Latest / Daily Cyber Briefing / Daily Cyber & AI Briefing — 2026-03-23

Transcript

Daily Cyber & AI Briefing — 2026-03-23 · Daily Cyber Briefing

• 0:07
  SPEAKER_00: Grab your coffee or Red Bull or whatever your morning vice is, and this is your daily cyber and AI briefing, and I am your host, Michael Hoosh.
• 0:16
  SPEAKER_00: And welcome back, everyone.
• 0:17
  SPEAKER_00: Today we're looking at the cyber and AI risk landscape as of March 23rd, 2026, a landscape that's growing more complex by the day.
• 0:27
  SPEAKER_00: The convergence of technical threats and governance challenges is creating a perfect storm for organizations across every sector.
• 0:35
  SPEAKER_00: We're seeing a surge in high severity vulnerabilities, active exploitation of critical software platforms, and a rapid expansion of AI deployments that are outpacing the frameworks meant to keep them in check.
• 0:50
  SPEAKER_00: Let's break down what's happening, and more importantly, what it means for security leaders and organizations trying to navigate these turbulent waters.
• 1:00
  SPEAKER_00: We'll start with the technical threats making headlines.
• 1:04
  SPEAKER_00: This week, we've seen a series of high-impact vulnerabilities being actively exploited, affecting some of the most widely used platforms in enterprise and government environments.
• 1:15
  SPEAKER_00: First up is Cisco.
• 1:17
  SPEAKER_00: The Cybersecurity and Infrastructure Security Agency, or CISA, has issued an emergency directive requiring all U.S.
• 1:25
  SPEAKER_00: government agencies to immediately patch a critical vulnerability in Cisco products.
• 1:30
  SPEAKER_00: This flaw has been rated at the highest severity level, and if left unaddressed, could allow remote attackers to take full control of affected devices.
• 1:41
  SPEAKER_00: Given Cisco's widespread presence in both public and private sector networks, this isn't just a government problem.
• 1:48
  SPEAKER_00: It's a wake-up call for any organization relying on Cisco infrastructure.
• 1:53
  SPEAKER_00: What's the practical takeaway here?
• 1:55
  SPEAKER_00: Patch management needs to be at the top of your priority list.
• 1:58
  SPEAKER_00: Security teams should not only apply the latest patches, but also review their exposure to Cisco products across their environments.
• 2:06
  SPEAKER_00: This is about more than compliance.
• 2:08
  SPEAKER_00: It's about preventing potentially catastrophic breaches.
• 2:12
  SPEAKER_00: Moving on to Oracle Identity Manager, Oracle has released an emergency fix for a zero-day vulnerability, specifically a pre-authentication remote code execution flaw.
• 2:24
  SPEAKER_00: This means attackers can compromise identity infrastructure without even needing credentials.
• 2:30
  SPEAKER_00: For organizations using Oracle for access management, the risk is significant.
• 2:36
  SPEAKER_00: Identity systems are the keys to the kingdom.
• 2:38
  SPEAKER_00: If they're compromised, attackers can move laterally and escalate privileges with little resistance.
• 2:45
  SPEAKER_00: The recommendation here is clear.
• 2:47
  SPEAKER_00: Patch immediately and review your identity system logs for any signs of suspicious activity.
• 2:54
  SPEAKER_00: Next, let's talk about Kraft CMS.
• 2:57
  SPEAKER_00: CISA has also issued a warning about a code injection vulnerability in Craft CMS that's being actively exploited.
• 3:05
  SPEAKER_00: Attackers are using this flaw to execute arbitrary code on vulnerable systems.
• 3:10
  SPEAKER_00: Content management systems like Kraft are frequent targets because they often sit at the intersection of business operations and the public internet.
• 3:19
  SPEAKER_00: If you're running Kraft CMS, make sure patches are applied and keep an eye out for unusual system behavior.
• 3:25
  SPEAKER_00: But it's not just about direct exploitation anymore.
• 3:28
  SPEAKER_00: We're seeing attackers increasingly target the supply chain, compromising the very tools organizations use to secure themselves.
• 3:37
  SPEAKER_00: A recent example is the breach of the Trivi Vulnerability Scanner.
