This week’s Cyber Security Headlines – Week in Review is hosted by Rich Stroffolino with guest Howard Holton, COO and industry analyst, GigaOm
Missed the live show? Check it out on YouTube
Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com
Microsoft removes Windows 11 account bypass
According to BleepingComputer, Microsoft has “removed the BypassNRO.cmd script from Windows 11 preview builds, which allowed users to bypass the requirement to use a Microsoft Account when installing the operating system.” Having been introduced in the latest Windows 11 Insider Dev preview build, this means the change will likely be coming to production builds. The change basically forces all users to have Microsoft Account, whether they want one or not.
Security companies clash over CrushFTP CVE number
This issue starts with a critical vulnerability in the CrushFTP enterprise file transfer solution. In short, its own developers alerts customers to the vulnerability which could have exposed systems to remote hacking. Five days later, with no CVE number announced, the vulnerability intelligence firm VulnCheck assigned one. However, CrushFTP itself rejected this number, arguing that the “real CVE had been pending,” and 10 days after disclosure, a new CVE, assigned by Outpost24, a security firm that had been credited for “responsibly disclosing the flaw to the vendor.” The crux of the issue was around a suitable delay period intended to keep the vulnerability under wraps to avoid malicious exploitation, something that did not happen, and in fact, according to The Shadowserver Foundation are still continuing. A link to this story from Security Week, which contains more details and background, is available in the show notes to this episode.
FTC sends warning to future 23andMe buyer
An update to the 23andMe data privacy concerns. On Monday, The Federal Trade Commission (FTC) sent a warning to the Department of Justice (DOJ) that any buyer of 23andMe must honor its existing privacy policies, ensuring users remain in control of their genetic data—even in bankruptcy. FTC Chair Andrew Ferguson emphasized that 23andMe has explicitly promised not to share data with insurers, employers, or law enforcement without legal orders and that these protections extend to any new owner.
Huge thanks to our sponsor, Qualys
North Korea’s fake worker schemes getting worse
North Korean operatives aren’t just freelancing—they’re securing full-time IT and engineering roles, gaining deep access to enterprise networks under legitimate employment. DTEX’s investigation found these insiders operating in Fortune 2000 companies, with privileged access to systems, remote tools, and the ability to pivot into supply chain partners. The workers, often teams posing as one high-performing individual, are funneling salaries back to Pyongyang, but experts warn financial motives could shift to espionage or sabotage. Forcing job candidates to be on camera and show government-issued ID is also not proving to be enough – researchers suggest watching for social red flags, such as candidates looking away for prompts during interviews or avoiding casual conversation about personal interests.
GitHub expands security tools after 39 million secrets leaked in 2024
GitHub has expanded its security tools after detecting over 39 million leaked secrets in repositories in 2024, including API keys and credentials. Despite measures like “Push Protection,” leaks persist due to developer habits and accidental exposure. To combat this, GitHub now offers standalone security products, free organization-wide secret risk assessments, enhanced push protection with bypass controls, AI-powered secret detection via Copilot, and improved detection through cloud provider partnerships. Users are advised to enable push protection, avoid hardcoded secrets, and use secure storage methods.
Google DeepMind unveils framework to exploit AI’s cyber weaknesses
Google DeepMind has developed a new AI evaluation framework to identify weaknesses in adversarial AI attacks, helping cybersecurity defenders prioritize their strategies. Their research found existing AI security frameworks to be inconsistent and ineffective. DeepMind analyzed over 12,000 AI-driven cyberattacks and identified 50 key attack challenges. Their study suggests AI is currently ineffective in certain attack phases, providing defenders with crucial points to break attack chains. The framework also helps AI developers enhance security by addressing vulnerabilities. DeepMind’s approach aims to improve cybersecurity defenses against evolving AI-powered threats.