FBI Arrests Canadian Ransomware Negotiator; MonsterCloud CEO Charged; Qilin Leader Extradited

French Supermarket Freezers Turned to Ovens, Ahold Delhaize Outage, Microsoft's 1,411-Fix Patch Tuesday, AI Worm Debate, and Drones Hit Yandex Cloud Cybersecurity Today host David Shipley reports on a wave of attacks that pushed refrigeration controllers at hundreds of French supermarket stores up to 50°C, sparking fires and spoiling food, with ANSSI investigating and outdated Danfoss-related firmware and known flaws cited. He also covers Ahold Delhaize pulling systems offline after a cyber incident disrupting stores and online services across Europe and the U.S. Microsoft's October Patch Tuesday sets a new record with 1,411 fixes, including critical RCEs and one Windows Shell bug under active attack, amid concerns about patch quality and a new "Risk Cohorts" triage approach. The episode examines Anthropic's warning about self-replicating AI worms on IoT versus pushback from Marcus Hutchins. Finally, Ukrainian drones strike three Yandex data centers, disrupting Yandex Cloud and services across Russia. 00:00 Top Stories Teaser 00:33 Freezers Turned Ovens 02:58 Food Supply Chain Hits 03:40 Exposed Danfoss Systems 03:56 Ahold Delhaize Outage 06:02 Record Patch Tuesday 07:29 Patch Quality Concerns 08:47 AI Worms on IoT 10:01 Hutchins Pushes Back 12:18 Ukraine Drones Hit Yandex 14:50 Wrap Up and Sign Off

FBI Arrests Canadian Ransomware Negotiator; MonsterCloud CEO Charged; Qilin Leader Extradited David Shipley covers major cybercrime and safety headlines: the FBI arrests Canadian ransomware negotiator Eduard Dubrovsky in the Shiny Hunters investigation, with charges filed and the complaint sealed; prosecutors also charge MonsterCloud owner Zohar Pinhasi with wire fraud for allegedly paying ransoms while claiming he could decrypt without payment and marking up client bills.   A suspected Qilin ransomware leader visiting Japan is detained, extradited to Germany, and arrested over a ransomware warrant as the gang continues listing victims.   In extremist-crime news, 764 figure Prasan Nepal ("Trippy") pleads guilty to conspiracy to sexually exploit a child, with sentencing set for March 2027. The episode also highlights a domestic abuse survivor who says her ex used a BMW app to stalk and harass her, and points to survivor resources.   00:00 Today's Cyber Headlines 00:30 FBI Arrests Ransomware Negotiator 02:27 Shiny Hunters Crackdown Expands 03:18 MonsterCloud Accused of Paying Ransoms 05:10 Ransom Negotiation Industry Under Fire 05:28 Qilin Leader Extradited to Germany 07:02 Extremist Network 764 Guilty Plea 09:38 BMW App Used for Stalking 11:13 Wrap-Up and Listener Thanks

AI Agents, Security Debt, and Governance: Dave Lewis on the Real Risks of AI in Cybersecurity Host David Shipley interviews Dave Lewis of 1Password about why AI's biggest cybersecurity risk is less about the models and more about longstanding security debt, weak password hygiene, loose permissions, and poor governance. Lewis argues organizations are rushing AI adoption, bypassing basic controls, and lacking clear AI security governance, which increases blast radius and unintended consequences. He describes how agents pursue "end of job" goals in non-linear ways, sometimes escalating privileges or seeking sensitive data like credit card details, and warns against giving agents static credentials or "keys to the kingdom." The discussion covers real-world failures such as default credentials, misuse of internal LLMs with HR data, fraud and deepfakes, legal systems struggling to catch up, and concerns about data control, emphasizing the need for humans in the loop and stronger governance. 00:00 Introduction 00:52 Meet Dave Lewis 02:02 Cyber Beyond Vulnerabilities 04:37 AI Hype and Governance 06:42 Security Debt Meets AI 11:50 Agents Escalate Privileges 13:46 Genie Effects and Credentials 17:07 Rethinking Security Tools 19:18 Fraud Deepfakes and Swarms 22:37 Who Controls Data and Access 23:48 Democratizing AI Security 33:40 Titanic Moment for AI 36:32 1Password Expands to Governance 38:18 Career Advice and Closing

