Transcript
Kate: Good morning! It's Wednesday, October twenty-eighth, and this is your daily briefing on security, AI and tech. Dade, there's a lot of patching in the news today, so let's start there.
Dade: Morning, Kate. Yes, and the headline is Brotli. That's Google's very widely used compression library. A bug tracked as CVE-2026-111497 is an out-of-bounds problem that can be exploited remotely, and people are calling it Node2Shell or Brotli2Shell. CISA has put it in its Known Exploited Vulnerabilities catalog, which means attackers are already using it. It sits alongside a Magento and Adobe Commerce flaw, an unrestricted file upload, that was added the same day.
Kate: Why is Brotli such a big deal? It's a compression library. Doesn't sound very glamorous.
Dade: Right, and that's exactly the problem. Brotli is buried inside browsers, web servers, runtimes, all sorts of software. So the question for a consultant isn't "do we run Brotli", it's "what in our estate bundles it". Think of it like a part in a car that's used by twelve manufacturers. You need the software bills of materials, and then you need to check what's really running in production.
Kate: And that ties into another story, where Dark Reading argued that an SBOM alone can't tell you the scope of a supply chain attack. You need real-time visibility into production.
Dade: Exactly. An inventory tells you what you might have. It doesn't tell you what's actually exposed. Also on the patch list: the Belgian CCB warns about multiple critical PHP vulnerabilities that can lead to remote code execution, patch immediately or take the system offline. And Apple backported a fix for an actively exploited CoreGraphics bug, CVE-2026-86950, to older iPhones and iPads. If you have clients with older devices, that matters.
Kate: Let's move on to attacks that rely on people rather than bugs. Arctic Wolf has seen something clever with Microsoft Teams.
Dade: It's nasty. Attackers flood an employee's inbox with spam, so the person is annoyed and desperate. Then, a few minutes later, someone shows up in Teams, posing as IT support, offering to fix the problem they themselves created. Arctic Wolf documented more than four hundred incidents using the external chat feature in Teams. Dark Reading reports malware delivery can follow within fifteen minutes, and there's a possible link to the Black Basta ransomware gang.
Kate: So what's the practical advice?
Dade: Look at your external access settings in Teams. If any outside tenant can message your staff, that's an open door. Restrict it to allow-listed domains, and train people that IT never first contacts them through an unknown external account. And related: Microsoft fixed an Authenticator flaw on Android, CVE-2026-80097, where an app with no permissions could pose as Teams and collect sign-in tokens for work accounts. Make sure that update is rolled out.
Kate: Now to a theme that matters for NIS2 and DORA: suppliers. Kroll says nearly seven in ten people affected by breaches it handled were exposed through an outside supplier.
Dade: Yes, and the British police inspectorate reached a similar conclusion, saying police data has been breached several times this decade through third-party IT suppliers. Victims often discover that their data was held by a company they've never heard of. For regulated entities, that's the point of the supply chain requirements. You can outsource the processing, but not the accountability. Also in the news, the Moldovan government took more than eighty public services offline after a cyberattack, and a hospital in New Mexico diverted ambulances for about two hours. Incidents like these show how quickly services stop.
Kate: There was some good news for the defenders as well, wasn't there?
Dade: Yes. A Ukrainian national, Artem Stryzhak, got seventy months in prison for his role in the Nefilim and Hive ransomware operations. And Australia's signals directorate got into the backend of an Amadey malware operator and cut off access to about a hundred and eighty thousand infected computers. Not a permanent fix, but it hurts the criminals.
Kate: Okay. Let's turn to AI, because it shows up on both sides of the security story.
Dade: It does. Researchers at TrendAI analyzed exposed servers and described a toolkit called CyberStrikeAI that used forty-four AI agents to automate attacks on organizations in Japan. In some cases the AI was driving, in others it assisted a human operator. And a stealer called Aokigahara goes after what they call developer keyrings and AI assistants. One compromised laptop can expose AI sessions, business data and infrastructure credentials in one go.
Kate: So AI tools become just another place where secrets live.
Dade: Exactly. Your coding assistant has tokens, history, access. Treat it like a privileged account. And there's a governance side too: Dark Reading suggests CISOs get ahead of AI liability with solid documentation, transparency, and careful contract negotiation with AI vendors. Meanwhile OpenAI added iCloud Mail and Calendar plugins to ChatGPT, which means one more integration to think about in a data policy.
Kate: And the biggest AI story of the day is financial. Anthropic filed its IPO prospectus.
Dade: It did, a document of around three hundred and thirty-five pages, as MIT Technology Review describes it. What grabbed headlines is the risk factors section, where the company warns that its AI could be misused, could blackmail people, even that it might become sentient. Ars Technica pulled out seven of the nightmares. Honestly, risk factors are written by lawyers to cover everything. I'd read them as legal hygiene, and the more interesting thing is the real revenue numbers, which feed the whole bubble debate.
Kate: There's also a Delaware proposal that would let AI agents run entire businesses.
Dade: Yes, with the owners shielded from liability for what the article calls reckless AI. That's a big question for risk people: if nobody's at the helm, who's accountable? Keep an eye on it.
Kate: Finally, tech. Apple refreshed the iMac and the entry-level MacBook Pro with the M6 chip.
Dade: Right, with a new N1 chip bringing Wi-Fi 7 and Bluetooth 6. The iMac keeps the same seven colors. And Bloomberg reports Apple has discussed charging two thousand eight hundred ninety-nine dollars for an OLED touchscreen MacBook Pro, four hundred more than today's model.
Kate: And there's a firmware story that deserves a mention.
Dade: Yes. Ars Technica reports a critical code-execution flaw in EDK2, the UEFI firmware base, which affects most servers on the planet. Attackers can run code very early in boot, before your security tools even start. Firmware patching is slow and often forgotten, so put it on the list. Also, Google will begin certifying registered app stores for Android on December first, though not in the US.
Kate: So, to recap: patch Brotli, Magento, PHP and Apple devices, lock down external Teams chats, and look at your suppliers.
Dade: Nicely put. And check your firmware, too.
Kate: That's the briefing for today. Thanks for listening, and have a great day!
Dade: Take care, everyone.
No news overview was kept for this day.