Greg Otto
Verified
As seen in:
CyberScoop,
Safe Mode Podcast,
Medium,
Scribd,
Goodreads,
U.S. News and World Report,
Flipboard,
Puget Sound Business Journal,
General Assembly,
Chief Marketer,
FedScoop,
Vocativ
and
Covers:
national news, pop culture, media, politics, campaigns, drones, sports, technology
Doing the professional thing over at @gregotto.bsky.social. Bad Philly sports tweets otherwise. You're welcome/I'm sorry.
Articles by Greg Otto
Spyware found on devices belonging to prominent Serbian critics as elections loom
Spyware has been detected on devices used by some of Serbia’s most prominent figures connected to the country’s political upheaval, according to researchers who announced their findings Monday.
Federal agencies recommend cyber controls, independent testing for frontier AI systems
The federal government is advising AI companies to set more industry standards for securing agents in sandbox testing environments.
Cybersecurity incident at BAE Systems disrupts US bankruptcy court system
A cybersecurity incident at BAE Systems has halted the production and delivery of bankruptcy notices for every federal bankruptcy court in the United States, disrupting a core administrative function of the judiciary with no announced date for restoration. The Bankruptcy Noticing Center, known as the BNC, produces and transmits notices in bankruptcy cases nationwide. BAE Systems, a defense contractor, operates the center’s systems and websites on behalf of the federal judiciary.
Proofpoint to buy Varonis for $6.3 billion
Proofpoint agreed Thursday to acquire Varonis Systems in a cash transaction valued at approximately $6.3 billion, combining two companies that have positioned themselves around a shared bet: that securing data has become the central problem of the AI era. The acquisition pairs two distinct approaches to security. Varonis specializes in data security, mapping where sensitive information sits inside an organization, who can reach it, and how it is actually used.
AdFection: How mercenary spyware invades victims’ devices through targeted advertising
Get our latest cybersecurity news first on Google. Listen to this article 0:00 Learn more. This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. That online ad you saw for earbuds, a drone or bubble gum-scented car air freshener may have been a gateway for mercenary spyware that can infect your device without you ever having to click on it.
DOJ charges 14 over a sprawling North Korean remote work scheme
Federal authorities have charged 14 people and seized roughly 187 computers in their newest effort to disrupt North Korea’s remote IT worker scheme. The Justice Department announced the indictment Tuesday, highlighting two arrests and searches of more than 40 residences in Texas known or suspected to operate as “laptop farms,” where facilitators maintain employer-issued laptops so North Korean engineers can use them while abroad.
IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion
IonQ announced Monday that it will acquire Elisity, a zero-trust network security firm, in an all-stock transaction valued at up to $1.3 billion that folds enterprise access control into the quantum computing company’s expanding cybersecurity business. Elisity, founded in 2019, sells a software policy layer that governs which users, devices, workloads and AI agents can communicate across a network, independent of the underlying network technology.
Your AI agent is only as safe as the packages it downloads
Strip away the model names and the headlines, and this year’s AI agent incidents share a feature that has little to do with how capable the models are. Nearly all of them ran through the software supply chain. Start with the case that set off the summer’s wave of disclosures. In July, two OpenAI models undergoing a cyber-capability evaluation escaped their sandbox.
Canadian cybersecurity executive arrested in federal extortion case
Federal authorities arrested a Canadian cybersecurity executive Thursday in Pennsylvania on charges of conspiracy of extortion, according to federal court records posted Friday. Edward Dubrovsky, 54, is a former chief operating officer and founder of CYPFER, a firm that helps organizations negotiate with ransomware operators.
Quantum computers could break today’s encryption. Washington needs to prepare now.
The country is consumed right now with debating artificial intelligence and whether increasingly powerful AI systems could escape human control. Those are valid concerns, but lawmakers are overlooking another technological threat: quantum computing. Unlike AI safety debates, this risk could render today’s encryption obsolete – compromising everything from emails to financial transactions to government communications and military systems.
Former NSA chief Nakasone says agency overhaul is ‘probably needed’
Former National Security Agency Director Paul Nakasone said a reported broad reorganization of the agency is “probably necessary” as it confronts faster-moving cyberthreats, artificial intelligence and competition with China, but he cautioned that the outcome will depend on how the changes are carried out. Speaking Tuesday at VulnCheck’s ThreatCon1 conference, Nakasone addressed a recent report that the NSA is undergoing a major restructuring centered in part on artificial intelligence and China.
The US needs a real plan to defend its water systems
Get our latest cybersecurity news first on Google. Listen to this article 0:00 Learn more. This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. The summer’s cyberattacks by Iranian hackers on water systems in 12 states underscored how vulnerable U.S. water systems are to foreign adversaries. A broad attack on water infrastructure could have consequences comparable to a public health crisis that impacts the country’s entire population.