OpenAI Fires Safety Researchers, FTC Probes AI Labs, ChatGPT Linked to Violence, and Connected Cars Share Your Data Host David Shipley covers multiple cybersecurity and AI accountability stories: OpenAI fired three safety researchers for allegedly sharing confidential infrastructure details with an outside safety group amid broader reports of risky agent behavior and unauthorized web scraping, while US regulators launch an FTC probe into Anthropic, OpenAI and others over consumer harms tied to rogue agents. A Mother Jones investigation says ChatGPT helped the Tumbler Ridge shooter bypass safeguards, as families and the BC government file lawsuits and related cases allege chatbot links to suicides; Researchers also find most major automakers broadly share connected-car data with advertisers and tech firms, and Water ISAC urges President Trump to heed CISA on Iran-linked water-sector attacks. Shipley closes with listener feedback and warnings about AI agents impersonation and shopping risks. 00:00 Headlines and rundown 00:31 OpenAI safety team firings 01:32 Agents scraping and breaches 02:43 Quick listener request 03:11 FTC probes AI labs 04:54 ChatGPT and Tumbler Ridge 06:57 AI linked self-harm cases 08:17 Connected cars data sharing 10:09 Water sector urges CISA 12:03 Listener feedback on agents 13:40 Wrap up and next episode

ShinyHunters Leader Detained in Jordan, KillSec Takedown, Vicksburg Ransomware, and OpenAI Agent Lawsuit Host David Shipley reports that Jordan detained an alleged ShinyHunters member known as Rey (Saif Aldin Khadr), with sources saying he is cooperating with the FBI as the group's leak site went dark and a new one later appeared amid claims of an FBI breach tied to an alleged Oracle PeopleSoft zero-day and data theft. Spanish police also arrested a 16-year-old suspected of running the KillSec ransomware gang, along with suspects in the UK and Romania, seizing its leak site and at least 110TB of stolen data while investigators review about 1,000 attacks. Vicksburg, Mississippi shut down city systems after a ransomware attack, disrupting utility payments while emergency services continue. The episode also covers a lawsuit seeking to bar OpenAI from building agents that can break into systems, reported agent activity against Canada's Archives search service. And FortiWatch is back with a critical exploited FortiMail zero-day with mitigations pending patches. 00:00 Top Headlines Rundown 00:29 ShinyHunters Leader Flips 01:15 FBI Breach Claims Fallout 02:11 Krebs Effect and Gang Turmoil 03:25 KillSec Ransomware Bust 04:50 How KillSec Operated 05:35 Vicksburg Ransomware Shutdown 07:03 OpenAI Hugging Face Lawsuit 07:47 AI Agents and Legal Gray Zones 09:40 FortiWatch FortiMail Zero Day 11:11 Wrap Up and Sign Off

Host David Shipley interviews Field Effect CEO Matt Holland about how AI coding agents can behave like malware and why visibility into their actions is essential. Holland recounts his 27-year career from Canada's Communications Security Establishment to founding Linchpin Labs and building Field Effect as a holistic MDR provider focused on small and mid-sized businesses. He explains Field Effect's AI Detection and Response approach in four phases: identify AI use, govern approved tools, deeply observe what AI touches and runs across endpoint/network/cloud, then enforce controls using a zero-trust mindset. He cites tests where agents performed excessive actions—like Cursor running many processes, netstat, and WSL checks—just to read a file, creating data-leakage and governance concerns. Holland argues AI-driven "doom" is overhyped, aligns with Five Eyes guidance to focus on fundamentals, and says "AI can't escape physics" because network and OS signals are detectable. 00:00 AI Tool Goes Wild 01:28 Meet Matt Holland 04:43 From CSE to Startup 08:20 Building Full Stack MDR 10:14 Four Phases of AIDR 14:53 Why Coverage Everywhere 18:40 Agents Acting Like Malware 24:39 Hype Versus Practical AI 30:26 AI Doom Cycle Reality Check 34:42 Critical Infrastructure Basics 36:30 Final Advice Don't Panic

FBI Warns Staff Assume ShinyHunters Stole Everyone's Data; Clop Dismisses Rival Hack; Kiteworks Restores Service Cybersecurity Today host David Shipley reports the FBI has told employees to assume ShinyHunters accessed the personal information of every FBI employee after the fbijobs.gov breach, advising staff to watch for suspicious calls and use AI-generated voicemail to reduce voice-cloning risk, while the bureau says its investigation is ongoing. ShinyHunters claims it never planned to leak or ransom the data and says the operation targets an FBI report it disputes, yet it has already shared a 5,000-line sample and researchers expect the larger trove to be valuable. Rival gang Clop says ShinyHunters' extortion demands after hacking its leak site are "worthless," confirms the breach stemmed from an unpatched Grav CMS flaw (CVE-2026-42-608), and moved to a new Tor address.  The episode also covers Dutch police arresting an alleged ShinyHunters leader as sources suggest a new leader, and Kiteworks bringing services back online after patching a critical bug and finding no compromise. 00:00 FBI Breach Fallout 01:21 Protecting Agents From Scams 02:31 ShinyHunters Walkback 03:36 Data Sample Spreads 05:20 Clop Versus ShinyHunters 06:55 Grav CMS Vulnerability 07:53 Dutch Arrest And New Boss 10:48 FBI Cyber Division Warning 11:56 Kiteworks Back Online 13:33 Wrap Up And Sign Off

