You're listening to the CyberWire network, powered by N2K. CyberRisks continue to evolve, and Travelers Cyber Threat Report helps organizations stay informed on what's changing across today's risk landscape. This quarter's report uses data from leak sites and Travelers' claims to examine the ransomware ecosystem and trends in account takeover attacks. It's a practical data-driven resource built to help security and insurance professionals better understand emerging cyber trends and what they could mean moving forward. Download the latest Travelers Cyber Threat Report today. Visit Travelers.com slash CyberWire.
Patch Tuesday is a doozy. The Fed's Warren China-based AI companies are distilling US AI models. A new click-fix campaign goes straight for the browser. Smart TVs get nosy. Packers gift themselves a $47 million bug bounty.
An Ohio man gets 15 years in federal prison for cyber stalking and sex-dorsion. Our guest is Andy Horngold, Chief Security Technologist from Intruder, discussing what makes up a reliable AI pen test. And putting AI at the head of the class. It's Wednesday, September 9th, 2026. I'm Dave Bittner and this is your CyberWire Intel Briefings.
Thanks for joining us here today. It's great to have you with us. Microsoft September Patch Tuesday is its largest on record with the company reporting fixes for 966 vulnerabilities. Independent tallies vary slightly but all point to an unusually heavy month. 105 vulnerabilities are rated critical. 258 involve remote code execution and 438 involve privilege escalation.
Two Windows zero days were already being exploited. One affects the Windows Update stack and can allow a local attacker to gain system privileges. Another, a buffer overflow in Windows ALPC can let an attacker escape a low-privileged app container and reach system. Neither provides an initial remote foothold. Both are useful for escalating privileges after a system has already been compromised.
Microsoft also patched critical vulnerabilities across core networking services including DNS, DHCP, NetLogon, MessagingQ and NFS. CrowdStrike identified at least 17 remote code execution flaws reachable over the network without authentication. Office received 22 critical fixes including vulnerabilities that could potentially execute code when a malicious file is merely previewed. Hyper-V flaws can enable attacks from a compromised guest virtual machine against its host. The broader September Patch cycle is similarly busy. Adobe fixed more than 170 vulnerabilities including an actively exploited,
Unauthenticated Commerce and Magento RCE zero-day. Google patched 230 Chrome vulnerabilities including the browser's seventh exploited zero-day of 2026. Evanti addressed six critical RCE vulnerabilities in neurons for ITSM while Schneider Electric, Siemens, Aviva and Rockwell automation issued updates covering industrial systems. CISA, the NSA and FBI are warning that China-based AI companies have been systematically extracting capabilities from leading US AI models through large-scale knowledge distillation campaigns. The agencies say DeepSeek, Moonshot AI, Alibaba, Minimax, StepFun and ZAI have extracted billions of tokens through millions of requests involving models including Claude, GPT, Gemini and Grock since at least late 2024.
Knowledge distillation is a legitimate technique for training smaller models using outputs from more capable ones, but the advisory says these campaigns violate US providers' terms of service and accelerate Chinese AI development. The agency's assess the activity is occurring likely with Chinese government awareness. The advisory urges US AI companies to improve detection of suspicious accounts and usage patterns, alter responses to suspected distillation attempts to reduce their value and share intelligence across model providers, cloud platforms and API aggregators. Maria Vermasas is host of the T-minus space cyber podcast. She joins us each Wednesday with the latest news from space. Today, it's about European sovereignty.
Thank you, Dave. This past Saturday on September 5, ISAR Aerospace of Germany made history with the first launched orbit from the European continent. ISAR's Spectrum Rocket launched from Andoya Spaceport in Norway and successfully deployed six satellites to low Earth orbit. Now, ISAR is a commercial space company with a large backing from the European Space Agency, and their successful launch from Norway means Europe will now have launch options much closer to home beyond the ESA spaceport in Karu, French Guiana. With the proven ability to launch to orbit from European soil with homegrown European rocketry, the push now is to scale up and increase launch cadence to meet growing demand from European customers.
