This Week in Cybersecurity #58
Trust Without Verification: How Forgotten Credentials, Legacy Auth Flows, and AI Agents Became the Largest Attack Surface of 2026, Your weekend catch-up on the most critical cybersecurity stories
Good Morning, Security Gang!
Double espresso poured. And this week demands every drop of it.
James opened the week with a line that framed everything that followed:
“One person operating with apparently minimal operational security managed to compromise a market intelligence platform used by some of the most prominent names in cybersecurity and then promptly got their own data taken by someone else. The attacker didn’t need to be sophisticated. They just needed the credential and an automated Python script querying the Salesforce REST API. That’s it. Audit your OAuth tokens today.”
By the end of four episodes, that framing had been validated at every layer. The Klue/Icarus supply chain breach cascaded further as Icarus itself was reportedly compromised by a second threat actor running independent extortion using the same stolen data validating James’s prediction that stolen data doesn’t stay with one attacker. Oracle’s enterprise software ecosystem expanded its 2026 exploitation record: E-Business Suite, PeopleSoft, and now 900-plus internet-exposed EBS deployments still under active attack. Huntress documented 81 million Microsoft 365 password spray attempts over two weeks exploiting legacy ROPC OAuth flows that bypass MFA entirely. Cursor IDE deployed across more than half the Fortune 500 received two CVSS 9.8 zero-click vulnerabilities where opening an AI prompt is sufficient for full workstation compromise. And FortiBleed was officially linked to active Lynx and INC ransomware deployments, with persistent backdoors confirmed on hundreds of operational systems.
The week also brought Microsoft’s most important Agentic AI security advisory to date warning that MCP tool descriptions themselves can be weaponized to redirect AI agents toward data collection without touching a single line of application code. PTC Windchill engineering platforms landed on CISA’s KEV for the first time, putting aerospace, defense, automotive, and healthcare intellectual property at direct risk. And the DHS confirmed attackers breached the Homeland Security Information Network, the collaboration platform coordinating federal and private-sector security around the FIFA World Cup.
The theme James returned to across all four episodes: “Trust is not permanent. It has to be continuously validated, especially as technology evolves faster than operational processes.”
Let’s get into all of it.
🌐 Infrastructure & Active Exploitation
Oracle E-Business Suite CVE-2026-46817: 900+ Exposed Instances, Exploitation Accelerating
More than 900 internet-facing Oracle E-Business Suite instances remain exposed while attackers actively exploit CVE-2026-46817 a critical vulnerability in the Oracle Payments File Transmission component that requires no authentication, can be reached over HTTP, and allows full system compromise with low complexity. Diffuse observed active exploitation in honeypots throughout the past week. Shadowserver tracks approximately 950 publicly exposed deployments. Oracle released patches during the May 2026 CPU exploitation continues because patch deployment is lagging. Oracle enterprise platforms including EBS and PeopleSoft have now experienced repeated exploitation throughout 2026 across universities, insurance regulators, government organizations, and enterprises. Oracle environments must be treated as high-priority attack surfaces requiring accelerated patch management. If your organization still exposes Oracle EBS directly to the internet, today is the day to change that.
PTC Windchill and FlexPLM CVE-2026-39616: First CISA KEV for Engineering IP Platforms
CISA added CVE-2026-39616 to the KEV, a critical RCE vulnerability affecting PTC Windchill and FlexPLM, widely deployed product lifecycle management platforms across aerospace, defense, automotive, healthcare, and industrial engineering. The vulnerability stems from unsafe deserialization, enabling unauthenticated remote code execution without credentials or user interaction. Attackers are actively deploying JSP web shells against vulnerable systems. Windchill often serves as the central repository for an organization’s most valuable intellectual property: engineering drawings, CAD files, product roadmaps, bills of material, supplier documentation, manufacturing workflows, and regulatory submissions. Historical undervaluation of PLM platforms as attack targets is no longer operationally valid. Patch immediately, hunt for JSP web shells, review PTC’s published IOCs, and treat any confirmed compromise as a full incident response event.