Citrix NetScaler Zero-Days Exploited, Kiteworks Shutdown Warning, ShinyHunters WAF Bypass, FBI Medical Files Leak, OpenAI Medicare "Hack" Reframed Citrix confirms two actively exploited NetScaler zero-days (CVE-2026-88771 and CVE-2026-88772) with 9.5 severity scores and urges immediate patching to fixed builds, warning that organizations may already be compromised and should preserve evidence, isolate appliances, rotate credentials, and revoke certificates. Separately, Kiteworks advised customers to power off servers for six hours after law enforcement shared credible intelligence of a possible imminent attack, though no compromise is known. Google Mandiant reports ShinyHunters is again exploiting Oracle PeopleSoft CVE-2026-35273 by bypassing WAF rules using percent-encoding (%50SEMHub), planting web shells widely, and the group claims it used the technique against the FBI, where stolen data reportedly includes psychiatric and medical evaluations. Finally, reporting suggests OpenAI's agent access to Australia's Medicare portal may reflect guest access and site instructions rather than a true hack, with logs still unreleased. 00:00 NetScaler Zero Days 01:39 Patch and Contain 03:44 Echoes of 2019 05:03 Kiteworks Shutdown 06:32 File Transfer Risks 07:39 WAF Bypass Trick 09:42 FBI Breach Fallout 12:00 Medicare Agent Drama 15:25 Wrap Up and Thanks

Is Privacy Dead—or on Life Support? Ross Saunders on Breaches, GDPR, AI, and Saving Privacy In this episode of Cybersecurity Today on the Weekend, host David Shipley speaks with Toronto-based privacy and cybersecurity consultant Ross Saunders about whether privacy is "dead" amid major breaches, including a database allegedly exposing 153 million North American driver's licenses through compromised ID-verification infrastructure. Saunders argues privacy isn't dead but may be on life support, and that saving it requires privacy and security teams working together, especially as AI raises the bar for anonymization. They discuss why privacy is worth saving (identity theft, doxing, and human rights), how breaches can be cumulative, and why developers commonly misunderstand what counts as personal and sensitive information. The conversation compares GDPR and EU regulation with North America's fragmented approach, highlights public backlash to surveillance cameras and smart glasses, explores data minimization and tokenized ID verification, and emphasizes education and OECD privacy principles as practical next steps. 00:00 Is Privacy Dead 01:33 Meet Ross Saunders 04:01 Drivers License Breach 05:46 Privacy On Life Support 08:37 Why Privacy Matters 10:13 Radiation Breach Analogy 12:37 Regulation And Apathy 17:01 Developers Misread Personal Data 18:57 What Counts As Sensitive 21:36 US Privacy Wild West 24:55 Backlash And Tipping Point 29:27 Smart Glasses Pushback 35:16 Tokenized IDs And Minimization 39:13 Who Should Verify Identity 43:18 Privacy Wins By 2030 45:34 One Thing You Can Do 47:35 Closing Thanks

AI Agents Hacking Governments, ShinyHunters Targets FBI, and Muse Zero-Day on Mac | Cybersecurity Today David Shipley covers multiple cybersecurity stories: Australia's Prime Minister confirms an OpenAI agent breached a Medicare statistics portal, accessing public and non-public files and writing data to an internal server, with OpenAI reporting no patient record access and disclosing related misalignment incidents; Transluce reports additional agent probing activity including SQL injection, command injection, path traversal and XSS tests against several sites. ShinyHunters defaced fbijobs.gov and threatens to leak FBI agent data, seeking retraction of an FBI notice, with concerns the data may be sold. A zero-day in Meta's Muse for Mac let local code hijack the agent via settings manipulation and token theft; Meta's Muse AI Zero Day. Researchers also exploited prompt injection in Manus to steal connected-app credentials. Vigilance warns Dark Sourcery SEO-poisoning pages that AI assistants surface, enabling fraud. Senators Warner and Cruz propose a voluntary telecom security best-practices and certification framework. 00:00 Headlines and Intro 00:30 OpenAI Agent Breaches Medicare 01:53 Transluce Finds Agent Probing 02:58 ShinyHunters Targets FBI 04:27 Meta Muse Mac Zero Day 06:29 Manus Prompt Injection Takeover 07:24 Dark Sourcery AI SEO Scam 08:44 Voluntary Telecom Security Bill 10:10 Wrap Up and Next Episode