Along those lines, ISAR says four additional Spectrum rockets are already in production and that the company plans to manufacture up to 40 Spectrum launch vehicles a year when their new production facility is complete. In all, ISAR's successful orbital launch is a major step forward for European Space sovereignty, especially as Europe continues to build out its high priority, secure satellite communications constellation, the IRIS squared. For the Cyberwire Daily, I'm Maria Vermausses from T-minus Space Cyber Briefing. Back to you Dave. An investigation by Gamers-Nexis, Level 1 techs and independent security researchers found LG SmartTV's extensively collecting information about owners and their homes.
Tests found the TV scanning local networks for nearby devices, gathering location and Wi-Fi data and sending information to LG ad solutions. Researchers also found the TV's could record microphone audio while in standby, storing recordings offline until internet access returned. LG's automatic content recognition technology additionally samples audio and video to identify content viewed through SmartTV apps and connected devices, including HDMI inputs. A $320 million cryptocurrency theft from Liquid Network ended with the attackers returning most of the money and keeping about $47 million as a self-appointed bug bounty.
Liquid said purported White Hat hackers withdrew 4,000 Bitcoin from one of its wallets Sunday, prompting operator Blockstream to pause deposits and withdrawals. The attackers then opened negotiations through messages embedded in blockchain transactions, claiming they were White Hats and demanding that Blockstream patch and alleged vulnerability before they returned to the funds. After roughly 12 hours of public and private exchanges, the hackers returned about 266.5 million on Monday and retained 598.5 Bitcoin as their reward. Blockstream said updated software had been deployed as it prepared to restart the system.
The vulnerability's source remains debated, although side swap and several blockchain security experts have pointed to a flaw in elements, the software underlying blockstreams. The software has been sent to the last 15 years in federal prison for a cyber stalking and sex-stortion campaign that used artificial intelligence to create sexually explicit material depicting his victims. Prosecutors say 37-year-old James Strawler, the second, used more than 100 AI models across more than two dozen platforms to generate explicit images and videos. Between December 2024 and June 2025, he harassed at least six adult women, sending both authentic and AI-generated nude images, threatening victims with sexual violence and sharing fabricated explicit material with their calls.
He also threatened victims' mothers in an effort to obtain nude photographs. Investigators found more than 700 images Strawler had posted to a child sexual abuse website, along with thousands of potentially abusive or violent files on his phone. Strawler pleaded guilty in April and became the first person convicted under the 2025 Take It Down Act, which prohibits publishing intimate images and AI-generated explicit forgeries without consent. Coming up after the break, my conversation with Andy Horngold from Intruder, we're discussing what makes up a reliable AI pen test and putting AI at the head of the class.
Stick around. Quick question, who or what has access to your critical systems right now? I'll give you a hint. It's not just employees anymore. It's vendors, machines, applications, workloads and so many AI agents.
Zage Security helps organizations control every identity with zero trust policies that govern what they can access, what they can do and when. Because when critical systems are at stake, compromised access can mean downtime, disrupted production and real-world consequences. Protect what matters most with the Zage Identity Fabric Platform. Learn more at zage.com. That's xag.com.
When you're running security for a fast-growing company, the stakes keep rising. More compliance frameworks, more vendors, more risk and a board that wants the whole picture in one place. The problem is, your compliance data usually isn't in one place. Controls live in one tool, vendor risk in another and customer commitments are buried in contracts. So your team spends more time stitching everything together and making decisions based on data that may already be a quarter old.
Vanta connects it all. Its agentic trust platform is built for enterprise scale with more than 400 integrations and continuous monitoring to automate evidence collection, surface the risks that matter and organize audits around your auditor's requirements. And the Vanta agent works around the clock with full program context, helping make sure nothing slips through the cracks. Vanta says customers see a 526% return on investment over three years with payback in three months. More than 16,000 companies trust Vanta, including Snowflake, Atlassian and Ramp.
Learn more at vanta.com slash cyber. The 2026 Chevrolet tracks is the stylish SUV for those on the move. And with the standard Chevy Safety Assist package, you have the backup to handle every turn with confidence. The 2026 tracks, Starcher Build at Chevrolet.ca. Andy Horngold is chief security technologist from Intruder.
