Latest / Daily Cyber Briefing / Daily Cyber & AI Briefing — 2026-09-18

Transcript

Daily Cyber & AI Briefing — 2026-09-18 · Daily Cyber Briefing

• 0:07
  SPEAKER_00: Grab your coffee or Red Bull or whatever your morning vice is, and this is your daily cyber and AI briefing, and I am your host, Michael Hoosh.
• 0:16
  SPEAKER_00: Today's cyber and AI risk landscape is marked by a surge in critical vulnerabilities, active exploitation, and a rapidly evolving regulatory environment.
• 0:27
  SPEAKER_00: Security leaders are being tested on multiple fronts, from urgent patch management to the governance of shadow AI, and from defending against sophisticated supply chain attacks to anticipating the next wave of AI-driven threats.
• 0:43
  SPEAKER_00: Let's break down the key developments shaping today's risk environment, explore their practical implications, and consider what security leaders need to prioritize right now.
• 0:55
  SPEAKER_00: Let's start with the wave of critical vulnerabilities impacting some of the most widely deployed enterprise security products.
• 1:05
  SPEAKER_00: Over the past 24 hours, vendors, including Cisco, Checkpoint, Kaspersky, and Tanium, have all issued urgent patches for flaws that in many cases are already being exploited in the wild.
• 1:19
  SPEAKER_00: Cisco's Identity Services Engine, or ISE, is a particular concern, with active attacks targeting environments that haven't yet applied the latest fix.
• 1:30
  SPEAKER_00: Checkpoint, Kaspersky, and Tanium have addressed vulnerabilities that open the door to remote code execution or privilege escalation, attackers' favorite footholds for lateral movement or data theft.
• 1:44
  SPEAKER_00: For organizations running these products, the message is clear.
• 1:48
  SPEAKER_00: Immediate patch deployment is non-negotiable, but it doesn't stop there.
• 1:52
  SPEAKER_00: Environments with complex or distributed infrastructure, think hybrid cloud, multiple branch offices, or remote workforces face additional challenges.
• 2:03
  SPEAKER_00: Patching at scale requires coordination, testing, and sometimes downtime, but the risk of delay is now demonstrably higher.
• 2:11
  SPEAKER_00: Attackers are moving quickly to reverse engineer patches and weaponize exploits often within hours of disclosure.
• 2:20
  SPEAKER_00: That means continuous monitoring for exploitation attempts is just as critical as the patching itself.
• 2:26
  SPEAKER_00: Watch for unusual authentication attempts, privilege escalations, or unexpected outbound traffic.
• 2:34
  SPEAKER_00: These are often the first signs that a vulnerability is being targeted, shifting focus to network infrastructure.
• 2:41
  SPEAKER_00: MicroTIC routers are under active attack, with hackers exploiting vulnerabilities that allow unauthenticated takeover of devices.
• 2:50
  SPEAKER_00: This is particularly worrisome because micro tick hardware is popular in both enterprise and service provider environments.
• 2:58
  SPEAKER_00: Once compromised, these routers can be conscripted into botnets used as launch pads for lateral movement, or serve as persistent footholds for further compromise.
• 3:09
  SPEAKER_00: The fact that attackers don't even need credentials to take control amplifies the urgency.
• 3:15
  SPEAKER_00: Organizations using micro tick should prioritize patching, review their network segmentation to limit the blast radius of a potential breach, and monitor for unusual outbound connections that might indicate a device has been hijacked.
• 3:32
  SPEAKER_00: Fortinet's FortyGate appliances are also in the spotlight with news that a so-called one-day vulnerability, meaning a flaw that's just been patched but is not yet widely remediated, is being sold on underground forums.
• 3:49
  SPEAKER_00: FortyGate devices are a backbone of security infrastructure for many enterprises, providing firewall and VPN services.
• 3:58
  SPEAKER_00: The sale of this exploit on criminal marketplaces suggests that widespread attacks could be imminent.
• 4:04
  SPEAKER_00: Security teams should be monitoring vendor advisories closely, applying patches as soon as they become available, and reviewing firewall and VPN logs for any signs of suspicious activity.
• 4:18
  SPEAKER_00: This is a classic example of the shrinking window between vulnerability disclosure and exploitation, and it reinforces the need for rapid automated patch management wherever possible.
• 4:31
  SPEAKER_00: Now let's talk about the human element, specifically the rise of shadow AI in the enterprise.
• 4:37
  SPEAKER_00: A new report finds that 67% of employees are using unapproved AI tools at work.
• 4:44
  SPEAKER_00: That's two out of every three workers bypassing official channels to leverage generative AI, coding assistance, or other productivity tools.
• 4:53
  SPEAKER_00: While the intent may be to boost efficiency, the risks are significant.
• 4:58
  SPEAKER_00: Data leakage, compliance violations, and the introduction of unmonitored, potentially insecure applications into the environment.
• 5:06
  SPEAKER_00: For CISOs, this is a wake-up call.
• 5:08
  SPEAKER_00: AI governance policies can't be theoretical.
• 5:11
  SPEAKER_00: They need to be rolled out, communicated, and enforced.
• 5:15
  SPEAKER_00: This means increasing user awareness about the risks of unauthorized AI use, deploying monitoring tools to detect shadow AI activity, and working with business units to provide secure approved alternatives that meet employees' needs without compromising the organization's risk posture.
• 5:34
  SPEAKER_00: The supply chain threat landscape is also evolving, with attackers targeting code repositories and exploiting SaaS integrations in new ways.
• 5:43
  SPEAKER_00: One novel attack, dubbed the shy hulued worm, is hijacking AI coding assistant sessions to compromise SaaS code repositories.
• 5:52
  SPEAKER_00: This is a significant supply chain risk because compromised code can propagate downstream to customers and partners, multiplying the impact.
• 6:00
  SPEAKER_00: Security leaders should review their SaaS access controls, enforce multi-factor authentication for critical development tools, and monitor for anomalous activity within code repositories.
• 6:12
  SPEAKER_00: The lesson here is that the supply chain is only as strong as its weakest link, and attackers are increasingly targeting the tools and integrations that developers rely on every day.
• 6:23
  SPEAKER_00: The risks of third-party integrations are further highlighted by a large-scale supply chain attack involving Bravo widgets.
• 6:30
  SPEAKER_00: Attackers have turned these widgets into a malware delivery channel, impacting over 100,000 websites.
• 6:38
  SPEAKER_00: This demonstrates the inherent risk of embedding third-party scripts and components into web applications.
• 6:45
  SPEAKER_00: Organizations should maintain an up-to-date inventory of all third-party scripts, implement content security policies to limit the execution of untrusted code, and be prepared to respond quickly to widespread web-based compromises.
• 6:59
  SPEAKER_00: The scale of this attack serves as a reminder that even trusted vendors can become vectors for malware delivery if their supply chain is compromised.
• 7:09
  SPEAKER_00: Turning to the consumer and enterprise malware front, the Movie Reaper malware campaign is spreading through pirated movie torrents and using the Solana blockchain for command and control.
• 7:21
  SPEAKER_00: This is an example of attackers leveraging decentralized technologies to evade takedown efforts.
• 7:28
  SPEAKER_00: By using the blockchain, they make it much harder for defenders to disrupt their infrastructure.
• 7:34
  SPEAKER_00: Movie Reaper targets both individuals and organizations, potentially leading to ransomware infections or data theft.
• 7:42
  SPEAKER_00: Security teams should block access to known malicious torrent sources and monitor for unusual network activity related to blockchain transactions.
• 7:52
  SPEAKER_00: And the use of popular blockchains for command and control is likely to become more common, so defenders need to adapt their detection strategies accordingly.
• 8:01
  SPEAKER_00: As AI adoption accelerates, organizations are scrambling to secure and manage their AI fleets.
• 8:07
  SPEAKER_00: A growing ecosystem of governance tools is emerging to help with this challenge, but the regulatory environment remains fragmented.
• 8:16
  SPEAKER_00: Some governments are shelving AI legislation, while others, China, for example, are framing AI as a security threat rather than an existential risk.
• 8:26
  SPEAKER_00: This divergence creates uncertainty for security executives who must ensure their governance frameworks are both robust and adaptable.
• 8:35
  SPEAKER_00: Staying abreast of evolving best practices and regulatory expectations is essential.
• 8:41
  SPEAKER_00: This means regularly reviewing and updating AI governance policies, engaging with industry groups and regulators, and ensuring that governance tools are flexible enough to accommodate new requirements as they emerge.
• 8:54
  SPEAKER_00: On the policy front, the U.S.
• 8:56
  SPEAKER_00: Cybersecurity and Infrastructure Security Agency, or SISA, has released new guidance on the use of decoys, sometimes called deception technologies in cyber defense.
• 9:07
  SPEAKER_00: At the same time, policymakers are debating whether nuclear-style safeguards should be applied to AI, reflecting growing concern over the potential for catastrophic misuse.
• 9:19
  SPEAKER_00: For CISOs, this is a signal to evaluate the applicability of deception technologies within their own environments and to prepare for potential regulatory shifts in AI oversight.
• 9:32
  SPEAKER_00: Deception can be a valuable tool for detecting and slowing attackers, but it requires careful planning and integration with existing detection and response processes.
• 9:43
  SPEAKER_00: A recent analysis from Unit 42 highlights the complex relationship between identity management, cloud harnesses, and supply chain security.
• 9:52
  SPEAKER_00: The report emphasizes the uncomfortable space where vulnerabilities can be exploited, often at the intersection of identity and cloud infrastructure.
• 10:02
  SPEAKER_00: Security leaders should prioritize identity governance, review cloud access policies, and assess supply chain dependencies for potential weak points.
• 10:12
  SPEAKER_00: The takeaway is that identity is increasingly the new perimeter, and attackers are adept at finding and exploiting gaps in identity and access management.
• 10:22
  SPEAKER_00: Zooming out the convergence of AI and cyber operations is accelerating.
• 10:27
  SPEAKER_00: Both attackers and defenders are leveraging AI for automation, reconnaissance, and exploitation.
• 10:34
  SPEAKER_00: For defenders, this means investing in AI-enabled security tools that can keep pace with adversarial capabilities.
• 10:42
  SPEAKER_00: It also requires ongoing staff training to ensure that teams can effectively use these tools and adapt to new tactics.
• 10:50
  SPEAKER_00: The bar for defensive innovation is rising, and organizations that fail to keep up risk being outmaneuvered by more agile, AI-powered adversaries.
• 11:00
  SPEAKER_00: Let's take a step back and consider the strategic implications of these developments.
• 11:05
  SPEAKER_00: First, patch management and vulnerability response must be accelerated, especially for widely deployed security infrastructure.
• 11:13
  SPEAKER_00: The window between disclosure and the exploitation is shrinking, and attackers are increasingly targeting security products themselves as a means of gaining privileged access.
• 11:23
  SPEAKER_00: Second, shadow AI and unapproved tool usage represent a growing insider and data governance risk.
• 11:32
  SPEAKER_00: Proactive monitoring and policy enforcement are essential, not just to prevent data leakage, but to maintain compliance with evolving regulations.
• 11:41
  SPEAKER_00: Third, supply chain and SaaS compromise risks are escalating.
• 11:46
  SPEAKER_00: Organizations need to enhance third party risk management, implement code integrity controls, and maintain visibility into the security posture of all vendors and integrations.
• 11:57
  SPEAKER_00: Fourth, the regulatory landscape for AI is in flux.
• 12:02
  SPEAKER_00: Organizations must build adaptable governance frameworks and monitor for new compliance requirements.
• 12:07
  SPEAKER_00: This means engaging with legal and compliance teams, staying informed about legislative developments, and ensuring that AI deployments can be adjusted quickly in response to new rules.
• 12:17
  SPEAKER_00: So, what matters most today?
• 12:20
  SPEAKER_00: First and foremost, immediate patching and monitoring for Cisco, Checkpoint, Kaspersky, Tanium, MicroTick, and Fortinet vulnerabilities is critical.
• 12:30
  SPEAKER_00: These are high value targets for attackers and delays in remediation can have cascading consequences.
• 12:37
  SPEAKER_00: Second, shadow AI usage and supply chain attacks are exposing organizations to unmonitored risk.
• 12:45
  SPEAKER_00: Governance and monitoring must keep pace with the speed of innovation and the creativity of attackers.
• 12:51
  SPEAKER_00: Third, the convergence of AI and cyber capabilities is reshaping both the threat landscape and defensive priorities.
• 12:59
  SPEAKER_00: Security leaders must invest in AI-driven defense, continuous staff training, and adaptable governance frameworks.
• 13:07
  SPEAKER_00: Let's drill down a bit further on some of these points, starting with patch management.
• 13:12
  SPEAKER_00: The reality is that patching remains one of the most effective defenses against both opportunistic and targeted attacks.
• 13:20
  SPEAKER_00: But it's also one of the most challenging, especially in large distributed environments.
• 13:26
  SPEAKER_00: Automation can help.
• 13:28
  SPEAKER_00: But it's not a silver bullet.
• 13:30
  SPEAKER_00: Organizations need processes for rapid assessment of new vulnerabilities, prioritization based on risk, and coordinated deployment across all affected systems.
• 13:41
  SPEAKER_00: This is particularly important for security products themselves, which are often granted elevated privileges and broad network access.
• 13:49
  SPEAKER_00: When it comes to shadow AI, the challenge is as much cultural as it is technical.
• 13:54
  SPEAKER_00: Employees are turning to AI tools to solve real business problems, often because official solutions are too slow or cumbersome.
• 14:03
  SPEAKER_00: Security leaders need to balance the need for innovation with the imperative to protect data and maintain compliance.
• 14:12
  SPEAKER_00: This means engaging with business units, understanding their needs, and providing secure, approved alternatives.
• 14:19
  SPEAKER_00: It also means deploying monitoring tools that can detect unauthorized AI usage without creating a culture of surveillance or mistrust.
• 14:28
  SPEAKER_00: Supply chain risk is another area where attackers are innovating.
• 14:32
  SPEAKER_00: The shy hulud worm and Bravo widget attacks demonstrate that the supply chain is now a primary target, not just an indirect risk.
• 14:42
  SPEAKER_00: Organizations need to maintain an up-to-date inventory of all third party components, continuously monitor for changes or anomalies, and have plans in place for rapid response if a compromise is detected.
• 14:57
  SPEAKER_00: This includes not just technical controls, but also contractual requirements for vendors and clear communication channels for incident response.
• 15:08
  SPEAKER_00: On the regulatory front, uncertainty is the only constant.
• 15:12
  SPEAKER_00: Some regions are moving quickly to regulate AI, while others are taking a wait and see approach.
• 15:19
  SPEAKER_00: Security leaders need to build governance frameworks that are both robust and flexible, able to meet today's requirements while adapting to tomorrow's changes.
• 15:29
  SPEAKER_00: This may involve regular policy reviews, scenario planning, and engagement with industry groups to stay ahead of the curve.
• 15:36
  SPEAKER_00: The intersection of identity, cloud, and supply chain security is a particularly challenging space.
• 15:43
  SPEAKER_00: Attackers are looking for weak links, misconfigured cloud harnesses, overprivileged accounts, or unmonitored integrations.
• 15:52
  SPEAKER_00: Organizations need to adopt a zero trust mindset where identity is verified continuously and access is granted on a least privileged basis.
• 16:02
  SPEAKER_00: Regular audits, automated policy enforcement, and continuous monitoring are key components of an effective identity governance strategy.
• 16:11
  SPEAKER_00: Finally, the convergence of AI and cyber operations is raising the stakes for both attackers and defenders.
• 16:17
  SPEAKER_00: AI is being used to automate reconnaissance, identify vulnerabilities, and even craft convincing phishing campaigns.
• 16:26
  SPEAKER_00: Defenders need to respond in kind, leveraging AI for threat detection, incident response, and continuous improvement of security posture.
• 16:35
  SPEAKER_00: This requires not just investment in technology, but also ongoing training and development for security teams.
• 16:43
  SPEAKER_00: In summary, today's risk environment demands a holistic approach.
• 16:48
  SPEAKER_00: Security leaders must accelerate patch management, enforce robust AI governance, and stay vigilant against supply chain and SaaS compromise.
• 16:57
  SPEAKER_00: They must anticipate regulatory shifts and adapt to the growing convergence of AI and cyber risk.
• 17:04
  SPEAKER_00: The organizations that succeed will be those that balance technical controls, policy enforcement, and strategic alignment with an ever-changing threat and regulatory landscape.
• 17:17
  SPEAKER_00: That's today's briefing.
• 17:18
  SPEAKER_00: Stay vigilant, stay adaptable, and keep security at the center of your strategy.
• 17:23
  SPEAKER_00: That's a wrap, peeps.
• 17:25
  SPEAKER_00: Stay secure, stay sharp, and don't forget to hug your CISO.