Cybersecurity Headlines

European supermarkets report freezer hacks https://www.bloomberg.com/news/articles/2026-11-02/belgian-swedish-supermarkets-report-new-suspected-freezer-hack

BTCPay warns of hot wallet thefts https://www.bleepingcomputer.com/news/security/btcpay-server-warns-of-hot-wallet-thefts-targeting-outdated-instances/

GDPx puts AI agents through harder tests https://newsletter.semianalysis.com/p/gdpx-measuring-frontier-model-capabilities

Hackers send false emergency alerts https://www.bloomberg.com/news/articles/2026-11-02/ukraine-and-russia-report-cyberattacks-on-emergency-alert-apps https://theprint.in/world/ukraine-and-russia-say-emergency-alert-apps-were-hit-by-hacks/3088251/ https://apnews.com/article/717372f7bbf4e8a805bc918f06f9730f

DarkBlinders targets Israel and Iraqi Kurdistan https://thehackernews.com/2026/11/darkblinders-compromises-israeli-target.html

Chinese hackers use AI across simultaneous attacks https://www.bleepingcomputer.com/news/security/chinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs/

Business groups push to renew cyber sharing law https://cyberscoop.com/business-groups-cisa-2015-renewal-ndaa-cybersecurity/

Ransomware gang claims Michigan State data https://therecord.media/michigan-state-university-byod-gang-cyber-incident

Get the show notes here:

https://cisoseries.com/cybersecurity-news-november-3-2026/

Huge thanks to our episode sponsor, ESET

ESET MDR is a 24/7 threat management service combining AI and human expertise to achieve an industry-leading 6-minute threat response and containment, removing the need to maintain in-house security specialists. You don't need a security team the size of a Fortune 500. You need ESET. Supervised Cybersecurity for the AI Era. Built to be effortless.

NetamLoader malware targets government Windows systems in Asia

https://thehackernews.com/2026/11/netamloader-malware-targets-government.html

Northflank warns of security breach

https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/

Russian home goods chain Poryadok suffers cyberattack

https://therecord.media/russian-home-goods-chain-faces-disruptions

Android SMS of Death zero-click warning

https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/

Data of more than 41,000 homeland security workers leaked

https://www.theguardian.com/us-news/2026/oct/28/homeland-security-data-leak

Fashion retailer Revolve suffers data theft

https://therecord.media/resolve-fashion-retailer-data-breach-payment-cards

British spy agency cannot account for thousands of data storage devices

https://therecord.media/gchq-cannot-account-for-thousands-of-data-devices

UK landline phones to be disconnected in two months

https://www.theregister.com/networks/2026/11/01/landline-phones-will-switch-off-across-britland-in-100-days-no-extensions-openreach/5306673

Get the show notes here: https://cisoseries.com/cybersecurity-news-november-2-2026/

Huge thanks to our episode sponsor, ESET

Managed detection and response used to be built for big enterprises with big budgets. Not anymore. ESET is bringing effortless cybersecurity as a service to businesses of every size, with twenty-four-seven monitoring, automated threat containment, and real experts behind it, all without the overhead. You don't need a security team the size of a Fortune 500. You need ESET. Supervised Cybersecurity for the AI Era. Built to be effortless.

Read the full stories at CISOSeries.com.

This week's Department of Know is hosted by Rich Stroffolino, with guests Jason Elrod, CISO, MultiCare Health System, and DJ Schleen, head of infrastructure and security, Boats Group.

Missed the live show? Check it out on YouTube.

The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at https://cisoseries.com/.

Big thanks to our sponsor, GuardSquare

https://hubs.la/Q04sv5qF0

Guardsquare delivers mobile app security without compromise, providing advanced protections for both Android and iOS apps. From app security testing to code hardening to real-time visibility into the threat landscape, Guardsquare solutions provide enhanced mobile application security from early in the development process through publication. Learn more about how to protect your app at http://guardsquare.com/.

