The next name on CISA's door.

Palantir’s CISO gets the nod for CISA. Tehran takes the rap for sabotaging European grocery freezers. Russia’s Turla turns victim Exchange servers into passive spy hubs. Barracuda battles actively chained gateway zero-days. Vanderbilt grapples with a BYOD ransomware outbreak. CISA rushes patches for critical IBM and SignalWire flaws, while revamping its national incident portal. ENISA tracks the EU’s cyber maturity gap. Cryptographers debate whether AI will crack modern encryption. Our guest is Duncan Greatwood, CEO at Xage Security, discussing the cybersecurity problem you can’t patch away. Chinese AI labs set up shop in Silicon Valley's backyard.

Today is Tuesday November 10th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

Trump nominates Palantir’s CISO to lead CISA. 

The White House has tapped private-sector defense experience to take the helm at CISA.

President Trump nominated Michael LoSapio, chief information security officer at Palantir Technologies, to lead the Cybersecurity and Infrastructure Security Agency. The nomination was sent to the Senate on November ninth and awaits confirmation. If approved, LoSapio will succeed acting director Nick Andersen as the agency’s Senate-confirmed leader.

LoSapio brings over twenty years of systems engineering, cloud infrastructure, and cybersecurity experience to the role. At Palantir, he directed defenses against sophisticated nation-state adversaries, following earlier infrastructure roles at SingleStore and high-performance computing engineering at New York University.

The nomination was announced in an official statement from the White House.

CISA upgrades incident reporting portal with MITRE ATT&CK taxonomy. 

CISA is revamping how organizations report cyber incidents, leaning on standardized frameworks to turn disparate breach alerts into actionable national intelligence.

The Cybersecurity and Infrastructure Security Agency rolled out an updated reporting form on its Incident Reporting Portal. The streamlined questionnaire collects more granular incident data—categorizing intrusions across malware, social engineering, and insider threats—while integrating the MITRE ATT&CK framework to align observations with known adversary techniques. While only civilian federal agencies face mandatory reporting requirements under FISMA, CISA urges all critical infrastructure operators to voluntarily submit disclosures.

Standardizing intake across public and private sectors enables analysts to spot broader adversary campaigns faster, proving that one enterprise's early detection can secure an entire ecosystem.

Details were announced in an official agency release citing CISA’s Chris Butera.

ENISA charts EU cyber maturity amid AI and infrastructure threats. 

The European Union is taking stock of its collective cyber defenses, and while overall maturity is climbing, the regional threat ecosystem refuses to stand still.

According to ENISA’s biennial State of Cybersecurity in the Union report, the bloc averaged 71.5 points out of 100 on its 2026 Cybersecurity Index. Executive Director Juhan Lepassaar credited robust supply chain governance and research initiatives, but cautioned that recent disruptions—including cyber incidents hitting industrial refrigeration systems—spotlight persistent operational gaps. The assessment also identified uneven incident response capabilities among national CSIRTs alongside an expanding global cyber skills shortage.

While legislative frameworks like the NIS2 Directive push baseline compliance, operational realities diverge as frontier artificial intelligence accelerates automated vulnerability discovery and ideologically driven hacktivism dominates incident volume.

ENISA published the report in cooperation with the European Commission and the NIS Cooperation Group under Article 18 of the NIS2 Directive.

Western officials link Iranian cyber unit to European supermarket sabotage. 

State-sponsored cyber sabotage has crossed into everyday retail operations across Europe, spoiling tens of millions of dollars in food.

French officials, backed by American investigators, have tied a wave of cyber incidents affecting supermarket freezers and refrigerators across at least six European nations to Shahid Kaveh, an offensive cyber unit linked to Iran’s Islamic Revolutionary Guard Corps. In France alone, actors remotely altered temperatures at over seven hundred supermarkets, forcing units into defrost cycles and triggering fires and equipment failures. The Paris prosecutor is now pursuing international arrest warrants for the group's leadership.

Targeting internet-accessible industrial control systems reveals a deliberate pivot toward low-complexity, high-impact civilian disruption, testing Western infrastructure resilience well beyond conventional military targets.

French Foreign Minister Jean-Noël Barrot announced the attribution during a G-7 gathering in Paris, while U.S. and European agencies continue ongoing investigations.

Cryptographers debate whether AI advances could unravel modern encryption. 

While cybersecurity planners have spent years preparing for quantum decryption, a nearer-term challenge may be arriving from artificial intelligence.

Advances in machine learning are accelerating mathematical discoveries, prompting some researchers to question whether algorithmic shortcuts might unravel the foundational math securing modern encryption. Johns Hopkins cryptographer Matthew Green points to recent breakthroughs in theoretical computer science, while Ethereum creator Vitalik Buterin has called for the industry to proactively develop “post-AI cryptography.”