• 3:41
  SPEAKER_00: Attackers manage to inject credential stealing scripts into Trivi, turning a security tool into a potential vector for compromise.
• 3:50
  SPEAKER_00: This kind of supply chain attack highlights the importance of verifying the integrity of third-party tools and monitoring them for unexpected changes.
• 4:00
  SPEAKER_00: If you're using Trivi, check your installations and rotate any credentials that may have been exposed.
• 4:06
  SPEAKER_00: Ransomware actors are also upping their game.
• 4:09
  SPEAKER_00: Traditionally, they've relied on exploiting vulnerable drivers to bypass endpoint detection and response, EDR solutions, but now they're expanding their methods, finding new ways to evade detection and disable security controls.
• 4:23
  SPEAKER_00: This means that even organizations with advanced EDR solutions aren't immune.
• 4:28
  SPEAKER_00: Security teams should regularly review EDR configurations, monitor for anomalous behavior, and ensure that defenses are layered.
• 4:36
  SPEAKER_00: Don't rely on a single line of protection.
• 4:39
  SPEAKER_00: E-commerce platforms are another hot target.
• 4:41
  SPEAKER_00: In a recent campaign, cyber criminals managed to infect 7,500 Magento stores with hidden malicious files.
• 4:49
  SPEAKER_00: For those running online storefronts, this is a stark reminder of how quickly mass infections can occur.
• 4:55
  SPEAKER_00: The consequences range from data theft and payment card compromise to serious reputational damage.
• 5:02
  SPEAKER_00: If you're operating a Magento environment, now is the time to audit your systems and implement file integrity monitoring.
• 5:09
  SPEAKER_00: Let's not forget about threats to macOS environments.
• 5:12
  SPEAKER_00: The Mio Lab macOS Stealer has recently expanded its capabilities, adding features like click fix, wallet theft, and abuse of team APIs.
• 5:23
  SPEAKER_00: This increases the risk for organizations handling sensitive credentials or cryptocurrency assets on macOS devices.
• 5:29
  SPEAKER_00: The message here is to reinforce macOS security controls and boost user awareness.
• 5:34
  SPEAKER_00: These threats are evolving fast.
• 5:36
  SPEAKER_00: Now, even after law enforcement action, some cyber criminal services are proving remarkably resilient.
• 5:42
  SPEAKER_00: The Tycoon 2FA service, which provides tools for bypassing multi-factor authentication, remains operational despite recent takedown efforts.
• 5:52
  SPEAKER_00: This persistence demonstrates how robust and distributed cybercrime infrastructure has become.
• 5:57
  SPEAKER_00: For organizations, it's a reminder that adaptive authentication and continuous monitoring for suspicious login attempts are essential.
• 6:06
  SPEAKER_00: Multifactor authentication is still a strong defense, but it's not invulnerable.
• 6:12
  SPEAKER_00: Shifting gears to the AI front, we're witnessing a rapid expansion of AI applications across enterprise environments.
• 6:19
  SPEAKER_00: According to CrowdStrike, there are now 1800 distinct AI apps running on work devices.
• 6:26
  SPEAKER_00: This proliferation of unsanctioned AI tools introduces new risks, data leakage, compliance violations, and loss of control over sensitive information.
• 6:34
  SPEAKER_00: In response, CrowdStrike has introduced new controls to help organizations inventory and manage AI usage.
• 6:42
  SPEAKER_00: For CISOs, this is an urgent call to action.
• 6:44
  SPEAKER_00: You need to know what AI tools are in use across your organization and enforce policies to control their deployment.
• 6:53
  SPEAKER_00: But the challenge doesn't stop at inventory.
• 6:55
  SPEAKER_00: New research from Asaka reveals that over half of digital trust professionals don't know how quickly their organization could shut down AI systems in the event of a security incident.
• 7:07
  SPEAKER_00: This is a significant gap in incident response planning.
• 7:10
  SPEAKER_00: As AI becomes more deeply embedded in business processes, organizations must develop clear governance frameworks and operational playbooks for disabling AI systems when necessary.
• 7:21
  SPEAKER_00: Looking ahead, Gartner predicts that by 2028, AI will drive half of all cybersecurity incident response activities.
• 7:29
  SPEAKER_00: This is both an opportunity and a challenge.
• 7:32
  SPEAKER_00: On one hand, AI can help automate and accelerate response efforts, but on the other, it introduces new risks around transparency and oversight.
• 7:42
  SPEAKER_00: Organizations will need to invest in AI-driven security operations while maintaining human oversight and ensuring that automated decision making is transparent and auditable.
• 7:53
  SPEAKER_00: We're also seeing early signs of formalized AI governance frameworks.
• 7:58
  SPEAKER_00: Singapore-based WPH Digital has become one of the first companies in Asia to achieve ISO IEC 42001 2023 certification for AI governance.
• 8:09
  SPEAKER_00: This milestone sets a precedent, particularly for regulated industries like oil and gas and signals a shift toward increased regulatory scrutiny.
• 8:17
  SPEAKER_00: For organizations deploying AI at scale, aligning with emerging standards will become increasingly important, not just for compliance, but for building trust with customers and stakeholders.
• 8:29
  SPEAKER_00: Let's take a step back and look at the strategic implications of these developments.
• 8:34
  SPEAKER_00: First, patch management and vulnerability response must be accelerated.
• 8:38
  SPEAKER_00: The window between disclosure of a vulnerability and active exploitation is shrinking.
• 8:44
  SPEAKER_00: Zero days and actively exploited flaws in core infrastructure like Cisco, Oracle, and Craft CMS require immediate attention.
• 8:53
  SPEAKER_00: Delays in patching can have severe consequences, including data breaches, operational disruptions, and regulatory penalties.
• 9:01
  SPEAKER_00: Second, AI governance and incident response capabilities are lagging behind the pace of deployment.
• 9:07
  SPEAKER_00: Organizations are rolling out AI solutions at scale, but the frameworks for managing and securing these systems are still catching up.
• 9:15
  SPEAKER_00: This creates operational and compliance risks that can't be ignored.
• 9:19
  SPEAKER_00: Security and risk leaders need to work closely with business units and IT teams to develop policies, procedures, and technical controls for AI systems before an incident occurs.
• 9:32
  SPEAKER_00: Third, supply chain attacks are on the rise, targeting not just traditional software, but also security tools and platforms.
• 9:40
  SPEAKER_00: The compromise of the TRIVI vulnerability scanner is a case in point.
• 9:45
  SPEAKER_00: Organizations must enhance their integrity monitoring and vendor risk management processes.
• 9:50
  SPEAKER_00: This means verifying the authenticity of software updates, monitoring for unexpected changes, and maintaining an up-to-date inventory of all third-party tools in use.
• 10:01
  SPEAKER_00: Fourth, the resilience of cyber criminal infrastructure, like Tycoon 2FA, and the evolution of attacker tactics demand continuous adaptation of security controls.
• 10:13
  SPEAKER_00: Attackers are quick to pivot and develop new methods when old ones are disrupted.
• 10:17
  SPEAKER_00: Security teams need to stay informed about emerging threats, update their defenses regularly, and foster a culture of continuous improvement.
• 10:26
  SPEAKER_00: So, what matters most today?
• 10:29
  SPEAKER_00: There are three key actions that organizations should prioritize.
• 10:33
  SPEAKER_00: First, immediate action is required to patch critical vulnerabilities in Cisco, Oracle Identity Manager, and Craft CMS.
• 10:43
  SPEAKER_00: These are not theoretical risks, they are being actively exploited right now.
• 10:47
  SPEAKER_00: Delaying patching increases the likelihood of compromise.
• 10:51
  SPEAKER_00: Second, organizations must assess and control the proliferation of AI applications on enterprise devices.
• 10:58
  SPEAKER_00: This isn't just an IT issue, it's a business risk.
• 11:02
  SPEAKER_00: Data leakage, compliance violations, and loss of intellectual property are all on the table if AI usage isn't properly managed.
• 11:10
  SPEAKER_00: Third, incident response plans should be updated to include rapid shutdown and containment procedures for AI systems.
• 11:17
  SPEAKER_00: As AI becomes more integrated into business operations, the ability to quickly disable or isolate these systems during a security incident will be critical.
• 11:27
  SPEAKER_00: Let's briefly revisit some of the specific incidents and what they teach us.