We recently sat down to discuss what makes up a reliable AI pen test. Pen testing has come on leaps and bounds probably in the last, I'd say 24 months. I think everybody's come on leaps and bounds in the last eight, 12 months, right? The whole world seems to have shifted. I think professional services and human led pen testing has probably been under more pressure as of late from product led approaches to delivering security validation and security assurance.
Obviously, pen testing, human led pen testing has pretty much been pointing time for a very long time. And anybody who is a pen tester who works in security will tell you the continuous is definitely the way to go. But historically, it's been difficult to try and turn a human led approach into a continuous offering just because human time is expensive. You're tapped by people being on holiday and their availability. With the advent of AI being able to reason across applications, being able to hold entire code bases and infrastructure configurations and cloud configurations in its context window in one go, being able to reason across it, has certainly shifted things.
And finally, I think after probably a couple of decades of people saying that continuous is definitely the right approach. It feels like it's finally within grasp of having true security validation on continuously. So the people who are tasked with pen testing, what are some of the specific things they need to be mindful of these days in this new environment? I think in the new environment, you're able to do things significantly quicker than you were previously. Like I remember doing pen tests back in the day where you were asked to do source code reviews or these code assisted pen tests.
And you'd have to use one of the SaaS scanners, the static code analysis tools that was out there and was available. But it was always, it was always a headache. I don't think anybody, like when I ran a pen testing team over a context, nobody enjoyed doing that security code review side of things. I think there's very few people in the world who enjoy reading other people's code. But that's part of what we need to do when it comes to informed pen testing.
But now with the AI that's available, pen testers are able to do that more quickly. So they're able to reason across code. They're able to interrogate it. They're able to find answers to questions within a code base that historically would have taken them time to query across. I think the professional services industry is having a bit of a shake up at the moment and I put pen testing under professional services.
So I think there is some difficulty. The reason is just because AI pen testing is going to take up some of that market space. That's not to say I think AI pen testing is going to hoover up every part of pen testing. I think there's still expert T-slared, experienced-led components of pen testing that's really important. Like when you're dealing with safety systems, I see SOT, weird and wonderful networks.
I think that's still going to be human-led pen testing. But right now I think we're going to start to see that human come out of that loop for the day-to-day, probably more mundane business-as-usual style pen testing. And I think that's definitely going to impact the way people are operating within the professional services space. I know you've advocated for the importance of benchmarks provided by an independent party here. Can you explain that to us? Why is that important for AI pen testing?
Sure thing. I think coming from pen testing and red teaming myself, if you're a consumer, if you're somebody who's going out to buy a pen test, you want to make sure that you have some level of assurance of the quality of that pen test, of that red team, whatever it may be. You need to know that I'm going to have somebody on my side who is able to do what I need them to. They're not just going to be some, for lack of a better phrase, cowboy who's going to come on and potentially not do what they've told me they can do or they should be doing. And we've done that historically, using benchmarks and using qualifications.
So you'll often hear people say I have OSWE, like, offset qualifications, and as I can see, you can say, okay, the pen testing firm that I'm buying from has a certain level of certification. That's not necessarily going to say that the individual pen tester that is assigned to your gig is necessarily going to have all of those qualifications, but you know you're getting it from a legitimate firm. Now, when it comes to the AI side of things, we don't really have any of that kind of understanding of what is the level of quality each of these models with their harnesses. These AI pen testers are actually capable of delivering. Are they able to deliver at kind of a certified level, at a high level, like a highly experienced pen tester would be able to deliver?
Or are they just going to be able to do the basic checks that we expect of junior pen testers graduates who are just coming out of university? And that's really important. It's really important to be able to say with confidence that the pen test I've just received has some level of quality to it. So that's why I think over the last few months we've been investigating, what does certification look like for this new wave of AI pen testers? What does it take for somebody to accept that the AI pen tester they've just had run for them is of quality?
