Cybersecurity Saturday

David Ermer–Agentic & Generative AI, Congress, Cybersecurity, HIPAA Privacy and Security Rules–

From the frontier AI front,

  • Cyberscoop reports,
    • “OpenAI announced a new cybersecurity-focused model Thursday [November 4], citing internal benchmark testing that shows improvements in vulnerability discovery, patch development and adherence to safety guardrails meant to block out-of-scope work.
    • GPT-6 Cyber will first be available to a limited number of customers in OpenAI’s Daybreak Red program, which uses more advanced or nonpublic cybersecurity models for offensive red teaming.
    • “As a preview of the model’s capabilities, OpenAI officials said GPT-6 has found at least 81 “novel” vulnerabilities in the Firefox web browser, developed exploits for 948 Linux kernel vulnerabilities and was able to develop and validate a critical remote code execution vulnerability in Brotli, a popular open-source data compression tool. All the vulnerabilities were reported to owners and patched. 
    • “OpenAI officials told reporters Wednesday that the new safeguards include additional identity and account security requirements, more frequent check-ins from the model to OpenAI when a request is made to perform high-risk behaviors, and additional monitoring for “misalignment” or rule-breaking.”
  • The Wall Street Journal asks
    • “What if the mathematical locks and keys that secure our bank accounts, email inboxes and everything else on the internet turn out to be a lot less secure than we thought? What if the password-protected internet we rely on every day collapses?
    • “Quantum computers have long threatened such an apocalypse. For decades, engineers have been preparing for their arrival—and their inevitable abuse by well-heeled bad guys.
    • The result is known as “postquantum cryptography.” According to leading mathematics experts, an orderly transition of the world’s digital systems to this new paradigm should avert an event that could otherwise send us back a century, technology-wise.
    • “But now there is a potentially more pressing issue: AI’s impressive math skills.
    • Artificial intelligence is pushing advances in various mathematics fields at an unprecedented rate, conquering problems that our puny human minds have wrestled with for centuries. The fear is that this could include new solutions to the math problems that keep our encrypted communications encrypted.”
  • Cybersecurity Hub, writing in LinkedIn, adds,
    • “The US National Institute of Standards and Technology (NIST) has published its final roadmap for transitioning to post-quantum cryptography, marking a significant step towards replacing the cryptographic technologies that underpin digital communications, authentication and data protection.
    • “NIST IR 8547, Transition to Post-Quantum Cryptography Standards, identifies the existing standards vulnerable to future quantum computers and the quantum-resistant alternatives organisations will need to adopt. The publication moves the discussion beyond algorithm selection towards the practical challenge of coordinating migration across products, services and interconnected systems.
    • “For security leaders, the significance extends beyond choosing new encryption software. The transition will require visibility into cryptographic dependencies, cooperation with suppliers and decisions about which information and systems need protection first.”
  • CISA announced,
    • “CISA, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and the National Security Agency (NSA) released joint guidance and an accompanying quick-reference list to help organizations assess vendor readiness for transitioning to post-quantum cryptography (PQC). As quantum computing advances, widely used public-key cryptography will become vulnerable to compromise from cryptographically relevant quantum computers (CRQCs). To protect their systems and data, organizations must plan for and transition to PQC—which includes algorithms capable of withstanding both classical computing and quantum-enabled threats—before CRQCs become available. 
    • “Many organizations rely on third-party vendors for managed services, cloud capabilities, and other cryptography-dependent products and services. Cryptography is also embedded in systems and devices that are difficult to update, tied to long asset lifecycles, and require vendor support or replacement—such as industrial control systems and Internet of Things (IoT) devices. Reliance on vendors means that effective PQC transition depends on vendor readiness, and early, structured engagement with these vendors is critical to planning efforts. 
    • Organizations can use the vendor-neutral questions outlined in this guidance to determine whether a vendor understands quantum-related risks, maintains transparency over its cryptographic implementations, and supports a secure, cost-effective and timely transition to PQC. 
    • “Visit CISA’s PQC Initiative page for additional resources.”
  • McKinsey and Co. advises
    • “As AI makes it easier and faster for cyberattackers to discover and exploit vulnerabilities in software, companies must change their approach to safeguarding their digital assets and infrastructure.”

