Daily Cyber & AI Briefing — 2026-06-26

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Transcript

Today’s landscape of cyber and AI risk is defined by relentless innovation—on both sides of the security equation. As organizations accelerate digital transformation, threat actors are evolving just as quickly, exploiting new vulnerabilities and targeting the most critical business assets. In this briefing, we’ll break down the latest developments shaping enterprise risk, from major breaches and zero-day exploits to shifts in AI governance and the security workforce.

Let’s start with one of the most impactful incidents making headlines: the ShinyHunters breach of Oracle PeopleSoft. ShinyHunters, a group well-known for targeting enterprise software, has successfully compromised Oracle PeopleSoft systems at over a hundred organizations. This is not just another breach—it’s a stark reminder of how deeply interconnected our digital supply chains are, and how vulnerable even the most established platforms can be.

Attackers in this case leveraged a combination of known vulnerabilities and zero-day exploits, gaining access to sensitive enterprise data across sectors. The scale of this breach highlights the persistent risk posed by third-party and supply chain software. For risk leaders, the implications are clear: it’s no longer enough to secure your own environment. You have to rigorously manage third-party risk, continuously monitor your critical business applications, and ensure that your vendors are upholding the same security standards you expect internally.

This incident also brings into focus the challenge of visibility. Many organizations rely on PeopleSoft for core business functions—HR, finance, supply chain management. When a breach like this occurs, it’s not just about data loss; it’s about the potential for operational disruption, regulatory exposure, and long-term reputational damage. The lesson here is that continuous monitoring and robust third-party risk management aren’t optional—they’re foundational to enterprise resilience.

Moving from supply chain risk to infrastructure, let’s talk about the ongoing exploitation of vulnerabilities in Cisco Unified Communications Manager. The Cybersecurity and Infrastructure Security Agency, or CISA, has issued multiple alerts about active attacks targeting flaws in Cisco’s Unified Communications Manager and Session Management Edition. These vulnerabilities are now part of CISA’s Known Exploited Vulnerabilities catalog—a clear signal that exploitation is happening in the wild, not just in theoretical lab scenarios.

What’s particularly concerning about these Cisco vulnerabilities is their potential to enable remote code execution and lateral movement within enterprise networks. In practical terms, that means an attacker could gain a foothold in your communications infrastructure and then pivot to other critical systems. For organizations running Cisco Unified CM, the guidance is straightforward: prioritize patching immediately, review your deployment configurations, and monitor for indicators of compromise. The window between vulnerability disclosure and exploitation is shrinking, and attackers are moving faster than ever.

We’re also seeing the first confirmed exploitation of a vulnerability in PTC Windchill, a widely used product lifecycle management platform. This is significant, especially for organizations in engineering and manufacturing, where Windchill is often central to managing sensitive design and production data. Security researchers have observed attackers leveraging this flaw to gain unauthorized access to proprietary information—potentially putting intellectual property and competitive advantage at risk.

If your organization uses Windchill, now is the time to act. Patch the vulnerability as soon as possible, and review your access controls to ensure that only authorized users have access to sensitive data. This is another example of how attackers are expanding their focus beyond traditional IT targets to include operational technology and engineering platforms.

The threat landscape is also being reshaped by a surge in advanced malware. Three strains in particular—KuinaExtractor, SharkLoader, and Miasma—are making waves for their sophisticated evasion techniques. These tools are designed to slip past traditional defenses, using methods like sandbox detection, User Account Control bypass, and novel dropper mechanisms to avoid detection and deliver their payloads.

KuinaExtractor, for example, uses encrypted channels such as Telegram to exfiltrate data, making it harder for defenders to spot malicious activity. SharkLoader is being deployed in targeted attacks against government agencies and software development firms, enabling stealthy delivery of secondary payloads. Miasma, meanwhile, is part of a broader trend of malware leveraging supply chain weaknesses to reach their targets.

For security teams, the takeaway is clear: endpoint detection and response solutions must go beyond signature-based detection. Behavioral analytics, anomaly detection, and continuous monitoring are essential to catch these advanced threats before they can do real damage. It’s also critical to review your software supply chain controls. Attackers are increasingly targeting the links between organizations—partners, vendors, and service providers—knowing that a single weak point can open the door to a much larger breach.

The market is responding to these challenges with significant investment in fraud prevention and cloud security. Incode’s recent acquisition of Identiq for $100 million is a case in point. This move underscores the growing importance of identity verification and privacy-preserving solutions, especially as more business moves to the cloud and digital transactions become the norm.

