CyberWire Daily

Today we are joined by ⁠Subhajeet Singha⁠, Senior Security Researcher at ⁠Acronis⁠ Threat Research Unit, discussing their work on "Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit." A Chinese-speaking threat actor tracked as Red Heron exploited a critical Gitea remote code execution vulnerability, CVE-2026-60004, within days of its public disclosure, compromising organizations across five countries and stealing source code, credentials, and sensitive infrastructure data.

The campaign involved deploying persistent backdoors and a newly identified Linux implant called JITTERLY, which contains an undocumented rootkit, SIXZUT, capable of hiding files, processes, and network connections while protecting the malware from removal. Acronis assesses with moderate confidence that Red Heron operates within a PRC-linked context, highlighting how quickly attackers can weaponize newly disclosed vulnerabilities and turn exposed development platforms into gateways for broader network compromise.

The research and executive brief can be found here:

⁠⁠⁠⁠Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit⁠

Learn more about your ad choices. Visit megaphone.fm/adchoices

Binance suffers a record-breaking cryptocurrency heist. Attackers exploit a critical GitLab flaw. Russian disinformation targets U.S. elections. Treasury sanctions North Korean IT worker operations. A cyberattack halts Polymarket trading. GCHQ loses track of thousands of storage devices. An abandoned Mac app leaves security risks behind. Japan Airlines reports a third-party breach. An AI-powered command-and-control framework emerges in the wild. Our guest is Josh Devon, Co-founder & CEO of Sondera, winner of the 9th annual DataTribe Challenge. We bid farewell to the captain who inspired a generation of innovators.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today Josh Devon, Co-founder & CEO of Sondera and winner of the 9th annual DataTribe Challenge, is discussing their win.

Selected Reading

CISA says max severity GitLab flaw now exploited in the wild (Bleeping Computer)

Covert Russian Group Targets James Talarico With Baseless Claims in Texas Senate Race (The New York Times)

US sanctions Russians, North Koreans for laundering IT worker earnings (The Record)

Polymarket confirms cyberattack on third-party provider after outages (The Record)

Britain’s spy agency doesn’t know where thousands of its memory sticks are (POLITICO)

Old 'Popcorn Time' App Left Hundreds of Thousands of Macs at Risk (MacRumors)

Japan Airlines warns of data breach as country grapples with multiple cyber incidents (The Record)

NIK C2: The new AI-enabled command-and-control framework (Cisco Talos)

How North Korean hackers pulled off the biggest crypto heist in history (Metacurity)

Patrick Stewart, ‘Star Trek’ Captain and Professor X on ‘X-Men,’ Dies at 86 (The New York Times)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

DHS suffers a massive data leak. Researchers reveal Volt Typhoon’s sophisticated methods. Cisco patches a firewall zero-day. A suspected coordinated supply chain attack targets public GitHub repositories. Online scams overtake phishing. NIST shares post-quantum cryptography guidance. CISA warns a VMware ESXi vulnerability is under active exploitation. The Federal Election Commission takes systems offline. A Ukrainian national gets prison time for ransomware operations. Our guest is Yonald Chery, CTO from Technology Advancement Center (TAC), discussing securing operational technology in our critical infrastructure. Bitcoin mining gets you in hot water.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices segment, we are joined by Yonald Chery, CTO from Technology Advancement Center (TAC), discussing securing operational technology in our critical infrastructure takes more than traditional I.T. cybersecurity skills. If you enjoyed this conversation, be sure to check out the full interview here.

Selected Reading

Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents (WIRED)

Silent Train: Volt Typhoon’s Sophisticated Infection Chain into US Targets Exposed (Zero Day)

New Cisco firewall zero-day exploited to crash SSL VPN devices (Bleeping Computer)

Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour (The Register)

Online Scam Volumes Double to Overtake Phishing (Infosecurity Magazine)

NIST Publishes Guidance to Meet Federal Post-Quantum Deadlines (Infosecurity Magazine)

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day (SecurityWeek)

FEC takes down electronic filing platform after attempted hack (Nextgov)

Ukrainian Nefilim and Hive Affiliate Artem Stryzhak Jailed for 70 Months (Hackread)

Heatbit Says Your Water Heater Should Be Mining Bitcoin, and Now It Can (Gizmodo)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Senators accuse the White House of illegally withholding a secret surveillance court ruling. A suspected surveillance operation targets Starlink users. Attackers probe vulnerable Oracle E-Business Suite systems. The FBI shuts down a bulletproof hosting provider. Tailworm targets Tailscale. Ohio’s Auditor of State investigates a cyberattack. A suspected ransomware attack disrupts Israel’s largest vehicle importer. Norway raises their cyber risk level to high. Our guest is Amy Blackshaw, Senior Vice President of Product Marketing for Identity at Palo Alto Networks, discussing AI exploits and identity containment. AI science needs a spam filter.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today on our Industry Voices segment, we are joined by Amy Blackshaw, Senior Vice President of Product Marketing for Identity at Palo Alto Networks, discussing "The three-month clock: Neutralizing frontier AI exploits through identity containment." If you enjoyed this conversation, check out the full interview here.

Selected Reading

The US Government Is Hiding a Secret Court Ruling About How It Spies on Americans (WIRED)

EXCLUSIVE: Alleged Israeli spy company heavily targeted Starlink users, sources say (Reuters)

How Cosmos 2612 Ran Down ICEYE-X36 in October 2026 (KeepTrack)

Hackers now scanning systems for recently-patched Oracle flaw (Bleeping Computer)

FBI seizes ‘bulletproof’ hosting site accused of facilitating child abuse, money laundering (The Record)

Tailscale Rushes Patches After Uncoordinated Disclosure of 'Tailworm' Flaws (SecurityWeek)

State official: Auditor of State's Office targeted in overseas cyberattack (News 5 Cleveland)

Colmobil cyberattack exposes vulnerabilities in Israel’s connected-car ecosystem (Ctech)

NSM hever det nasjonale cyberrisikonivået til HØYT (NSM)

The maths bust-up fuelling fears that AI is undermining science (BBC News)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

CyberWire GuestSelected ReadingWant to hear your company in the show?
Learn more about your ad choices. Visit megaphone.fm/adchoices

CISA unveils its 2030 cyber strategy. PHP2Shell exploits are in the wild. HHS preserves healthcare security requirements. Microsoft offers buyouts amid its AI spending spree. A cyberattack disrupts New Mexico hospitals. Google’s Finnish data center plans hit an environmental roadblock. Blue Initiative tracks maritime vulnerabilities. A Chinese national faces charges in a $37 million cryptocurrency scam. Our guest is Cal Al-Dhubaib, host of the new Authorized Intelligence podcast. Anthropic’s prospectus includes an existential disclaimer.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Cal Al-Dhubaib, host of Authorized Intelligence, sharing his vision and some highlights of the new show joining the N2K CyberWire network. If you want to learn more, listen to the trailer here.

Selected Reading

CISA lays out plan to push cyber adversaries out of US critical infrastructure (Help Net Security)

CISA confirms PHP2Shell vulnerabilities now exploited in attacks (Bleeping Computer)

HHS Retreats on Plan to Scrap EHR Security, Privacy Regs (BankInfo Security)

Microsoft offers voluntary buyouts as AI leads to efficiency push (CNBC)

Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics (SecurityWeek)

‘Pure arrogance’: anger in Finland as Google illegally fells 250,000 trees for datacentre (The Guardian)

Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems (SecurityWeek)

Authorities extradite Chinese national for alleged $37M investment scam (CyberScoop)

Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI (SecurityWeek)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices