Subscribe Share Full episode and show notes Threat Intelligence , Critical Infrastructure Security , AI/ML GPS, PCI, ARCH, OH MY! – PSW #931 In the security news this week: GPS spoofing and satellite jamming are getting way too accessible, Rekeying satellites in orbit sounds terrifying, Cyber extortion and whether criminals still have ethics, AI helping cybersecurity research… and drug discovery, Data centers eating regional power grids, Nuclear, solar, natural gas, and the future of AI infrastructure, What happens when GPS stops being trustworthy?, Satellite constellations as the next critical infrastructure target, AI guardrails and why sci-fi warned us first, Cyber ranges that don’t simulate reality anymore, The weird morality line between hackers, scammers, and criminals, Future satellite warfare without calling it warfare, S... June 18, 2026 Full Segment Notes In the security news this week: GPS spoofing and satellite jamming are getting way too accessible Rekeying satellites in orbit sounds terrifying Cyber extortion and whether criminals still have ethics AI helping cybersecurity research... and drug discovery Data centers eating regional power grids Nuclear, solar, natural gas, and the future of AI infrastructure What happens when GPS stops being trustworthy? Satellite constellations as the next critical infrastructure target AI guardrails and why sci-fi warned us first Cyber ranges that don't simulate reality anymore The weird morality line between hackers, scammers, and criminals Future satellite warfare without calling it warfare Security standards for infrastructure nobody thought would be online Historical cybersecurity stories that suddenly feel very current Why AI changes both offense and defense simultaneously And how much of modern cyber defense is just educated guessing Hosts David Johnson Jeff Man https://www.obsglobal.com/ Larry Pesce @haxorthematrix https://www.finitestate.io/ https://breakstuffforfun.com/ Lee Neely Announcements If you’re in the SOC, you already know the pain. Too many alerts, not enough context, and attackers slipping through the cracks. Now add AI-driven attacks and increasingly complex environments. At the AI for Next-Gen SOC Virtual Cybersecurity Summit on June 24th, learn how to actually apply AI for detection engineering, threat hunting, and reducing false positives without breaking your workflows. Security Weekly listeners can register for free at https://securityweekly.com/nextgensoc using the promo code: CSS26-SW List of Articles David Johnson ToorCamp 2026! Awww yeah it's camp time! Larry Pesce Supply Chain Attack Compromising Arch Linux AUR Packages with Infostealer and Rootkit – Truesec Fedora Linux 43 exposes 20-year-old Microsoft Outlook security failure The Evil MSI Background is Back! – SANS Internet Storm Center Receiving US Nuclear Detection Satellite Signals with RTL-SDR, Discovery Dish and Discovery Drive The U.S. Military Quietly Turned GPS Into a Global ‘Numbers Station,’ Evidence Suggests Spy Tech: The GPS Numbers Station Russia develops costly Starlink jamming system: Here’s the catch Smart Bulb WiFi Server Hosts “Banned” Literature Hacking Group Claims Major Hack of Novo Nordisk, Attempted $25 Million Extortion – Slashdot Honda Civics and the Evil Valet Lee Neely Google Threat Intelligence Group Report: PRC Threat Actor Maintained Presence on Networks for More Than a Year Google Threat Intelligence Group (GTIG) has published a report describing "a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community." The threat actor maintained presence in targeted networks for more than a year. The earliest known compromise occurred in September 2023, where externally facing servers were exploited to deploy the INFINITERED custom malware to capture legitimate credentials. Google provides prevention, detection and remediation guidance which applies to more than just this sector. This includes SIEM, Audit, Log monitoring as well as MFA, device bound session credentials, alerts for compromised passwords, patching/updates as well as YARA rules and IoCs for the detection of the INFINITERED malware. Leverage this to both prevent and minimize dwell time. You really want to be sure you can detect and respond to malicious activity as rapidly as possible, you don't want to be explaining, to management, why they were in your system for a year undetected. Feds snooze as US datacenter law set to lapse with no replacement in site The Federal Data Center Enhancement Act (FDCEA), which passed in 2023, will expire on September 30, 2026 and there does not appear to be any effort made to extend its duration or create an alternative. The FDCEA establishes standards for data centers that are entirely or partially owned, operated, or maintained by US federal agencies. Its provisions address facility availability and uptime; use of sustainable energy; protection from power failure, physical intrusions, and natural disasters; and IT security. This may get lost with all the dust-up over creating, or blocking, AI data center building in the US. While the objections cite environmental concerns, advocates point out the result is likely those capabilities developing in other countries. Existing control frameworks, such as NIST 800-53, include controls around heating, cooling and fire supression, and even resiliency, but don't include environmental concerns. Even without this specific legislation, federal data centers will still have to follow the most restrictive of any applicible federal, state, county or city regulations, which will likely keep them on their toes. Controversial FISA spying law expires tonight. The spying will continue. The US Foreign Intelligence Surveillance Act (FISA) expired on June 12, 2026 when legislators failed to pass a short-term extension to the warrantless surveillance law. FISA, which was enacted in 2008, allows US intelligence agencies to gather data, from US citizens as well as residents of other countries, in an effort to identify foreign hackers, spies, and possible terrorists. The law's critics have called for changes, citing its misuse. Legislators have been seeking to amend FISA to require agencies to obtain warrants prior to accessing information of US citizens. However, because Section 702 surveillance operates under yearlong certifications approved by the FISA Court, intelligence agencies are still able to use surveillance tools until March 2027, but cannot seek any new orders under the law. This is a matter for the legislative branch, not the executive, and the core beef is the abuse/protection of US Citizen's privacy rights. Expect a renewal of this or similar legislation in the future, even so, agencies can fall back on other surveillance avenues such as Executive Order 12333 which allows for surveillance around the world and also includes restriction on use/access to US Citizen data. Inside the FBI’s Kinetic Cyber Range In 2025 the Operational Technology Division of the FBI built a 22,000-square-foot "Kinetic Cyber Range" (KCR) in Huntsville, Alabama to train personnel to handle cyber incidents and investigations in a simulated small town. The KCR contains a wide variety of areas ranging from residential and commercial — houses, a hotel, a gas station with a grocery market, an arcade, a data center, real vehicles — to government and critical infrastructure buildings including a courthouse, a power company, and a hospital. Every space is set up with realistic physical conditions as well as "functioning systems, networks, and devices designed to behave as they would in the real world," down to Active Directory, email, and firewalls on a network, a home full of IoT devices, or a data center containing over 200 Windows and Linux servers. Having a kinetic range, with "real" sysetms as well as role players is a boon to developing cyber skills, both in offense and defense. Note this environment also includes working in real environments, the data center is cold, dark and noisy, as it would be in a real-world situation. This range also teaches soft skills, such as working under stress, where communicating clearly, and judgetment and restraint are as critical as expertise. This is vrey cool and brings back fond memories of using the SANS CyberCity kinetic range. Statement on the US government directive to suspend access to Fable 5 and Mythos 5 On June 12, 2026, Anthropic disabled Fable 5 and Mythos 5 for all customers in order to comply with an export control directive sent by the US Department of Commerce at 5:21 p.m. ET that day, which ordered the company to suspend access to both models "by any foreign national ... including foreign national Anthropic employees." Fable 5 had been publicly released three days earlier, but Mythos remained restricted to specific partner companies. Tricky balance of enabling a competitive edge while preventing ones adversaries from obtaining the same advantage. When working with foreign nationals you need to understand what is considered a deemed export as well as risks to your IP when handled by non-citizens. In my career that was significant as we were working with federal inforamtion, both unclassified and classified. Regardless of which side you're on, appreciate that this is an indication that AI jailbreaks are being taken seriously by DoC, and they are worried about loss of our IP/competitive edge. Anthropic is working to educate and clarify the risks to DoC by documenting controls, which include defense in depth, likelihood of jailbreak, to include difficulty, mitigtaions, and 30 day data retentaion. This should be resolved quickly. Maine Disables Data Breach Portal Due to Fake Submissions The Office of the Maine Attorney General announced it has temporarily disabled its data breach portal in response to fake submissions. Maine is one of a small number of US states in which