A heavy patch Tuesday lands.

The CyberWire Daily episode covers a high-impact Patch Tuesday with Microsoft addressing 165 vulnerabilities, including critical flaws in SharePoint, Windows TCPIP, and Microsoft Defender. Industrial control system vendors like Siemens and Rockwell issued urgent advisories, while Adobe patched 55 vulnerabilities, five of which were rated critical. The episode highlights growing cyber threats, including a pro-Russian group's attempted disruption of a Swedish power plant, a massive fake crypto app scam on Apple's App Store, and ongoing chip smuggling to China. CISA's directive to furloughed federal employees to return to work underscores the strain on U.S. cybersecurity operations amid funding lapses, which have disrupted key programs like the Cyber Corps Scholarship. A major theme is the rise of AI-driven threat discovery, exemplified by Anthropic's Project Glasswing, which autonomously identified thousands of vulnerabilities and generated exploits in hours. The episode features a conversation with Johnny Hand, VP for AI Excellence at Trend AI, who discusses the need for AI operational discipline, the risks of over-reliance on AI, and the ethical and practical challenges of treating AI agents as 'employees' with separate licenses. Virginia's new law banning precise geolocation data sales reflects a broader national trend toward stronger privacy protections. The episode concludes with sponsor segments from Arcova, Vanta, ThreatLocker, and GuardSquare, emphasizing real-world security solutions for evolving threats.