French energy company ENGIE suffers data breach

https://securityaffairs.com/201985/data-breach/engie-data-breach-exposes-customer-details-and-energy-contracts.html

NIST publishes guidance to meet federal post-quantum deadlines

https://www.infosecurity-magazine.com/news/nist-guidance-post-quantum/

MR ROBOT Malware-as-a-Service targets Indian bank customers

https://www.infosecurity-magazine.com/news/robot-malware-indian-bank-customers/

Hackers exploit Cisco SD-WAN flaw to install encryption key stealing malware

https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html

Japan Airlines warns of data breach

https://therecord.media/japan-airlines-warns-of-breach-country-grapples-with-incidents

GitHub launches npm firewall to block malicious packages before installation

https://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.html

Pentagon treating military base freezer malfunctions as suspected cyberattack

https://www.reuters.com/technology/pentagon-treating-military-base-freezer-malfunctions-suspected-cyberattack-2026-10-29/

Get more info here: https://cisoseries.com/cybersecurity-news-french-energy-breach-pentagon-freezer-hack-japan-airlines-breach/

Attackers are treating your mobile app like an open book. Sixty-three percent of security leaders recently detected app tampering, cloning, or unauthorized modifications. When your code runs in an untrusted environment, you need runtime self-protection and code hardening to keep attackers out. Address tampering before it starts. Learn more at http://guardsquare.com.

OpenAI opens an election war room https://www.politico.com/news/2026/10/28/openai-election-war-room-interference-01137690

Hack attempt disrupts FEC disclosures https://www.reuters.com/technology/hacker-trying-breach-us-federal-election-commission-system-email-shows-2026-10-27/

Google gives cyber defenders first access to Carbon https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/

Attackers probe newly patched Oracle flaw https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html

Volt Typhoon's Silent Train network exposed https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html

Entra admins face authentication deadline https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys/

Belarusian hackers move closer to Russia and Ukraine https://therecord.media/belarus-russia-hackers-ukraine-war

Software inventory can't tell the whole story https://www.darkreading.com/cyber-risk/sboms-alone-scope-supply-chain-attack

Get the show notes here:

https://cisoseries.com/cybersecurity-news-october-29-2026/

Huge thanks to our sponsor, Guardsquare

https://hubs.la/Q04sv5qF0

AI is speeding up development, but at what cost? While 96% of teams now use AI tools, 81% report that AI-generated code has introduced new vulnerabilities into their mobile apps. In a world with automated threats, you need multi-layered, polymorphic security to stay ahead of the curve. Learn more at http://Guardsquare.com.

Authenticator flaw exposes work accounts https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html

Tailworm flaws put Tailscale SSH at risk https://www.securityweek.com/tailscale-rushes-patches-after-uncoordinated-disclosure-of-tailworm-flaws/

UK police suppliers repeatedly breached https://therecord.media/uk-police-data-breached-from-suppliers-watchdog-report

Rural hospitals get a cyber lifeline https://cyberscoop.com/oncd-rural-hospital-cybersecurity-pilot-project-lifeline-250/

Cyberattack disrupts UNM health services https://www.theregister.com/cyber-crime/2026/10/27/day-2-of-canceled-classes-at-university-of-new-mexico-after-health-sciences-center-cyberattack/5305690

Warp breach exposes AI agent logs https://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data/

Malware hides from online store scanners https://www.infosecurity-magazine.com/news/hackers-infect-953-online-stores/

Apple patches exploited flaw on older devices https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html

Get the show notes here:

https://cisoseries.com/cybersecurity-news-october-28-2026/

Huge thanks to our sponsor, Guardsquare

https://hubs.la/Q04sv5qF0

Is your mobile app truly protected? Relying on the OS isn't enough. A global study of thirteen-hundred security and developer leaders found that ninety-six percent of teams using layered protection reported significantly fewer security incidents. Don't wait for a breach to harden your defenses. Get the protection needed for modern security risks. Learn more at http://Guardsquare.com.

