Daily Cyber & AI Briefing — 2026-06-26

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.TranscriptToday’s landscape of cyber and AI risk is defined by relentless innovation—on both sides of the security equation. As organizations accelerate digital transformation, threat actors are evolving just as quickly, exploiting new vulnerabilities and targeting the most critical business assets. In this briefing, we’ll break down the latest developments shaping enterprise risk, from major breaches and zero-day exploits to shifts in AI governance and the security workforce.Let’s start with one of the most impactful incidents making headlines: the ShinyHunters breach of Oracle PeopleSoft. ShinyHunters, a group well-known for targeting enterprise software, has successfully compromised Oracle PeopleSoft systems at over a hundred organizations. This is not just another breach—it’s a stark reminder of how deeply interconnected our digital supply chains are, and how vulnerable even the most established platforms can be.Attackers in this case leveraged a combination of known vulnerabilities and zero-day exploits, gaining access to sensitive enterprise data across sectors. The scale of this breach highlights the persistent risk posed by third-party and supply chain software. For risk leaders, the implications are clear: it’s no longer enough to secure your own environment. You have to rigorously manage third-party risk, continuously monitor your critical business applications, and ensure that your vendors are upholding the same security standards you expect internally.This incident also brings into focus the challenge of visibility. Many organizations rely on PeopleSoft for core business functions—HR, finance, supply chain management. When a breach like this occurs, it’s not just about data loss; it’s about the potential for operational disruption, regulatory exposure, and long-term reputational damage. The lesson here is that continuous monitoring and robust third-party risk management aren’t optional—they’re foundational to enterprise resilience.Moving from supply chain risk to infrastructure, let’s talk about the ongoing exploitation of vulnerabilities in Cisco Unified Communications Manager. The Cybersecurity and Infrastructure Security Agency, or CISA, has issued multiple alerts about active attacks targeting flaws in Cisco’s Unified Communications Manager and Session Management Edition. These vulnerabilities are now part of CISA’s Known Exploited Vulnerabilities catalog—a clear signal that exploitation is happening in the wild, not just in theoretical lab scenarios.What’s particularly concerning about these Cisco vulnerabilities is their potential to enable remote code execution and lateral movement within enterprise networks. In practical terms, that means an attacker could gain a foothold in your communications infrastructure and then pivot to other critical systems. For organizations running Cisco Unified CM, the guidance is straightforward: prioritize patching immediately, review your deployment configurations, and monitor for indicators of compromise. The window between vulnerability disclosure and exploitation is shrinking, and attackers are moving faster than ever.We’re also seeing the first confirmed exploitation of a vulnerability in PTC Windchill, a widely used product lifecycle management platform. This is significant, especially for organizations in engineering and manufacturing, where Windchill is often central to managing sensitive design and production data. Security researchers have observed attackers leveraging this flaw to gain unauthorized access to proprietary information—potentially putting intellectual property and competitive advantage at risk.If your organization uses Windchill, now is the time to act. Patch the vulnerability as soon as possible, and review your access controls to ensure that only authorized users have access to sensitive data. This is another example of how attackers are expanding their focus beyond traditional IT targets to include operational technology and engineering platforms.The threat landscape is also being reshaped by a surge in advanced malware. Three strains in particular—KuinaExtractor, SharkLoader, and Miasma—are making waves for their sophisticated evasion techniques. These tools are designed to slip past traditional defenses, using methods like sandbox detection, User Account Control bypass, and novel dropper mechanisms to avoid detection and deliver their payloads.KuinaExtractor, for example, uses encrypted channels such as Telegram to exfiltrate data, making it harder for defenders to spot malicious activity. SharkLoader is being deployed in targeted attacks against government agencies and software development firms, enabling stealthy delivery of secondary payloads. Miasma, meanwhile, is part of a broader trend of malware leveraging supply chain weaknesses to reach their targets.For security teams, the takeaway is clear: endpoint detection and response solutions must go beyond signature-based detection. Behavioral analytics, anomaly detection, and continuous monitoring are essential to catch these advanced threats before they can do real damage. It’s also critical to review your software supply chain controls. Attackers are increasingly targeting the links between organizations—partners, vendors, and service providers—knowing that a single weak point can open the door to a much larger breach.The market is responding to these challenges with significant investment in fraud prevention and cloud security. Incode’s recent acquisition of Identiq for $100 million is a case in point. This move underscores the growing importance of identity verification and privacy-preserving solutions, especially as more business moves to the cloud and digital transactions become the norm.Identiq’s technology focuses on enabling organizations to verify identities without sharing sensitive personal data—a key capability for reducing fraud risk while maintaining privacy. For financial services, e-commerce, and any sector dealing with high-value transactions, these kinds of solutions are becoming indispensable. The acquisition is expected to accelerate innovation in this space, giving organizations new tools to combat fraud and identity theft.Cloud risk is another area seeing increased attention and investment. Aryon, a security startup, has raised $29 million to develop solutions that identify and mitigate cloud risks before deployment. This reflects a broader industry shift toward proactive cloud security—moving away from reactive incident response and toward automated risk assessment and policy enforcement.As organizations accelerate their adoption of cloud infrastructure, the complexity of managing risk grows. Misconfigurations, excessive permissions, and unvetted third-party integrations can all introduce vulnerabilities. Aryon’s approach is to catch these issues before workloads go live, reducing the attack surface and helping organizations maintain compliance with regulatory requirements.The need for proactive cloud risk management is only going to increase as more organizations embrace multi-cloud and hybrid environments. Automated tools that can assess risk and enforce policy at scale are quickly becoming a must-have for any organization serious about security.Let’s circle back to the malware landscape for a moment. The SharkLoader dropper, in particular, is being used in targeted attacks against governments and software development firms. This tool enables attackers to deliver secondary payloads in a stealthy manner, often as part of a broader supply chain attack. The use of droppers like SharkLoader highlights the importance of monitoring for anomalous activity—not just at the endpoint, but across the entire software development and deployment pipeline.Security teams should be reviewing their supply chain controls, validating the integrity of software updates, and monitoring for unexpected changes in system behavior. The goal is to catch malicious activity early, before attackers can escalate privileges or move laterally within the network.CISA’s decision to add Cisco Unified Communications Manager vulnerabilities to its Known Exploited Vulnerabilities catalog is another indicator of the urgency surrounding these flaws. Organizations are urged to prioritize remediation and to monitor for indicators of compromise. Exploitation is ongoing, and the longer these vulnerabilities remain unpatched, the greater the risk of a successful attack.Shifting gears to AI governance, we’re seeing new challenges emerge as organizations deploy agentic AI workspaces—particularly in the Asia-Pacific region. Agentic AI refers to systems that can act autonomously, making decisions and taking actions on behalf of users or organizations. While these capabilities can drive efficiency and innovation, they also introduce new risks around security, privacy, and regulatory compliance.Ensuring the secure deployment and operation of AI agents requires robust access controls, continuous monitoring, and alignment with evolving regulatory requirements. For risk leaders, this means evaluating and updating AI governance frameworks to address the unique risks posed by autonomous systems. It’s not just about preventing unauthorized access—it’s about ensuring that AI agents act in accordance with organizational policy and ethical standards.The financial sector, in particular, is feeling the pressure to enhance AI governance. As AI-driven decision-making becomes more common in banking and financial services, the need for transparent and auditable controls is paramount. Industry voices are calling for stronger frameworks to maintain trust—both with regulators and with customers.Without proper g