New command amid mounting cyber risks.

0:00You're listening to the CyberWire Network, powered by N2K. AI is changing how enterprises operate and how they stay protected. It's time to eliminate risk and protect innovation. From March 23rd through the 26th, join Trend AI for actionable AI security insights. Catch impactful sessions at RSA C, then unwind and grab a bite at their lounge in Trapasueño. Experience industry leading AI security in-person, engage with the experts, and get your chance to win $500,000. San Francisco, let's AI fearlessly. Learn more at trendmicro.com slash RSA. Rudd takes the helm at NSA and CyberCommand.

1:04A watchdog probes alleged social security data mishandling. Patch Tuesday lands. Governments brace for cyber fallout from Iran. Beat bankers spread via fixed starlink apps. Install fixed targets developers. Zombies zip hides malware and archives. DHS reassigns CBP officials in a FOIA secrecy dispute. Ben Yellen unpacks andthropics lawsuit against the Pentagon. And AI I wear leads to awkward exposures. It's Wednesday, March 11th, 2026. I'm Dave Bittner and this is your CyberWire Intel briefing.

2:09Thanks for joining us here today. It's great to have you with us. The Senate has confirmed General Joshua Rudd to lead both the National Security Agency and US CyberCommand. Feeling a critical national security role vacant since April. Lawmakers approved Rudd in a 71 to 29 vote yesterday. He becomes the first Senate confirmed leader since President Donald Trump fired General Timothy Hogg last April. Lieutenant General William Hartman has served as acting chief since then and plans to retire after Rudd is sworn in. Trump nominated Rudd in December. Rudd previously served as deputy director of US Indo-Pacific Command. He has decades of military experience, though none in cybersecurity leadership roles. The confirmation drew criticism from Senator Ron Wyden, who cited concerns about Rudd's cyber experience and his understanding of national security agency surveillance authorities.

3:12Rudd told lawmakers he will continue evaluating the long debated dual hat structure and defended Section 702 of the Foreign Intelligence Surveillance Act, which expires in April. The Social Security Administration's Inspector General is investigating a whistleblower complaint alleging a former US Doge service engineer claimed access to highly sensitive citizen databases and intended to share the data with a private agency. According to the complaint, the former employee allegedly told colleagues he possessed copies of two restricted Social Security databases, Numadent and the master death file, which together contain records on more than 500 million living and deceased Americans. The records include Social Security numbers and other identifying information. The complaint alleges he stored at least one data set on a thumb drive and sought help transferring it to a personal computer to sanitize before you set a contractor.

4:17The allegations do not claim the data was successfully transferred. The Inspector General has notified Congress and shared the disclosure with the government accountability office. The claims raise concerns about potential mishandling of highly sensitive federal data, agency officials and the former employee deny wrongdoing and investigations are ongoing. Yesterday was patched Tuesday and Microsoft has released security updates addressing 83 vulnerabilities across its products. None of the flaws are currently known to be exploited in the wild, though two vulnerabilities were publicly disclosed before patches were released. The update includes one critical bug, a remote code execution issue in the device's pricing program that Microsoft says has already been mitigated. Other notable issues include privilege escalation flaws in Windows components and an Azure MCP server tools vulnerability that could allow attackers to capture a managed identity token by submitting crafted input.

5:23Additional Azure flaws affect Linux virtual machines and Azure IoT Explorer privilege escalation bugs are often used after attackers gain initial access, making timely patching important even in quieter update cycles. Adobe has released security updates addressing 80 vulnerabilities across eight products, including Adobe Commerce, Illustrator, Acrobat Reader and Premier Pro. The largest set of fixes targets 19 flaws in Adobe Commerce and magento open source, including several high severity privilege escalation bugs and a security feature bypass. Adobe urged users to apply these patches within 30 days because the platforms are frequent targets for attackers. Additional updates address vulnerabilities that could lead to arbitrary code execution in Illustrator, Acrobat Reader, Premier Pro and other tools. Adobe says none of the flaws are currently known to be exploited.

