Cybersecurity today would like to thank Meter for their support in bringing you
This podcast Meter delivers a complete networking stack, wired, wireless and
cellular in one integrated solution that's built for performance and scale.
You can find them at meter.com/cst.
Unsupported edge devices are becoming a global infrastructure risk.
Microsoft Exchange online flags, legitimate emails as phishing.
Google warns governments to start preparing now for post quantum
cybersecurity and open claw fallout continues as new research finds
growing infrastructure exposure.
This is cybersecurity today.
I'm your host, Jim Love a new advisory from the Cybersecurity
and Infrastructure Security Agency.
CSA landed this week with little noise.
It shouldn't have.
It describes a problem that's already playing out in the
real world in a big way.
The update follows a cyber incident in Poland's energy sector.
Attackers got into operational technology systems by exploiting
vulnerable internet facing edge devices.
These are the systems that sit at the edge of the network, firewalls,
routers, VPN appliances, the gear that decides what gets in and what stays out.
The incident itself is documented by Cert Polska.
It happened in December, 2025.
We've covered it.
It affected renewable energy sites, a combined heat and power
plant, and a manufacturing company.
The attackers broke in through exposed edge devices, deployed wiper malware.
Damaged remote terminal units, wiped human machine interfaces and corrupted firmware
on operational technology equipment.
Power generation, fortunately continued, but operators lost
visibility and control and that matters.
Systems were running, but the people responsible for them couldn't reliably
see what's happening or intervene if something went wrong in industrial
environments, that's not resilience.
That's just huge risk in power systems that can have a huge impact.
If you pull a power system offline quickly, it can take the whole
network with it in the same way in industrial environments, this
is not resilience, it's just risk.
So CASA's message is straightforward.
Unsupported edge devices are now one of the most reliable entry
points for persistent threat actors.
once these devices reach end of vendor support, they stop
receiving security updates.
Any vulnerability that becomes public stays exploitable forever.
In the Polish case, attackers also relied on default credentials to move
deeper into industrial control systems.
That's not a vendor specific flaw.
It's a pattern we keep seeing across sectors and countries when those edge
devices fail, everything's exposed.
It's a disaster.
This advisory is tied to CS a's new binding operational
directive, 26 dash oh two.
It orders US federal agencies to immediately update supported
edge devices, identify all end of support devices within three months,
And remove those unsupported devices entirely over the following year.
The language is calm, but the assessment is not unsupported.
Devices are enabling sustained cyber campaigns against critical infrastructure,
and the scale of this problem is where things get uncomfortable.
CSA didn't publish its internal list of end of support devices, probably
for good reason, but independent research gives us a partial view.
There was a study by Bishop Fox that identified tens of thousands of clearly
unsupported internet exposed devices and another couple of hundred thousand,
yes, I said it, a couple of hundred thousand that could not be definitively
classified because of visibility and configuration limits, and it's important
to be clear about what that represents.
That's one vendor ecosystem, one set of devices, just one.
There are no reliable global counts, at least that I can find.
But once numbers reach this type of range, precision stops being the point.
There are unquestionably hundreds of thousands of
exposed edge devices worldwide.
When you include other vendors, regions, less visible deployments, that number
plausibly reaches into the millions.
And these devices aren't peripheral.
They sit at the network perimeter.
They hold and regulate privileged access, and they are often the only barrier
between the internet and operational technology that was never designed
to be exposed in the first place.
The Polish incident didn't cause a blackout, which is good news.
The bad news is it showed how easily control and visibility can disappear
when that edge quietly fails.
Microsoft is investigating an issue in exchange online where legitimate
emails are being incorrectly flagged as phishing and quarantined
The problem surfaced over the weekend and has affected organizations globally.
According to reporting by bleeping computer, the false positives appear to be
tied to Microsoft's anti phishing systems rather than customer misconfiguration.
In many cases, emails sent from trusted external or even internal domains
were suddenly classified as malicious.
Even though they passed standard authentication checks like SPFD, Kim
and DARC for affected organizations, the impact was immediate and operational.
Legitimate business emails were being diverted into quarantine, delayed or
even blocked outright with administrators left scrambling to determine whether
they were facing an actual phishing campaign or a detection failure.
In some cases, users were told messages were unsafe when they were anything but.
Microsoft has acknowledged the issue and said it's reviewing recent
changes to its detection logic.
