You're listening to the Cyber Wire Network, powered by N2K. Your IT team wasn't hired to manually manage endpoints. So why do they spend so much time doing just that? As AI-driven threats move faster, Avanti helps IT teams scale their efforts while minimizing risk with autonomous IT solutions. Avanti proactively identifies and resolves endpoint issues to reduce disruption and boost security. Meet endpoint autonomy that doesn't go rogue because it's grounded in verified data. Scale fearlessly at Avanti.com slash future. That's I-V-A-N-T-I dot com slash future.
So whether you're filling up your tank or filling up your grocery cart, You can earn more cash back on your everyday essentials. That's what we call cash maxing. Apply and earn a welcome bonus of up to $400 in value. CIBC, ambitions made real.
Meta settles. Australian police arrest two alleged teen PCP members. The White House moves to shore up water utility cybersecurity. ATF reports a major cyber incident. The Navy tells sailors to lock down social media. The FBI warns of a prolific Chinese hacking operation. Bill Gates sounds the alarm on AI. A purported think tank tries to influence chatbots. Attackers focus less on individual vulnerabilities and more on the vendors behind them. Our guest is Tim Springston, principal product manager at Sempris, on achieving hybrid identity resilience in the age of agentic AI. And Meta pumps the brakes on going AI native.
It's Thursday, August 27th, 2026. I'm Dave Bittner, and this is your CyberWire Intel Briefing. Thanks for joining us here today. It's great, as always, to have you with us. Meta has agreed to pay up to $18 billion over the next decade and impose new restrictions on teenage users of Facebook and Instagram, settling claims from nearly all US states that its platforms were designed to addict children and harmed their mental health. The agreement limits teens to two hours of daily use and blocks access from midnight to 6 a.m. without parental consent. Meta will also restrict most push notifications during school hours and strengthen protections against age-restricted content.
The settlement includes about $12.7 billion in guaranteed payments, with another $5 billion contingent on Snapchat, TikTok, and YouTube adopting similar safeguards. Meta also agreed to pay $459 million to resolve privacy claims stemming from the Cambridge Analytica scandal. Meta denied wrongdoing. The settlement ends a federal trial but leaves thousands of other lawsuits pending, including claims from individuals, schools, and governments alleging social media platforms contributed to a youth mental health crisis. Australian Federal Police have arrested two Western Australian men, aged 21 and 23, accused of involvement with Team PCP, the cybercrime group linked to an extensive campaign of software supply chain attacks and data extortion. Team PCP gained prominence in late 2025 by compromising open-source software packages and using the self-propagated Shai-Haloud worm to steal developer credentials and spread malicious code into additional projects.
Its campaigns included a compromise of the LightLLM AI gateway that researchers say exposed secrets from more than 2,500 organizations, as well as thousands of GitHub repositories. Krebs on Security identifies one arrested suspect as Team PCP spokesperson Ruben Thompson, based on extensive open-source research linking his online aliases to his real identity. Team PCP appears to operate less like a traditional criminal organization and more like a loose community of collaborating hackers. The two defendants face a combined 14 cybercrime offenses. Researchers say Team PCP's attacks also help push GitHub and other software ecosystems to strengthen supply chain security. Politico reports the Trump administration is preparing a program offering free cybersecurity services to vulnerable U.S. water utilities, following a surge of attacks that officials suspect may be linked to Iran. Led by the Office of the National Cyber Director, the initiative is expected to begin as a proof of concept in Texas before potentially expanding to other states. Utilities will receive services including network vulnerability scanning, with private cybersecurity companies reportedly helping provide the assistance.
The effort comes as water systems in at least a dozen states have faced attacks affecting IT and operational technology, sometimes forcing operators to use manual controls. Federal agencies recently warned of a significant increase in attacks targeting programmable logic controllers at water and wastewater facilities. The administration has not formally attributed the campaign to Iran. The Bureau of Alcohol, Tobacco, Firearms, and Explosives says hackers breached a standalone computer system containing information about targets of ATF investigations. The agency has designated the incident a major incident under federal guidelines. The Keelan Ransomware Group added ATF to its leak site Wednesday but did not publish samples of allegedly stolen data. ATF says the compromised system was isolated from its case management, laboratory, and e-forms systems and was quickly shut down after the breach was discovered. Officials say the attack did not affect the agency's operations.
