Jun 10's Top Cyber News NOW! - Ep 1150

At a glance

Anthropic's Fable 5 adds guardrails to its Mythos-class model just as threat actors prepare to abuse it; France's TCAP messaging app was breached via compromised credentials and hardcoded LDAP secrets in PowerShell scripts; CISA is pushing federal agencies to rethink patch prioritization by risk, not speed. Meanwhile, WinRAR patches from over a year ago still aren't deployed in active warzones, and Cisco SDWAN hit its seventh zero-day this year with no patch yet available.

Stories covered

Is Anthropic's Fable 5 model actually safe for cybersecurity tasks?

What happened: Anthropic released Fable 5, a Mythos-class model with targeted guardrails for high-risk domains including cybersecurity and biology. When users attempt malicious requests like writing exploits, the model refuses and downgrades to Opus 4.8 for the same query. Anthropic claims 95% of sessions run natively without fallback.

Why it matters: Threat actors will immediately weaponize this model regardless of guardrails. The downgrade mechanism may create a false sense of security while still enabling capable baseline models. Your asset inventory and vulnerability management programs need hardening now, not later.

What to do: Treat Mythos/Fable 5 access by adversaries as inevitable. Accelerate asset discovery, patch automation, and risk prioritization. If you've delayed these programs, stop delaying.

---

Why did France's official government messaging app get breached via PowerShell credentials?

What happened: Threat actors compromised TCAP, the French government's mandatory encrypted messaging app for civil servants, by gaining access to a privileged user account. They stole hardcoded LDAP credentials from a PowerShell script leaked by a French tax authority regional director, exfiltrating 13 GB of data and metadata on 73,000+ accounts.

Why it matters: This demonstrates the exact attack pattern Flare and other credential monitoring vendors warn about—credentials in scripts, weak account controls, and administrative privilege misuse. Privileged accounts without MFA remain trivial targets in government and enterprise environments.

What to do: Audit all privileged accounts for MFA enforcement. Scan your codebase and scripts for hardcoded credentials using secrets management tools. Remove or heavily restrict service account permissions.

---

Should patch management be based on vulnerability severity or actual risk?

What happened: CISA Director Nick Anderson announced a binding operational directive requiring federal agencies to shift from speed-based patching to risk-based prioritization. The new approach asks teams to identify which systems can actually be exploited, which assets matter most, and whether external exploit availability exists before allocating patch resources.

Why it matters: Not all vulnerabilities carry equal risk. Meltdown was catastrophic in theory but rarely exploited; a misconfigured S3 bucket poses higher actual risk. GRC professionals already practice this, but federal standardization forces orgs to model risk properly rather than patch alphabetically by CVE ID.

What to do: Map which assets host which vulnerable software, then rank by business criticality and active exploit availability. Use threat intelligence on known exploited vulnerabilities (KEV list) as a guide. Document your prioritization logic for audits.

---

How are threat actors using romance lures to target Russian soldiers?

What happened: Russian security firm F-Secure reported a Syria Clone campaign impersonating women offering humanitarian aid or romance to Russian soldiers stationed near combat zones. Lures redirect targets to spoofed sites, harvest Telegram credentials, and deliver Safe Love Stealer—an Android spyware stealing files, communications, and military data.

Why it matters: This is weaponization of the cyber kill chain in practice. The payload (malware) is wrapped in a delivery package (romance lure) designed for the target population. The technique works because it exploits human behavior, not zero-days. Applies equally to any high-value user group worldwide.

What to do: If you manage endpoint security for military, diplomatic, or aid personnel, educate users on credential harvesting and app installation risks. Enforce app allowlisting on Android devices. Monitor for unexplained credential compromises.

---

Why is a year-old WinRAR patch still being exploited in Ukraine?

What happened: A path traversal flaw in WinRAR patched in July 2025 is actively being exploited by Russian-aligned groups Earth Dahu and Shadowear066 against Ukrainian organizations. Earth Dahu uses it to install persistent espionage modules active since April 2026.