Oracle PeopleSoft Zero-Day Campaign: NAIC, Nissan, 100+ Organizations
The ShinyHunters PeopleSoft campaign exploiting CVE-2026-35273 continued expanding this week with two major new confirmations. The National Association of Insurance Commissioners the regulatory body supporting insurance oversight across all 50 U.S. states confirmed attackers accessed statutory financial reports, credit rating information, legacy log files, and system configuration data. Nissan confirmed current and former employees in North America and Latin America had Social Security numbers, banking information, and tax records compromised. Mandiant previously confirmed attackers exploited PeopleSoft as a zero-day for nearly two weeks before Oracle released emergency mitigations. The campaign now spans insurance, government, higher education, and enterprise sectors. Validate Oracle emergency mitigations, review authentication logs dating back to early June, rotate integrated credentials, and treat any PeopleSoft exposure as a potential compromise rather than a patch management exercise.
Oracle E-Business Suite: Patch Dates Are Not Safety Dates
The Oracle exploitation pattern this week carries one unified lesson: organizations treating Oracle CPU releases as quarterly maintenance rather than emergency patch events are operating in a threat environment that doesn’t match their patch cadence. Restrict public access to Oracle environments immediately, review file transmission logs, and begin treating Oracle CPUs as emergency patch events.
🔐 Authentication & Credential Security
“MFA isn’t binary. Having MFA and having MFA protect every authentication path are two very different things.”
Huntress: 81 Million Microsoft 365 Password Spray Attempts via Legacy ROPC OAuth Bypass
Huntress documented 81 million login attempts targeting Microsoft 365 tenants over two weeks (June 12–26) exploiting Azure’s Resource Owner Password Credential (ROPC) OAuth authentication flow, a legacy mechanism that submits credentials directly to Microsoft’s token endpoint without supporting modern MFA or single sign-on. Accounts were compromised despite MFA being enabled, because MFA wasn’t protecting every authentication path. Researchers identified recurring misconfigurations: Conditional Access policies in report-only mode, MFA enforced only for administrators, trusted location exceptions, and policies scoped only to selected cloud applications. MFA isn’t binary. Having MFA and having MFA protect every authentication path are two very different things. Every Microsoft 365 administrator should immediately review Conditional Access policies to ensure legacy authentication flows ROPC, PowerShell, Azure CLI, older API clients — are covered by modern controls. Disable ROPC where operationally feasible.
FortiBleed Officially Linked to Lynx and INC Ransomware Operations
SOC Radar directly linked FortiBleed to active Lynx and INC ransomware group operations. The full picture is now confirmed: FortiBleed compromised more than 73,000 Fortinet credentials, targeted approximately 430,000 FortiGate firewalls, installed packet sniffers across roughly 19,000 devices, maintained persistent administrator backdoors on hundreds of operational systems, and browser sessions were logged directly into ransomware negotiation portals from systems participating in the operation. FortiBleed was the front-end access operation for ransomware deployment. Rotate every Fortinet administrative password and VPN credential that has not been replaced since FortiBleed emerged. Hunt for unauthorized Fortinet administrator accounts. Treat every previously harvested credential as compromised.
BlueHammer CVE-2026-33825: Microsoft Defender Flaw Now Deployed in Active Ransomware Campaigns
CISA quietly updated the BlueHammer KEV entry to confirm active ransomware deployment without issuing a new public advisory. Security teams monitoring only new vulnerability announcements may have missed the update entirely. Organizations cannot rely exclusively on vendor announcements to understand evolving threat activity. The lesson extends beyond this specific vulnerability: continuously monitor KEV catalog updates, including changes to existing entries, not just newly added ones. Confirm BlueHammer patches are deployed across all Microsoft Defender installations.
Scattered Spider: Extradition, Guilty Pleas, and Pipeline Remains Active
Nineteen-year-old Peter Stokes (”Bouquet”) was extradited from Finland to face U.S. charges tied to Scattered Spider intrusions generating more than $100 million. Two additional Scattered Spider members 20-year-old Tahala Jubair and 18-year-old Owen Flowers pleaded guilty to UK charges in the Transport for London attack that generated £29–39 million in recovery costs. Despite these arrests, the pipeline remains active. Authorities estimate one in five UK children aged 10–16 has engaged in activities technically violating computer misuse laws. Strengthen help desk verification procedures Scattered Spider’s primary operational method remains social engineering against IT support functions.