Identiq’s technology focuses on enabling organizations to verify identities without sharing sensitive personal data—a key capability for reducing fraud risk while maintaining privacy. For financial services, e-commerce, and any sector dealing with high-value transactions, these kinds of solutions are becoming indispensable. The acquisition is expected to accelerate innovation in this space, giving organizations new tools to combat fraud and identity theft.

Cloud risk is another area seeing increased attention and investment. Aryon, a security startup, has raised $29 million to develop solutions that identify and mitigate cloud risks before deployment. This reflects a broader industry shift toward proactive cloud security—moving away from reactive incident response and toward automated risk assessment and policy enforcement.

As organizations accelerate their adoption of cloud infrastructure, the complexity of managing risk grows. Misconfigurations, excessive permissions, and unvetted third-party integrations can all introduce vulnerabilities. Aryon’s approach is to catch these issues before workloads go live, reducing the attack surface and helping organizations maintain compliance with regulatory requirements.

The need for proactive cloud risk management is only going to increase as more organizations embrace multi-cloud and hybrid environments. Automated tools that can assess risk and enforce policy at scale are quickly becoming a must-have for any organization serious about security.

Let’s circle back to the malware landscape for a moment. The SharkLoader dropper, in particular, is being used in targeted attacks against governments and software development firms. This tool enables attackers to deliver secondary payloads in a stealthy manner, often as part of a broader supply chain attack. The use of droppers like SharkLoader highlights the importance of monitoring for anomalous activity—not just at the endpoint, but across the entire software development and deployment pipeline.

Security teams should be reviewing their supply chain controls, validating the integrity of software updates, and monitoring for unexpected changes in system behavior. The goal is to catch malicious activity early, before attackers can escalate privileges or move laterally within the network.

CISA’s decision to add Cisco Unified Communications Manager vulnerabilities to its Known Exploited Vulnerabilities catalog is another indicator of the urgency surrounding these flaws. Organizations are urged to prioritize remediation and to monitor for indicators of compromise. Exploitation is ongoing, and the longer these vulnerabilities remain unpatched, the greater the risk of a successful attack.

Shifting gears to AI governance, we’re seeing new challenges emerge as organizations deploy agentic AI workspaces—particularly in the Asia-Pacific region. Agentic AI refers to systems that can act autonomously, making decisions and taking actions on behalf of users or organizations. While these capabilities can drive efficiency and innovation, they also introduce new risks around security, privacy, and regulatory compliance.

Ensuring the secure deployment and operation of AI agents requires robust access controls, continuous monitoring, and alignment with evolving regulatory requirements. For risk leaders, this means evaluating and updating AI governance frameworks to address the unique risks posed by autonomous systems. It’s not just about preventing unauthorized access—it’s about ensuring that AI agents act in accordance with organizational policy and ethical standards.

The financial sector, in particular, is feeling the pressure to enhance AI governance. As AI-driven decision-making becomes more common in banking and financial services, the need for transparent and auditable controls is paramount. Industry voices are calling for stronger frameworks to maintain trust—both with regulators and with customers.