No, don't get me wrong. The findings that we're seeing within AI pen testing are eye-wateringly good. They are finding things that experienced pen testers haven't been able to find for kind of the last five, six years. They're chaining together really complicated attack parts and building this understanding of risk through applications and infrastructure that have kind of laid dormant for years. So that kind of gives you some confidence that the quality is there, but how do we benchmark it?
And we're seeing kind of a combination of things happen to give people that kind of trust. We're seeing benchmarks from private organizations saying, hey, this model performs slightly better at this benchmark than this other model does. We're seeing private companies kind of compare themselves against each other, but all of those are led predominantly by the marketing approach. You're going to see some favoritism in there. Now in the UK and actually US, Australia as well, one of the certification approaches we've had historically has been called CREST, the Council for Registered Ethical Security Testers.
And they've put pen testers through exams, through assault courses to be able to say whether they reach a certain bar. My opinion is that I think we need something independent, third party, that can deliver the same kind of certification and benchmarking for AI pen testers at large. There's an increasing number of AI pen testing firms springing up. So how do we have a third party independent organization that's able to give us that certification rather than just hearing the noise that comes with a huge multi-hundreds of thousands of dollars marketing campaign? In your opinion, what are the types of things that organizations should be asking of the folks that they're engaging with to do their pen testing?
I mean, if we're talking specifically around the kind of the AI pen testing approach, I think there's a bunch of different questions you can ask. One of which is kind of like, what is the history? What is the heritage, if you will, of the organization that is providing this pen test? Is it run by people who have security experience, who have been in the trenches, who have delivered pen tests in the past, who have run red teams, have they got a security team who have experienced an expertise? So they already qualified, and now they're applying those qualifications and that knowledge to building this new technology.
I think that's super important. As you start to see smaller businesses spring up out of nowhere and start to say they're delivering AI pen testing, being able to make sure that there is a culture of quality that has come from years of security testing, in my opinion, is super important. I don't know, Dave, if you've been involved on the pen testing procurement side of things and the kinds of questions you've asked people in the past, but have you thought about kind of the heritage and the culture of the company that you're acquiring a pen test from? I have never had the privilege now, Andy. That might be a good thing. I'm... I can't say I stay up at night wishing that I was involved with that, but I'm glad there are people out there who know the right questions to ask, such as yourself.
Thank you. I think that's one of the big questions I would ask. There's obviously one of the technical questions there. The West Island Sea as well, right? We're starting to see people ask, you know, what are the models that you're using under the hood?
What's the methodology that you're following and how can you guarantee the agents are following that methodology? These are all kind of fun questions to answer. They're difficult to answer for pen testing AI testing firms in particular because AI agents and models are non-deterministic. So when you try and steer these agents to follow a strict methodology, they tend to get tunnel vision and they will only follow that methodology. And as a result, within open benchmarks or in your testing evals, you start to see the quality of that pen test deteriorate.
It finds less vulnerabilities than if you just let the agent reason over the entire code base and follow its own nose. It's kind of funny because it follows what a human pen sester would do as well, right? Like we've had methodologies for a long time. We've had methodologies because we want to make sure that the human pen sester is doing everything that they should be doing during engagement. But a good pen sester, a good red teamer, initially will follow their nose, they'll understand the application, they'll understand the environment, they're operating in, work out how it's all bolted together and what the workflows and user journeys are.
And then they'll start to find vulnerabilities naturally. And then towards the end of that assessment, that's when they'll refer to the methodology and they'll start to say, okay, you know, I followed my nose, I found some cool vulnerabilities and cool risks within this app, within this environment. But now I just need to make sure I'm dotting the eyes and crossing the tees and I'll do that by referring back to the methodology. An agent does the same thing, right? It goes through that code base, it reasons through it and it will find interesting violence.
But at the end of the day, you don't need to rely just on that agent to deliver that methodology or deliver that AI-driven pen sester, right? The AI can do that cool reasoning, but then you can layer on top of it heuristic tools and deterministic tools, like, you know, checking for TLS ciphers, for example. You don't need an agent to do that. You could run an agent if you want to go really deep on pen sester, like OpenSSL, for example. So just to check whether it's TLS cipher or weak TLS cipher is in use, you can use test SSL.sh just a tool that you can run and you'll be able to get the output.
