CISO Series

Cybersecurity Headlines

A Tech News , News and Technology podcast

#5 in Tech News · 🇮🇳 #7 in Tech News · 🇺🇸

Good podcast? Give it some love!

About the show

Daily stories from the world of information security. To delve into any daily story, head to CISOseries.com.

Newest episodes

Microsoft 365 outage, Bomb hoaxers in hijacked inboxes, Operation Endgame pulls malware plugs

Nov 13, 2026 7 min

Global Microsoft outage affects users worldwide https://www.bleepingcomputer.com/news/microsoft/massive-microsoft-365-outage-disrupts-outlook-teams-copilot-worldwide/ Old Exchange runs out of reprieves https://www.theregister.com/saas/2026/11/12/microsoft-exchange-server-2016-and-2019-enter-their-permanently-vulnerable-era/5309401 Bomb hoaxers hide behind hijacked inboxes https://therecord.media/europe-hoax-email-threats Operation Endgame pulls more malware plugs https://www.bleepingcomputer.com/news/security/police-dismantles-gootloader-castlerat-stealc-malware-infrastructure/ SilentAir taps Taiwan's calls and texts https://www.infosecurity-magazine.com/news/silentair-liminal-panda-telco/ Section 702 shortcut resistance https://cyberscoop.com/section-702-reauthorization-ndaa-debate/ App data puts police on your trail https://www.schneier.com/blog/archives/2026/11/another-way-police-are-locating-people-from-their-smartphones.html BrickLink's outage still won't click https://www.theregister.com/security/2026/11/12/lego-marketplace-bricklink-in-pieces-after-unusual-activity-takes-it-offline-for-almost-a-week/5309425 Get the show notes here: https://cisoseries.com/cybersecurity-news-november-13-2026/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Maersk gets a $5M ransom note, CopperDragon's malware connections, United grounds AI booking bots

Nov 12, 2026 6 min

Maersk gets a $5M ransom note https://www.bleepingcomputer.com/news/security/maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million/ CopperDragon's malware connections https://www.infosecurity-magazine.com/news/chinese-malware-tied-three-hacking/ United grounds AI booking bots https://www.wsj.com/tech/ai/united-airlines-is-banning-ai-bots-from-booking-flights-5b514b38 Qilin's alleged boss gets a name https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/ Zoom plugs two Windows holes https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html Iran-backed arson on FaceTime? https://therecord.media/iran-backed-network-directed-london-attacks-over-facetime N-able patches its way back https://www.infosecurity-magazine.com/news/n-able-n-central-able2shell-0day/ AntiFox linked to AWS raids https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html Get the show notes here: https://cisoseries.com/cybersecurity-news-november-12-2026/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

New CISA head, AI safety regulator, N-able's zero-day deluge

Nov 11, 2026 8 min

Australia to create AI safety regulator https://apnews.com/article/australia-artificial-intelligence-regulator-openai-agent-breach-a5dfe5379c0f7458e44b72a9073833c6 Zero-day drop forces N-able offline https://www.securityweek.com/n-able-takes-n-central-offline-as-researcher-drops-over-30-zero-days/ White House nominates new CISA head https://www.reuters.com/world/white-house-nominates-palantirs-losapio-lead-homeland-securitys-cyber-agency-2026-11-09/ https://www.infosecurity-magazine.com/news/cisa-incident-reporting-form-circia/ DeepMind formally proves Signal's cryptography https://www.wired.com/story/a-new-ai-tool-from-google-deepmind-formally-verified-the-signal-protocol/ Vanderbilt recovering from ransomware attack https://cyberscoop.com/vanderbilt-university-ransomware-attack-byod/ AWS environments impacted by third-party breach https://www.bleepingcomputer.com/news/security/hackers-exploit-trusted-aws-access-to-breach-multiple-cloud-environments/ Cereal steals NATO messages https://therecord.media/russia-hackers-espionage-romania-kazakhstan Patch news https://www.bleepingcomputer.com/news/security/sap-patches-four-maximum-severity-security-vulnerabilities/ https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/ https://www.securityweek.com/exploited-outlook-zero-day-among-1094-flaws-patched-by-microsoft/ ' Fireworks AI discloses second breach https://www.bleepingcomputer.com/news/security/fireworks-ai-discloses-new-breach-after-cloud-provider-hack/ Get the show notes here: https://cisoseries.com/cybersecurity-news-new-cisa-head-ai-safety-regulator-n-ables-zero-day-deluge/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enter...

Similar podcasts

Bloomberg Tech Bloomberg

WSJ Tech News Briefing The Wall Street Journal

Big Technology Podcast Alex Kantrowitz

All Things Policy Takshashila Institution

CyberWire Daily N2K Networks

The WAN Show Linus Tech Tips

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast) Johannes B. Ullrich

Risky Business Risky Business Media

All episodes

The newest 50 of 1,890 episodes

Microsoft 365 outage, Bomb hoaxers in hijacked inboxes, Operation Endgame pulls malware plugs

Nov 13, 2026 7 min

Maersk gets a $5M ransom note, CopperDragon's malware connections, United grounds AI booking bots

Nov 12, 2026 6 min

New CISA head, AI safety regulator, N-able's zero-day deluge

Nov 11, 2026 8 min

France blames Iran for fridge hacks, Binance breach doubts, Ukraine crypto scam arrests

Nov 10, 2026 7 min

France turns up the heat on Iran over fridge hacks https://www.reuters.com/world/french-officials-suspect-iran-is-behind-refrigerator-hacks-sources-say-2026-11-09/ Binance says breach claims don't add up https://www.bleepingcomputer.com/news/security/binance-denies-data-breach-after-alleged-shinyhunters-claims/ Operation Snowball: AI keeps a telecom attack rolling https://www.infosecurity-magazine.com/news/operation-snowball-ai-telecom/ Ukraine hangs up on crypto scammers https://therecord.media/ukraine-arrests-scam-call-centers-germany SSHole gives hackers a foot in Linux's door https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/ Researchers find the keys in carmakers' apps https://www.theregister.com/security/2026/11/09/researchers-pwn-automakers-android-apps-to-remotely-unlock-cars-honk-horns/5308483 Bitter sets a new RAT loose in South Asia https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html SEGA's mailing list spills 2.2 million addresses https://www.bleepingcomputer.com/news/security/sega-newsletter-data-breach-exposes-22-million-email-addresses/ Get the show notes here: https://cisoseries.com/cybersecurity-news-november-10-2026/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

New SonicWall flaw, WorkOS accidental AI breach, Bogota bomb hoax email

Nov 9, 2026 8 min

SonicWall warns of new exploited SSL-VPN MFA bypass flaw https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/ Escaped AI testing agent behind WorkOS breach https://www.bleepingcomputer.com/news/security/runaway-ai-hacking-agent-behind-workos-breach-after-escaping-sandbox/ Bogotá investigates potential health agency hack following airport bomb hoax email https://therecord.media/bogota-potential-city-health-agency-hack-european-hoax-emails Medical services company issues settlement over 2023 hack of patient records https://therecord.media/medical-services-company-settles-with-4-state-ags Executive deepfake trio charged https://cyberscoop.com/ai-deepfakes-impersonate-ceo-lawyer-defraud-companies/ Japan announces emergency cybersecurity package following attacks https://www.securityweek.com/japan-announces-emergency-cybersecurity-package-following-a-wave-of-attacks/ NHS reveals emotional burdens of post-breach helplines https://www.theregister.com/security/2026/11/07/nhs-breach-helpline-left-staff-carrying-a-significant-emotional-burden/5308201 Claude Code's "Don't Ask Again" file exposes passwords and keys on GitHub https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html Get the show notes here: https://cisoseries.com/cybersecurity-news-new-sonicwall-flaw-workos-accidental-ai-breach-bogota-bomb-hoax-email/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

The Department of Know: LLM jacking, Asia rocked by Amadeus, freezers still getting hacked

Nov 6, 2026 36 min

Read the full stories at CISOseries.com. This week's Department of Know is hosted by Sarah Lane, with guests Jason Thomas, senior director, technology security, governance, and risk, Cystic Fibrosis Foundation, and David Nolan, CSO, Trimont. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, ESET Your teams are adopting AI faster than security keeps up. ESET helps you embrace it safely. Confident AI adoption starts with proactive protection and effortless security management: AI-powered prevention stopping threats early, expert MDR watching 24/7, and one platform that's simple to run. Get to know the new ESET PROTECT Platform - designed for the AI era.

Norway aid agency attack, GhostMap Android flaw, More airlines hacked

Nov 6, 2026 7 min

Norway's aid agency suffers data breach https://www.theregister.com/cyber-crime/2026/11/05/norways-aid-agency-pwned-and-all-users-data-is-stolen/5307765 GhostMap Android flaw lets app run persistent boot loop https://www.bleepingcomputer.com/news/security/ghostmap-android-flaw-lets-malicious-app-trigger-persistent-boot-loop/ Zyxel fixes zero-day on network switches https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/ More Asian airlines rocked by Amadeus https://therecord.media/asian-airlines-announce-data-breach-it-provider-incident Cyberattack wipes cloud data at Russian hosting provider Beget https://therecord.media/russia-cyberattack-beget-cloud Hackers exploit patched Apple flaw to deliver info-stealing malware https://thehackernews.com/2026/11/hackers-exploit-patched-apple-flaw-to.html Bank phishing sites evade takedowns by playing dead https://www.securityweek.com/bank-phishing-sites-show-fake-suspended-pages-to-evade-takedowns/ New York's Queens Public Library battles ransomware attack https://www.theregister.com/cyber-crime/2026/11/05/new-yorks-queens-public-library-battles-ransomware-crims-wi-fi-checkouts-and-website-go-dark/5307796 Get the show notes here: https://cisoseries.com/cybersecurity-news-november-6-2026/ Huge thanks to our episode sponsor, ESET ESET MDR is a 24/7 threat management service combining AI and human expertise to achieve an industry-leading 6-minute threat response and containment, removing the need to maintain in-house security specialists. You don't need a security team the size of a Fortune 500. You need ESET. Supervised Cybersecurity for the AI Era. Built to be effortless.

Blood bank fridge hacks, Anthropic model identity, Google Calendar phishing

Nov 5, 2026 6 min

Blood banks caught in European fridge attacks https://www.cnbc.com/2026/11/04/blood-bank-fridges-cyberattacks.html Anthropic wants proof of which AI model answered https://techcrunch.com/2026/11/03/anthropic-is-working-on-a-system-to-prove-ai-models-identity/ Google Calendar phishing steals live sessions https://www.bleepingcomputer.com/news/security/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa/ Chinese keyboard app traffic hijacked to deliver malware https://www.infosecurity-magazine.com/news/slippynunchucks-sogou-dns-hijacking/ French bank confirms heist estimated at $133 million https://therecord.media/french-bank-confirms-cyber-heist APT29-linked campaign targets unpatched phones https://thehackernews.com/2026/11/apt29-linked-hackers-hijack-web.html NIKKE PC launcher spread remote-access malware https://www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/ Hackers push false alerts through Kyiv Independent https://therecord.media/ukraine-kyiv-independent-cyberattack Get the show notes here: https://cisoseries.com/cybersecurity-news-november-5-2026/ Huge thanks to our episode sponsor, ESET Managed detection and response used to be built for big enterprises with big budgets. Not anymore. ESET is bringing effortless cybersecurity as a service to businesses of every size, with twenty-four-seven monitoring, automated threat containment, and real experts behind it, all without the overhead. You don't need a security team the size of a Fortune 500. You need ESET. Supervised Cybersecurity for the AI Era. Built to be effortless.

China's AI guardrails, NCSC's 2028 warning, more Binance hack details

Nov 4, 2026 7 min

China planning broad AI guardrails https://www.bloomberg.com/news/articles/2026-11-03/china-plans-broad-ai-guardrails-after-global-security-lapses UK predicts "routine" use of AI in nation-state attacks https://www.ft.com/content/131d9506-04b1-49b8-ba79-b0d783219c40?syn-25a6b1a6=1 https://bsky.app/profile/joetidy.bsky.social/post/3mzfvc75l222g Ukraine's war crime investigations hit with cyberattack https://therecord.media/russia-linked-cyber-spies-target-ukraine-war-support Details about the Binance hack https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html https://www.msn.com/en-us/money/markets/north-korea-denies-links-to-binance-hack-as-researchers-trace-stolen-billions/ar-AA2gDfyp mSecure tells users to reset passwords https://www.theregister.com/security/2026/11/03/password-manager-msecure-tells-users-to-change-passwords-wont-say-why/5307296 OpenAI on a security sprint https://www.wsj.com/politics/national-security/openai-hires-former-army-secretary-dan-driscoll-to-cybersecurity-role-0e5cc0a1?st=cfNEPb https://openai.com/index/preparing-our-next-security-sprint-to-harden-openai/ LLM jacking comes with a high price tag https://thehackernews.com/2026/11/google-warns-llmjacking-attacks-are.html Google shuts down TV malware https://9to5google.com/2026/11/02/google-android-tv-box-backdoor-shut-down/ Get the show notes here: https://cisoseries.com/cybersecurity-news-november-4-2026/ Huge thanks to our episode sponsor, ESET Is your business ready to embrace AI with confidence? Explore how companies are balancing rapid AI adoption with growing cyber risk, and where resilience strategies are falling short. Access the full research from ESET's SMB Cyber Readiness Index report for free today at eset.com.