AI policy circles targeted in China-linked phishing operation
A China-aligned cyber espionage group targeted U.S. artificial intelligence policy experts through phishing emails that impersonated prominent officials, economists and an employee of AI company Anthropic, according to research released Thursday by Proofpoint. The campaigns, which the cybersecurity company attributed to a group it calls TA419, sought access to cloud accounts held by people at think tanks, universities and law firms.
Kiteworks lifts shutdown advisory after ‘credible threat intelligence’ from federal authorities
Kiteworks, a provider of secure file transfer and data-sharing tools, told customers Monday they could resume normal operations after a weekend-long precautionary shutdown prompted by what it called “credible threat intelligence” from federal authorities. The recommendation, issued last week, advised customers to take production systems offline ahead of a potential imminent attack. The company also shut down the environments it hosts on customers’ behalf.
How tax policy can stop threat actors from breaching US water systems
The foundation for modern society in America is under attack. State and local governments, entities that often oversee critical natural resources, schools, and hospital systems, are routinely targeted and breached by state-backed threat actors. Their budgets are simply too slim to provide the digital bulwarks required to fend off such attacks. The problem is growing.
Pentagon cyber chief: The demand far exceeds supply
The Pentagon’s top civilian cyber policy official said Tuesday her single priority is expanding the cyber options available to the president and the defense secretary, describing a gap between what commanders are asking for and what the force can deliver. “I’m focused on one single priority, and that is building a more robust set of capabilities for the secretary and the president,” said Katie Sutton, assistant secretary of defense for cyber policy, at DefenseTalks, hosted by DefenseScoop.
The president has called for AI leadership. Here’s the mission.
America leads the world in artificial intelligence. As it should. But tech leaders keep warning, with alarming frequency, that we are at risk of losing control. President Donald Trump has called for an AI czar and an “AI Force.” The details remain unclear, but the announcement underscores something fundamental. A technology this consequential demands clear leadership, accountability and action inside the U.S. government. The question now is what that leadership should do.
Authorities seize popular, long-running DDoS-for-hire service domains
Authorities seized the primary domain and other websites linked to NightmareStresser, one of the longest-running and most popular distributed denial-of-service operations used by cybercriminals globally, the Justice Department said Tuesday. Cybercriminals of various motivations used the DDoS-for-hire service to launch hundreds of thousands of DDoS attacks or attempted attacks since at least 2022, officials said.
America’s cyber strategy overlooks the infrastructure that actually keeps the military moving
Get our latest cybersecurity news first on Google. Listen to this article 0:00 Learn more. This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. A US Army Stryker seen moving towards the ARC Defender vessel at the Baltic Container Terminal in Gdynia. The US Army transports military equipment from Poland to the United States after being deployed for 9 months. It is the long-term rotation of the equipment.
GitLab’s critical flaw is already drawing internet-wide probes
GitLab released emergency patches Thursday for two high-severity flaws in its software development platform, one of them holding the highest possible severity score, while a security firm reports that it has already seen attackers probing the internet for the flaws. The company patched the issues in new versions of both its Community Edition and Enterprise Edition, and urged those that use self-managed installations to upgrade as soon as possible.
AI lets small actors run state-level hacking campaigns, Anthropic report finds Original
Artificial intelligence has removed the skill advantage that once set state-sponsored hackers apart from lone criminals, according to a threat report Anthropic published Thursday that documents misuse of its Claude models across seven areas of harm. The report, which details activity observed between December 2025 and August 2026, covers cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development and distillation.
CIA’s Michael Ellis says cyber intelligence is changing how the agency operates
CIA Deputy Director Michael Ellis said Tuesday that the agency’s role in Operation Absolute Resolve is an example of how it has moved to put cyber operations at the center of intelligence collection and field missions, rather than treat them as a separate technical service.
In most cities, nobody owns the whole network
Editor’s note: Waco bought the network segmentation technology described here from Elisity while Mike Searight was the city’s chief information officer. He is now a senior adviser to Elisity, a cybersecurity company. I stood in front of a network cabinet at one of Waco’s water treatment plants, tracing what systems could reach which. The plant’s controls were on that network. So was the branch library. So was the register at the municipal golf course.
Why judgment is emerging as cybersecurity’s defining skill
AI is getting better at much of what security teams have long spent time on: analyzing information, identifying patterns, and providing technically sound recommendations quickly. As those capabilities become more routine, they are changing what security practitioners spend their time on. Reaching a technically sound recommendation is also getting easier, which puts more weight on the judgment about what to do with it.
The AI Kill Switch Act is repeating the Clipper Chip’s mistakes
“Anything that can go wrong will go wrong.” Policymakers alarmed by the recent incidents of autonomous AI agents breaking through guardrails to hack other companies seem to have Murphy’s Law on the mind – and who can blame them? When agents’ behavior becomes unpredictable, it’s easy to imagine any number of scenarios where they’re running amok. To address this amorphous and evolving risk, Reps.
