In today’s cybersecurity news…
TSA cyber chief David Pekoske ousted by new administration
Pekoske had been appointed during President Donald Trump’s first term and “led the way in issuing cybersecurity directives governing the airline, pipeline, and rail industries.” His 5-year tenure was extended in 2022 by former President Joe Biden, and he was instrumental in the Biden administration’s efforts to “address cybersecurity failures following the ransomware attack on Colonial Pipeline in 2021.” No mention has yet been made as to the reason for the ouster, or who will replace him.
CISOs gain boardroom traction but still lack soft skills, says Splunk
This is mentioned in a report by research company Splunk, now a subsidiary of Cisco. It is based on responses from 500 CISOs or equivalent as well as 100 board members globally and is presented as part of its CISO Report 2025. The report says that “82% of security leaders now report directly to the CEO, up from 47% in 2023. A further 83% said they participate in board meetings “somewhat often” or “most of the time,” with many executives reporting “excellent or very good working relationships with the CISO in areas like setting and aligning on strategic cybersecurity goals and communicating progress against milestones.” Some of the areas where skills gaps are perceived to exist are in business acumen, emotional intelligence, and communication. As expected, the two camps remain distanced with regard to a belief that enough money is or is not being spent on cybersecurity efforts.
Cisco Fixes vulnerability in Meeting Management
This warning focuses on a new privilege escalation vulnerability in Cisco’s Meeting Management tool that could allow a remote attacker to gain administrator privileges on exposed instances. The vulnerability, which has a CVE number (CVE-2025-20156), has a CVSS score of 9.9, was disclosed by Cisco on Wednesday. Cisco has released a fix, as Cisco Meeting Management version 3.9.1. The company says, “there are no workarounds address this vulnerability and urged customers to update to this version.”
Thanks to today’s episode sponsor, Vanta
Now that’s…a new way to GRC. Get started at Vanta.com/headlines.
ChatGPT’s API could have been used in DDoS attacks
Described as an example of “bad programming,” a now-fixed vulnerability, discovered by German researcher Benjamin Flesch allows an attacker to send unlimited connection requests through ChatGPT’s API. He said the bug occurs when the API is processing HTTP POST requests to the back-end server and is due to the fact that manufacturer OpenAI “did not have a limit on the number of URLs that can be included in a single request. That error allows an attacker to cram thousands of URLs within a single request, something that could overload traffic to a targeted website. The vulnerability was assigned a CVSS score of 8.6 because it’s a network-based, low-complexity flaw that doesn’t require elevated privileges or user interaction to exploit.
ChatGPT goes dark temporarily
In further ChatGPT news, the service went down temporarily yesterday, with users worldwide finding the Generative AI tool unresponsive and providing a “bad gateway” message. Its developer, OpenAI, reported “elevated error rates” on its status page, but despite its recovery, no explanation for the outage has yet been provided.
Subaru security flaws expose tracking system for millions of cars
Sam Curry, researcher with a long history of discovering vulnerabilities in automotive brands, has now revealed vulnerabilities in a web portal belonging to Subaru that allowed him to unlock a car, start its ignition, and reassign control of those features to a different phone or computer. He also discovered that the portal was able to track the physical movements of a Subaru down to a single parking space in front of any building, with data stretching back a full year. This was occurring within a Subaru feature called Starlink intended for use by employees at Subaru of America. Subaru stated that the individuals authorized to use the technology “receive proper training and are required to sign appropriate privacy, security, and NDA agreements as needed,” and that the systems have “security monitoring solutions in place which are continually evolving to meet modern cyber threats.” A link to Curry’s blog post is available in the show notes to this episode.
‘Magic’ backdoor targets enterprise Juniper Routers
A new campaign discovered by Black Lotus Labs and named J-magic, focuses in on “Juniper-brand routers at the edge of high-value networks.” According to Nate Nelson, writing in DarkReading, “such routers typically lack endpoint detection and response protection, are in front of a firewall, and don’t run monitoring software, making the attacks harder to detect. In this instance, exposed enterprise routers are tapped with a variant of a 25-year-old backdoor named cd00r, “which stays dormant until it receives an activation phrase, also known as a “magic packet.” At this point it grants access to a reverse shell, from which its attackers can steal data, manipulate configurations, and spread to more devices.