The Justice Department is investigating while ATF has begun forensic and incident response work. Keelan remains a prolific ransomware operation, with researchers ranking it as the second most active ransomware group in July, with 127 reported attacks. The U.S. Navy is warning its entire workforce, roughly 608,000 active duty personnel, reservists, and civilian employees, to tighten their social media security amid what it describes as a coordinated intelligence gathering campaign by adversaries. In a new bulletin, the Navy advises personnel and their families to enable privacy settings and remove information linking them to the service or revealing locations and routines that could be exploited.
Personnel are also being told to report suspicious activity, including surveillance of installations, drones near bases, questions about ship movements being followed off-base, and fake social media accounts impersonating sailors. The warning comes amid the U.S.-Israeli military campaign against Iran. While some commenters have questioned its timing, the Navy says adversaries are attempting to gather intelligence, test defenses, disrupt operations, and intimidate personnel. The FBI is warning that a sophisticated Chinese hacking group known as QTFI has spent years targeting U.S. government agencies and critical infrastructure, including defense contractors, communications providers, financial institutions, and universities. The group uses a custom ecosystem of tools, including QSCAN, a platform for identifying and exploiting vulnerable systems, and QT Router, which routes malicious traffic through compromised IoT devices to obscure its origins. In 2024, QTFI reportedly exfiltrated data for more than 300 organizations after exploiting a checkpoint quantum gateway vulnerability.
The FBI attributes QTFI to a Chinese company linked to PRC cyber operations. U.S. authorities announced Wednesday that they had disrupted QSCAN and QT Router. Agencies are urging organizations to patch systems, isolate critical infrastructure from edge devices, hunt for compromise, and audit applications for exposed credentials. Microsoft co-founder Bill Gates is warning that artificial intelligence could usher in one of the most turbulent periods in human history unless governments act quickly to manage its risks. In a new essay, Gates argues that rapidly improving AI could replace humans across many tasks, causing widespread job losses, economic disruption, and greater inequality. Gates says global efforts to prepare for the transition are inadequate and suggests policies including taxes on AI usage and robots that replace workers. Revenue could support retraining programs and stronger safety nets.
He also proposes reserving some roles, including caregiving and certain medical work, for humans. University of Washington computer science professor Oren Etzioni agreed with Gates' concerns, but questioned some proposed solutions, particularly taxing AI tokens. He warned that slowing U.S. development could also put American companies at a disadvantage against foreign competitors. A website presenting itself as the Hanover Institute for Public Policy has published more than half a million words of pro-Israel content designed in part to influence how AI chatbots answer questions about Israel and Gaza, according to The Guardian. Their purported think tank has no apparent legal entity, physical address, named staff, or report bylines. Its articles resemble neutral academic research, but consistently frame disputed issues in ways favorable to Israel. The site was built using technology marketed to help content get cited by AI systems.
Pirro Inc., the U.S. company behind the site, registered the material under the Foreign Agents Registration Act as work for the Israeli government. The effort is part of a broader, multi-million dollar public diplomacy campaign involving several contractors. Researchers warn such techniques could influence not only chatbot search results, but eventually AI training data, potentially shaping responses without users knowing the original source. Joint research from SentinelOne and Tenable suggests attackers are concentrating on particular technology vendors and product lines rather than individual vulnerabilities. Comparing exposure and runtime detection data, the companies found a 79% overlap in targeted edge device vendor surfaces, but only 21% overlap among specific vulnerabilities. The researchers argue that defenders should prioritize what Tenable calls persistently targeted vendors, product lines that repeatedly attract attackers even as individual CDEs change.