Why it matters: In a active military theater with nation-state threat actors, unpatched archive utilities are low-hanging fruit. This is not a zero-day problem—it's a patch management execution failure. One year to deploy a patch is operationally unacceptable.

What to do: Remove WinRAR from endpoints where possible; Windows built-in extract handles most formats. If retention is mandatory, patch immediately. For military/critical infrastructure endpoints, enforce quarterly patch cycles minimum, bi-weekly for known-exploited CVEs.

---

What's new with Cisco SDWAN's seventh actively exploited zero-day this year?

What happened: CVE-2026-20452 (transcript ambiguous on exact number) affects Cisco SDWAN Manager, allowing authenticated users to execute arbitrary commands as root via a validation error. Mandiant disclosed late last week; Cisco confirmed limited active exploitation and promised a patch "at a future date" with no workaround available.

Why it matters: SDWAN is your edge network control plane across all facilities. An exploited instance gives attackers root access to routing, firewall, and segmentation logic. Seven zero-days in one product line in six months signals either a systemic design issue or a high-value target receiving scrutiny.

What to do: Immediately audit and restrict privileged account access to SDWAN management interfaces—follow least-privilege principles like you would for domain admin. Verify credential inventory. Monitor for unauthorized configuration changes. Check Cisco advisories weekly for patch availability.

---

Why did a federal judge ban lawyers from court for using AI-hallucinated case citations?

What happened: U.S. District Judge Sherian Oaks sanctioned four attorneys in an Aberdine, Mississippi contract dispute after both sides submitted briefs citing non-existent court cases generated by ChatGPT. Judge Oaks canceled the trial, disqualified all counsel, barred two lawyers from appearing in court for two years, and issued $3,500 fines each. Attorney Kathleen Wilson had been repeatedly cited for AI hallucinations since January 2026.

Why it matters: This is not a cybersecurity story, but it illustrates a critical operational risk: AI tools amplify lazy verification and fake plausibility. The same dynamic applies to security decision-making—always source-check statistics, threat intel, and risk assessments rather than trusting AI summaries.

What to do: When evaluating vulnerability statistics, breach reports, or risk data, trace back to the original source. Question survey sizes, methodology, and definitions. Don't accept "AI says" as justification for security spending or incident response.

---

Should Taiwan criminalize AI chip smuggling to align with U.S. export controls?

What happened: Bloomberg sources report Taiwan is considering stricter export controls on AI chip sales, including criminal penalties for smuggling to China. Currently, unauthorized AI chip exports to China are only violations of U.S. rules, not Taiwanese law; sellers merely receive warnings.

Why it matters: Not directly relevant to cybersecurity operations. This is geopolitical supply chain policy signaling Taiwan's alignment with U.S. tech containment strategy toward China.

What to do: Monitor for now.

---

Key takeaways

• Threat actors will exploit Fable 5 and Mythos immediately; guardrails are speed bumps, not walls. Patch and inventory assets now before AI-accelerated campaigns reach scale.
• Credential theft in scripts and hardcoded secrets remain the fastest path to privileged access. Enforce MFA on all privileged accounts and scan code for secrets.
• Patch prioritization by risk (not speed or CVE severity) is now federal policy. GRC teams should document why you patch what, when, and in what order.
• Unpatched software a year after disclosure in active threat zones is execution failure, not inevitability. Even resource-constrained environments need quarterly patch cycles minimum.
• Verify all threat data, statistics, and AI summaries back to primary sources before making decisions. AI hallucination and lazy citation happen in security briefs as much as courtrooms.

Topics covered

anthropic fable 5, mythos model, vulnerability management, patch management, france tcap breach, ldap credentials, hardcoded secrets, cisa directive, patch prioritization, risk-based patching, android spyware, threat actor romance lures, winrar cve, ukraine military cyberattacks, cisco sdwan zero-day, privilege escalation, ai hallucination, supply chain attacks

Show notes generated from the live transcript using AI on Wed, 10 Jun 2026 17:42:37 GMT. Errors? Open the YouTube replay for the source of truth.