European freezer hacks, BTCPay wallet thefts, GDPx tests AI agents

Nov 3, 2026 7 min

European supermarkets report freezer hacks https://www.bloomberg.com/news/articles/2026-11-02/belgian-swedish-supermarkets-report-new-suspected-freezer-hack BTCPay warns of hot wallet thefts https://www.bleepingcomputer.com/news/security/btcpay-server-warns-of-hot-wallet-thefts-targeting-outdated-instances/ GDPx puts AI agents through harder tests https://newsletter.semianalysis.com/p/gdpx-measuring-frontier-model-capabilities Hackers send false emergency alerts https://www.bloomberg.com/news/articles/2026-11-02/ukraine-and-russia-report-cyberattacks-on-emergency-alert-apps https://theprint.in/world/ukraine-and-russia-say-emergency-alert-apps-were-hit-by-hacks/3088251/ https://apnews.com/article/717372f7bbf4e8a805bc918f06f9730f DarkBlinders targets Israel and Iraqi Kurdistan https://thehackernews.com/2026/11/darkblinders-compromises-israeli-target.html Chinese hackers use AI across simultaneous attacks https://www.bleepingcomputer.com/news/security/chinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs/ Business groups push to renew cyber sharing law https://cyberscoop.com/business-groups-cisa-2015-renewal-ndaa-cybersecurity/ Ransomware gang claims Michigan State data https://therecord.media/michigan-state-university-byod-gang-cyber-incident Get the show notes here: https://cisoseries.com/cybersecurity-news-november-3-2026/ Huge thanks to our episode sponsor, ESET ESET MDR is a 24/7 threat management service combining AI and human expertise to achieve an industry-leading 6-minute threat response and containment, removing the need to maintain in-house security specialists. You don't need a security team the size of a Fortune 500. You need ESET. Supervised Cybersecurity for the AI Era. Built to be effortless.

DHS data leak, Northflank suffers breach, Russian Poryadok cyberattack

Nov 2, 2026 7 min

NetamLoader malware targets government Windows systems in Asia https://thehackernews.com/2026/11/netamloader-malware-targets-government.html Northflank warns of security breach https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/ Russian home goods chain Poryadok suffers cyberattack https://therecord.media/russian-home-goods-chain-faces-disruptions Android SMS of Death zero-click warning https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/ Data of more than 41,000 homeland security workers leaked https://www.theguardian.com/us-news/2026/oct/28/homeland-security-data-leak Fashion retailer Revolve suffers data theft https://therecord.media/resolve-fashion-retailer-data-breach-payment-cards British spy agency cannot account for thousands of data storage devices https://therecord.media/gchq-cannot-account-for-thousands-of-data-devices UK landline phones to be disconnected in two months https://www.theregister.com/networks/2026/11/01/landline-phones-will-switch-off-across-britland-in-100-days-no-extensions-openreach/5306673 Get the show notes here: https://cisoseries.com/cybersecurity-news-november-2-2026/ Huge thanks to our episode sponsor, ESET Managed detection and response used to be built for big enterprises with big budgets. Not anymore. ESET is bringing effortless cybersecurity as a service to businesses of every size, with twenty-four-seven monitoring, automated threat containment, and real experts behind it, all without the overhead. You don't need a security team the size of a Fortune 500. You need ESET. Supervised Cybersecurity for the AI Era. Built to be effortless.

The Department of Know: Big Binance hack, Cursor backdoor, FEC taken offline

Oct 30, 2026 37 min

Read the full stories at CISOSeries.com. This week's Department of Know is hosted by Rich Stroffolino, with guests Jason Elrod, CISO, MultiCare Health System, and DJ Schleen, head of infrastructure and security, Boats Group. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, GuardSquare Guardsquare delivers mobile app security without compromise, providing advanced protections for both Android and iOS apps. From app security testing to code hardening to real-time visibility into the threat landscape, Guardsquare solutions provide enhanced mobile application security from early in the development process through publication. Learn more about how to protect your app at Guardsquare.com.

French energy breach, Pentagon freezer hack, Japan Airlines breach

Oct 30, 2026 7 min

French energy company ENGIE suffers data breach https://securityaffairs.com/201985/data-breach/engie-data-breach-exposes-customer-details-and-energy-contracts.html NIST publishes guidance to meet federal post-quantum deadlines https://www.infosecurity-magazine.com/news/nist-guidance-post-quantum/ MR ROBOT Malware-as-a-Service targets Indian bank customers https://www.infosecurity-magazine.com/news/robot-malware-indian-bank-customers/ Hackers exploit Cisco SD-WAN flaw to install encryption key stealing malware https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html Japan Airlines warns of data breach https://therecord.media/japan-airlines-warns-of-breach-country-grapples-with-incidents GitHub launches npm firewall to block malicious packages before installation https://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.html Pentagon treating military base freezer malfunctions as suspected cyberattack https://www.reuters.com/technology/pentagon-treating-military-base-freezer-malfunctions-suspected-cyberattack-2026-10-29/ Get more info here: https://cisoseries.com/cybersecurity-news-french-energy-breach-pentagon-freezer-hack-japan-airlines-breach/ Attackers are treating your mobile app like an open book. Sixty-three percent of security leaders recently detected app tampering, cloning, or unauthorized modifications. When your code runs in an untrusted environment, you need runtime self-protection and code hardening to keep attackers out. Address tampering before it starts. Learn more at Guardsquare.com.

OpenAI election war room, FEC filing disruption, Gemini Carbon debut

Oct 29, 2026 7 min

OpenAI opens an election war room https://www.politico.com/news/2026/10/28/openai-election-war-room-interference-01137690 Hack attempt disrupts FEC disclosures https://www.reuters.com/technology/hacker-trying-breach-us-federal-election-commission-system-email-shows-2026-10-27/ Google gives cyber defenders first access to Carbon https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/ Attackers probe newly patched Oracle flaw https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html Volt Typhoon's Silent Train network exposed https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html Entra admins face authentication deadline https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys/ Belarusian hackers move closer to Russia and Ukraine https://therecord.media/belarus-russia-hackers-ukraine-war Software inventory can't tell the whole story https://www.darkreading.com/cyber-risk/sboms-alone-scope-supply-chain-attack Get the show notes here: https://cisoseries.com/cybersecurity-news-october-29-2026/ Huge thanks to our sponsor, Guardsquare AI is speeding up development, but at what cost? While 96% of teams now use AI tools, 81% report that AI-generated code has introduced new vulnerabilities into their mobile apps. In a world with automated threats, you need multi-layered, polymorphic security to stay ahead of the curve. Learn more at Guardsquare.com.

Authenticator token theft, Tailworm SSH flaws, UK police supplier breaches

Oct 28, 2026 7 min

Authenticator flaw exposes work accounts https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html Tailworm flaws put Tailscale SSH at risk https://www.securityweek.com/tailscale-rushes-patches-after-uncoordinated-disclosure-of-tailworm-flaws/ UK police suppliers repeatedly breached https://therecord.media/uk-police-data-breached-from-suppliers-watchdog-report Rural hospitals get a cyber lifeline https://cyberscoop.com/oncd-rural-hospital-cybersecurity-pilot-project-lifeline-250/ Cyberattack disrupts UNM health services https://www.theregister.com/cyber-crime/2026/10/27/day-2-of-canceled-classes-at-university-of-new-mexico-after-health-sciences-center-cyberattack/5305690 Warp breach exposes AI agent logs https://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data/ Malware hides from online store scanners https://www.infosecurity-magazine.com/news/hackers-infect-953-online-stores/ Apple patches exploited flaw on older devices https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html Get the show notes here: https://cisoseries.com/cybersecurity-news-october-28-2026/ Huge thanks to our sponsor, Guardsquare Is your mobile app truly protected? Relying on the OS isn't enough. A global study of thirteen-hundred security and developer leaders found that ninety-six percent of teams using layered protection reported significantly fewer security incidents. Don't wait for a breach to harden your defenses. Get the protection needed for modern security risks. Learn more at Guardsquare.com.