Twelve vulnerabilities were exploited independently by both state-sponsored and ransomware actors, while more than half of organizations using F5 products had at least one exposed, actively exploited vulnerability. Citrix customers had the slowest medium remediation time at 461 days. The findings suggest organizations should combine vulnerability remediation with attack surface reduction and behavioral detection, particularly as AI accelerates vulnerability discovery and exploit development. Coming up after the break, my conversation with Tim Springston, Principal Product Manager at Sempris, on achieving hybrid identity resilience in the age of agentic AI. And Meta pumps the brakes on going AI native. Stay with us.
The cybersecurity challenges shaping our future demand more than conversation. They demand action. On November 18th, the Aspen Cyber Summit brings together leading voices from government, industry, and civil society in Washington, D.C. to tackle today's most pressing cyber and technology policy issues and advance real cross-sector solutions. Join the leaders shaping what comes next in cybersecurity. Learn more and register at AspenCyberSummit.org.
Cyber risks continue to evolve, and Traveler's Cyber Threat Report helps organizations stay informed on what's changing across today's risk landscape. This quarter's report uses data from leaked sites and Traveler's claims to examine the ransomware ecosystem and trends in account takeover attacks. It's a practical, data-driven resource built to help security and insurance professionals better understand emerging cyber trends and what they could mean moving forward. Download the latest Traveler's Cyber Threat Report today. Visit travelers.com slash cyberwire.
Canada's construction industry is changing fast. Is your workforce ready? Labor shortages and new technologies are raising the bar. Schulich Exec Ed at the Schulich School of Business, York University offers real-world education and professional development training. Our Construction Academy prepares you and your teams to lead what's next. Take your seat. Graduate. Tap to learn more.
Tim Springston is Principal Product Manager at Sempris. And in today's sponsored Industry Voices conversation, we discuss achieving hybrid identity resilience in the age of agentic AI. Hybrid identity is, it's not a new concept. It's been around as long as on-premise identity has been. Active Directory in 2000 was the start of it. It became hybrid from Active Directory typically when Microsoft and others started to have this concept of cloud. And in order to gain access to cloud resources via Office 365 and other services, you had to be able to sign in and you wanted to sign in with just a single identity.
Well, you already had the one on-premise in Active Directory. Why don't we have it be hybrid? And so you ended up in this hybrid scenario where you have a copy of the same identity and the same user sign-in and the same access controls across two different identity stores. That's what makes it hybrid. So what does a typical hybrid identity environment look like today?
The most common hybrid environment is Active Directory, whether it's hosted on virtual appliances or virtual windows in whatever cloud infrastructure and InterID or Okta. This is, again, part of that gain access to Office 365. And I'll often say to organizations, if you don't know if you're hybrid, answer a couple of questions. One of them is, do you have Active Directory on-premise? Do you synchronize those identities to the cloud so that you can get access to Office 365? If the answer to those two things is yes.
You're almost there. The third one is, do the user sign in with one user principal name, one username? If that third one's yes, then you're hybrid. I know you describe these environments today as more of a mesh than being a simple synchronization path. What has prompted that change? And why are organizations ending up with these multiple interconnected identity providers? It's typically the business processes that have driven it. It's more of a mesh nowadays because there's...
There are more services that synchronize between organizational identities. So it's not just that I have Active Directory, for example, not just that I have Office 365, which means I have IntraID and or Okta. It's also that I have other services where identities are created. Perhaps I have a provisioning service that synchronizes from some like. Workday or other identity provisioning service or HR service into the cloud and thus down to Active Directory or directly to Active Directory and up to the cloud. And so mesh is kind of a strong term because it implies there's a line between everything. In reality, it's just kind of like a complex spider web, right? Okay. Well, as these become more interconnected, what kinds of challenges does that create for the defenders out there?
Oh, so many. So the big challenge is where does one identity begin and when does it end? And in many cases, it ends up being even more complex than that. It's not just where does it begin, where does it end in terms of updating and creation and maybe pruning those identities, but it also becomes what ingredients come from which identity stores. So I could say it's created in Active Directory, for example, but it gets some memberships and access and resource access and app access in Okta or in Intra.
Or maybe it's created an HR service and it gains all these things through several different identity providers. That's where the complexity comes in because without truly understanding where all those ingredients come in, putting them back is hard and detecting those changes is hard. What is the status for most organizations in terms of having visibility into all of those tendrils? I think the larger organizations now have an awareness of what identity stores they have. For the most part, organizations understand the dependencies and have a rough idea of the flow. Understanding it holistically, start to finish, and being able to view it, secure it, and troubleshoot it if it goes wrong between those. Or, heaven forbid, restore it after an incident.
that's a place where it's kind of almost a frontier. I know one of the themes in your research is this idea of resilience versus prevention. And perhaps resilience is becoming the more important goal for identity security. Can you unpack that for us? Sure. Prevention doesn't go away. Prevention has been the key theme in security for as long as there's been security outside of even cybersecurity. I think the challenge is that resilience is becoming more important given the fact that all of these underpinnings, all this complexity is being highlighted with the advent of agentic AI and the use of agentic AI for threat actors and now for defenders.
So it's kind of put an accent on how do I understand that? How do I deal with it, you know, in terms of hybrid identity? And how do I put things back? It's not just, can I secure it? Can I prevent, you know, things from getting changed by a threat actor or a malicious insider? It's more about, can I actually be resilient in the face of this problem, which we know will occur. What specifically are we seeing with agentic AI in terms of the challenges that it's presenting to the defenders out there?
It's democratizing threat actors access, right? It used to be, you know, you'd have people sharing, you know, maybe they'd come together with bad people wanting to do bad things. They would come together and they would share techniques, share tools, and mutually kind of gain expertise that way. They don't have to do that now. With Agendic AI, they can train an agent to do specific actions and do it repeatedly and do it well. It's like really, really awful, nasty interns who do a great job, right? And they can have a whole bunch of them.
And so that's the part that is kind of changing things. And so when I say, listen, you can't really think about it as just security controls and putting the security controls back, you have to think about this holistically about putting a whole identity back. And that's hard. And I think agentic AI has a place on the defender side, for sure. And we're, you know, we're in early thinking on, for my part, on how we do that, you know, in a concerted way, like with all the tools at your disposal, how's agentic AI help you? Are there areas where you feel like the defenders still have an advantage?
Yeah, I think they do. I think that if you start with insights and clarity on what is important to your organization... Tools will help with that. Some dedicated time sitting down and looking at those tools, looking at your environment, having the business conversations with everybody in the business. If you're like a healthcare provider, patient intake is important. What's the patient intake app service? That's important for us to understand. How do we understand the patient info? We need to maintain access to that. So identifying what those things are and making sure that all the systems, the identity systems that support access to and authorization to those things are known.
and you've documented how to restore the access and restore the working order of those things, that's a critical step. That puts you, even with threat actors out there, that puts you a step ahead. Because if you identify what's important in your organization, the next small step is get the tools to be able to put them back. And then you're a step ahead. So you might have somebody interrupt your little journey, but they're not going to bring you down. What about organizations that have complex hybrid environments? Are there common mistakes that you see organizations making when they're planning out their identity resilience?
I think the biggest mistake is not understanding that it is in fact hybrid. It seems, it can seem kind of silly to be talking about this kind of, you know, 20 years and almost from hybrid becoming kind of prevalent. But it is actually kind of a big deal is understanding where the source of truth for an identity begins. And then further understanding what you can do without the source of authority. A lot of this is just understanding where are we granting controls and what's important to our organization kind of boils down to that. And that clarity piece is the biggest issue. The next one I would say outside of gaining clarity about what's important to the business and having the tools to put it back is being ready for an incident.
That's the number one, I would say. Incidents are going to happen. Accidental or otherwise, it's just going to happen. Being able to deal with the incident, having all the documents that maybe you hopefully have comprised beforehand at your fingertips, knowing how to contact and having methods to contact all the team. You know, if your Teams or Zoom or whatever is down, that's critical stuff. That's probably the sort of corollary place where you have to devote some energy. No, it's a really interesting insight. You know, it reminds me of, I suspect many of my coworkers have no idea what a phone tree actually is, right? It's true. It can happen. Yeah.
