Cybersecurity Today

Host David Shipley covers multiple cyber stories: Florida confirmed criminals breached its DMV using credentials from a Plant City police officer that were improperly stored on a personal device; ShinyHunters claimed responsibility and the full scope remains unknown.

IDScan also confirmed attackers accessed customer data in its cloud, involving over 153 million U.S. driver's license scans and 1.1 million Canadian scans, contributing to more than 160 million North American license records stolen this year. 
A report says state governments lack money, staffing, and training to defend critical infrastructure as Iran-linked attacks hit water utilities. 

Researchers traced OpenAI agents uploading over 2,000 malicious RubyGems packages. Anthropic's threat report describes AI-enabled criminal and nation-state operations, including ShinyHunters and Russia's Midnight Blizzard. 

Finally, a new DOT rule will classify cyberattack-related flight disruptions as "not controllable," reducing passenger compensation despite compliance requirements.
00:00 Headlines Preview
00:35 Florida DMV Breach
01:14 IDScan Mega Leak
02:52 States Lack Cyber Resources
04:31 OpenAI Agents Malware Flood
06:28 Anthropic AI Espionage
08:13 Regulate Weaponized AI
08:53 Airlines Compliance Trap
11:10 Wrap Up And Sign Off

Defender Patch Broken in 24 Hours, AI Agents Hit Papercut Servers, FTC Rolls Back Health App Breach Rules
Microsoft patched a Defender zero day, but a day later researcher Nightmare Eclipse released "ShieldCrash," a new exploit that bypasses the ShieldBreak fix, itself a bypass of an earlier Defender flaw, with a proof of concept working on fully patched Windows 10, 11, and Server to enable arbitrary file reads as SYSTEM.
Researchers also tied recent Papercut print server compromises to a suspected Russian-speaking criminal who used hundreds of AI agents (OpenAI Codex and a DeepSeek model) plus tools like Mimikatz and Impacket to rapidly attack 440 servers across 395 organizations in 48 countries, heavily impacting schools and achieving domain admin in 12 cases.
The FTC rescinded a 2021 policy applying breach notification rules to health apps and connected devices.
Veradigm reported stolen customer data via a vendor compromise, while a ransomware gang claimed 3.5 million patient records.
Fortinet went 92 days without a new critical advisory before disclosing two new critical bugs.
Host David Shipley marks the 25th anniversary of 9/11.
00:00 Headlines Teaser
00:32 Defender Patch Bypass
02:47 AI Agents Hit Papercut
04:45 FTC Rolls Back Rules
06:17 Veradigm Breach Fallout
07:41 FortiWatch Quarter Win
09:12 9 11 Reflection Closing

Microsoft's Record 966-Fix Patch Tuesday, Liquid Network Bitcoin Returned (Mostly), and Five Eyes' Back-to-Basics Warning
Cybersecurity Today host David Shipley reports Microsoft's largest Patch Tuesday ever with 966 vulnerability fixes (plus 204 earlier cloud-service fixes), including 105 critical issues, two actively exploited Windows zero-days, and a surge tied to AI-assisted bug discovery—raising defenders' triage and testing burden. 
The episode also covers a Liquid network theft of nearly 4,000 Bitcoin enabled by an Elements software bug; attackers publicly negotiated on-chain, returned 3,400 BTC after fixes and patching, but kept 598.5 BTC, prompting debate over "white hat" claims versus extortion or laundering. 
At the Billington Cybersecurity Summit, Five Eyes leaders stress fundamentals like identity management, monitoring, hygiene, and MFA over AI hype, while noting AI boosts both defenders and criminals. 
Finally, Germany's Stadtwerk Landsberg utility reports a cyberattack encrypting central IT, amid wider German infrastructure tensions and new intelligence powers.
00:00 Headlines Overview
00:26 Microsoft Patch Tuesday Record
02:50 Liquid Network Bitcoin Heist
03:43 White Hat Or Extortion
04:39 Five Eyes Security Basics
05:43 AI Boosts Defenders And Attackers
06:09 Germany Utility Ransomware
07:58 Wrap Up And Sign Off

Identity verification firm IDScan faces multiple lawsuits and investigations after hackers allegedly breached it. The criminals offered over 153 million U.S. and Canadian driver's license scans for sale.
Nightmare Eclipse releases FalconFlank, a zero-day privilege escalation that abuses CrowdStrike's Falcon alongside other zero-days targeting Kaspersky, Avast, and Nvidia.
Sansec disclosed an unpatched Magento/Adobe Commerce flaw "Style Smuggler" enabling unauthenticated code execution.
Arctic Wolf observed active exploitation of PaperCut authentication bypass and RCE flaws against schools, including credential theft and lateral-movement prep.
UK police data shows reported losses from hacked accounts rose 417% amid improved reporting via the new Report Fraud system.
00:00 Top Headlines
00:31 IDScan Breach Lawsuits
03:13 FalconFlank Zero Day
05:02 Security Tools Weaponized
05:48 Magento Style Smuggler
08:59 Papercut Attacks Schools
11:02 UK Account Hack Losses
13:57 Wrap Up and Sign Off

Katie Moussouris on AI's Vulnerability Deluge, Bug Bounties, and Smart Regulation
In this Cybersecurity Today on the Weekend feature interview, host David Shipley interviews cybersecurity entrepreneur and long-time hacker Katie Moussouris about today's surge in AI-driven vulnerability discovery and the growing strain on disclosure and patching ecosystems.
Drawing on her experience building Microsoft's vulnerability research and first bug bounty program and launching Hack the Pentagon, Moussouris argues the hard, expensive work is triage, context, and prioritization, now amplified as vendors ship far more patches and organizations struggle to keep up without strong asset inventory, preparedness, and Zero Trust progress. 
She warns AI model capabilities are outpacing monitoring and containment, especially with open-weight models, and says regulation should focus on requirements like real-time monitoring without harming defenders.
The conversation also covers the reemergence of the old tool-access debates, Microsoft's clash with researcher "Nightmare Eclipse," the rise-and-fall of "security civilizations," Luta Security's work improving internal maturity, concerns about shrinking entry-level talent pipelines, and a closing call to consider universal basic income as part of our strategy to deal with AI's impact on the world.
00:00 Weekend Show Intro
00:07 Katie Moussouris Background
02:00 Bug Bounties Then and Now
03:31 AI Hype and Model Escapes
05:06 The Real Cost of Fixing
08:36 Smart AI Regulation
12:34 Tools for Defenders vs Rogues
15:53 Metasploit and Agentic Risk
17:25 Nightmare Eclipse and Microsoft
21:53 Luta Security Today
24:28 Training the Next Generation
27:46 Hope, UBI, and Wrap Up