Without proper g

Transcript

SPEAKER_00 0:07

Grab your coffee or Red Bull or whatever your morning vice is, and this is your daily cyber and AI briefing, and I am your host, Michael Hoosh. Today's landscape of cyber and AI risk is defined by relentless innovation on both sides of the security equation. As organizations accelerate digital transformation, threat actors are evolving just as quickly, exploiting new vulnerabilities and targeting the most critical business assets. In this briefing, we'll break down the latest developments shaping enterprise risk, from major breaches and zero-day exploits to shifts in AI governance and the security workforce. Let's start with one of the most impactful incidence-making headlines, the Shiny Hunters Breach of Oracle PeopleSoft. Shiny Hunters, a group well known for targeting enterprise software, has successfully compromised Oracle PeopleSoft systems at over a hundred organizations. This is not just another breach, it's a stark reminder of how deeply interconnected our digital supply chains are, and how vulnerable even the most established platforms can be. Attackers in this case leverage a combination of known vulnerabilities and zero-day exploits, gaining access to sensitive enterprise data across sectors. The scale of this breach highlights the persistent risk posed by third-party and supply chain software. For risk leaders, the implications are clear. It's no longer enough to secure your own environment. You have to rigorously manage third-party risk, continuously monitor your critical business applications, and ensure that your vendors are upholding the same security standards you expect internally. This incident also brings into focus the challenge of visibility. Many organizations rely on PeopleSoft for core business functions, HR, finance, supply chain management. When a breach like this occurs, it's not just about data loss. It's about the potential for operational disruption, regulatory exposure, and long-term reputational damage. The lesson here is that continuous monitoring and robust third-party risk management aren't optional. They're foundational to enterprise resilience. Moving from supply chain risk to infrastructure, let's talk about the ongoing exploitation of vulnerabilities in Cisco Unified Communications Manager. The Cybersecurity and Infrastructure Security Agency, or CISA, has issued multiple alerts about active attacks targeting flaws in Cisco's Unified Communications Manager and Session Management Edition. These vulnerabilities are now part of CISA's known exploited vulnerabilities catalog, a clear signal that exploitation is happening in the wild, not just in theoretical lab scenarios. What's particularly concerning about these Cisco vulnerabilities is their potential to enable remote code execution and lateral movement within enterprise networks. In practical terms, that means an attacker could gain a foothold in your communications infrastructure and then pivot to other critical systems. For organizations running Cisco Unified CM, the guidance is straightforward. Prioritize patching immediately, review your deployment configurations, and monitor for indicators of compromise. The window between vulnerability disclosure and exploitation is shrinking, and attackers are moving faster than ever. We're also seeing the first confirmed exploitation of a vulnerability in PTC Windchill, a widely used product lifecycle management platform. This is significant, especially for organizations in engineering and manufacturing, where windchill is often central to managing sensitive design and production data. Security researchers have observed attackers leveraging this flaw to gain unauthorized access to proprietary information, potentially putting intellectual property and competitive advantage at risk. If your organization uses windchill, now is the time to act. Patch the vulnerability as soon as possible and review your access controls to ensure that only authorized users have access to sensitive data. This is another example of how attackers are expanding their focus beyond traditional IT targets to include operational technology and engineering platforms. The threat landscape is also being reshaped by a surge in advanced malware. Three strains in particular, Quina Extractor, Sharkloader, and Miasma, are making waves for their sophisticated evasion techniques. These tools are designed to slip past traditional defenses using methods like sandbox detection, user account control bypass, and novel dropper mechanisms to avoid detection and deliver their payloads. Quina Extractor, for example, uses encrypted channels such as Telegram to exfiltrate data, making it harder for defenders to spot malicious activity. Shark Loader is being deployed in targeted attacks against government agencies and software development firms, enabling stealthy delivery of secondary payloads. Miasma, meanwhile, is part of a broader trend of malware leveraging supply chain weaknesses to reach their targets. For security teams, the takeaway is clear. Endpoint detection and response solutions must go beyond signature-based detection. Behavioral analytics, anomaly detection, and continuous monitoring are essential to catch these advanced threats before they can do real damage. It's also critical to review your software supply chain controls. Attackers are increasingly targeting the links between organizations, partners, vendors, and service providers, knowing that a single weak point can open the door to a much larger breach. The market is responding to these challenges with significant investment in fraud prevention and cloud security. ENCODE's recent acquisition of Identic for $100 million is a case in point. This move underscores the growing importance of identity verification and privacy preserving solutions, especially as more business moves to the cloud and digital transactions become the norm. Identix technology focuses on enabling organizations to verify identities without sharing sensitive personal data, a key capability for reducing fraud risk while maintaining privacy. For financial services, e-commerce, and any sector dealing with high value transactions, these kinds of solutions are becoming indispensable. The acquisition is expected to accelerate innovation in this space, giving organizations new tools to combat fraud and identity theft. Cloud risk is another area seeing increased attention and investment. Arian, a security startup, has raised $29 million to develop solutions that identify and mitigate cloud risk before deployment. This reflects a broader industry shift toward proactive cloud security, moving away from reactive incident response and toward automated risk assessment and policy enforcement. As organizations accelerate their adoption of cloud infrastructure, the complexity of managing risk grows. Misconfigurations, excessive permissions, and unvetted third-party integrations can all introduce vulnerabilities. Arian's approach is to catch these issues before workloads go live, reducing the attack surface and helping organizations maintain compliance with regulatory requirements. The need for proactive cloud risk management is only going to increase as more organizations embrace multi-cloud and hybrid environments. Automated tools that can assess risk and enforce policy at scale are quickly becoming a must-have for any organization serious about security. Let's circle back to the malware landscape for a moment. The Sharkloader dropper in particular is being used in targeted attacks against governments and software development firms. This tool enables attackers to deliver secondary payloads in a stealthy manner, often as part of a broader supply chain attack. The use of droppers like Sharkloader highlights the importance of monitoring for anomalous activity, not just at the endpoint, but across the entire software development and deployment pipeline. Security teams should be reviewing their supply chain controls, validating the integrity of software updates, and monitoring for unexpected changes in system behavior. The goal is to catch malicious activity early, before attackers can escalate privileges or move laterally within the network. CESA's decision to add Cisco Unified Communications Manager vulnerabilities to its known exploited vulnerabilities catalog is another indicator of the urgency surrounding these flaws. Organizations are urged to prioritize remediation and to monitor for indicators of compromise. Exploitation is ongoing, and the longer these vulnerabilities remain unpatched, the greater the risk of a successful attack. Shifting gears to AI governance, we're seeing new challenges emerge as organizations deploy agentic AI workspaces, particularly in the Asia Pacific region. Agentic AI refers to systems that can act autonomously, making decisions and taking actions on behalf of users or organizations. While these capabilities can drive efficiency and innovation, they also introduce new risks around security, privacy, and regulatory compliance. Ensuring the secure deployment and operation of AI agents requires robust access controls, continuous monitoring, and alignment with evolving regulatory requirements. For risk leaders, this means evaluating and updating AI governance frameworks to address the unique risks posed by autonomous systems. It's not just about preventing unauthorized access, it's about ensuring that AI agents act in accordance with organizational policy and ethical standards. The financial sector in particular is feeling the pressure to enhance AI governance. As AI-driven decision making becomes more common in banking and financial services, the need for transparent and auditable controls is paramount. Industry voices are calling for stronger frameworks to maintain trust, both with regulators and with customers. Without proper governance, AI systems can introduce risks of bias, fraud, and regulatory noncompliance. Transparent decision-making processes, regular audits, and clear accountability are essential to safeguarding trust. For organizations in regulated sectors, investing in robust AI governance isn't just a best practice. It's a business imperative. Leadership changes at major firms are reflecting the increasing complexity and strategic importance of the CISO role. Uber has appointed Philip Martin as its new chief information security officer, while SoCure has named Mark Carter to the same position. These appointments underscore the evolving demands placed on security leaders as organizations navigate heightened cyber and AI risks. Today's CISOs are expected to be more than just technical experts. They're strategic partners, responsible for aligning security with business objectives, managing risk across complex digital ecosystems, and responding to incidents that can have far-reaching consequences. As the threat landscape evolves, so too must the leadership and governance structures that support effective risk management. Workforce development is another critical piece of the puzzle. CompTIA's new career pathway initiative highlights the growing demand for practical, employable cybersecurity skills. For risk executives, this reinforces the importance of ongoing training and professional development. The threat landscape is constantly changing, and organizations need teams that can adapt, learn, and respond to new challenges. Building a pipeline of skilled cybersecurity professionals is essential for sustaining effective risk management. This means investing in training, mentoring, and career development programs that equip employees with the skills they need to tackle today's and tomorrow's threats. Let's take a step back and look at some of the strategic implications emerging from these developments. First, supply chain and third-party software vulnerabilities remain a top risk vector. The Shiny Hunter's Breach is just the latest example of how attackers are exploiting weaknesses in interconnected systems. Enhanced due diligence, continuous monitoring, and strong contractual security requirements for vendors are essential. Second, the rapid evolution of malware and exploitation techniques demands investment in advanced detection and response capabilities. Traditional security tools are no longer sufficient. Organizations need solutions that can identify and respond to novel threats in real time, leveraging behavioral analytics and automation to stay ahead of attackers. Third, AI governance frameworks must keep pace with the deployment of agentic AI and automation, especially in regulated sectors like banking and healthcare. This means developing policies and controls that address not just technical risks, but also ethical and regulatory considerations. Finally, leadership and workforce development are critical to sustaining effective risk management in a complex dynamic threat environment. Organizations need leaders who can think strategically about risk, and teams that are equipped with the skills and knowledge to execute on that vision. So, what matters most today? First and foremost, dream immediate patching of Cisco Unified Communications Manager and PTC Wind Chill vulnerabilities is essential to prevent exploitation. These are active threats and the window for remediation is closing fast. Second, supply chain security and third-party risk management should be at the top of every organization's agenda. Recent large-scale breaches have shown just how quickly vulnerabilities can cascade across interconnected systems. Third, proactive investment in AI governance and cloud risk mitigation will be key to maintaining trust and compliance as organizations accelerate digital transformation. The risks are real, but so are the opportunities for those who take a proactive strategic approach. As we move forward, the convergence of advanced malware, supply chain attacks, and AI-driven risks will continue to challenge even the most mature organizations. So staying ahead requires a layered defense strategy, combining technology, process, and talent to build resilience against an ever-evolving threat landscape. That's the briefing for today. Stay vigilant, keep learning, and make sure your defenses are as dynamic as the threats you face. That's a wrap, peeps. Stay secure, stay sharp, and don't forget to hug your CISO.