You're listening to the Cyber Wire Network, powered by N2K. Welcome aboard Via Rail. Please sit and enjoy. Please sit and stretch. Steep. Flip. Or that, and enjoy. Via Rail. Love the way.
Trump hits pause on an AI executive order. Lawmakers sound alarms over CISA cuts. A sophisticated scareware campaign traps users in fake tech support scams. Ubiquity patches critical Unify flaws. The U.S. pours billions into quantum computing. Researchers uncover delayed Google API key revocation. Canadian authorities arrest the alleged Kim Wolfe botnet operator. Two Americans plead guilty in a global tech support fraud scheme. Our guest is Ankit Kumar Honey, senior engineering manager for Dependabot at GitHub, discussing closing the agentic gap between alert and patch at a global scale.
And AI-generated reports still come up short. It's Friday, May 22nd, 2026. I'm Dave Bittner, and this is your CyberWire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. Happy Friday.
President Trump delayed a planned executive order on AI and cybersecurity just hours before it was set to be signed, after pushback from top advisor David Sachs and several tech leaders, according to Axios. Sources said Trump objected to the order because he viewed it as unnecessary regulation that could slow US AI companies as they compete with China. Meta CEO Mark Zuckerberg, ex-AI CEO Elon Musk, and David Sachs reportedly spoke with Trump before the decision. The delay highlights growing divisions inside both the White House and the tech industry over how aggressively AI should be regulated. Some officials and industry sources also questioned why the Treasury Department would play a leading role in identifying AI security vulnerabilities, a task typically handled by agencies like CISA and NIST. While many companies support voluntary AI testing and safeguards, disagreements remain on oversight, model-sharing rules, and government involvement. For now, advocates of lighter AI regulation appear to have gained the upper hand, though additional White House AI security initiatives may still emerge.
Bipartisan lawmakers are raising concerns over staffing cuts and operational strain at the Cybersecurity and Infrastructure Security Agency, warning the agency may be less prepared to defend federal and critical infrastructure networks. Representatives Don Bacon and James Walkinshaw said the Trump administration has weakened CISA through funding and workforce reductions, despite growing cyber threats and increased use of artificial intelligence to uncover zero-day vulnerabilities. Democratic lawmakers Benny Thompson and Delia Ramirez also requested a briefing from Acting CISA Director Nick Anderson after reports that a contractor exposed privileged AWS GovCloud credentials in a public GitHub repository. They argued the incident may reflect declining security oversight following the loss of nearly 1,000 employees over the past 15 months. CISA said it is still investigating the exposure and currently has no indication mission data was compromised. Meanwhile, lawmakers continue pressing the agency about whether it has sufficient staffing and resources to fulfill its cybersecurity mission.
Speaking of CISA, they have added two actively exploited flaws to the known exploited vulnerabilities catalog, a critical LangFlow origin validation flaw and a Trend Micro Apex 1 directory traversal flaw. Researchers say the LangFlow bug can enable full system compromise and expose sensitive API keys, while reports linked its exploitation to Iran-aligned threat group Muddy Water. Trend Micro confirmed active exploitation of the Apex 1 flaw in on-premise deployments. CISA ordered federal agencies to patch both vulnerabilities by June 4th. Researchers at Barracuda Networks detailed a sophisticated scareware kit called CipherLock that uses browser-based tricks and psychological pressure to push victims into calling fraudulent tech support lines. Since early 2026, researchers observed roughly 2.8 million attacks using the framework. CipherLock begins with phishing emails that lead victims to malicious websites. The kit hides encrypted payloads that only activate under specific conditions, helping it evade scanners and sandboxes.
Once triggers, it locks the browser in full-screen mode, displays fake security alerts, plays warning audio, and even shows the victim's public IP address to increase panic. Attempts to inspect the page can intentionally slow or destabilize the browser. Barracuda said the campaign reflects a shift from traditional malware toward browser-based social engineering attacks that rely on fear and deception rather than malicious file downloads. Ubiquity released security updates for five vulnerabilities affecting Unify OS devices, including three maximum security flaws that remote unauthenticated attackers could exploit. The issues include improper access control, path traversal, and command injection vulnerabilities. Ubiquity also patched another critical command injection flaw and a high-severity information disclosure bug. The company said the vulnerabilities were reported through its HackerOne bug bounty program and can be exploited with low-complexity attacks.
Threat intelligence firm Census tracks nearly 100,000 Internet-exposed Unify OS endpoints worldwide. The U.S. Department of Commerce announced plans to provide more than $2 billion in Chips and Science Act incentives to nine quantum technology companies aimed at strengthening U.S. leadership in quantum computing. The funding includes support for quantum foundries led by IBM and Global Foundries, along with investments in seven quantum computing firms working across superconducting, photonic, trapped ion, silicon spin, and neutral atom technologies.
Officials say the investments are intended to accelerate development of utility-scale, fault-tolerant quantum computers and address engineering challenges such as error correction, photonic loss, cryogenic systems, and qubit scalability. The administration framed the initiative as both an economic and national security priority, citing potential applications in defense, energy, finance, advanced materials, and biopharmaceutical research. Researchers from Aikido found that deleted Google API keys can continue authenticating requests for up to 23 minutes after deletion because revocation propagates gradually across Google's infrastructure. In testing across 10 trials, deleted keys remained intermittently functional for between 8 and 23 minutes, potentially allowing attackers to continue accessing enabled services, including Gemini, after a credential leak. The researchers say that delayed revocation stems from Google's eventually consistent infrastructure model and warned that users receive no indication a deleted key may still be active.
They also observed regional inconsistencies and how quickly revocation took effect. Google reportedly closed the disclosure as won't fix, describing the delay as expected system behavior. Researchers advised organizations to treat API key deletion as a roughly 30-minute process and closely monitor usage during that window for signs of abuse. Canadian authorities arrested a 23-year-old Ottawa resident, Jacob Butler, also known as Dort, on allegations he operated the Kim Wolf Internet of Things botnet linked to massive DDoS attacks. U.S. prosecutors allege the botnet infected millions of devices, including webcams and digital photo frames, and generated attacks reaching nearly 30 terabits per second. Authorities said Kim Wolf issued more than 25,000 attack commands and caused significant financial damage, including attacks affecting Department of Defense address ranges.
Investigators tied Butler to the operation through IP addresses, transaction records, and online messaging accounts. He also allegedly participated in harassment, doxing, and swatting campaigns targeting security researchers. Canadian and U.S. authorities coordinated the investigation alongside broader efforts to seize infrastructures tied to several DDoS for Hire services. Butler now faces criminal charges in both Canada and the United States.
Two Americans pleaded guilty to charges tied to a long-running India-based tech support fraud scheme that targeted elderly and vulnerable victims across the United States. Prosecutors said Adam Young and Harrison Gevertz provided phone numbers, call routing, and tracking services that helped scammers connect victims to fraudulent call centers in India between 2016 and 2022. Victims were tricked through fake malware warnings and pressured into paying for bogus technical support services. In some cases, scammers gained remote access to devices and stole financial information. Investigators said the pair continued supporting the operation even after learning customers were involved in fraud and allegedly advised scammers on ways to avoid detection by rotating phone numbers. The case comes amid broader government effort to combat robocalls and digital scams, which lawmakers say continue to cost Americans billions of dollars annually. Coming up after the break, my conversation with Ankit Kumar Honey, Senior Engineering Manager for Dependabot at GitHub. We're discussing closing the agentic gap between alert and patch. And AI-generated reports still come up short. Stay with us.
Welcome aboard via rail. Please sit and enjoy. Please sit and stretch. Steep. Flip.
Before you knew what a stock was, you traded snacks, cards, turns. You knew what something was worth because you felt it. That instinct to trade didn't disappear. Basically, the team which I lead is a part of our supply chain security organization within GitHub. This team, what it does is basically it builds and operates automated dependency security system that monitors around.
20 plus million repository across 32 ecosystem, and which is serving around 180 million or even more developers worldwide. So basically our team works around vulnerability detection through, I'll repeat that again. So basically our team works on vulnerability detection through data advisory database, automated security updates, and AI augmented vulnerability remediation at scale. Well, take us through some of the changes and innovations that you and your team have been implementing here lately with the onset of all of this concern about AI. Yeah, so one thing is basically how AI agent is able to fix vulnerabilities. So we shift something which is called
security alerts remediation with an AI coding agent. That was last month. So what's emerging across the industry is the idea of assigning a security alert to an AI coding agent, not just to flag the problem. And this is something our team Dependbot wanted to tackle. This is the first step. So what we try to do is we just not analyze the vulnerability. We simply examine how the dependencies used in a specific code base and propose a fix. So exactly what happens? You have a security vulnerability in your code base. You assign that vulnerability to AI coding agent.
The AI coding agent, what it does is it actually analyzes those vulnerabilities, examine how the effective dependency is used in your specific code base, and it proposes a fix. Now, what agent does is it opens a draft pull request that a human engineer reviews before merging. And this is a very important part because we always want to have humans in the loop. AI and genetic fix are not always correct. They can message cases, introduce new issues, or produce incomplete patches. Sorry, they can produce incomplete patches, but they dramatically reduce the time from alert to actionable fix, especially for the complex cases that human engineers do not have bandwidth to tackle.
So it sounds to me like this system does just about everything but press the go button and relies on the human to look over what it's prepared before committing to it. Do I have that right? Yes, exactly. And the best part is, or I would say the beauty is, once the draft pull request is ready, there is a section called view session where a developer can go and see what exactly the AI coding agent has done and how they propose to fix. So that gives the developer more confidence in terms of reviewing that particular pull request and shipping it to production.
Can you share with us how this tool was developed? How did you and your colleagues decide you were going to approach this particular problem? A few things which made us make this decision. First, the AI generated code explosion is creating new dependency patterns, which we haven't seen before. Now, when the LLM writes code, it pulls in packages based on its training data, which means it's recommending packages that were popular two years ago, not necessarily the most secure options today. We are seeing huge number of security alerts, and the time to remediation is...
is between 8 to 70 days. So in the industry right now, we have a very good detection mechanism. Industries have good security scanners, they have good advisory database, they have good vulnerability reporting mechanism. But the average time to remediation is still between 8 days to 70 days, which means detection without remediation is just noise. And that is what exactly we are trying to tackle. And the first step towards this is like, why don't we assign a security alert to an AI coding agent, which will solve a problem within a couple of hours, rather than like...
having that problem set for days for the developers. This will also help developers to reduce the backlog. And the more the backlog increases, the attack surface area for those particular packages or application increases. How do you balance people's desire to save time with the need to be accurate here? So the first thing we are trying to tackle is the noise. Engineering teams get hundreds and thousands of alerts. The simple ones get fixed, but the complex ones, for example, breaking API changes or compromised packages, transitive dependency conflicts, those get piled up, and it creates a backlog, which becomes kind of a headache for any developer, any security folks. And this is exactly what we want to tackle. And to fill that gap, we are trying to make sure...
We provide a solution to the developers so that they can themselves analyze and figure out what needs to be done within our time frame, which is suitable for them as well as for the security folks in the organization. Since you've launched this, what has the response been and what have you learned? So the initial response is promising. We are still in the early phase. So I will circle back again after a couple of months. But the initial response was pretty good. We are seeing customers onboarding to it and we are getting some good results. That's Ankit Kumar Hani from GitHub.
Welcome aboard Via Rail. Please sit and enjoy. Please sit and stretch. It's deep. Flip.
Or that and enjoy. Via Rail. Love the way. If you paid for the venue before revenue came in, built a marketing plan at midnight, or chased the perfect headliner, you know what it takes to grow an event. That's why ShowPass created Event Incubator to give selected independent event organizers access to $10 million in growth capital, plus technology, expertise, and community. Applications are open through November 30, 2026. $10 million is on the table. What will you do with it? Search ShowPass Event Incubator, Incubator with a K, or tap the link to apply. Before you knew what a stock was, you traded snacks, cards, turns. You knew what something was worth because you felt it.
And finally, researchers at Cisco Talos spent months teaching large language models how to write cybersecurity reports without wandering off into confidently incorrect fiction, a task easier said than done when your co-author occasionally invents facts with perfect grammar.
The team found that AI-generated reports often suffered from inconsistent conclusions, formatting drift, and the digital equivalent of losing the plot halfway through a meeting. To rein things in, Talos developed tightly controlled prompt engineering techniques, including task-specific prompts, strict source constraints, rigid templates, and structured formatting rules. In testing, the approach cut report drafting time roughly in half while improving consistency and reducing typos, a rare moment when everyone involved in incident response briefly experienced joy. The researchers cautioned that human oversight remains essential, models still hallucinated recommendations, mixed content between projects, and occasionally missed obvious errors while confidently flagging imaginary ones. In other words, the AI intern still needs supervision. And that's The Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. Just a quick program note, we will not be publishing our daily podcast this coming Monday in observance of Memorial Day.
Be sure to check out this weekend's Research Saturday and my conversation with Sasi Levi, security research lead at Noma Security. The research we're discussing is titled Grafana Ghost, the phantom stealing your data. That's Research Saturday. Check it out. And hello, Maria Vermaz is here. On Sunday's T-minus space cyber briefing, we're covering the future of modernizing and securing GPS operations with Dr. Sean Gorman, CEO at Zephyr. That's Sunday on T-minus. Don't miss it. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity.
If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire at n2k.com. N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazis. Our executive producer is Jennifer Iben. Peter Kilpie is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you all back here next week.