6:27Fortinet, Avanti and Intel have released security updates addressing dozens of vulnerabilities across enterprise and firmware products. Fortinet patch 22 flaws affecting products, including Forta Web, Forta Switch, AX Fixed, Forta Manager and Forta client Linux. Several high severity issues could allow remote attackers to bypass authentication limits or execute unauthorized commands. While a Forta client Linux flaw could enable local privilege escalation to root. Avanti a fixed a high severity privilege escalation bug in desktop and server management, Intel also disclosed nine vulnerabilities in the UEFI firmware for certain reference platforms and issued updates affecting more than 45 processor models. Major industrial technology vendors, including Siemens Schneider Electric, Mitsubishi Electric and MoxA have released patch Tuesday advisories addressing newly discovered vulnerabilities in industrial control system products.

7:31Schneider Electric disclosed six issues, including high severity flaws affecting eco structure platforms that could enable command execution, arbitrary code execution or system compromise. Siemens also published six advisories, including a critical stored cross site scripting vulnerability in somatic S7 1500 devices. Mitsubishi Electric reported a remotely exploitable denial of service flaw in several numerical control systems. MoxA issued four advisories, largely tied to vulnerabilities in Intel components. State and local government officials are being urged to prepare for potential cyber and physical threats following US and Israeli military strikes on Iran during a briefing hosted by the Center for Internet Securities Multi-State Information Sharing and Analysis Center. Officials warned that governments could face increased low level cyber activity, including DDoS attacks and website defacements.

8:36Threat intelligence leaders said politically motivated activist groups aligned with Iran or Russia are forming coalitions that could expand targeting capabilities. Officials also warned that damage to regional infrastructure, including cloud data centers and shipping routes could disrupt global technology supply chains and online services. Researchers have identified a new Android malware strain called BeatBanker that spreads through fake websites impersonating the Google Play Store and posing as a starlink app. According to Kaspersky, the malware combines banking Trojan capabilities with cryptocurrency mining. It can steal credentials, manipulate cryptocurrency transactions, and mine Monero on infected devices. Recent variants also deploy the BitMob Remote Access Trojan, giving attackers full control of the device, including key logging, screen recording, camera access, and GPS tracking.

9:38BeatBanker uses several evasion techniques, including delayed execution and a persistence method that continuously plays a near silent audio file to keep the malware running. Researchers are warning about a new social engineering tactic called install fix that tricks users into installing malware by posing as legitimate command line tool installers. According to push security, attackers create cloned installation pages for popular developer tools and replace legitimate setup commands with malicious ones. The technique targets users who copy and run curl to bash commands commonly used to install command line interfaces. One observed command cloned the installation page for Anthropics Claude Code tool and promoted it through Google search ads. The malicious commands delivered Amatera Stealer malware designed to steal credentials, browser data, and cryptocurrency wallet information.

10:40The attack exploits common developer workflows and trusted installation practices, making malicious commands harder for users to detect. Researchers have disclosed a new evasion technique called zombie zip that can conceal malicious payloads inside compressed archives while bypassing many security scanners. The method manipulates zip file headers, so security tools treat compressed data as uncompressed. According to Bombadil Systems Researcher Chris Aziz, many antivirus engines trust the zip headers compression method field and scan the archive incorrectly, seeing only compressed noise rather than the actual payload. Standard extraction tools such as WinRAR and 7ZIP typically fail to unpack the files showing errors or corrupted data. A custom loader that ignores the header, however, can correctly decompress the hidden payload.

11:40Cert coordination center has issued a warning and assigned the issue a CVE. The Department of Homeland Security reassigned several career customs and border protection officials after they objected to orders to restrict the release of surveillance records under the Freedom of Information Act. According to reporting reviewed by Wired, DHS directed staff to label privacy threshold analyses, compliance forms describing how government technologies collect personal data as drafts and legally privileged documents. Sources say the move followed the public release of a redacted assessment describing mobile fortify, a facial recognition application used by CBP. The reassigned officials include the agency's top privacy officer, a privacy branch chief, and the director of the FOIA office. Critics argue the policy could allow the departments to withhold records detailing surveillance tools and privacy impacts.

12:45Restricting access to these documents could limit public oversight of government surveillance technologies. Coming up after the break, Ben Yellen unpacks and tropics lawsuit against the Pentagon and AII wear leads to awkward exposures. Stay with us. No, it's not your imagination. Risk and regulation really are ramping up and these days customers expect proof of security before they'll even do business. That's where Vanta comes in. Vanta automates your compliance process and brings compliance, risk, and customer trust together on one AI-powered platform.