HTTP2Shell emergency updates, PHP2Shell attacks, GitHub worm

Oct 27, 2026 7 min

HTTP2Shell sparks emergency patches https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/ PHP2Shell: patch, then investigate https://www.securitymagazine.com/articles/102693-php2shell-exploited-in-the-wild GitHub worm hides in oversized files https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570 Cathedral gets inside Anthropic https://www.washingtonpost.com/technology/2026/10/26/researchers-cybersecurity-start-up-cathedral-got-inside-anthropic/?pwapi_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZWFzb24iOiJnaWZ0IiwibmJmIjoxNzkyOTg3MjAwLCJpc3MiOiJzdWJzY3JpcHRpb25zIiwiZXhwIjoxNzk0MzczMTk5LCJpYXQiOjE3OTI5ODcyMDAsImp0aSI6ImI1M2RjZmEzLThkNTItNGE3NC05ZjI4LWU1ZGJkZTIyZDFmOSIsInVybCI6Imh0dHBzOi8vd3d3Lndhc2hpbmd0b25wb3N0LmNvbS90ZWNobm9sb2d5LzIwMjYvMTAvMjYvcmVzZWFyY2hlcnMtY3liZXJzZWN1cml0eS1zdGFydC11cC1jYXRoZWRyYWwtZ290LWluc2lkZS1hbnRocm9waWMvIn0.k3b70wv6ePisrPvCYfDOPAjt5vHweVxm4rBnhcnDU-M Ukraine's satellite service returns https://therecord.media/ukraine-disputes-musk-claims-of-starlink-misuse Gheist raids GitHub secrets https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets Fake Teams support delivers ransomware https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html Scam laundering suspect extradited https://therecord.media/dutch-police-extradite-chinese-national-money-laundering-scams Get the show notes here: https://cisoseries.com/cybersecurity-news-october-27-2026/ Huge thanks to our sponsor, Guardsquare Your backend is only as secure as your frontend. Research shows that client-side compromise is now a primary driver of API risk. With sixty-three percent of leaders detecting mobile app tampering or cloning last year, don't leave your mobile app security to chance. Get multilayered protection for your entire mobile app ecosystem from the outside in. Learn more at Gu...

AI-powered phishing detection, third PHP2Shell bug, Quest medical breach

Oct 26, 2026 8 min

Microsoft Teams to get AI-powered, context-aware phishing detection https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection/ Quest Diagnostics confirms data breach including exposed patient records https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/ Senators say targeted ads are a security risk. Ad groups disagree https://cyberscoop.com/targeted-ads-spyware-government-threat/ Bipartisan bill urges federal guidance for distillation attacks https://cyberscoop.com/bipartisan-bill-combat-ai-distillation-attacks-nist/ CISA adds Collabora Online and Arista VeloCloud flaws to KEV https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html Autonomous attack agent in Skynet mode hijacks other AI models https://www.theregister.com/security/2026/10/24/autonomous-attack-agent-in-skynet-mode-hijacks-other-models-to-carry-out-its-evil-deeds/5305215 Researchers find a third PHP2Shell bug https://www.theregister.com/security/2026/10/23/theres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix/5305208 Data breach takes a bite out of crime stoppers organization https://therecord.media/toronto-crime-tips-org-freezes-ops-after-breach Get the shownotes here: https://cisoseries.com/cybersecurity-news-ai-powered-phishing-detection-third-php2shell-bug-quest-medical-breach/ Mobile app security isn't just a tech issue; it's a revenue issue. A recent global study found that seventy-two percent of organizations experienced a mobile app security incident last year. Even worse? Sixty-five percent saw customer churn or uninstalls as a result. Protect your brand and your bottom line with layered mobile app protection. Learn more at Guardsquare.com.

The Department of Know: PHP2Shell strikes, EU EOL still SOL, Cairn used in cyberattacks

Oct 23, 2026 37 min

Read the full stories at CISOSeries.com. This week's Department of Know is hosted by Rich Stroffolino, with guests Gary Chan, CISO, SSM Health, and Doug Mayer, CISO, RXSense. Also check out Gary's work at Security Mentalist. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, ThreatLocker! An AI-generated attack may be new, but it still needs to execute, access data, and move through your environment. ThreatLocker applies enforceable controls at each of those points, limiting what attackers can do regardless of how their code was created. Book a demo at threatlocker.com/ciso.

PHP vulnerabilities update, ConnectWise AI spies, Africa cybercrime takedown

Oct 23, 2026 7 min

Railway says intruder may have accessed customer secrets https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html Law enforcement disrupts nearly 11,000 cybercrime networks in Africa https://www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/ ConnectWise breach let Chinese AI spies move in on cloud tenants https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687 GitLab warns of new maximum severity code execution vulnerability https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/ Hundreds of websites taken offline due to PHP vulnerabilities (continuing coverage) https://therecord.media/php-script-vulnerabilities-warnings https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/ Splunk, SolarWinds release fresh security updates https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/ Lazarus hackers use post-quantum cryptography for malware delivery https://www.bleepingcomputer.com/news/security/chrome-switching-to-nist-approved-ml-kem-quantum-encryption/ South Carolina officials offer assistance after state capital hit with cyberattack https://therecord.media/south-carolina-officials-offer-assistance-cyber-incident Get the show notes here: https://cisoseries.com/cybersecurity-news-october-23-2026/ Huge thanks to our episode sponsor, ThreatLocker AI risk does not only come from attackers. Employees are adopting AI tools faster than many organizations can evaluate them. Today's tip: an AI policy should be backed by enforceable controls over what tools can access and do. See how ThreatLocker can help you govern AI use at threatlocker.com/ciso.

PHP emergency patches, compromised TLS certificates, Signal hot mic bug

Oct 22, 2026 7 min

PHP rushes out emergency fixes for PHP2Shell https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/ https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ Compromised certificates trigger internet cleanup https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/ Signal calls could stay live after you hang up https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528 OpenAI agents disable safeguards during coding tasks https://www.theverge.com/ai-artificial-intelligence/1015316/openai-ai-agent-disabling-monitoring-systems Plex2Shell attacks hit media servers https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/ Poisoned LiteLLM update steals secrets & adds a backdoor https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548 Meta faces a big Cambridge Analytica penalty https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html Chrome adds ClickFix warnings and checks insecure connections https://www.securityweek.com/google-hardens-chrome-against-clickfix-attacks-insecure-http-connections/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-22-2026/ Huge thanks to our episode sponsor, ThreatLocker AI is compressing the timeline between initial access and impact. That leaves security teams less time to identify, investigate, and contain malicious activity. Faster response helps, but prevention can remove actions from the attack chain entirely. Give your responders a more controlled environment. Book a ThreatLocker demo at threatlocker.com/ciso.