From the cybersecurity policy and law enforcement front,

  • Cybersecurity Dive reports,
    • “Democrats’ big wins in the midterm elections are poised to transform cybersecurity policymaking and oversight on Capitol Hill, with potentially big implications for critical infrastructure operators and other businesses that work with the government.
    • “After Democrats take control of the Senate and the House of Representatives in January, they likely will ramp up scrutiny of the Cybersecurity and Infrastructure Security Agency (CISA), accelerate efforts to solve AI security challenges and revive cybersecurity grants for struggling local utilities, experts told Cybersecurity Dive. Republican lawmakers have largely ignored those subjects, in part to avoid angering or embarrassing President Donald Trump’s administration, but Democrats — newly energized by unexpectedly sweeping gains on Tuesday — are expected to take a far more assertive approach to cybersecurity hearings, investigations and legislation.
    • “Key figures in Congress’s new Democratic majority told Cybersecurity Dive that they viewed digital security as a top priority.”
  • and
    • “Three dozen business groups, including organizations representing critical infrastructure sectors, are pressing Congress to renew a major cybersecurity information sharing law before its expiration next month.
    • “The 2015 Cybersecurity Information Sharing Act “has become a foundational component of the nation’s cybersecurity,” the groups wrote on Sunday to the chairs and ranking members of the congressional armed-services committees.”
  • Cyberscoop adds,
    • “Republicans have talked about wanting to get the fiscal 2027 National Defense Authorization Act done in the lame duck. Besides the possibilities of CISA 2015 being included in the bill, Nicholas Leiserson, senior vice president for policy at the Institute for Security and Technology, said the Senate version of the legislation has a pair of very noteworthy cyber provisions: a “very broad” authorization for contractor-owned, contractor-operated offensive cyber operations, and a requirement that every artificial intelligence product sold to the Defense Department have an AI bill of materials.”
  • CISA announced,
    • “The Cybersecurity and Infrastructure Security Agency (CISA) kicks off Critical Infrastructure and Resilience Month today [November 2], recognizing the systems and assets that keep the country running as well as the people who operate them. This year’s Critical Infrastructure Security and Resilience Month aligns with President Trump’s National Resilience Strategy and comes as we continue to see new and evolving threats, including those driven by rapid advances in technology like super intelligence. Through it all, we rely on frontline operators who keep essential services moving even when things are disrupted.
    • “Our work depends on people who understand their systems and stay prepared,” said Acting CISA Director Nick Andersen. “Resilience comes from knowing what matters most and having a plan you can actually use when something goes wrong.”
  • Federal News Network notes,
    • “The Cybersecurity and Infrastructure Security Agency is turning to a former Department of Health and Human Services official to head up CISA’s infrastructure security division.
    • “Brian Mazanec is now serving as acting executive assistant director for infrastructure security at CISA. He was sworn in Monday, according to CISA.
    • “Mazanec previously served as deputy assistant secretary and director of the Center for Preparedness within HHS’s Administration for Strategic Preparedness and Response (ASPR). He stepped down from ASPR last week after serving there since January 2023.
    • “During his time at HHS, Mazanec helped spearhead the department’s response to significant events like the Change Healthcare ransomware attack.“
  • Cyberscoop tells us,
    • “Delaware-based defense and aerospace company has settled a case with U.S. agencies over government allegations that the firm neglected its cybersecurity obligations in its contracts.
    • ILC — the name the government uses to collectively refer to ILC Dover and ILC Astrospace — agreed to pay $13 million to resolve the False Claims Act allegations involving its contracts with the Department of the Army, Missile Defense Agency and National Aeronautics and Space Administration.
    • “ILC, according to the government, submitted false or fraudulent claims for payment on contracts with the agencies because it knew it hadn’t complied with the contracts’ cybersecurity requirements over a period between 2018 and 2024.
    • “For instance, ILC allegedly used a third-party company to store sensitive data in the cloud without proper safeguards, and didn’t develop and update mandated security plans for each of its covered information systems.
    • “The best response to cyberattacks is to prevent them from happening in the first place,” Benjamin Wallace, U.S. Attorney for the District of Delaware, said in a news release Tuesday. “The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation.” 

