CyberWire Daily

The Ukraine has experienced a second major outage of its Starshield services reigniting questions about relying on a single private provider for critical national security services.

Host Maria Varmazis sits down Dave Bittner and Brandon Karpf to discuss the recent incident where Ukraine lost Starshield coverage. They explore how the growing role of private satellite companies in warfare creates challenges for establishing operational accountability and impacts US alliances.

Key Sources:

⁠Musk ordered Starlink slowdown that blindsided Ukraine.

Starlink access in Ukraine a decision for Musk, not White House, Rubio says.

Like what you heard? Be sure to subscribe to our free Signals and Space Briefing⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, our Sunday newsletter covering the intersection of cybersecurity and space. Subscribe at: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://thecyberwire.com/newsletters/signals-and-space⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

Is there a topic or person you’d like to hear on our show? You can send your questions and feedback to ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠space@n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠. You can also fill our our audience survey: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.surveymonkey.com/r/NJYCN2P ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

T-Minus: Space-Cyber Briefing is a production of N2K CyberWire. ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠N2K⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ is your nexus for discovery and connection for people, technology, and ideas shaping the future of secure innovation. Learn how at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠n2k.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Today we have Damon Rouse, Threat Intelligence from Lumen's Black Lotus Labs, discussing their work on "The infrastructure quartermaster: inside a China-nexus state enablement model." Black Lotus Labs identified a China-nexus cyber infrastructure provider, dubbed a “quartermaster,” that supplies reconnaissance, proxy routing, and obfuscation services to Chinese cyber espionage actors.

Its interconnected systems, including QScan and Fast Labyrinth, help identify high-value targets, conceal malicious traffic, and support potential exploitation of government, military, research, and critical infrastructure networks. Researchers warn that this shared infrastructure makes traditional IP-based defenses less effective and recommend following CISA and NCSC guidance, reducing external attack surfaces, and keeping routers, firewalls, and IoT devices updated.

The research and executive brief can be found here:

The infrastructure quartermaster: inside a China-nexus state enablement model

Learn more about your ad choices. Visit megaphone.fm/adchoices

Attackers target critical PHP flaws, and former CISA director Chris Krebs weighs in on AI’s role in the vulnerability surge. Railway confirms a cyberattack. HPE patches critical ArubaOS flaws. Quest Diagnostics investigates a disruptive intrusion. Capcom reports a data breach. China-linked hackers put AI-powered attacks on autopilot. And researchers uncover a Microsoft 365 campaign that hijacks authentication tokens to bypass MFA. Our guest is Anudeep Parhar, COO at Entrust, sharing his thoughts on AI kill switches. eMudra throws in the certificate towel.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today, we are joined by Anudeep Parhar, COO at Entrust, sharing his thoughts on "If you need the AI kill switch, it's already too late."

Selected Reading

Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge (SecurityWeek)

426 Android and iOS Apps Linked to PHP2Shell Backend Risks (Hackread)

Chris Krebs on AI discovering cyber vulnerabilities: It'll get worse before it gets better (CNBC)

Developer platform Railway urges 'all users' to revoke secret keys after cyberattack (TechCrunch)

HPE patches eight max severity RCE and auth bypass AOS flaws (Bleeping Computer)

Quest Diagnostics warns of potential data theft after attack on lab service system (The Record)

Gaming Giant Capcom Confirms Data Breach Exposed Users' Personal Information (Infosecurity Magazine)

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks (SecurityWeek)

M365 Token Spray and Replay Campaign Compromises Business Email Accounts (Huntress)

eMudhra to Exit global SSL/TLS Certificate Business (eMudhra)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Amazon spots PHP exploits before disclosure. GitLab patches a critical flaw. Meta faces a $25 billion penalty. Autonomous AI agents power new cyberattacks. Hackers breach a Japanese cloud provider. CyberCartel unleashes AI against Latin American banks. Tor exit nodes are hijacked. OpenAI coding agents disable security monitoring. Interpol dismantles thousands of cybercrime networks across Africa. Our guest is Danny Manimbo, ISO and AI Practice Leader at Schellman, explaining why companies waiting for AI regulatory clarity may already be behind. Spotify hits the skip button on AI slop.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Danny Manimbo, ISO & AI Practice Leader at Schellman, discussing why companies waiting for AI regulatory clarity are already behind. If you enjoyed this conversation, check out the full interview on Caveat.

Selected Reading

Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot (AWS Security Blog)

GitLab warns of new max severity code execution vulnerability (Bleeping Computer)

Meta ordered to pay $25 billion penalty in New Mexico Cambridge Analytica case (CNBC)

CrowdStrike Uncovers New Agentic AI Campaigns (CrowdStrike)

Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected (Bleeping Computer)

CARLIY0S: CyberCartel's AI Attacks on Latin American Banks (Straiker)

333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email (Ars Technica)

Suppressing misalignment monitoring alerts and disabling misalignment monitoring (OpenAI Alignment)

Authorities disrupt nearly 11,000 cybercrime networks in Africa (Bleeping Computer)

One Year In: Putting Human Artistry First on Spotify (Spotify)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Critical PHP flaws threaten millions of websites. Weak certificates from an Indian authority spark a global security scramble. Investigators probe a U.S. consulting executive’s alleged ties to ShinyHunters. SafePay ransomware hits at least 600 critical infrastructure organizations. Researchers find troubling security biases in Chinese AI-generated code. A $10 million initiative bolsters cybersecurity for small U.S. utilities. An American pleads guilty to stealing from thousands of servicemembers and veterans. Leo Scott, Managing Director of DataTribe, is talking about their upcoming Cyber Innovation Conference and the 9th annual DataTribe Challenge. Two pallets of GPUs never make it to baggage claim.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Leo Scott, Managing Director of DataTribe, talking about their upcoming Cyber Innovation Conference and the 9th annual DataTribe Challenge.

Selected Reading

PHP warns it plans to release 2 emergency patches imminently (Ars Technica)

The Internet goes on high alert after discovery of 8 compromised TLS certs (Ars Technica)

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site (Krebs on Security)

SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns (Infosecurity Magazine)

China Defends DeepSeek After US Ban of Its AI From Government Systems (SecurityWeek)

Chinese AI Model Writes More Hackable Code When Told It's for US Contractor (SecurityWeek)

Accenture, Dragos, and SANS Institute Launch Foundation to Strengthen Cyber Defenses for Under-Resourced U.S. Utilities (Dragos)

Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers (CyberScoop)

Nvidia RTX 5090 shipment worth $470,000 goes missing in Brazilian airport — two pallets disappear, distributor seeks explanations but met with zero answers (Tom's Hardware)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices