Daily Briefing for 02.04.26

At a glance.

• White House Cyber Director launches major overhaul of cybersecurity policy.
• CISA warns of actively exploited SolarWinds flaw.
• ShinyHunters extortion group leaks Panera Bread data.

White House Cyber Director launches major overhaul of cybersecurity policy.

The Trump administration's National Cyber Director, Harry Coker Jr., is preparing a major overhaul of US cybersecurity policy with a strong emphasis on private-sector collaboration and regulatory reform, WebProNews reports. The forthcoming national cybersecurity strategy will focus on streamlining security mandates to address complaints about overlapping and sometimes conflicting regulations. The new strategy would also prioritize increasing threat intelligence sharing between the public and private sectors, strengthening legal protections for companies that disclose cyber incidents. The National Cyber Director’s office is soliciting input from industry stakeholders on areas for improvement.

CISA warns of actively exploited SolarWinds flaw.

The US Cybersecurity and Infrastructure Security Agency (CISA) warns that a critical vulnerability in SolarWinds Web Help Desk is being actively exploited in attacks. CISA has ordered Federal Civilian Executive Branch agencies to patch the flaw by this Friday, February 6th. Private sector entities should follow suit and prioritize patching the vulnerability as soon as possible.

The SolarWinds vulnerability (CVE-2025-40551) was disclosed last week and given a CVSS score of 9.8. The flaw is an untrusted data deserialization vulnerability that can lead to unauthenticated remote code execution.

ShinyHunters extortion group leaks Panera Bread data.

The ShinyHunters extortion group has published data belonging to 5.1 million Panera Bread customers, SecurityWeek reports. The data includes names, email addresses, phone numbers, and home addresses. Panera confirmed an intrusion to Reuters last week, stating that the "data involved is contact information."

Mandiant published a report last week warning that the ShinyHunters group was using voice phishing attacks to compromise SSO credentials and multifactor authentication codes in order to gain initial access.

Business News: LevelBlue acquires MDR provider Alert Logic from Fortra.

Dallas-based MSSP LevelBlue has acquired Houston-based managed detection and response (MDR) provider Alert Logic from Fortra. LevelBlue shared news of the acquisition alongside the announcement of a long-term strategic partnership with Fortra. The company stated, "LevelBlue’s expanded MDR platform, strengthened through recent acquisitions, will provide Alert Logic’s client base with access to a larger global footprint, broader threat telemetry, and accelerated detection and response across complex environments. In parallel, Fortra will become one of LevelBlue’s leading cybersecurity partners, making its best-in-class software and platforms available to LevelBlue’s global client base."

Read more in the Business Briefing at 4pm ET.