🧬 Supply Chain & Third-Party Trust
Klue/Icarus: The Attacker Got Attacked — Stolen Data Doesn’t Stay With One Group
The Klue supply chain breach reached an unexpected new chapter: Icarus, the extortion group conducting the campaign, was reportedly compromised by a second threat actor now conducting independent extortion using the same stolen data from the same victims. If confirmed, this fundamentally changes ransomware negotiation assumptions even if one attacker agrees to delete data, nothing prevents another criminal group from already possessing their own copy. The breach now affects approximately two dozen organizations including HackerOne, Huntress, Recorded Future, Tanium, Snyk, Jamf, OneTrust, LastPass, Gong, and Sprout Social all traced back to a pilot-project credential left active for nearly four years. Assume stolen data propagates. Audit every OAuth integration, rotate all dormant API keys and third-party credentials, and communicate phishing risk to all affected organization contacts.
Amazon Q Developer Vulnerability: Silent AWS Credential Theft on Repository Open
Researchers disclosed a serious vulnerability in Amazon Q Developer, Amazon’s AI-powered coding assistant integrated into VS Code, JetBrains, Eclipse, and Visual Studio. A specially crafted configuration file placed inside an ordinary repository caused Amazon Q to execute malicious configuration silently the moment a developer opened the repository. No clicks required. Spawned processes inherited the developer’s environment, allowing silent capture of AWS access keys, session tokens, cloud credentials, API keys, and SSH agent sockets. Researchers demonstrated realistic attack scenarios including malicious GitHub repositories, typosquatted npm packages, fake coding assessments, and compromised open-source projects. The attack surface isn’t the thing you built, it’s everything you’re connected to. Update Amazon Q immediately, rotate potentially exposed AWS credentials, and review cloud activity logs.
SimpleHelp CVE-2026-48558: Djinn Stealer Targets AI Development Credentials
Attackers are exploiting a critical authentication bypass in SimpleHelp RMM to deploy “Djinn Stealer”, a new malware family specifically engineered for the AI development ecosystem. Unlike traditional infostealers targeting browser passwords, Djinn Stealer searches for locally stored configuration files belonging to Claude, Gemini, Codex, OpenCode, and other MCP environments which often contain privileged cloud credentials, API tokens, repository access, internal service accounts, and automation secrets. MCP configuration files are now privileged credentials, not ordinary developer artifacts. Patch SimpleHelp immediately, rotate AI coding assistant credentials and MCP configuration secrets, and invalidate technician sessions.
LibSSH2 CVE-2026-55200 CVSS 9.2: Public PoC, Embedded Across Enterprise Applications
Public proof-of-concept exploit code was released for a critical LibSSH2 vulnerability, a client-side library embedded throughout enterprise applications including curl, wget, PHP deployments, backup platforms, embedded appliances, and firmware management systems. Many organizations have no inventory identifying where LibSSH2 exists inside commercial software or internally developed applications. This incident highlights why software composition analysis is becoming foundational rather than optional. Inventory software dependencies relying on LibSSH2, upgrade affected applications as patches become available, and treat this as a software bill of materials audit catalyst.
North Korean npm Supply Chain: 60+ Packages Targeting Developer Credentials
Microsoft attributed 60-plus malicious npm packages to North Korean Sapphire Sleet targeting developer credentials and cryptocurrency wallets through typosquatted dependencies. Review development environments and dependency trees immediately.
Polymarket JavaScript Supply Chain: $3 Million Stolen via Third-Party Web Component
Prediction platform Polymarket confirmed attackers compromised a third-party web dependency and injected malicious JavaScript, stealing approximately $3 million in cryptocurrency from fewer than 15 users. The blockchain remained secure the compromise was entirely through a trusted third-party frontend component. Review all third-party JavaScript dependencies supporting customer-facing applications.
🤖 AI Security & Agentic Risk
Cursor IDE: Two CVSS 9.8 Zero-Click Vulnerabilities — Opening a Prompt Achieves Full Workstation Compromise
Cato AI Labs disclosed two critical vulnerabilities in Cursor IDE, deployed across more than half of the Fortune 500, both rated CVSS 9.8. No deliberate user interaction required: a developer simply opens an AI prompt referencing attacker-controlled content from an MCP server, malicious search result, or poisoned web resource. The Cursor agent processes the content, escapes its sandbox, overwrites critical files, and executes attacker-controlled code on the developer’s workstation. Researchers indicated similar architectural weaknesses likely exist across multiple AI coding assistants because the underlying trust model is similar. The model isn’t the security boundary treat every AI input like attacker-controlled user input. Review AI coding agent access to local filesystems and external MCP services immediately. Patch Cursor IDE when vendor updates become available.
