Intel Chat: Japan's ¥10B cyber fund, Apache HTTP/2 RCE, 60K GitHub repos, France blames Iran [354]

Intel Chat with Matt Bromiley and Chris Luft.

• Japan approves a ¥10 billion (about $63 million) emergency cybersecurity package, announced November 6, to expand incident response, cyber investigations, AI-assisted defenses and victim recovery, backing the Active Cyber Defense law that took effect October 1. TrendAI counts more than 600 publicly reported incidents in the first nine months of 2026, already past 2025's 594, after ransomware at Nichirei and Asahi and breaches at GMO Internet Group. Chris: $63M doesn't go far at Japan's scale. Matt reads it as an exploratory starting fund focused on faster disclosure, then widens it out: national cyber strategies were written before AI and now need redoing, some countries are "showing up to an F1 race with a horse", and AI sovereignty raises a hard question. Do you build your own LLM, rely on another country's frontier model, or find a supplier you trust, the way governments once bought network hardware?
• Apache patches CVE-2026-119618, a critical (CVSS 9.8) remote code execution race condition in mod_http2 affecting Apache HTTP Server 2.4.55 through 2.4.70, fixed in 2.4.71. Only servers with HTTP/2 enabled are affected; disabling HTTP/2 is the stopgap. It was found independently by Anthropic's OSS scanner and by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research. Wiz sees affected versions in 64% of cloud environments. The release also fixes CVE-2026-106023 and CVE-2026-109163. Three words: patch, patch, patch. Chris: humans aren't very good at writing code, and machines are better at this part of the game. Matt: was it a vulnerability when the code was written, or did new capabilities make it one?
• wfx-loot (Aikido Security): about 4,800 compromised developer and bot accounts sent probe pull requests to 61,764 GitHub repositories, and the credential stealer executed in more than 1,800 of them through GitHub Actions workflows, CI shell scripts and npm install hooks. It harvests GitHub tokens, repository secrets, cloud credentials and AI API keys, then reaches for persistence in AWS and Azure. StepSecurity traced 173 probe PRs to tokens issued to the Fly.io GitHub app, with no sign Fly.io itself was compromised. Chris: AI is multiplying the PRs every team merges, and malicious changes get harder to spot in that noise. Matt: some of those PRs were probably approved and merged autonomously, and over-permissioned developer tooling is the theme.
• France attributes the October 11 sabotage of refrigeration controllers at about 700 retail locations, which caused tens of millions of euros in losses and about 20 fires, to Shahid Kaveh, a cyber unit tied to Iran's IRGC. Attackers reached exposed Danfoss and Dixell controllers and forced endless heating cycles with safety alerts switched off; Carrefour, Casino, Leclerc, Intermarché, Metro and Coopérative U were among those hit. Chris retracts last week's guess that Russia was behind the fridge attacks. Matt on hacktivist personas and "look what I can do". CERT-FR's best advice: don't put this stuff on the internet. Chris closes on Cory Doctorow's story about appliances that stop working when the company behind them goes under.

Stories covered:
• https://www.darkreading.com/cybersecurity-operations/japan-emergency-funding-cybersecurity-ai-assisted-breaches
• https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/
• https://www.securityweek.com/attacker-targets-60000-github-repositories-in-credential-theft-campaign/
• https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html

Chapters:
0:00 Captain Underpants and core memories
2:07 A trillion-dollar scandal and the human side
4:32 Japan's ¥10B emergency cybersecurity package
6:49 $63M doesn't go far at Japan's scale
10:08 Rewriting national cyber strategy for AI
11:12 Showing up to an F1 race with a horse
13:05 AI sovereignty and the kill switch
15:31 ¥10B won't build you an LLM
17:31 Apache HTTP/2 RCE found by Anthropic and Google
21:10 Humans aren't very good at writing code
21:39 Was it a vulnerability when it was written?
25:08 wfx-loot: 60,000 GitHub repositories probed
29:30 AI is taxing the pipes
30:43 PRs merged autonomously
31:58 France blames Iran for the refrigeration sabotage
34:30 Why would Iran attack Europe?
36:59 Don't put this stuff on the internet
37:24 Cory Doctorow and the dishwasher that stopped working

The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.

Subscribe wherever you listen:
• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps
• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740
• YouTube: https://www.youtube.com/@limacharlieio

Learn more about LimaCharlie: https://limacharlie.io

#cybersecurity #infosec #supplychain #ICS #AI