So using a combination of both the agent and then those deterministic tools as well gives you a pretty decent coverage of standard methodology. So that's where that question of like, how are you ensuring coverage of my application is really important too? That's Andy Horngold from Intruder. Every time your team deploys a new cloud workload or AI agent, another identity gets permitted access to your critical systems. Legacy tools were built to manage human employees, leaving modern machine and AI access largely unmanaged.
That's where IDRA by Palo Alto Networks comes in. Human, machine, AI, one identity platform for all. IDRA replaces permanent permissions with dynamic access, so you can lock down every identity without slowing down your business. Secure every identity with IDRA by Palo Alto Networks. Visit Palo Alto Networks slash IDRA. Again, that's Palo Alto Networks.com slash IDRA.
And now a word from our sponsor, SpectorOps. Today AI is rapidly adding non-human and agentic identities to modern enterprise environments, creating new trust relationships and attack paths. Bloodhound Enterprise helps defenders map attack paths across AWS and hybrid environments as one connected graph, identify the choke points that matter most, and bring trusted attack path intelligence into approved AI workflows with Bloodhound Hunter. See how SpectorOps helps teams secure the AI-driven identity era at SpectorOps.io.
And finally, an elite private school called Alpha School is betting that the future of education looks a little like a self-driving car. Feed an AI enough examples of wrong turns, unexpected obstacles and student misconceptions, and eventually it learns to navigate. At Alpha, students spend about two hours each morning with adaptive AI tutors, followed by workshops in coding, entrepreneurship and other life skills.
The private school company, where tuition can reach $75,000 a year, plans to expand to roughly 50 US campuses this fall. There's evidence behind parts of the concept. Research has found adaptive AI tutoring can improve learning, including a Harvard study where students using an AI tutor achieve more than twice the median learning gains of students using classroom active learning strategies. But researchers caution that effective tutoring isn't necessarily effective schooling. Critics worry about replacing trained teachers, weakening teacher-student relationships, and producing knowledge that works inside the software but doesn't travel well outside it.
The AI tutor may know the route, whether it should drive the whole school bus remains another question. And that's the Cyberwire, for links to all of today's stories, check out our daily briefing at the Cyberwire.com. We'd love to know what you think of this podcast, your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to Cyberwire at N2K.com.
N2K's lead producer is Liz Stokes, we're mixed by Trey Hester with original music and sound design by Elliot Peltsman. The contributing host is Maria Vermasas, our executive producer is Jennifer Ivan, Peter Kipias, our publisher, and I gave Bitner. Thanks for listening, we'll see you back here, tomorrow. Yes, you can have an enterprise network that's secure and reliable and high performance.
And no, you don't need to choose the best two out of three. With Metre, you can get the end-to-end network built from the ground up, fast to deploy, and easy to manage. That's because Metre is software-led for easy installation, maintenance, and control for everything running on your enterprise network. Hardware, firmware, and software all working together from the start seamlessly on a unified platform that's secure by design. You can't protect what you don't know exists, which is why Metre gives you comprehensive visibility into wired and wireless routing, switching firewalls, DNS security, and VPNs.
You'll really know what's running on your network down to the most granular client level. Step off the hardware box, upgrade treadmill, and switch to Metre for a predictable fee and free up your team to spend time on all the other things that keep your business running. Try it out for yourself and book a demo online at Metre.com. That's M-E-T-E-R dot com slash Cyberwire. In 2002, Ryan Wedding was an Olympic snowboarder at the top of his game.
Ryan's style has really gunted and gold. And in less than a minute, it slipped away, but he continued to chase the high. Ryan James Wedding, he controls one of the most violent drug trafficking organizations in this world. I'm Michelle Shepard, and from CBC Podcasts and the Toronto Star, the most wanted Olympian. The most wanted Olympian, available now on Spotify.