Microsoft Advisory: MCP Tool Descriptions Are a Supply Chain Attack Vector
Microsoft published a critical Agentic AI security advisory warning that MCP tool descriptions plain-language explanations of tool purpose shown to AI agents can be weaponized without changing underlying application code. Researchers demonstrated that modifying tool descriptions to include hidden instructions directed AI agents to collect invoices, sensitive documents, or internal data during otherwise legitimate workflows. Because the tool remains approved and operational, the AI agent follows the instructions without recognizing malicious intent. Academic testing showed successful tool poisoning against leading AI models approximately 73% of the time. Tool descriptions should now receive the same approval process, change management, and security review traditionally reserved for application code. AI agents need least privilege, individual identities, logging, and formal change control.
AI Browser Extensions Exposing GitHub Credentials
Researchers demonstrated that AI-powered browser agents could be manipulated into revealing sensitive GitHub credentials through crafted web interactions. OpenAI addressed the issue; several competing platforms remain partially vulnerable. Carefully evaluate browser-based AI assistants before enterprise deployment.
🔓 Data Breaches & Identity Exposures
“Assume stolen data doesn’t stay with one attacker. Assume it propagates.”
Aflac Japan: 4.38 Million Customers, Ten-Day Dwell Time Across Policy Portal
Aflac Life Insurance Japan disclosed attackers repeatedly accessed its customer policy portal between June 15 and June 25 before detection affecting approximately 4.38 million policyholders with names, addresses, telephone numbers, birth dates, insurance account details, and banking information exposed. Ten days of repeated authenticated access presents clear behavioral monitoring opportunities that were missed. Monitoring legitimate authenticated sessions is often just as important as detecting unauthorized login attempts. Review portal session monitoring, anomaly detection, and behavioral analytics coverage.
DHS HSIN Breach: FIFA World Cup Coordination Platform Compromised
The Department of Homeland Security confirmed attackers compromised a legacy instance of the Homeland Security Information Network the collaboration platform supporting federal, state, local, and private-sector information sharing including FIFA World Cup security coordination. Classified systems were reportedly unaffected. Review critical infrastructure information-sharing connections for exposure.
Kubota Employee Data: One Month of Undetected Network Access
Industrial equipment manufacturer Kubota disclosed attackers maintained access for more than one month before detection, exposing employee Social Security numbers, financial account information, benefit records, and sensitive personnel data. One-month dwell time reinforces continuous behavioral monitoring as a baseline requirement.
KDDI Japan: 14.2 Million Customer Accounts via Third-Party Software
Japanese telecom provider KDDI disclosed a breach through third-party software supporting six ISPs, exposing up to 14.22 million customer email addresses and passwords. Affected customers should change passwords and enable MFA immediately.
Texas Parks and Wildlife: Three Million Records via Unidentified Third-Party Vendor
Three million individuals had driver’s license numbers, passport information, and contact details exposed through a third-party vendor that remains publicly unidentified reinforcing the ongoing challenge of vendor-side breach transparency.
Apple Unpatchable BootROM Exploit: A12/A13 Chipsets
USBlitter-V8 targets the SecureROM in Apple’s A12 and A13 chipsets in an exploit that Apple cannot patch through software updates. Requires physical access but represents a hardware lifecycle issue for older devices approaching a decade in service. Hardware refresh timelines are a security control.
⚖️ Law Enforcement, Policy & Industry
Supreme Court: Warrant Required for Geofence Location Data
In a 6-3 decision, the U.S. Supreme Court ruled law enforcement must obtain a warrant before accessing historical geofence location information from technology providers. Organizations handling legal requests for location data should update compliance procedures.
FBI Warning: Russian Intelligence Now Targets Signal Backup Recovery Keys
The FBI updated guidance on Russian intelligence operations targeting Signal — attackers now specifically request Signal backup recovery keys after compromising accounts, enabling recovery of encrypted message history. Educate executives: legitimate support personnel never request backup recovery keys.
State Department: $10 Million Reward for Russian Signal Hackers
The Rewards for Justice program announced a $10 million reward for information on Russian groups UNC5792 and UNC4221 targeting Signal and WhatsApp accounts of government officials, journalists, and NATO personnel.