While the company has not confirmed a single root cause, it's indicated
that adjustments were being made to reduce the false positives
and restore normal mail flow.
No evidence has been reported that the emails were genuinely malicious or that
customer environments were compromised.
So this is not a breach, but it's still a reminder of how much trust organizations
place in automated security systems.
When detection tools fail quietly, they don't just stop threats, they stop work.
And when those tools sit inside, managed cloud services, customers
have limited visibility into what changed, when it changed, or why.
Google is warning governments and industry that the transition to
post quantum cybersecurity needs to start now, not later in a new
policy push in technical briefing.
The companies arguing that waiting until practical quantum computers arrive will
be too late to protect sensitive data.
In a post published on the Google blog, the company says that the harvest now
decrypt later Threat is already real.
Adversaries can steal encrypted data today and store it until future quantum
systems are powerful enough to break widely used encryption methods like
RSA and Elliptic Curve cryptography.
Google's message is not that quantum computers are about
to crack encryption tomorrow.
It's that cryptographic transitions are slow, complex, and deeply embedded.
Replacing encryption across operating systems, cloud services,
network devices, and industrial systems can take a long time.
They say maybe even a decade or more.
So the company is urging governments to accelerate adoption of post quantum
cryptography standards, particularly those finalized by the US National
Institute of Standards and Technology.
Google says organizations should begin inventorying where cryptography is used,
testing quantum resistant algorithms and planning staged migrations.
Google's role here is notable.
It has already deployed post quantum protections in parts of Chrome,
Google Cloud, and its internal infrastructure, giving it real
experience with the trade-offs involved.
The core point is simple.
Quantum computing doesn't need to arrive suddenly to create risk.
The risk window opens the moment attackers decide Data is worth stealing
today, so it can be decrypted tomorrow.
And for anyone who thinks that quantum computers are a distant or theoretical
problem, our sister podcast hashtag trending is running a story today on how
Google has made real progress towards a commercially viable quantum computer.
You can find it@technewsday.com under podcasts, or just search
for hashtag trending and gym love wherever you get your podcasts.
Just what it seemed, the open clause security incident might be settling down.
New research shows the situation is still evolving, and in
some ways it's getting worse.
A report from Security Scorecard says The real risk tied to open
claw is not runaway AI behavior or speculative super intelligence fears.
It's exposed infrastructure According to researchers systems connected to Open
Claw are continuing to surface online with misconfigurations weak access controls
and unnecessary internet exposure.
Security Scorecard says the pace of discovery has been so fast that it's
been necessary to build a live public dashboard to track all the newly
identified exposures as they appear.
That alone tells you this is not a static cleanup problem.
The research highlights a familiar pattern, rapid deployment, complex
architectures and security controls that lag behind functionality.
As organizations rush to experiment with these agent-based systems and
interconnected AI services, supporting infrastructure, APIs, cloud services,
orchestration layers were often left more exposed than intended.
What's notable is what the report does not claim.
There's no suggestion of sentient AI or science fiction scenarios.
Just exposed services, over permissive access internet facing systems
that were never meant to be public.
One detail in security scorecard's live dashboard really stands out when exposures
are broken down by industry, one of the leading adopters and the most exposed
IT and technology companies themselves.
There's no public data showing exactly how those systems are configured
or how exposed they are internally, but given what we've already
seen with open claw deployments, it's hard to rule anything out.
So the open clause story is no longer about a single breach or a single fix.
It's about how quickly modern systems can change and how easily security
debt can accumulate when complexity outpaces visibility and architecture.
What can we do?
Well, check your organization.
Check to see if you have any exposures, . And this is just my opinion, but I've
said it many times, unless you've got it totally isolated and you know exactly
what you're doing at the command level.
Get anything from open claw off your system and have somebody competent.
Check it out.
That's our show.
We'd like to thank Meter for their support in bringing you this podcast
Meter delivers full stack networking infrastructure, wired, wireless,
and cellular to leading enterprises.
Working with their partners, meter designs, deploys and manages everything
required to get performant, reliable and secure connectivity in a space.
They design the hardware, the firmware build, the software, manage deployments.
Even run support.
It's a single integrated solution that scales from branch offices
to warehouses to large campuses, all the way to data centers.
You can book a demo at meter.com/cst.
That's METE r.com/cst.
I'm your host, Jim Love.
Thanks for listening.