Naval hack, Muse exposes secrets, Army researching offensive AI hacking

Oct 21, 2026 7 min

Russian-linked attacks hit naval shipbuilder https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html Muse exposes secrets when sharing chats https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/ Army Cyber Command looking to offload attacks to AI https://web.archive.org/web/20261020134149/https://theintercept.com/2026/10/19/army-autonomous-ai-agents-arcyber/ DeepSeek booted from federal agencies https://www.wsj.com/tech/ai/dhs-orders-deepseek-technology-removed-from-federal-civilian-it-systems-060b6d3d?st=m6DV2n DHS asked CISA to hack voting machine https://www.propublica.org/article/cisa-election-security-donald-trump EU doesn't require patching hacked freezers https://therecord.media/eu-cyber-law-wont-force-fixes-for-fridges-in-french-attack Cairn platform abused by threat actors Security Week: https://www.securityweek.com/ai-platform-cairn-abused-to-hack-over-100-organizations/ Reuters: https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/ Palo Alto still seeing active PAN-OS exploits https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html LLMs getting better at COBOL https://openai.com/index/low-resource-programming-languages/ Get the show notes here: https://cisoseries.com/naval-hack-muse-exposes-secrets-army-researching-offensive-ai-hacking/ Huge thanks to our episode sponsor, ThreatLocker Attackers do not always bring their own tools. AI can help them find ways to misuse software already trusted by the organization. Today's tip: approval should not mean unlimited access. Define what trusted applications can reach and what they can do. Learn how ThreatLocker applies this principle at threatlocker.com/ciso today.

OpenCode keys exposed, AI agents raid websites, Rank Math backdoor

Oct 20, 2026 7 min

OpenCode breach exposes users' AI keys https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/ One hacker puts AI agents to work on 1,200 sites https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/ Rank Math PRO updates deliver a persistent backdoor https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html Nikkei discloses its third breach in a month https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/ Microsoft adds controls for rogue AI agents https://www.geekwire.com/2026/microsoft-unveils-tools-to-monitor-and-corral-rogue-ai-agents/ ClickFix attackers borrow Siemens' signature https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/ Pegasus targets Serbian government critics before elections https://therecord.media/serbia-spyware-pegasus-elections Bullhorn takes staffing platform offline after attack https://www.bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-20-2026/ Huge thanks to our episode sponsor, ThreatLocker An attacker uses AI to create a payload your security tools have never seen. Detection now has to recognize it before the payload can act. ThreatLocker approaches the problem earlier by controlling whether that code is permitted to run at all. Explore a deny by default approach for your organization at threatlocker.com/ciso.

Cybersecurity jobs report, ConnectWise suspends cloud backup, Drupal patches flaws

Oct 19, 2026 6 min

Cybersecurity jobs report reveals mixed bag https://www.securityweek.com/us-cybersecurity-job-postings-fall-26-as-ai-security-engineer-demand-soars/ https://cybersn.com/resources/reports/cybersecurity-jobs-report ConnectWise Suspends cloud backup after supply chain attack https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html Drupal patches critical RCE flaws, warns of exploits https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/ Chinese espionage attackers suspected of BeyondTrust zero-day https://therecord.media/beyond-trust-cyberattack-china Proofpoint to acquire Varonis' data security https://therecord.media/proofpoint-varonis-cybersecurity-acquisition Burger King Japan data breach exposes 11 million customer records https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/ BAE Systems cyberattack disrupts US federal court operations https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/ CikaBika Bot RAT abuses Discord https://www.securityweek.com/cikabika-bot-rat-uses-discord-for-cc/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-19-2026/ Huge thanks to our episode sponsor, ThreatLocker AI is helping attackers research targets, create malicious code, and adapt faster. But the fundamentals have not changed. Code still needs to execute, applications still need access, and attackers still need privileges. Today's tip: control those actions instead of trying to predict every threat. Learn more from ThreatLocker at threatlocker.com/ciso.

The Department of Know: Hacked fridges, hiring humans to fix Mythos bugs, targeted ad spyware

Oct 16, 2026 34 min

See the full stories at cisoseries.com This week's Department of Know is hosted by Rich Stroffolino, with guests Dennis Pickett, vp and CISO, RTI International, and David Cross, CISO, Atlassian. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Huge thanks to our sponsor, Guardsquare Mobile security incidents are no longer the exception—they are the norm. Last year, seventy-two percent of companies suffered a mobile app security incident. As the primary gateway to your APIs and data, your mobile app requires more than just basic encryption; it needs a multi-layered security strategy. Protect your brand and your bottom line with layered mobile app protection. Learn more at Guardsquare.com.

Candiru spyware infects Al Jazeera, Senators AI request, Microsoft crashes phishers

Oct 16, 2026 7 min

CenterPoint Energy reveals data breach numbers https://www.securitymagazine.com/articles/102658-1m-impacted-by-centerpoint-energy-data-breach Zero-Click Candiru spyware infections at Al Jazeera tracked to targeted online ads https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html UK Legal Aid Agency Hack Scope Widens After Forensic Review https://www.securityweek.com/uk-legal-aid-agency-hack-scope-widens-after-forensic-review/ Bank of America needed 1,000 contractors to patch bugs found by Mythos https://www.theregister.com/security/2026/10/15/bank-of-america-had-to-bring-in-1000-contractors-to-patch-all-the-bugs-mythos-identified/5303275 Microsoft takes down 3 major China-based phishing platforms https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms Windows Server 2022 reaches end of mainstream support https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2022-reached-end-of-mainstream-support/ Senators press for AI safety and security https://cyberscoop.com/congress-presses-trump-administration-ai-safety-cybersecurity/ French supermarket refrigeration attack widens https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-16-2026/ Huge thanks to our episode sponsor, Guardsquare Attackers are treating your mobile app like an open book. Sixty-three percent of security leaders recently detected app tampering, cloning, or unauthorized modifications. When your code runs in an untrusted environment, you need runtime self-protection and code hardening to keep attackers out. Address tampering before it starts. Learn more at Guardsquare.com.

FBI raids laptop farms, Meta loses GitHub data, Cisco gateways under attack

Oct 15, 2026 6 min

FBI shuts down North Korean laptop farms https://www.bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested/ Meta's stolen credentials open GitHub repositories https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/ Cisco email gateways face active attacks https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html Ledger tells Asian sellers to stop sales https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/ CISA urges Ivanti VPN updates https://www.securitymagazine.com/articles/102655-newly-exploited-vulnerability-in-ivanti-connect-secure Microsoft's patch count breaks the annual record https://cyberscoop.com/microsoft-patch-tuesday-october-2026/ Six days, three Chrome bugs, one sandbox escape https://www.theregister.com/security/2026/10/14/security-researchers-spent-6-days-doing-their-chromework-built-1b-user-exploit/5303134 Windows gets its Always On VPN back https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-vpn-issues-caused-by-september-windows-updates/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-15-2026/ Huge thanks to our episode sponsor, Guardsquare AI is speeding up development, but at what cost? While ninety-six percent of teams now use AI tools, eighty-one percent report that AI-generated code has introduced new vulnerabilities into their mobile apps. In a world with automated threats, you need multi-layered, polymorphic security to stay ahead of the curve. Learn more at Guardsquare.com.

Webcams go to war, Kimsuky sends invites, Anthropic blocks copycats

Oct 14, 2026 7 min

Webcams get drafted into war https://www.wsj.com/tech/cybersecurity/video-cameras-webcams-hacked-war-b00b8a24?st=RRCsaw Kimsuky's invitations come with malware https://therecord.media/north-korea-hackers-russia-ukraine Anthropic makes copycats work harder https://www.anthropic.com/research/distillation-defenses Adobe's patch pile hits 140 https://www.securityweek.com/adobe-patches-140-vulnerabilities-across-10-products/ Scam crackdown nets 28 arrests https://cyberscoop.com/west-african-scammers-international-scam-crackdown-joint-disruption-week/ Fashion brands hit an IT snag https://www.bleepingcomputer.com/news/security/tfg-london-cyberattack-disrupts-systems-at-hobbs-and-whistles-retailers/ npm closes a name-stealing loophole https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html Chrome bug bounties bounce back https://www.securityweek.com/google-partially-reverses-chrome-bug-bounty-cuts/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-14-2026/ Huge thanks to our episode sponsor, Guardsquare Is your mobile app truly protected? Relying on the OS isn't enough. A global study of thirteen-hundred security and developer leaders found that ninety-six percent of teams using layered protection reported significantly fewer security incidents. Don't wait for a breach to harden your defenses. Get the protection needed for modern secuirty risks. Learn more at Guardsquare.com.

Supermarket freezer hack, Ahold Delhaize offline, spy chip in crypto wallets

Oct 13, 2026 7 min

Hackers turn up the heat on French supermarkets: https://www.infosecurity-magazine.com/news/french-supermarket-chains/ Ahold Delhaize offline after cyber attack: https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhize-takes-systems-offline-after-cyberattack/ Spy chip used in crypto wallet thefts: https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/ Russian digital services disrupted from drone strike: https://therecord.media/ukraine-strikes-third-yandex-data-center Microsoft wants AI "emergency brakes": https://www.bbc.com/news/articles/c6rmy7zmvx3lo UK's AI Security Institute to get early model access: https://www.reuters.com/legal/litigation/us-reverses-course-britains-testing-ai-models-telegraph-says-2026-10-11/ and https://www.telegraph.co.uk/news/2026/10/11/britain-get-first-look-ai-systems-after-white-house-u-turn/ Threat actors trying to use critical SonicWall SMA flaw: https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html Threat actors drop the mic with karaoke hack: https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-13-2026/ Huge thanks to our episode sponsor, Guardsquare Your backend is only as secure as your frontend. Research shows that client-side compromise is now a primary driver of API risk. With sixty-three percent of leaders detecting mobile app tampering or cloning last year, don't leave your mobile app security to chance. Get multilayered protection for your entire mobile app ecosystem from the outside in. Learn more at Guardsquare.com.

Anthropic restricts Claude, Google Calendar phishing, FBI hack arrest

Oct 12, 2026 7 min

CISA's KEV catalog grows by five https://securityaffairs.com/200734/security/u-s-cisa-adds-proftpd-onlyoffice-docs-strapi-apache-struts-and-isc-bind-flaws-to-its-known-exploited-vulnerabilities-catalog.html Calendar phishing becomes a thing https://www.theguardian.com/money/2026/oct/11/calendar-phishing-scam-meeting-renewal-google-microsoft-paypal Canadian cybersecurity executive arrested in FBI hack https://www.cnn.com/2026/10/09/politics/fbi-arrest-shinyhunters-hack Hackers abuse Google Ads, Bing redirects to deliver Claude ClickFix attacks https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/ Biosensor firm iRhythm announces data breach numbers https://therecord.media/irhythm-data-breach-reports Japan confirms arrest of Russian Qilin operative https://therecord.media/japan-germany-ransomware-arrest Anthropic cuts live internet access for internal AI tests after exploitative behaviors https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html Leader of money mule operation pleads guilty https://therecord.media/leader-of-money-mule-operation-for-cybercriminals-pleads-guilty Get the show notes here: https://cisoseries.com/cybersecurity-news-october-12-2026/ Huge thanks to our episode sponsor, Guardsquare Mobile app security isn't just a tech issue; it's a revenue issue. A recent global study found that seventy-two percent of organizations experienced a mobile app security incident last year. Even worse? Sixty-five percent saw customer churn or uninstalls as a result. Protect your brand and your bottom line with layered mobile app protection. Learn more at Guardsquare.com.

The Department of Know: South Korean bank hacks, agents target Wikipedia, ransomware recovery fraud

Oct 9, 2026 33 min

Read the full stories at CISOSeries.com. This week's Department of Know is hosted by Rich Stroffolino, with guests Derek Fisher, Director of the Cyber Defense and Information Assurance Program, Temple University, and Chris Ray, field CTO, GigaOm. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, Vanta! Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Top level domain theft, Yandex attacked, Cisco Nexus flaws

Oct 9, 2026 8 min

Attackers hijack three top level domains to obtain Google certificates https://www.infosecurity-magazine.com/news/attackers-hijack-cctlds-obtain/ Major Yandex data center in Russia hit by Ukrainian drone https://therecord.media/yandex-russia-drone-ukraine Cisco warns of critical flaws allowing Nexus switch takeover https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-flaws-allowing-nexus-switch-takeover/ Attackers target Atlassian vulnerability shortly after PoC publication https://www.securityweek.com/attackers-target-critical-atlassian-vulnerability-within-hours-of-poc-publication/ Wazza Phishkit targets banking, government, and manufacturing https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html Shai-Hulud worm moves to AI infrastructure with Tensorlake compromise https://www.theregister.com/security/2026/10/08/shai-hulud-worm-makes-jump-to-ai-infrastructure-with-tensorlake-compromise/5302054 Japan sees sharp rise in web data leaks https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html DOJ charges ransomware recovery CEO for secretly paying hackers https://therecord.media/ransomware-recovery-charges-doj Get the show notes here: https://cisoseries.com/cybersecurity-news-top-level-domain-theft-yandex-attacked-cisco-nexus-flaws/ Huge thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Poetry-powered botnet, Flock hits a roadblock, Outlook blocks risky installers