13:49So whether you're getting ready for a SOC-2 or managing an enterprise governance risk and compliance program, Vanta helps keep you secure and keeps your deals moving. Companies like Ramp and Riders spend 82% less time on audits with Vanta. That means less time chasing paperwork and more time focused on growth. For me, it comes down to this. Over 10,000 companies from startups to large enterprises trust Vanta to help prove their security. Get started at Vanta.com slash cyber. Most environments trust far more than they should and attackers know it. Threat Locker solves that by enforcing default and I at the point of execution. With Threat Locker allow listing, you stop unknown executables cold. With ring fencing, you control how trusted applications behave. And with Threat Locker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliant standards.

14:59Threat Locker is the simplest way to enforce zero trust principles without the operational pain. It's powerful protection that gives CISO's real visibility, real control, and real peace of mind. Threat Locker makes zero trust attainable even for small security teams. CY thousands of organizations choose Threat Locker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo at Threat Locker.com slash N2K today. And joining me once again is Ben Yellen. He is from the University of Maryland Center for Cyber Health and Hazard Strategies. But more important than that, he is my co-host on the caveat podcast where we discuss privacy surveillance law and policy. Ben, welcome back. Good to be with you again, Dave. So let's jump in here with the latest on this kerfuffle between anthropic and the Pentagon. Can you bring us up to date here, Ben?

16:08Sure. So just to catch everybody up, anthropic had a deal with the Pentagon. They were going to be involved in a bunch of different department of war. I guess I should call it activities. But they tried to put up some guardrails saying that they weren't going to be fully compliant when it came to fully autonomous weapon systems and mass domestic surveillance. And that disagreement came out into public view at the end of February. And then the Pentagon not only decided to terminate the contract with anthropic, but the administration issued this executive order saying that because anthropic now represents a risk to the supply chain, any federal agency and any federal contractor is prohibited from doing business with anthropic. And then the particular contract with the Pentagon was replaced with a contract with open AI, so a different company. Anthropic is filing a lawsuit in federal court in the northern district of California, challenging this executive order.

17:11I think they are mildly upset about the fact they lost this Pentagon contract, but they are far more upset. And I think reasonably so with this designation of them as a supply chain risk, they think that this designation is pretextual, that it is punishing them for their position on AI ethics and the use of their AI tools for such serious things as autonomous weapon systems and mass surveillance. So their lawsuit is on a couple of grounds. First that this is arbitrary and capricious under the administrative procedure act. The argument here is that this is an administrative action that so far a field of the administration's authority and is arbitrary in a sense that it doesn't actually further any meaningful government interests in a compelling way. So that's one part of their argument. The other part, which I think is more interesting for our purposes, is that this is a violation of the first amendment right to free speech and free association.

18:16What they are alleging in the suit is that they're being punished for their speech. And by speech, it's public pronouncements by the CEO about the risks of unregulated AI. And it's their very public refusal to give the Pentagon carte blanche when it comes to these particular issues. The Constitution obviously protects first amendment rights and the way the Supreme Court has interpreted that is if the government is trying to take away constitutional rights as it relates to the content of speech, the government has to have a very good reason to do so. And that's called strict scrutiny and under strict scrutiny, the government has to have a compelling interest. And I think you could make an argument and the government will make the argument that national security is a compelling interest. But the means of achieving that interest have to be narrowly tailored. And I think that's where the government is going to run into problems. If the government actually thought that anthropic represented some type of national security threat, then I think it would have been appropriate for them to terminate the Pentagon contract, but not to prohibit any other federal agency or contractor from coming up with an agreement with anthropic for the use of their AI tools for even but not all.

19:29But not all occurrences, like summarizing data in the Department of Treasury for the Bureau of Labor Statistics. We mentioned on caveat, you know, coming up with nutritional menus for kids in schools or something, you know, something having nothing to do with national security. Right. So it goes so far afield of what the government's purported interest is here, compelling interest for the purposes of strict scrutiny that I think there's a very good chance that the federal court in the northern district of California issues, some type of preliminary injunction or temporary restraining order, preventing the federal government from enforcing this administration's action on the supply chain risk issue. And so suppose they rule in anthropics favor, what does that mean? Do they and they still don't get the Pentagon contract, but they're also they don't have this poison pill for the for excluding them from the entire federal government. Exactly. So the remedy is a little bit complicated here, but I think the most likely scenario is yes, they would not renew that Pentagon contract that had previously been in place.