• 11:32
  SPEAKER_00: The Cisco Vulnerability and CES Emergency Directive highlight the importance of timely patching and the risks associated with widely deployed infrastructure.
• 11:42
  SPEAKER_00: The Oracle Identity Manager flaw underscores the criticality of identity systems and the need for vigilant monitoring.
• 11:49
  SPEAKER_00: The Kraft CMS code injection issue is a reminder that web-facing platforms are prime targets and require continuous oversight.
• 11:58
  SPEAKER_00: The breach of the TRIVI vulnerability scanner shows that even security tools can be turned against us, emphasizing the need for supply chain vigilance.
• 12:06
  SPEAKER_00: The evolution of ransomware tactics demonstrates that attackers are not standing still.
• 12:11
  SPEAKER_00: They're finding new ways to bypass defenses.
• 12:15
  SPEAKER_00: The mass infection of Magento stores illustrates how quickly attackers can scale their operations and the importance of proactive monitoring.
• 12:23
  SPEAKER_00: On the AI side, the rapid adoption of unsanctioned AI tools is creating new blind spots for organizations.
• 12:31
  SPEAKER_00: The lack of clarity around incident response for AI systems is a governance gap that needs to be closed.
• 12:38
  SPEAKER_00: The prediction that AI will drive half of incident response activities by 2028 is a sign of things to come.
• 12:45
  SPEAKER_00: Automation will be essential, but it must be implemented responsibly.
• 12:49
  SPEAKER_00: The achievement of ESO EC for 2001-2023 certification by WPH Digital is an early indicator of where the industry is headed.
• 12:59
  SPEAKER_00: Formalized governance frameworks for AI are coming, and organizations that get ahead of the curve will be better positioned to manage risk and demonstrate accountability.
• 13:10
  SPEAKER_00: So, what are the practical steps organizations can take right now?
• 13:14
  SPEAKER_00: Start by conducting a comprehensive review of your patch management processes.
• 13:19
  SPEAKER_00: Identify any gaps and ensure that critical vulnerabilities, especially those in Cisco, Oracle, and Craft CMS, are addressed without delay.
• 13:29
  SPEAKER_00: Next, inventory all AI applications running on enterprise devices.
• 13:33
  SPEAKER_00: Work with business units to understand how these tools are being used, assess the risks, and enforce policies to control deployment.
• 13:41
  SPEAKER_00: This may involve restricting access to unsanctioned AI tools or implementing data loss prevention measures.
• 13:48
  SPEAKER_00: Review your incident response plans with a focus on AI systems.
• 13:52
  SPEAKER_00: Develop clear procedures for rapidly disabling or isolating AI applications in the event of a security incident.
• 13:59
  SPEAKER_00: Train your teams on these procedures and conduct regular tabletop exercises to ensure readiness.
• 14:07
  SPEAKER_00: Strengthen your supply chain risk management processes.
• 14:11
  SPEAKER_00: Verify the integrity of third-party tools, monitor for unexpected changes, and maintain an up-to-date inventory of all software in use.
• 14:21
  SPEAKER_00: Engage with vendors to understand their security practices and request transparency around their own supply chain controls.
• 14:29
  SPEAKER_00: Finally, stay informed about emerging threats and evolving attacker tactics.
• 14:34
  SPEAKER_00: Foster a culture of continuous improvement within your security team.
• 14:38
  SPEAKER_00: Encourage information sharing, invest in threat intelligence, and be prepared to adapt your defenses as the landscape changes.
• 14:45
  SPEAKER_00: Before we wrap up, let's acknowledge that the pace and complexity of change in the cyber and AI risk landscape can feel overwhelming.
• 14:54
  SPEAKER_00: But with a proactive, holistic approach, one that combines technical controls, governance frameworks, and continuous adaptation, organizations can manage risk effectively.
• 15:06
  SPEAKER_00: That's it for today's briefing.
• 15:08
  SPEAKER_00: Stay vigilant, stay informed, and keep security at the forefront of your organization's strategy.
• 15:14
  SPEAKER_00: Thanks for listening, and I'll talk to you next time.
• 15:16
  SPEAKER_00: That's a wrap, peeps.
• 15:18
  SPEAKER_00: Stay secure, stay sharp, and don't forget to hug your CISO.