Where do you suppose we're headed here over the next few years? How do you anticipate this is going to play out? What I think is going to happen is Agentec AI is going to, I said the word democratize, is going to make it really available for more advanced attacks. Things that we've been kind of worried about happening. Like, yeah, everybody's like, I wonder if they do this. I wonder if they do that. I think those harder things to accomplish in terms of breaching security and overcoming security controls, I think they're going to become more prevalent, particularly in the identity space.
So I think that's one part of it. I think the second part of it is the urgency of using agentic AI for defenders is going to become equally important. And agentic AI is a tool that must have information. It must have specific guidance. It must have specific tools to accomplish its job. And having clarity of what's important to the organization to tell the agentic AI what to defend and having the tools to actually defend and put things back is what's going to be the added piece.
I think this space, this layer of agentic AI, it's almost like Rock'em Sock'em Robots, if you remember that game. Oh, yeah, yeah. So here's two, we have Defender and Attacker, and we're all going to have our agentic AIs working together. But you still have to know what the right techniques are and what to protect. That's Tim Springston from Sempris.
Maybe that's an urgent email from your CEO, or maybe it's a deepfake targeting your business. Doppel is the AI native social engineering defense platform fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back, automatically dismantling cross-channel attacks, building team resilience, and providing agentic email protection. Doppel, outpacing what's next in social engineering. Learn more at doppel.com. That's D-O-P-P-E-L dot com.
Quick question. Who or what has access to your critical systems right now? I'll give you a hint. It's not just employees anymore. It's vendors, machines, applications, workloads, and so many AI agents. Zage Security helps organizations control every identity with zero-trust policies that govern what they can access, what they can do, and when. Because when critical systems are at stake, compromised access can mean downtime, disrupted production, and real-world consequences. Protect what matters most with the Zage Identity Fabric platform. Learn more at Zage.com.
That's X-A-G-E dot com. Canada's construction industry is changing fast. Is your workforce ready? Labor shortages and new technologies are raising the bar. Schulich Exec Ed at the Schulich School of Business, York University, offers real-world education and professional development training. Our construction academy prepares you and your teams to lead what's next. Take your seat. Graduate. Tap to learn more. And finally, Meta spent part of this year exploring just how AI native it could become and how many humans might become optional along the way.
Reuters reports that Project OT, short for Organizational Transformation, considered shrinking some teams by as much as 60%, while AI agents took over much of their daily work. One round of layoffs followed in May, but CEO Mark Zuckerberg reportedly canceled a planned second round. The rethink came amid questions about whether the promised productivity gains were actually materializing. Internal data reportedly showed code changes soaring, while user-facing improvements rose much more modestly. More concerning, AI agents were linked internally to a 40% increase in major technical and security incidents, with employees spending considerably more time cleaning up afterward. By July, Zuckerberg acknowledged that agentic development hadn't accelerated as expected. Apparently, becoming AI native still requires a fair number of native humans.
And that's The Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire at n2k.com. N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazis. Our executive producer is Jennifer Iben. Peter Kilby is our publisher, and I'm Dave Bittner.
Thanks for listening. We'll see you back here tomorrow. And now a word from our sponsor, SpecterOps. Today, AI is rapidly adding non-human and agentic identities to modern enterprise environments, creating new trust relationships and attack paths. Bloodhound Enterprise helps defenders map attack paths across AWS and hybrid environments as one connected graph. Identify the choke points that matter most and bring trusted attack path intelligence into approved AI workflows with Bloodhound Hunter. See how SpecterOps helps teams secure the AI-driven identity era at specterops.io.
Canada's construction industry is changing fast. Is your workforce ready? Labor shortages and new technologies are raising the bar. Schulich Exec Ed at the Schulich School of Business, York University offers real-world education and professional development training. Our Construction Academy prepares you and your teams to lead what's next. Take your seat. Graduate. Tap to learn more.