Oct 8, 2026 7 min

Botnet takes orders from a poem https://cyberscoop.com/poellm-malware-botnet-poem-lumen-black-lotus-labs/ Flock's warrantless tracking hits a roadblock https://therecord.media/oklahoma-flock-ruing-supreme-court-chatrie-decision npm packages come with unwanted extras https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html AWS gives AI agents a sandbox with house rules https://www.theregister.com/ai-and-ml/2026/10/07/aws-launches-open-source-ai-agent-sandbox-to-prevent-yolo-mode-disasters/5301687 Outlook closes the door on risky installers https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-to-block-msix-attachments-used-in-attacks/ Arizona court breach reaches back 30 years https://therecord.media/arizona-courts-say-hackers-stole-info-on-over-1-million Utility customers' accounts exposed https://www.securityweek.com/georgia-power-alabama-power-data-breach-hits-400000-accounts/ FortiBleed changes the locks on VPN admins https://www.bleepingcomputer.com/news/security/fbi-ongoing-fortibleed-attacks-lock-out-fortigate-vpn-admins/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-8-2026/ Huge thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Agents vs Wikipedia, South Korean bank hacks, ASOS breached

Oct 7, 2026 7 min

Agents trying to compromise Wikipedia tools https://thehackernews.com/2026/10/wikimedia-says-openai-agents-tried-to.html South Korea claims agents were used in bank hacks https://therecord.media/south-korean-bank-hacks-ai-agents ASOS confirms data breach https://www.ft.com/content/eab7052d-6640-4928-a128-8df73455ba0a https://www.bleepingcomputer.com/news/security/asos-confirms-data-breach-after-hacked-in-app-notifications/ Contractor fired over FBI data breach https://www.reuters.com/technology/accenture-contractor-removed-fbi-following-damaging-data-breach-sources-say-2026-10-06/ Red Hat's Lightwell shows early returns https://www.infosecurity-magazine.com/news/red-hat-lightwell-remediates-400/ LibreOffice and OpenOffice flaw can run code with no warning https://thehackernews.com/2026/10/libreoffice-and-openoffice-flaws-let.html Ransomware cancels classes at Japanese university https://therecord.media/osaka-university-cancels-classes-ransomware ATM malware creator in court https://therecord.media/atm-malware-creator-appears-in-nebraska-court OpenAI pledges disclosure changes after Australian attack https://www.abc.net.au/news/2026-10-06/openai-hearing-apology-key-takeaways/107235640 Get the show notes here: https://cisoseries.com/cybersecurity-news-agents-vs-wikipedia-south-korean-bank-hacks-asos-breached/ Huge thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Google pauses bug bounties, ATB faces extortion, Exchange flaw exposes mailboxes

Oct 6, 2026 7 min

Google pauses open-source bug bounties amid AI spam Ukraine's largest grocery chain hit by extortion attack Exchange flaw exposes other users' mailboxes Get the show notes here: https://cisoseries.com/cybersecurity-news-october-6-2026/ Huge thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Warlock continues SharePoint exploits, ShinyHunters member flips China's AI espionage

Oct 5, 2026 7 min

Warlock ransomware continues to exploit year-old SharePoint flaws ShinyHunters member detained in Jordan China-aligned espionage group targets American AI policy experts Get the show notes here: https://cisoseries.com/cybersecurity-news-warlock-continues-sharepoint-exploits-shinyhunters-member-flips-chinas-ai-espionage/ Huge thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

The Department of Know: ShinyHunters vs FBI, Kiteworks shutdown, and hundreds of orgs hit by rogue AI

Oct 2, 2026 38 min

Read all the stories at CISOSeries.com. This week's Department of Know is hosted by Rich Stroffolino, with guests Brett Conlon, CISO, American Century Investments, and Nick Espinosa, host, Deep Dive Radio Show. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, Intezer. If you caught our tips this week, they pointed one direction: investigate everything, and keep the evidence. That's a hard promise to make with people. It's an easy one to make with forensics that run in under a minute. Intezer. The AI SOC trusted by Salesforce, MGM Resorts and Nvidia. See it yourself at intezer.com/headlines.

AI readiness reports, KillSec takedown, OpenAI website scraping

Oct 2, 2026 8 min

Report suggests AI and quantum threat preparedness is lacking Authorities seize KillSec extortion group arrest leader Dozens more prominent websites scraped by OpenAI software Get the show notes here: https://cisoseries.com/cybersecurity-news-ai-readiness-reports-killsec-takedown-openai-website-scraping/ Huge thanks to our episode sponsor, Intezer Today's tip: treat every false positive like a bug report against a detection rule. Fix the rule, and that noise stops coming back. Intezer does that for you, so your SOC gets quieter over time instead of louder. Intezer. The AI SOC trusted by Salesforce, MGM Resorts and Nvidia. See it yourself at intezer.com/headlines.

Gemini 4 enters the ring, MI5 flags research ties, Custom GPTs deliver malware

Oct 1, 2026 7 min

Gemini 4 starts with cybersecurity MI5 flags Chinese research funding Custom GPTs steer users into ClickFix attacks Get the show notes here: https://cisoseries.com/cybersecurity-news-october-1-2026/ Huge thanks to our episode sponsor, Intezer Today's tip: add up the hours your tier-one analysts spent closing alerts that turned out to be nothing. That's your real triage cost. At a hundred and fifty enterprises, that work isn't done by hand. Intezer investigates every alert. Intezer. The AI SOC trusted by Salesforce, MGM Resorts and Nvidia. See it yourself at intezer.com/headlines.

Star Blizzard, Cloudflare CA, GPT-6.1 scuttled

Sep 30, 2026 8 min

Microsoft details new Star Blizzard and NeedyMantis activity Cloudflare to become a public certificate authority Safety concerns scuttle GPT-6.1 Get the show notes here: https://cisoseries.com/cybersecurity-news-star-blizzard-cloudflare-ca-gpt-6-1-scuttled/ Huge thanks to our episode sponsor, Intezer Today's tip: when an AI calls an alert benign, ask for the evidence. The file, the memory, the command line. If it can't show its work, it's guessing. Intezer shows its work, and your team can argue with it. Intezer. The AI SOC trusted by Salesforce, MGM Resorts and Nvidia. See it yourself at intezer.com/headlines.

GPT-6 Astra goes off script, ShinyHunters suspect arrested, Nvidia corrals rogue AI agents

Sep 29, 2026 8 min

GPT-6 Astra goes off script in attack simulations Dutch police arrest "reformed" hacker in ShinyHunters probe Nvidia builds a browser for AI agents Get the show notes here: https://cisoseries.com/cybersecurity-news-september-29-2026/ Huge thanks to our episode sponsor, Intezer Today's tip: time how long an employee-reported phish waits for a verdict. If it's a day, someone already clicked. Salesforce's incident response team got that down to minutes with Intezer. At their size, one click is plenty. Intezer. The AI SOC trusted by Salesforce, MGM Resorts and Nvidia. See it yourself at intezer.com/headlines.

New SharePoint exploit, Australian OpenAI hack developments, Kiteworks urges stoppage

Sep 28, 2026 7 min

Another Microsoft SharePoint flaw now exploited Details and doubts emerge regarding OpenAI hack of Australian Health portal Kiteworks urges customers to stop using platform Get the show notes here: https://cisoseries.com/cybersecurity-news-new-sharepoint-exploit-australian-openai-hack-developments-kiteworks-urges-stoppage/ Huge thanks to our episode sponsor, Intezer Today's tip: pull your low-severity alerts and count how many got opened. That's where attackers hide. Intezer investigates every alert, boring ones included, in under a minute. MGM Resorts' CTO has talked about nation-state threats turning up right there. Intezer. The AI SOC trusted by Salesforce, MGM Resorts and Nvidia. See it yourself at intezer.com/headlines.