HTTP2Shell sparks emergency patches https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/

PHP2Shell: patch, then investigate https://www.securitymagazine.com/articles/102693-php2shell-exploited-in-the-wild

GitHub worm hides in oversized files https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570

Cathedral gets inside Anthropic https://www.washingtonpost.com/technology/2026/10/26/researchers-cybersecurity-start-up-cathedral-got-inside-anthropic/?pwapi_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZWFzb24iOiJnaWZ0IiwibmJmIjoxNzkyOTg3MjAwLCJpc3MiOiJzdWJzY3JpcHRpb25zIiwiZXhwIjoxNzk0MzczMTk5LCJpYXQiOjE3OTI5ODcyMDAsImp0aSI6ImI1M2RjZmEzLThkNTItNGE3NC05ZjI4LWU1ZGJkZTIyZDFmOSIsInVybCI6Imh0dHBzOi8vd3d3Lndhc2hpbmd0b25wb3N0LmNvbS90ZWNobm9sb2d5LzIwMjYvMTAvMjYvcmVzZWFyY2hlcnMtY3liZXJzZWN1cml0eS1zdGFydC11cC1jYXRoZWRyYWwtZ290LWluc2lkZS1hbnRocm9waWMvIn0.k3b70wv6ePisrPvCYfDOPAjt5vHweVxm4rBnhcnDU-M

Ukraine's satellite service returns https://therecord.media/ukraine-disputes-musk-claims-of-starlink-misuse

Gheist raids GitHub secrets https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets

Fake Teams support delivers ransomware https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html

Scam laundering suspect extradited https://therecord.media/dutch-police-extradite-chinese-national-money-laundering-scams

Get the show notes here:

https://cisoseries.com/cybersecurity-news-october-27-2026/

Huge thanks to our sponsor, Guardsquare

https://hubs.la/Q04sv5qF0

Your backend is only as secure as your frontend. Research shows that client-side compromise is now a primary driver of API risk. With sixty-three percent of leaders detecting mobile app tampering or cloning last year, don't leave your mobile app security to chance. Get multilayered protection for your entire mobile app ecosystem from the outside in. Learn more at http://guardsquare.com/.

Microsoft Teams to get AI-powered, context-aware phishing detection

https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection/

Quest Diagnostics confirms data breach including exposed patient records

https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/

Senators say targeted ads are a security risk. Ad groups disagree

https://cyberscoop.com/targeted-ads-spyware-government-threat/

Bipartisan bill urges federal guidance for distillation attacks

https://cyberscoop.com/bipartisan-bill-combat-ai-distillation-attacks-nist/

CISA adds Collabora Online and Arista VeloCloud flaws to KEV

https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html

Autonomous attack agent in Skynet mode hijacks other AI models

https://www.theregister.com/security/2026/10/24/autonomous-attack-agent-in-skynet-mode-hijacks-other-models-to-carry-out-its-evil-deeds/5305215

Researchers find a third PHP2Shell bug

https://www.theregister.com/security/2026/10/23/theres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix/5305208

Data breach takes a bite out of crime stoppers organization

https://therecord.media/toronto-crime-tips-org-freezes-ops-after-breach

Get the shownotes here: https://cisoseries.com/cybersecurity-news-ai-powered-phishing-detection-third-php2shell-bug-quest-medical-breach/

https://hubs.la/Q04sv5qF0

Mobile app security isn't just a tech issue; it's a revenue issue. A recent global study found that seventy-two percent of organizations experienced a mobile app security incident last year. Even worse? Sixty-five percent saw customer churn or uninstalls as a result. Protect your brand and your bottom line with layered mobile app protection. Learn more at http://guardsquare.com/.

Read the full stories at CISOSeries.com.

This week's Department of Know is hosted by Rich Stroffolino, with guests Gary Chan, CISO, SSM Health, and Doug Mayer, CISO, RXSense.

Also check out Gary's work at Security Mentalist.

Missed the live show? Check it out on YouTube.

The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at https://cisoseries.com/.

Big thanks to our sponsor, ThreatLocker!

https://www.threatlocker.com/ciso

An AI-generated attack may be new, but it still needs to execute, access data, and move through your environment. ThreatLocker applies enforceable controls at each of those points, limiting what attackers can do regardless of how their code was created. Book a demo at http://threatlocker.com/ciso.

Railway says intruder may have accessed customer secrets

https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html

Law enforcement disrupts nearly 11,000 cybercrime networks in Africa

https://www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/

ConnectWise breach let Chinese AI spies move in on cloud tenants

https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687

GitLab warns of new maximum severity code execution vulnerability

https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/

Hundreds of websites taken offline due to PHP vulnerabilities (continuing coverage)

https://therecord.media/php-script-vulnerabilities-warnings

https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/

Splunk, SolarWinds release fresh security updates

https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/

Lazarus hackers use post-quantum cryptography for malware delivery

https://www.bleepingcomputer.com/news/security/chrome-switching-to-nist-approved-ml-kem-quantum-encryption/

South Carolina officials offer assistance after state capital hit with cyberattack

https://therecord.media/south-carolina-officials-offer-assistance-cyber-incident

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-23-2026/

Huge thanks to our episode sponsor, ThreatLocker

AI risk does not only come from attackers. Employees are adopting AI tools faster than many organizations can evaluate them. Today's tip: an AI policy should be backed by enforceable controls over what tools can access and do. See how ThreatLocker can help you govern AI use at http://threatlocker.com/ciso.

PHP rushes out emergency fixes for PHP2Shell https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/ https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

Compromised certificates trigger internet cleanup https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

Signal calls could stay live after you hang up https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528

OpenAI agents disable safeguards during coding tasks https://www.theverge.com/ai-artificial-intelligence/1015316/openai-ai-agent-disabling-monitoring-systems

Plex2Shell attacks hit media servers https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/

Poisoned LiteLLM update steals secrets & adds a backdoor https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548

Meta faces a big Cambridge Analytica penalty https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html

Chrome adds ClickFix warnings and checks insecure connections https://www.securityweek.com/google-hardens-chrome-against-clickfix-attacks-insecure-http-connections/

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-22-2026/

Huge thanks to our episode sponsor, ThreatLocker

https://threatlocker.com/ciso

AI is compressing the timeline between initial access and impact. That leaves security teams less time to identify, investigate, and contain malicious activity. Faster response helps, but prevention can remove actions from the attack chain entirely. Give your responders a more controlled environment. Book a ThreatLocker demo at http://threatlocker.com/ciso.

Russian-linked attacks hit naval shipbuilder https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html

Muse exposes secrets when sharing chats https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/

Army Cyber Command looking to offload attacks to AI https://web.archive.org/web/20261020134149/https://theintercept.com/2026/10/19/army-autonomous-ai-agents-arcyber/

DeepSeek booted from federal agencies https://www.wsj.com/tech/ai/dhs-orders-deepseek-technology-removed-from-federal-civilian-it-systems-060b6d3d?st=m6DV2n

DHS asked CISA to hack voting machine https://www.propublica.org/article/cisa-election-security-donald-trump

EU doesn't require patching hacked freezers https://therecord.media/eu-cyber-law-wont-force-fixes-for-fridges-in-french-attack

Cairn platform abused by threat actors Security Week: https://www.securityweek.com/ai-platform-cairn-abused-to-hack-over-100-organizations/ Reuters: https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/

Palo Alto still seeing active PAN-OS exploits https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html

LLMs getting better at COBOL https://openai.com/index/low-resource-programming-languages/

Get the show notes here: https://cisoseries.com/naval-hack-muse-exposes-secrets-army-researching-offensive-ai-hacking/

Huge thanks to our episode sponsor, ThreatLocker

Attackers do not always bring their own tools. AI can help them find ways to misuse software already trusted by the organization. Today's tip: approval should not mean unlimited access. Define what trusted applications can reach and what they can do. Learn how ThreatLocker applies this principle at http://threatlocker.com/ciso today.

OpenCode breach exposes users' AI keys https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/

One hacker puts AI agents to work on 1,200 sites https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/

Rank Math PRO updates deliver a persistent backdoor https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html

Nikkei discloses its third breach in a month https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/

Microsoft adds controls for rogue AI agents https://www.geekwire.com/2026/microsoft-unveils-tools-to-monitor-and-corral-rogue-ai-agents/

ClickFix attackers borrow Siemens' signature https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/

Pegasus targets Serbian government critics before elections https://therecord.media/serbia-spyware-pegasus-elections

Bullhorn takes staffing platform offline after attack https://www.bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack/

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-20-2026/

Huge thanks to our episode sponsor, ThreatLocker

http://threatlocker.com/ciso

An attacker uses AI to create a payload your security tools have never seen. Detection now has to recognize it before the payload can act. ThreatLocker approaches the problem earlier by controlling whether that code is permitted to run at all. Explore a deny by default approach for your organization at http://threatlocker.com/ciso.

Cybersecurity jobs report reveals mixed bag

https://www.securityweek.com/us-cybersecurity-job-postings-fall-26-as-ai-security-engineer-demand-soars/

https://cybersn.com/resources/reports/cybersecurity-jobs-report

ConnectWise Suspends cloud backup after supply chain attack

https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html

Drupal patches critical RCE flaws, warns of exploits

https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/

Chinese espionage attackers suspected of BeyondTrust zero-day

https://therecord.media/beyond-trust-cyberattack-china

Proofpoint to acquire Varonis' data security

https://therecord.media/proofpoint-varonis-cybersecurity-acquisition

Burger King Japan data breach exposes 11 million customer records

https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/

BAE Systems cyberattack disrupts US federal court operations

https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/

CikaBika Bot RAT abuses Discord

https://www.securityweek.com/cikabika-bot-rat-uses-discord-for-cc/

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-19-2026/

Huge thanks to our episode sponsor, ThreatLocker

AI is helping attackers research targets, create malicious code, and adapt faster. But the fundamentals have not changed. Code still needs to execute, applications still need access, and attackers still need privileges. Today's tip: control those actions instead of trying to predict every threat. Learn more from ThreatLocker at http://threatlocker.com/ciso.

See the full stories at cisoseries.com

This week's Department of Know is hosted by Rich Stroffolino, with guests Dennis Pickett, vp and CISO, RTI International, and David Cross, CISO, Atlassian.

Missed the live show? Check it out on YouTube.

The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at https://cisoseries.com/.

Huge thanks to our sponsor, Guardsquare Mobile security incidents are no longer the exception—they are the norm. Last year, seventy-two percent of companies suffered a mobile app security incident. As the primary gateway to your APIs and data, your mobile app requires more than just basic encryption; it needs a multi-layered security strategy. Protect your brand and your bottom line with layered mobile app protection. Learn more at Guardsquare.com.

CenterPoint Energy reveals data breach numbers

https://www.securitymagazine.com/articles/102658-1m-impacted-by-centerpoint-energy-data-breach

Zero-Click Candiru spyware infections at Al Jazeera tracked to targeted online ads

https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html

UK Legal Aid Agency Hack Scope Widens After Forensic Review

https://www.securityweek.com/uk-legal-aid-agency-hack-scope-widens-after-forensic-review/

Bank of America needed 1,000 contractors to patch bugs found by Mythos

https://www.theregister.com/security/2026/10/15/bank-of-america-had-to-bring-in-1000-contractors-to-patch-all-the-bugs-mythos-identified/5303275

Microsoft takes down 3 major China-based phishing platforms

https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms

Windows Server 2022 reaches end of mainstream support

https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2022-reached-end-of-mainstream-support/

Senators press for AI safety and security

https://cyberscoop.com/congress-presses-trump-administration-ai-safety-cybersecurity/

French supermarket refrigeration attack widens

https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-16-2026/

Huge thanks to our episode sponsor, Guardsquare

Attackers are treating your mobile app like an open book. Sixty-three percent of security leaders recently detected app tampering, cloning, or unauthorized modifications. When your code runs in an untrusted environment, you need runtime self-protection and code hardening to keep attackers out. Address tampering before it starts. Learn more at http://Guardsquare.com.

FBI shuts down North Korean laptop farms https://www.bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested/

Meta's stolen credentials open GitHub repositories https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/

Cisco email gateways face active attacks https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html

Ledger tells Asian sellers to stop sales https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/

CISA urges Ivanti VPN updates https://www.securitymagazine.com/articles/102655-newly-exploited-vulnerability-in-ivanti-connect-secure

Microsoft's patch count breaks the annual record https://cyberscoop.com/microsoft-patch-tuesday-october-2026/

Six days, three Chrome bugs, one sandbox escape https://www.theregister.com/security/2026/10/14/security-researchers-spent-6-days-doing-their-chromework-built-1b-user-exploit/5303134

Windows gets its Always On VPN back https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-vpn-issues-caused-by-september-windows-updates/

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-15-2026/

Huge thanks to our episode sponsor, Guardsquare

AI is speeding up development, but at what cost? While ninety-six percent of teams now use AI tools, eighty-one percent report that AI-generated code has introduced new vulnerabilities into their mobile apps. In a world with automated threats, you need multi-layered, polymorphic security to stay ahead of the curve. Learn more at http://Guardsquare.com.

Webcams get drafted into war https://www.wsj.com/tech/cybersecurity/video-cameras-webcams-hacked-war-b00b8a24?st=RRCsaw

Kimsuky's invitations come with malware https://therecord.media/north-korea-hackers-russia-ukraine

Anthropic makes copycats work harder https://www.anthropic.com/research/distillation-defenses

Adobe's patch pile hits 140 https://www.securityweek.com/adobe-patches-140-vulnerabilities-across-10-products/

Scam crackdown nets 28 arrests https://cyberscoop.com/west-african-scammers-international-scam-crackdown-joint-disruption-week/

Fashion brands hit an IT snag https://www.bleepingcomputer.com/news/security/tfg-london-cyberattack-disrupts-systems-at-hobbs-and-whistles-retailers/

npm closes a name-stealing loophole https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html

Chrome bug bounties bounce back https://www.securityweek.com/google-partially-reverses-chrome-bug-bounty-cuts/

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-14-2026/

Huge thanks to our episode sponsor, Guardsquare

Is your mobile app truly protected? Relying on the OS isn't enough. A global study of thirteen-hundred security and developer leaders found that ninety-six percent of teams using layered protection reported significantly fewer security incidents. Don't wait for a breach to harden your defenses. Get the protection needed for modern secuirty risks. Learn more at http://Guardsquare.com.

Hackers turn up the heat on French supermarkets: https://www.infosecurity-magazine.com/news/french-supermarket-chains/

Ahold Delhaize offline after cyber attack: https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhize-takes-systems-offline-after-cyberattack/

Spy chip used in crypto wallet thefts: https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/

Russian digital services disrupted from drone strike: https://therecord.media/ukraine-strikes-third-yandex-data-center

Microsoft wants AI "emergency brakes": https://www.bbc.com/news/articles/c6rmy7zmvx3lo

UK's AI Security Institute to get early model access: https://www.reuters.com/legal/litigation/us-reverses-course-britains-testing-ai-models-telegraph-says-2026-10-11/ and https://www.telegraph.co.uk/news/2026/10/11/britain-get-first-look-ai-systems-after-white-house-u-turn/

Threat actors trying to use critical SonicWall SMA flaw: https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html

Threat actors drop the mic with karaoke hack: https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-13-2026/

Huge thanks to our episode sponsor, Guardsquare

Your backend is only as secure as your frontend. Research shows that client-side compromise is now a primary driver of API risk. With sixty-three percent of leaders detecting mobile app tampering or cloning last year, don't leave your mobile app security to chance. Get multilayered protection for your entire mobile app ecosystem from the outside in. Learn more at http://Guardsquare.com.

CISA's KEV catalog grows by five

https://securityaffairs.com/200734/security/u-s-cisa-adds-proftpd-onlyoffice-docs-strapi-apache-struts-and-isc-bind-flaws-to-its-known-exploited-vulnerabilities-catalog.html

Calendar phishing becomes a thing

https://www.theguardian.com/money/2026/oct/11/calendar-phishing-scam-meeting-renewal-google-microsoft-paypal

Canadian cybersecurity executive arrested in FBI hack

https://www.cnn.com/2026/10/09/politics/fbi-arrest-shinyhunters-hack

Hackers abuse Google Ads, Bing redirects to deliver Claude ClickFix attacks

https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/

Biosensor firm iRhythm announces data breach numbers

https://therecord.media/irhythm-data-breach-reports

Japan confirms arrest of Russian Qilin operative

https://therecord.media/japan-germany-ransomware-arrest

Anthropic cuts live internet access for internal AI tests after exploitative behaviors

https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html

Leader of money mule operation pleads guilty

https://therecord.media/leader-of-money-mule-operation-for-cybercriminals-pleads-guilty

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-12-2026/

Huge thanks to our episode sponsor, Guardsquare

Mobile app security isn't just a tech issue; it's a revenue issue. A recent global study found that seventy-two percent of organizations experienced a mobile app security incident last year. Even worse? Sixty-five percent saw customer churn or uninstalls as a result. Protect your brand and your bottom line with layered mobile app protection. Learn more at http://Guardsquare.com.