However, other leading voices urge restraint. Coinbase head of cryptography Yehuda Lindell contends that current post-quantum algorithms are resilient, arguing that speculative panic is premature and that artificial intelligence is just as likely to help defend and harden existing cryptographic primitives.

At stake is the core premise of modern digital trust: if computational shortcuts render previously intractable mathematical problems solvable, upgrading legacy protocols before adversaries exploit them becomes a race against time.

Attackers chain Barracuda ESG flaws for root access in targeted attacks. 

Barracuda Networks is urging administrators to patch immediately as threat actors actively target two critical vulnerabilities in its Email Security Gateway appliances.

Tracked as CVE-2026-116606 and CVE-2026-111560, the flaws allow attackers with access to an appliance's administrative interface to bypass authorization controls and execute arbitrary commands with root privileges. While patched last week, Barracuda confirmed on Monday that attackers are already exploiting the chained flaws against a limited number of customer environments. Several other Barracuda products, including its Load Balancer and Web Application Firewall, share the command injection vulnerability.

Securing perimeter email gateways remains a priority for enterprise defense, especially given past nation-state campaigns that weaponized edge appliances for persistent espionage.

Turla deploys stealthy "Cereal" malware targeting Exchange servers. 

Russian state-sponsored operators are turning victim email servers into their own operational infrastructure.

ESET Research has detailed "Cereal," a sophisticated, modular .NET malware toolkit attributed to the Russian threat group Turla. Deployed against national government bodies in Kazakhstan and Romania, the malware eliminates dedicated external command-and-control servers. Instead, a passive backdoor listens for incoming malicious web requests disguised as legitimate Outlook Web Access and ActiveSync traffic. Another module, CerealBox, injects directly into Exchange's transport service, in-memory hijacking existing mail handlers to filter and stage messages involving NATO and European Union addresses.

By operating entirely within legitimate enterprise processes and unmanaged .NET image caches, the campaign evades traditional network defenses while weaponizing mission-critical servers as long-term intelligence collection hubs.

Vanderbilt University investigates a cyberattack claimed by BYOD ransomware. 

Vanderbilt University is actively responding to a significant cybersecurity incident affecting campus devices, enterprise systems, and cloud infrastructure.

University officials instructed students, faculty, and staff on Monday to power down institutional hardware, disconnect from campus Wi-Fi, and alert IT to suspicious behavior. While the university has not officially confirmed the specific nature of the intrusion, the relatively new BYOD ransomware gang claimed responsibility on its data leak site. The group claims to have encrypted databases and exfiltrated research files alongside personal records for over one million individuals.

Targeting major academic research hubs underscores how rapidly evolving ransomware operations threaten both critical intellectual property and sensitive community data.

CISA adds actively exploited IBM and SignalWire bugs to KEV catalog. 

CISA has added critical vulnerabilities affecting IBM Aspera Faspex and SignalWire FreeSwitch to its Known Exploited Vulnerabilities catalog.

Both flaws carry CVSS scores of 9.8. The Faspex bug permits authorization bypass for full administrative takeover, while the FreeSwitch defect enables arbitrary command execution via crafted SIP messages. Mandated under Binding Operational Directive 26-04, federal civilian agencies must apply vendor patches within three days.

Rapid cataloging of these flaws underscores federal urgency to seal network-accessible enterprise tools before widespread automated exploitation takes hold.

 

Stick with us after the break where we are joined by Duncan Greatwood, CEO at Xage Security, discussing the cybersecurity problem you can’t patch away. And….

On our Industry Voices segment, I sat down with Duncan Greatwood, CEO at Xage Security, discussing the cybersecurity problem you can’t patch away. Here’s our conversation. 

If you enjoyed this conversation be sure to check out the show notes for the full interview. 

Chinese AI labs set up shop in Silicon Valley's backyard. 

Chinese AI companies are taking their talent search straight to Silicon Valley, hoping to recruit the researchers who helped make American AI labs dominant.

MiniMax, Moonshot, and ByteDance are expanding their U.S. hiring efforts, targeting engineers with experience at companies like OpenAI and Anthropic.

But there's a problem. American AI researchers are expensive, with top talent commanding compensation packages exceeding a million dollars annually. Chinese companies generally have smaller budgets, and researchers often prefer working on cutting-edge American models.

There's also the matter of work-life balance. China's notorious “996” schedule—nine to nine, six days a week—is apparently not a particularly compelling recruiting perk.

ByteDance is reportedly offering substantially higher compensation to compete, but money isn't everything.

Meanwhile, Washington's restrictions on Chinese access to advanced technology could eventually extend to talent recruitment.

For now, Chinese AI companies can open offices in Silicon Valley. Convincing Silicon Valley's engineers to join them is another matter.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

 

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.