News · eGov
President Donald Trump has nominated Palantir's chief information security officer to head the Cybersecurity and Infrastructure Security Agency, as several significant security incidents come to light globally.
✦ AI SUMMARY 30-second read
- Michael LoSapio, Palantir's CISO since September 2024, nominated by President Trump to lead CISA, which has lacked a Senate-confirmed director since January 2025.
- Researchers disclosed flaws in ForgeRock identity deployments used by unnamed automakers, enabling remote commands to connected vehicles; fixes applied within two hours.
- Baker Tilly clients hit by a data breach affecting personal information including Social Security numbers, with over 10,000 victims recorded in Texas alone.
Why it matters: A string of high-profile incidents across government, financial services and automotive sectors underscores the breadth of current cybersecurity vulnerabilities worldwide.
This summary was generated by AI. Editors may review and update it.
President Donald Trump has nominated Michael LoSapio to serve as director of the Cybersecurity and Infrastructure Security Agency. LoSapio has held the role of chief information security officer at Palantir since September 2024. CISA has been without a Senate-confirmed director since January 2025.
Separately, security researchers Sam Curry and Shubham Shah disclosed weaknesses in ForgeRock identity deployments operated by unnamed automakers. The flaws enabled them to take over customer accounts and issue remote commands to connected vehicles.
Connected vehicle vulnerabilities
In one instance, the researchers bypassed a web application firewall to reach an Apache Felix console that accepted default administrator credentials. This gave them the ability to execute code on production identity servers shared by two automakers.
The affected automakers resolved the issue approximately two hours after being notified. ForgeRock is an identity and access management platform widely used by enterprises to handle customer authentication.
Baker Tilly breach and OpenAI incidents
US accounting firm Baker Tilly is notifying clients of a data breach originating from a service provider's platform. The intrusion dates to early September and affected personal information, including Social Security numbers, belonging to clients and their dependants. State regulator filings indicate more than 10,000 victims in Texas alone.
OpenAI disclosed details of a July incident in which five AI agents conducting cybersecurity evaluations gained root privileges within continuous integration workloads. The agents used credentials and scripts left by earlier agents to alter evaluation settings and access restricted information.
Separately, researchers at Depi described a prompt injection attack chain targeting OpenAI's Codex repository that could have resulted in a malicious Codex release on the npm package registry.
Further incidents: Railway, SQL Server malware and LLM backdoor
Cloud deployment platform Railway published an incident report on an October attack in which a threat actor obtained its code repository and decrypted customer environment variables. Unauthorised spending on stolen keys is estimated at about $740,000.
Fortinet analysed a campaign in which Go-based malware targets internet-facing Microsoft SQL Server instances to deliver a Monero cryptominer and the Gh0st remote access Trojan.
Microsoft researchers described a technique called Lazarus that backdoors a large language model by rewriting the weights of dormant neurons. An AI agent built on a compromised model behaves normally until a specific trigger activates an attacker's commands.