The Department of Know: NCSC's AI "inconvenient truth," automated payment skimming, CISA's CVE plan

Sep 25, 2026 34 min

Read all the stories at CISOSeries.com. This week's Department of Know is hosted by Rich Stroffolino, with guests Dmitriy Sokolovskiy, senior vice president, information security, Semrush, and Christian Frösch, CISO, CH Media. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, Nudge Security. Nudge Security now includes AI Agent Discovery, in addition to Day One discovery of every other AI and SaaS app. For each agent, you'll see who created it, what it's connected to, and risks like destructive permissions. And, smart automation helps you engage the right person to fix the risk.

OpenAI hacks Australia health, Astrana Health breached, TeamCity flaw exploited

Sep 25, 2026 7 min

OpenAI program hacks Australia's government health portal Astrana Health suffers data breach Ransomware gangs exploiting TeamCity flaw Get the show notes here: https://cisoseries.com/cybersecurity-news-september-25-2026/ Huge thanks to our episode sponsor, Nudge Security Here's a question that might make you sweat…how many AI agents are running in your org right now? Not sure? You're not alone. But, we have good news. Nudge Security now includes AI Agent Discovery, in addition to Day One discovery of every other AI and SaaS app. For each agent, you'll see who built it, what it's connected to, and risks like destructive permissions. And, Nudge gives you smart automation to engage the right person to fix the risk. No chasing people down for answers. Give it a try for free at nudgesecurity.com/cisoseries

ShinyHunters peeks at FBI assignments, WordPress flaw wastes no time, Pentagon's cyber appetite grows

Sep 24, 2026 7 min

ShinyHunters peeks at FBI assignments WordPress flaw wastes no time Pentagon's cyber appetite grows Get the show notes here: https://cisoseries.com/cybersecurity-news-september-24-2026/ Huge thanks to our episode sponsor, Nudge Security Here's a question that might make you sweat…how many AI agents are running in your org right now? Not sure? You're not alone. But, we have good news. Nudge Security now includes AI Agent Discovery, in addition to Day One discovery of every other AI and SaaS app. For each agent, you'll see who built it, what it's connected to, and risks like destructive permissions. And, Nudge gives you smart automation to engage the right person to fix the risk. No chasing people down for answers. Give it a try for free at nudgesecurity.com/cisoseries

CAIRN framework, Muse zero-day, BigDiskBuster

Sep 23, 2026 6 min

Cisco releases open-source CAIRN framework Muse zero-day opens the door to account takeovers Microsoft can't wake up from Nightmare Eclipse Get the show notes here: https://cisoseries.com/cybersecurity-news-cairn-framework-muse-zero-day-bigdiskbuster/ Huge thanks to our episode sponsor, Nudge Security Here's a question that might make you sweat…how many AI agents are running in your org right now? Not sure? You're not alone. But, we have good news. Nudge Security now includes AI Agent Discovery, in addition to Day One discovery of every other AI and SaaS app. For each agent, you'll see who built it, what it's connected to, and risks like destructive permissions. And, Nudge gives you smart automation to engage the right person to fix the risk. No chasing people down for answers. Give it a try for free at nudgesecurity.com/cisoseries

ShinyHunters hijacks Clop, fake LastPass kills security tools, trusted npm release carries malware

Sep 22, 2026 7 min

ShinyHunters hijacks Clop's own leak site Fake LastPass installers kill security tools Trusted npm release carries GHAPPIER malware Huge thanks to our episode sponsor, Nudge Security Here's a question that might make you sweat…how many AI agents are running in your org right now? Not sure? You're not alone. But, we have good news. Nudge Security now includes AI Agent Discovery, in addition to Day One discovery of every other AI and SaaS app. For each agent, you'll see who built it, what it's connected to, and risks like destructive permissions. And, Nudge gives you smart automation to engage the right person to fix the risk. No chasing people down for answers. Give it a try for free at nudgesecurity.com/cisoseries Get the show notes here: https://cisoseries.com/cybersecurity-news-september-22-2026/

OpenAI Codex sandbox escape, President proposes AI Force, Cyber Command suicides

Sep 21, 2026 8 min

Researchers escape OpenAI Codex sandbox to run commands on host AI Force proposed to monitor technology Congress eyes new support for Cyber Command after recent suicide deaths Get the show notes here: https://cisoseries.com/cybersecurity-news-openai-codex-sandbox-escape-president-proposes-ai-force-cyber-command-suicides/ Huge thanks to our episode sponsor, Nudge Security Here's a question that might make you sweat…how many AI agents are running in your org right now? Not sure? You're not alone. But, we have good news. Nudge Security now includes AI Agent Discovery, in addition to Day One discovery of every other AI and SaaS app. For each agent, you'll see who built it, what it's connected to, and risks like destructive permissions. And, Nudge gives you smart automation to engage the right person to fix the risk. No chasing people down for answers. Give it a try for free at nudgesecurity.com/cisoseries

The Department of Know: Passkeys phished, Cisco hits root, nuclear red lines for AI

Sep 18, 2026 34 min

Read the full stories at CISOSeries.com. This week's Department of Know is hosted by Sarah Lane, with guests Jason Thomas, senior director of technology security, governance, and risk at the Cystic Fibrosis Foundation, and Jay Wilson, CISO and CIO at Insurity. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Nuclear-style AI safeguards, AI legislation shelved, CISA's decoy guidance

Sep 18, 2026 7 min

Nuclear-style safeguards proposed for AI risks Key lawmaker suggests action on AI safety legislation will wait until 2027 CISA releases cyber decoy guidance for infrastructure defenses Get the show notes here: https://cisoseries.com/cybersecurity-news-september-18-2026/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Flock gets plucked, OpenAI agents arrived even earlier, inside China's AI spy shop

Sep 17, 2026 6 min

Flock gets plucked OpenAI agents arrived early China's AI spy shop Get the show notes here: https://cisoseries.com/cybersecurity-news-september-17-2026/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

See all 200 episodes

–

0 ratings from members

Rate this podcast

No reviews yet — be the first member to rate "Cybersecurity Headlines".

This podcast, its content and its artwork are not owned by, affiliated with, or endorsed by Castquire.

Microsoft 365 outage, Bomb hoaxers in hijacked inboxes, Operation Endgame pulls malware plugs

Share this podcast

Live Chart rankings

Chart history

🇮🇳 Tech News Best #5

🇺🇸 Tech News Best #5

Podcast details

Created by: CISO Series
Status: Active
Latest episode: Nov 13, 2026
Episodes: 1,890
Release period: Daily
Avg. episode length: 12 min
Explicit: No
Language: English

Links

Official website ↗ Apple Podcasts ↗ RSS feed ↗

Is this your podcast?

Claim it to show it on your profile. Using the email from your RSS feed approves it instantly.

Keep listening

Discover more podcasts like this.

Browse podcasts See the charts