From the cybersecurity breaches and vulnerabilities front,

  • On November 3, 2026, Binance shared on LinkedIn “29 October Binance Security Incident: Initial Findings and Response Update.”
    • “This is our initial report. It covers what we know today and what we have already improved. “The investigation remains ongoing and our findings will be subject to further independent review. Some technical details will remain confidential to prevent malicious actors from using them to plan attacks. We are engaging independent security firms for further review.
    • “The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.
    • “We are sharing this initial report because security improves when the industry learns together.”
  • HIPAA Journal tells us,
    • “Data breaches have been announced by HCA Healthcare, Blossom Health, El Camino Health, and University of Mississippi Medical Center.”
  • and
    • “Cleveland-based University Hospitals is working on restoring systems after an October 22 cyberattack. Cybersecurity incidents have also been announced by EyeMed Vision Care and Facial Surgery Group.”
  • Cybersecurity Dive reports,
    • “Authorities are investigating a cyberattack targeting a refrigeration-equipment supplier for the French Blood Establishment (EFS), which oversees France’s civilian blood supply.
    • “An unknown hacker was able to manipulate temperature controls at cold storage rooms for three EFS sites, according to the agency. Temperatures and defrosting thresholds were raised to very high levels. 
    • “EFS monitoring systems and alarms detected the activity, and staff were able to regain control. The supplies were transferred to other facilities, the agency said, and the integrity of those blood supplies was not compromised.” 
  • The American Hospital Association News adds,
    • “Federal agencies Nov. 5 issued a bulletin saying that they are aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally, including systems used within the healthcare sector. The agencies warned that threat actors may exploit unpatched or internet-accessible refrigeration controllers to remotely alter temperature settings, trigger extended defrost or heating cycles, cause inventory loss, create equipment hazards and disrupt temperature monitoring capabilities. The agencies are urging organizations to identify internet-exposed systems, remove unnecessary remote access, apply available patches and firmware updates, implement strong authentication controls, segment operational technology networks and review alerting and monitoring capabilities.”
  • Cybersecurity Dive relates,
    • “Hackers are using Artex and other agentic AI-based frameworks to scan public GitHub repositories for exposed credentials and API keys, according to a report Thursday from Microsoft Threat Intelligence.
    • “The credentials are then deployed in downstream attacks against targeted organizations. Starting Oct. 28, researchers found a single IP address using compromised but still-valid application credentials to sign into downstream tenants. 
    • “In one case, hackers were able to steal credentials and exfiltrate data from Azure Key Vaults and Storage Accounts, as well as abuse Azure AI services. Researchers also saw hackers using embedded shell commands in a user agent to exploit vulnerabilities as well as attempts to steal App Service authentication tokens.
    • “Microsoft researchers said the threat activity overlaps with a campaign using the same IP address, as outlined in research released Wednesday by Todyl. That report showed how hackers with stolen secrets for Entra ID signed into Microsoft 365 and Azure environments at various managed service providers.” 
       
  • Bleeping Computer informs us,
    • “Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers.
    • “Chainalysis provides blockchain analysis tools to trace cryptocurrency transactions and investigate crimes such as fraud, ransomware, and money laundering. Its customer list includes law enforcement, government agencies, financial institutions, insurance companies, and cryptocurrency businesses worldwide.
    • “This follows the company’s disclosure last Friday that attackers using AI tools accessed customers’ names, email addresses, user IDs, and organizational role labels using what it described as “offensive agentic techniques.”
  • Computer Weekly lets us know,
    • “Two-thirds of the vulnerabilities Palo Alto Networks has uncovered using frontier artificial intelligence (AI) models had never been disclosed as Common Vulnerabilities and Exposures (CVEs), according to the security supplier’s CIO, Meerah Rajavel.
    • “Speaking to Computer Weekly on the sidelines of Singapore International Cyber Week last month, Rajavel said the sheer number of undisclosed vulnerabilities means organisations can no longer simply prioritise which known flaws to patch first.
    • “Palo Alto Networks has had an early look at what frontier AI can do. It was among the launch partners of Anthropic’s Project Glasswing, which gave a select group of organisations access to the unreleased Claude Mythos Preview model to find and fix flaws in critical software.
    • “The model’s knack for finding vulnerabilities made headlines, but that was not what surprised the company. “The thing that shocked us was how good it was in devising attack paths,” said Rajavel, referring to the model’s ability to chain vulnerabilities in novel ways.” * * *
    • Organisations cannot patch some systems at all, she said, especially those that run business-critical processes or rely on older technology that cannot take rolling updates.
    • “That makes virtual patching critical, said Rajavel, as it blocks exploit attempts at the network level until a fix is applied. She added that a good zero-trust architecture and attack surface management can help eliminate attack paths to a large part of an organisation’s infrastructure.”