Trump Post-Quantum Cryptography Executive Order: 2030/2031 Deadlines
Executive Order 14409 established federal deadlines for post-quantum migration: quantum-resistant key establishment by December 31, 2030 and digital signatures by December 31, 2031. Federal contractors will face similar expectations. Begin inventory and planning now.
U.S. Restores Global Access to Anthropic’s Advanced AI Models
Following implementation of additional safety controls with greater than 99% effectiveness in detecting restricted usage, the U.S. government lifted export restrictions on Anthropic’s Fable 5 and Mythos 5 models.
Polish Authorities Arrest SIM Swapping Crew
Four suspects arrested in Poland for SIM swapping attacks against telecommunications providers to facilitate cryptocurrency theft, reinforcing that SMS-based MFA remains a viable attack target.
Iran-Linked Hacker Arrested in Montenegro
An Iranian national wanted by the U.S. for attacks against 150+ American universities causing estimated $3.4 billion in damages through intellectual property theft was arrested in Montenegro.
Adobe ColdFusion: Seven Critical CVSS 10.0 Vulnerabilities
Adobe addressed seven critical ColdFusion vulnerabilities with perfect CVSS 10.0 ratings. ColdFusion remains the highest-priority Adobe remediation target given its exploitation history. Patch before the holiday weekend.
Google Chrome: 382 Vulnerabilities Including 15 Critical
Google released Chrome updates addressing 382 vulnerabilities including 15 critical flaws. Deploy across all managed endpoints immediately.
Citrix NetScaler: Six Vulnerabilities Including New CitrixBleed-Style SAML Issue
Citrix patched six NetScaler vulnerabilities including a new CitrixBleed-style issue affecting SAML identity provider deployments. Patch before the holiday weekend.
Apple iOS/macOS: 30 Vulnerabilities Including Kernel and WebKit Flaws
Apple released updates addressing approximately 30 vulnerabilities across iOS, iPadOS, and macOS, including kernel and WebKit flaws enabling memory corruption, sandbox escapes, and cross-origin data exposure. Prioritize deployment this week.
Google Workspace Passkey Deadline: September 30
All Workspace administrator accounts must transition to passkey-based authentication by September 30. Begin migration planning immediately.
Accenture Acquires Dragos, RunZero, NetRise: $4.1 Billion OT Security Expansion
Accenture’s $4.1 billion OT security transaction reflects growing institutional demand for integrated industrial security capabilities. Signals the maturation of OT security as a distinct enterprise discipline.
✅ This Week’s Priority Action List
Immediate (Do This Now)
Remove internet exposure from Oracle E-Business Suite and verify May 2026 CPU deployment — 900+ exposed instances under active exploitation
Validate all Oracle PeopleSoft emergency mitigations and review authentication logs back to early June — NAIC and Nissan are the latest in a 100+ organization campaign
Patch PTC Windchill and FlexPLM immediately and hunt for JSP web shells — first CISA KEV for PLM engineering platforms, intellectual property at direct risk
Audit Microsoft 365 Conditional Access policies for ROPC and legacy OAuth coverage — 81 million spray attempts bypassed MFA through legacy authentication paths
Disable ROPC and legacy authentication flows in Microsoft Entra where operationally feasible
Confirm BlueHammer (CVE-2026-33825) patches are deployed across all Microsoft Defender installations — now in active ransomware campaigns
Rotate all Fortinet administrative and VPN credentials that have not been replaced since FortiBleed — FortiBleed is now confirmed ransomware infrastructure, not just credential harvesting
Hunt for unauthorized Fortinet administrator accounts
Patch Adobe ColdFusion (seven CVSS 10.0 vulnerabilities), Google Chrome (382 vulnerabilities, 15 critical), Citrix NetScaler (CitrixBleed-style SAML), and Apple iOS/macOS before the holiday weekend
Update Amazon Q Developer and rotate potentially exposed AWS credentials for developers using affected versions
Short-Term (This Month)
Audit every Salesforce OAuth integration and connected application — revoke any integration without a current business purpose
Rotate all dormant API keys and third-party credentials — Klue/Icarus breach traced to a four-year-old forgotten pilot credential
Patch SimpleHelp immediately and rotate AI coding assistant credentials and MCP configuration secrets — Djinn Stealer is specifically targeting Claude, Gemini, Codex MCP config files
Classify MCP configuration files as privileged credentials and rotate them on the same schedule as cloud credentials
Inventory software dependencies relying on LibSSH2 and upgrade affected applications
Review AI coding agent access to local filesystems, external MCP services, and repository permissions — Cursor IDE zero-click vulnerabilities confirm AI agents are privileged identities