20:39I think the new contract with open AI, which was agreed to on the same day that anthropic was put on this naughty list for supply chain purposes. That's going to stay in place, but I think they would now be at least temporarily able to contract with federal agencies and contractors for business purposes to sell the whatever clause service is most valuable to a particular federal agency or contractor. There are questions about whether a anthropic would want to do that or given the chance of this being some type of injunction being reversed on appeal at a federal appeals court, whether agencies or federal contractors are going to want to take that risk. And I think there could be a chilling effect where even if there's a favorable court ruling that removes the supply chain risk designation from anthropic, you get contractors and federal agencies saying, OK, let's see what happens first. We don't want to be in a situation where we've developed the system and then.

21:42Anthropics contract with the federal government are summarily terminated once again, because of an appeals court holding. So certainly those are considerations, but I do think. And this is me prognosticating, which is never, never safe. If you look at my record of bets on the fan duel, you don't want to take my, my predictions at face value necessarily, but I do think that anthropic has a very good case here. All right. Well, we will have a link to that story in the show notes. Ben Yellen is from the University of Maryland Center for Cyber Health and Hazard Strategies and also my co-host on the caveat podcast. Ben, thanks so much for joining us. Great to be with you, Dave. Ever wished you could rebuild your network from scratch to make it more secure, scalable and simple?

22:46Meet Meeter, the company reimagining enterprise networking from the ground up. Meeter builds full stack zero trust networks, including hardware, firmware and software all designed to work seamlessly together. The result, fast, reliable and secure connectivity without the constant patching, vendor juggling or hidden costs. From wired and wireless to routing, switching firewalls, DNS security and VPN, every layer is integrated and continuously protected in one unified platform. And since it's delivered as one predictable monthly service, you skip the heavy capital costs and endless upgrade cycles. Meeter even buys back your old infrastructure to make switching effortless, transform complexity into simplicity and give your team time to focus on what really matters, helping your business and customers thrive. Learn more and book your demo at meter.com slash cyber wire. That's M-E-T-E-R dot com slash cyber wire.

23:57When cyber threats strike minutes matter, Booz Allen brings the same battle tested expertise trusted to protect national security to defend today's leading global organizations. They safeguard their data, strengthen enterprise resilience and mobilize in minutes across energy, healthcare, financial services and manufacturing. Their teams don't just respond, they anticipate, outthink and stay ahead of evolving threats. This is powerful protection for commercial leaders only from Booz Allen. See how your organization can prepare today at Booz Allen dot com slash commercial. And finally, Meta's AI smart glasses promised hands-free insight into the world around you.

24:58Some users now suspect the world, unfortunately, was looking back. A new class action lawsuit alleges Meta misled customers about privacy protections after reporting found contractors at a Kenya-based subcontractor reviewing footage captured by the glasses. According to the complaint, that footage sometimes included extremely private moments, including nudity and other intimate situations. The plaintiffs argue Meta's marketing, which described the glasses as built for your privacy and controlled by you, did not make it clear that shared content could be reviewed by human moderators. Meta says human review may occur when users choose to share media with Meta AI, which the company says helps improve the service. The case underscores a growing reality of AI products, sometimes smart devices still rely on very human eyes.

26:09And that's the CyberWire, or links to all of today's stories check out our daily briefing at the CyberWire dot com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast apps. Please also fill out the survey in the show notes or send an email to CyberWire at N2K dot com. N2K's lead producers Liz Stokes were mixed by Tray Hester with original music and sound designed by Elliott Peltzman. Our contributing host is Maria Vermazis. Our executive producer is Jennifer Eibin. Peter Kilti is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. If you only attend one cybersecurity conference this year, make it RSAC 2026.

27:26It's happening March 23rd through the 26th in San Francisco, bringing together the global security community for four days of expert insights, hands on learning and real innovation. I'll say this plainly, I never miss this conference. The ideas and conversations stay with me all year. Join thousands of practitioners and leaders tackling today's toughest challenges and shaping what comes next. Register today at rsaconference.com slash CyberWire 26. I'll see you in San Francisco. When it comes to mobile application security, good enough is a risk. A recent survey shows that 72% of organizations reported at least one mobile application security incident last year and 92% of responders reported threat levels have increased in the past two years. Guard Square delivers the highest level of security for your mobile apps without compromising performance, time to market or user experience.

28:33Discover how Guard Square provides industry leading security for your Android and iOS apps at www.guardsquare.com