CyberWire Daily The bug that got everyone’s attention.
12 snips
Dec 9, 2025 In this discussion, Dave Lindner, CISO of Contrast Security and an expert in application security, dives into the critical React2Shell vulnerability that has organizations on high alert. He explores how nation-state adversaries are focusing on source code infiltrations, aiming for both public and private sectors. Lindner highlights the stealth tactics used in supply-chain attacks, and shares practical defenses for businesses facing these threats. The conversation also touches on the implications of AI in cybersecurity and the evolving landscape of digital risks.
AI Snips
Chapters
Transcript
Episode notes
Source Code Offers Wide Strategic Reach
- Nation-state actors target widely used source code to amplify impact across many victims.
- Compromising a single vendor can give access to governments and large corporations simultaneously.
Hollywood Metaphor For Supply-Chain Attacks
- Dave Lindner compares supply-chain compromises to Hollywood infiltration scenes.
- He uses F5 and SolarWinds examples to show attackers exploit trusted third parties to reach bigger targets.
Low‑And‑Slow And Living‑Off‑The‑Land
- Attackers use low-and-slow and living-off-the-land techniques to remain undetected.
- These methods exploit existing tools and compromised credentials rather than obvious malware installs.