100-plus companies call for ‘global surge’ in AI-powered cyber defense
By Greg Otto • Aug 28, 2026 More than 100 companies and organizations, including OpenAI, Anthropic, Google, Microsoft and Amazon Web Services, have signed an open letter calling for a global effort to improve cybersecurity defenses as artificial intelligence capabilities advance. The letter, published Thursday, argues that the timeframe to strengthen defenses before AI-enabled attacks become more widespread and complex is rapidly dwindling.
100-plus companies call for ‘global surge’ in AI-powered cyber defense
More than 100 companies and organizations, including OpenAI, Anthropic, Google, Microsoft and Amazon Web Services, have signed an open letter calling for a global effort to improve cybersecurity defenses as artificial intelligence capabilities advance. The letter, published Thursday, argues that the timeframe to strengthen defenses before AI-enabled attacks become more widespread and complex is rapidly dwindling.
OpenAI: Agent behavior that led to Hugging Face intrusion formed in May
(Mariia Shalabaieva / Unsplash) By Greg Otto • Aug 27, 2026 OpenAI says the behavior that led its agents to breach Hugging Face emerged in its research environment more than two months before the incident, and concluded that it was a failure of alignment as much as it was a failure of security. The details come from a technical report the frontier AI company released Wednesday, which gives a full breakdown on how the incident unfolded and what the company has changed in response.
Two alleged TeamPCP members arrested and charged after months of software supply-chain chaos
Get our latest cybersecurity news first on Google. Listen to this article 0:00 Learn more. This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. The AFP charged the men yesterday (26 August, 2026) with a combined total of 14 offences after executing search warrants in Perth with WAPF, and the assistance of the FBI.
OpenAI: Agent behavior that led to Hugging Face intrusion formed in May
OpenAI says the behavior that led its agents to breach Hugging Face emerged in its research environment more than two months before the incident, and concluded that it was a failure of alignment as much as it was a failure of security. The details come from a technical report the frontier AI company released Wednesday, which gives a full breakdown on how the incident unfolded and what the company has changed in response.
Interpol targets Black Axe’s illicit financial web in latest international sting
An international law enforcement operation carried out against organized crime groups in West Africa resulted in 58 arrests and identified 263 suspects, Interpol announced Tuesday. The operation, known as Operation Jackal IV, aimed to disrupt money laundering, locate high-value targets, seize assets and support prosecutions tied to various Africa-based criminal groups, including Black Axe.
SCOTUS tosses one of two injunctions against Trump USPS mail-in ballot rules
The Supreme Court dismissed one of two lawsuits blocking the Trump administration from implementing changes to U.S. Postal Service regulations regarding mail-in ballots, saying that states lacked standing because they could not prove that the regulations would cause “concrete harm.” California and 23 other states sued the federal government after a White House executive order directed USPS to begin creating “State Citizenship Lists” for each state, consisting of voters who, according to...
Trump turns to private sector in offensive hacking operations memo
President Donald Trump signed a national security memorandum Wednesday that lays the groundwork for private sector companies to take a larger role in helping law enforcement carry out offensive hacking operations against transnational criminal organizations. The White House said sustained fraud and other cyber-enabled campaigns from transnational criminal organizations (TCOs) warranted the memo, and cited a fraud-focused executive order from March as only the first step.
Kimwolf botnet rebuilt to survive takedowns, researchers say
The developers of a notorious botnet that’s powered mostly by hijacked Android TV boxes and other internet-connected devices have released a new version built to blend attack traffic in with ordinary web browsing and to keep its command channels from being seized by law enforcement, researchers at Palo Alto Networks said in a report published Tuesday.
Kimwolf botnet rebuilt to survive takedowns, researchers say
5 days ago The most blatant security backdoor yet seen in an internet router has been found in a range of models sold under multiple brand names. A firmware implant phones home to cloud servers in China to ask for instructions, and can then be remotely controlled … Earlier this year, the US government banned …
Delta investigates in-flight Wi-Fi spoofing on post-DEF CON flight from Las Vegas
Delta Airlines said Tuesday it’s investigating an incident on a Monday flight where a passenger reportedly used an unidentified device to spoof the airline’s in-flight Wi-Fi network, leading to severe delays and authorities to board the plane once it arrived at its destination.
NATO and an AI startup can now name and track software vulnerabilities
NATO’s cyber defense arm and a startup that uses artificial intelligence to find software flaws can now issue the ID numbers the industry uses to track those flaws, the European Union Agency for Cybersecurity announced last week. The NATO Cyber Security Centre, part of the NATO Communications and Information Agency, and AISLE, a cybersecurity company with offices in San Francisco and Prague, joined as CVE numbering authorities under the ENISA Root.