From the ransomware front,

  • Spectrum News reports,
    • “A ransomware attack has disrupted services across the Queens Public Library system.
    • “The library system first reported a systemwide network outage on Wednesday, saying it was affecting its website and app, as well as checkout and return machines, renewals, on-site computers and free Wi-Fi access at all 66 branches.  
    • “As of Thursday morning, those services were still unavailable, Queens Public Library president and CEO Dennis Walcott said in a statement.
    • “All library locations are currently open as scheduled, but some virtual and in-person programs may be impacted, Queens Public Library said on social media.”
  • The Recorded Future News relates,
    • “Michigan State University officials said recent claims by a ransomware gang were tied to an incident last month that forced password resets for all student and employee accounts.  
    • “On Sunday evening [November 1], the BYOD ransomware gang added the university to its leak site — claiming to have stolen personal information on 1.3 million current and former students. Last week, BYOD caused outrage after attacking The University of New Mexico and shutting down its hospital.  
    • A spokesperson for Michigan State told Recorded Future News that the university “became aware of suspicious cyber activity and immediately began investigating the matter,” in early October.  
  • Tech Radar points out,
    • “Synology, a major network-attached storage (NAS) manufacturer, is warning users about ongoing ransomware attacks targeting devices running outdated software. It urged all users to apply provided patches and secure their devices without delay.
    • “In a brief announcement, Synology said it “identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.” The goal of the attacks seem to be data encryption and a ransom demand.
    • “Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems. Synology also recommends enabling automatic updates to keep DSM up to date at all times.” * * *
    • “The company also did not say who the threat actors are, but according to BleepingComputer, there has been a “massive wave of reports” from Synology customers whose data was apparently locked down by the “C3rb3r” encryptor. These customers were asked to pay “thousands of dollars” in ransom, in exchange for the decryption key. The publication says the first reports started surfacing more than two weeks ago.”
  • Huntress offers guidance on how to protect against ransomware before it encrypts data,
    • “Phishing is one of the most common ways in, but not the only way. Exposed remote access, unpatched internet-facing systems, and stolen credentials work just as well for attackers.
    • “Backups are crucial to your security plan. Keep at least one copy offline or isolated, and test restores before you need them.”
    • “Ransomware usually leaves footprints. Catch the behavior early, and you can stop the attack before the ransom note shows up.”

From the cybersecurity business and defenses front,

  • The New York Times reports,
    • “Anthropic Is Racing to Obtain the A.I. Boom’s Most Vital Resource
      • “The company went on a deal spree with tech giants, former crypto miners and others to gain computing power to further its artificial intelligence ambitions.”
  • Cybersecurity Dive relates,
    • “Companies are struggling to oversee their AI agents because they don’t know what those agents’ normal behavior looks like, according to a new report.
    • “Nearly half (46%) of security professionals say they’re unable to establish safe baselines for agentic AI activity, the security firm Abnormal AI said in a report published on Thursday [November 4].
    • “The report highlights security gaps in AI oversight that businesses should prioritize as they increase their AI deployments.”
  • Security explains “Frontier AI Is Changing Cyber Defense: 15 Moves CISOs Should Make Now.”
  • Dark Reading offers,
    • “9 Cyber Awareness Tips That Actually Match Today’s Maze of Threats
      • “Practical guidance on safer search, stronger login security, better executive protection, and other habits can reduce enterprise risk.
  • Security points out,
    • “Companies are getting faster at disclosing cyberattacks and slower at explaining what those attacks actually cost. Since the SEC’s cyber disclosure rule took effect, a public company has four business days to file an 8-K once it determines an incident is material, often before it knows the full scope. The filing says some version of the same thing: Systems are affected, operations are disrupted, and whether the impact will be material has not yet been determined.
    • “Increasingly, these incidents get discussed as one problem, with cybersecurity, business continuity, and enterprise resilience collapsed together, when each does something different. Cyberattacks are hitting more often and doing more damage when they land, which makes the distinction matter more. Cybersecurity focuses on detecting and stopping the attack itself. “Business continuity and enterprise resilience determine how the organization keeps operating once that happens. Detection and containment alone aren’t enough. When disruption hits, the business continuity function must be able to answer what is impacted, what happens next, what is the financial exposure, and what should be prioritized.”
  • NIST announced
    • “A new NIST guide can help solo business owners — also called “solopreneurs” — grasp the basics of cybersecurity and craft a strategy that can help reduce their cybersecurity risk.
    • “The guide is designed to help solopreneurs prioritize and implement a selection of actions from the NIST Cybersecurity Framework that would best help their businesses.
    • “The publication is written in lay language and assumes no prior cybersecurity knowledge.”
  • FEHBlog note — This guide also may improve guidance for work at home staff.
  • Here’s a link to Dark Reading’s CISO Corner

Leave a Reply

Your email address will not be published. Required fields are marked *