Implement MCP tool description change management — treat AI tool descriptions as production code requiring formal review
Monitor authenticated sessions in customer and policy portals for behavioral anomalies — Aflac’s 10-day dwell time is the operational warning
Educate executives and security staff on Signal backup recovery key phishing — Russian intelligence is specifically targeting these keys
Begin Google Workspace administrator passkey migration planning for September 30 deadline
Strategic (This Quarter)
Implement management plane segmentation and restrict internet exposure for all Oracle enterprise platforms
Develop third-party credential lifecycle management processes — Klue demonstrates the systemic risk of forgotten pilot credentials
Apply least privilege and individual identities to AI agents with logging, approval workflows, and change control
Begin post-quantum cryptography inventory in response to EO 14409 deadlines (2030 key establishment, 2031 digital signatures)
Review hardware refresh timelines for older Apple A12/A13 devices — BootROM exploit is software-unpatchable
Implement behavioral monitoring across all customer-facing portals, not just login attempt detection
🎙️ James Azar’s CISO’s Take
When I look across this week’s four episodes, the most important insight is that attackers continue succeeding not by defeating our strongest controls but by finding the paths we forgot to protect. Oracle’s enterprise suite is being exploited because patch cadences don’t match exploitation timelines. Microsoft 365 accounts are being compromised because legacy authentication flows weren’t included in Conditional Access policy scope. Cursor IDE became a workstation compromise vector because AI agents are trusted to process external content without input validation. And FortiBleed became ransomware infrastructure because organizations didn’t rotate credentials after detecting credential exposure. None of these are defeats of sophisticated defensive technology. They are governance failures that attackers identified before defenders did.
The second takeaway that defines this week is that AI development environments are now privileged infrastructure requiring the same security architecture we’ve spent decades building around production systems. AI coding agents possess access to repositories, cloud credentials, local filesystems, and enterprise environments simultaneously. MCP tool descriptions can be modified to redirect agent behavior without touching application code. A developer opening a repository can result in full workstation compromise without a single click. We built zero-trust principles, least privilege frameworks, and change management processes for good reasons. Every one of those principles applies directly to AI agents — and the organizations that apply them now will avoid the operational failures that others are only beginning to discover.
Stay Cyber Safe. 🔐
📋 Week in Summary
This was the week that crystallized one of 2026’s defining cybersecurity truths: trust without continuous validation has become one of the largest attack surfaces in the enterprise. Oracle’s enterprise platforms EBS, PeopleSoft, and WebLogic have experienced repeated exploitation throughout the year because organizations are treating quarterly patch cycles as sufficient protection in an environment where exploitation follows disclosure within days, not weeks. The Klue/Icarus cascade demonstrated that one forgotten four-year-old credential can compromise dozens of organizations simultaneously and that stolen data doesn’t stay with the initial attacker. Huntress’s documentation of 81 million password spray attempts exploiting a legacy Microsoft OAuth flow that bypasses MFA entirely showed that “we have MFA” is no longer a complete sentence. And Cursor IDE’s zero-click vulnerabilities confirmed that AI coding agents are now privileged identities that deserve the same threat modeling as domain administrators.
The positive signals this week were meaningful. Operation Endgame recovered 27 million stolen credentials. Scattered Spider members are facing criminal consequences across multiple jurisdictions. The Five Eyes are issuing direct warnings about AI-accelerated attacks rather than theoretical future scenarios. Post-quantum cryptography is now a federal deadline rather than a distant planning exercise. But the pace of positive developments still lags behind the operational tempo of attackers who are actively exploiting Oracle environments three weeks after patches were available, linking FortiBleed directly to ransomware deployment pipelines, and targeting the exact MCP configuration files that contain the keys to cloud infrastructure. The organizations that will navigate what comes next are the ones executing the fundamentals with the urgency the threat environment actually demands.
Stay informed. Stay prepared. Stay Cyber Safe. 🔐
© CyberHub Podcast | Subscribe on Substack | Watch on YouTube | Follow on LinkedIn