyone who interacts with AI-driven systems.
• 10:42
  SPEAKER_00: This means moving beyond traditional security awareness training and incorporating modules on AI risks, data privacy, and safe use of automation.
• 10:51
  SPEAKER_00: The goal is to build a culture of security that keeps pace with technological change.
• 10:56
  SPEAKER_00: Stepping back, there are a few strategic implications that tie these threads together.
• 11:01
  SPEAKER_00: First, zero-day vulnerabilities in core infrastructure demand rapid detection, patching, and incident response.
• 11:09
  SPEAKER_00: The window between disclosure and exploitation continues to shrink, and organizations that can't move quickly are at heightened risk.
• 11:17
  SPEAKER_00: Second, AI is now both a tool for defenders and a weapon for attackers.
• 11:23
  SPEAKER_00: This duality requires investment in defensive AI, continuous monitoring, and a willingness to adapt as the threat landscape evolves.
• 11:32
  SPEAKER_00: Third, machine identity and supply chain security are emerging as critical control points, particularly in cloud and hybrid environments.
• 11:42
  SPEAKER_00: Investing in these areas can help prevent lateral movement and reduce the risk of cascading failures.
• 11:47
  SPEAKER_00: Fourth, workforce training and AI governance must keep pace with technology adoption.
• 11:54
  SPEAKER_00: Human error remains a leading cause of breaches.
• 11:57
  SPEAKER_00: And as AI systems become more prevalent, the risks associated with misuse or misunderstanding will only grow.
• 12:04
  SPEAKER_00: So what matters most today?
• 12:07
  SPEAKER_00: Patch management is urgent, especially for F5 Big IP, Checkpoint, Chrome, and WordPress.
• 12:14
  SPEAKER_00: These platforms are under active attack, and delays in patching can have immediate and severe consequences.
• 12:21
  SPEAKER_00: AI driven threats are becoming more autonomous and adaptive, challenging traditional security models.
• 12:28
  SPEAKER_00: Security teams need to embrace behavioral analytics and AI driven detection, and be prepared to respond to threats that don't fit established patterns.
• 12:39
  SPEAKER_00: Secure AI adoption requires holistic governance, careful vendor selection, and workforce upskilling.
• 12:46
  SPEAKER_00: Don't let the pressure to innovate outpace your ability to manage risk.
• 12:51
  SPEAKER_00: As we look ahead, the convergence of advanced threats, expanding attack surfaces, and rapid AI-driven change means that a proactive strategic approach is more important than ever.
• 13:04
  SPEAKER_00: Prioritize vulnerability management, invest in AI governance, and make workforce readiness a core part of your security program.
• 13:13
  SPEAKER_00: By doing so, you'll be better positioned to mitigate immediate risk and build long-term resilience in an increasingly complex environment.
• 13:22
  SPEAKER_00: That's the briefing for today.
• 13:25
  SPEAKER_00: Stay vigilant, keep learning, and make security a shared responsibility across your organization.
• 13:32
  SPEAKER_00: That's a wrap, peeps.
• 13:33
  SPEAKER_00: Stay secure, stay sharp, and don't forget to hug your CISO