UK man tied to The Com sentenced for abusing 117 victims
A 20-year-old man in the United Kingdom was sentenced to two years in prison Monday after admitting to running an online abuse campaign that affected 117 victims across multiple countries during his time in the loosely organized online criminal network known as The Com. Justin Swaddle, who was a minor when committed the crimes, pleaded guilty last month to a series of child sexual abuse offenses and blackmail.
Why transparent AI agents matter more than you think
As security operations teams now use large language models (LLMs) and autonomous AI agents into their daily work, a new frontier is emerging: attackers deliberately manipulating AI agents. Prompt injection attacks—where an attacker hides malicious instructions that cause an AI agent to ignore its safety rules—pose a serious risk to enterprises. These attacks continue to grow in size and scale.
Despite federal warnings, thousands of U.S. industrial controllers used in water systems remain exposed online
(Raymond Sime / Unsplash) By Greg Otto • Aug 07, 2026 A new scan of internet-connected industrial equipment found over 4,000 Rockwell Automation and Allen-Bradley controllers exposed online, including 22 in cities impacted by cyberattacks on U.S. water systems. The findings, published Wednesday by Forescout’s Vedere Labs, show that direct internet access to equipment used in water and wastewater operations remains common despite years of warnings from manufacturers and federal agencies.
Coast Guard says it is monitoring cyberattack that disrupted North Carolina’s ports
The U.S. Coast Guard said it is monitoring the aftermath of a cyberattack that disrupted gate operations at all three of North Carolina’s port facilities this week, though it offered few details as the investigation into the breach continues. A Coast Guard spokesperson told CyberScoop that the branch’s IT unit was coordinating with partner agencies while conducting the investigation. A spokesperson for CISA did not respond to CyberScoop’s inquiry by press time.
Despite federal warnings, thousands of U.S. industrial controllers used in water systems remain exposed online
A new scan of internet-connected industrial equipment found over 4,000 Rockwell Automation and Allen-Bradley controllers exposed online, including 22 in cities impacted by cyberattacks on U.S. water systems. The findings, published Wednesday by Forescout’s Vedere Labs, show that direct internet access to equipment used in water and wastewater operations remains common despite years of warnings from manufacturers and federal agencies.
The water sector just got it’s wake-up call. Again.
Get our latest cybersecurity news first on Google. Listen to this article 0:00 Learn more. This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. A wastewater treatment plant in Houston, Texas. (Getty Images) Last week, the FBI and EPA issued a joint alert that should concern anyone who drinks water in America–which is to say, everyone.
How companies could share cyber risks without exposing their secrets
Zero-knowledge proofs could let infrastructure operators answer key security questions without handing over the sensitive data behind their answers. Imagine a major software flaw is discovered in equipment used across pipelines, power plants and telecom networks. The government needs to know as fast as possible which companies are exposed.
Public interest coalition urges Congress to investigate OpenAI, Hugging Face hack
Public interest coalition urges Congress to investigate OpenAI, Hugging Face hack Listen to this article 0:00 Learn more. This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment.
What the Hugging Face breach reveals about defense in the age of agentic AI
The OpenAI logo is displayed on a smartphone screen placed on a reflective surface, photographed using a slow exposure with a motion blur effect, in Creteil, France, on May 12, 2026. Daybreak is an AI-powered cybersecurity service designed to detect, analyze, and remediate software vulnerabilities more quickly. (Photo by Samuel Boivin/NurPhoto via Getty Images) We almost never get both sides of an intrusion. This time we did.
Anthropic says its AI accidentally hacked three real companies during safety tests
Anthropic said a review of its cybersecurity testing found three cases in which its models broke out of sealed test environments and reached the live computer systems of outside organizations, according to a company blog post published Thursday.
Okta’s deal for Permiso aims to close gaps in identity threat detection
Okta announced Thursday it has signed a deal to buy Permiso Security, a cloud-based firm that tracks threats tied to human, machine, and AI-driven digital identities. Permiso specializes in spotting risks after a user or system has already logged in, an area the industry refers to as identity threat detection and response.
A little-known npm package was North Korea’s warm-up act for the axios hack
Amazon’s security researchers say a hacking group tied to North Korea targeted small, little-noticed software packages more than a year before it struck one of the internet’s most widely used programming tools.
OpenAI’s rogue AI agent shows why we need federal rules for autonomous systems
Months before the Hugging Face breach, Emergence AI published research that investigative journalist Ronan Farrow made public. Ten autonomous AI agents operated across five virtual environments for fifteen days without human intervention. Much of the attention focused on Grok 4.1 turning violent and Gemini 3 Flash committing 683 crimes.
Show More
loading
Actions
Get in touch with Greg
Contact Greg, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack