NewsTech NewsTechnology

Cybersecurity Headlines

CISO Series

Daily stories from the world of information security. To delve into any daily story, head to CISOseries.com.

Play

Open in

82 episodes
daily
Avg 11 min
English

Episodes 82

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

Friday · 37 min
The Department of Know: PHP2Shell strikes, EU EOL still SOL, Cairn used in cyberattacks
Read the full stories at CISOSeries.com. This week's Department of Know is hosted by Rich Stroffolino, with guests Gary Chan, CISO, SSM Health, and Doug Mayer, CISO, RXSense. Also check out Gary's work at Security Mentalist. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, ThreatLocker! An AI-generated attack may be new, but it still needs to execute, access data, and move through your environment. ThreatLocker applies enforceable controls at each of those points, limiting what attackers can do regardless of how their code was created. Book a demo at threatlocker.com/ciso.
Friday · 7 min
PHP vulnerabilities update, ConnectWise AI spies, Africa cybercrime takedown
Railway says intruder may have accessed customer secrets https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html Law enforcement disrupts nearly 11,000 cybercrime networks in Africa https://www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/ ConnectWise breach let Chinese AI spies move in on cloud tenants https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687 GitLab warns of new maximum severity code execution vulnerability https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/ Hundreds of websites taken offline due to PHP vulnerabilities (continuing coverage) https://therecord.media/php-script-vulnerabilities-warnings https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/ Splunk, SolarWinds release fresh security updates https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/ Lazarus hackers use post-quantum cryptography for malware delivery https://www.bleepingcomputer.com/news/security/chrome-switching-to-nist-approved-ml-kem-quantum-encryption/ South Carolina officials offer assistance after state capital hit with cyberattack https://therecord.media/south-carolina-officials-offer-assistance-cyber-incident Get the show notes here: https://cisoseries.com/cybersecurity-news-october-23-2026/ Huge thanks to our episode sponsor, ThreatLocker AI risk does not only come from attackers. Employees are adopting AI tools faster than many organizations can evaluate them. Today's tip: an AI policy should be backed by enforceable controls over what tools can access and do. See how ThreatLocker can help you govern AI use at threatlocker.com/ciso.
Thursday · 7 min
PHP emergency patches, compromised TLS certificates, Signal hot mic bug
PHP rushes out emergency fixes for PHP2Shell https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/ https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ Compromised certificates trigger internet cleanup https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/ Signal calls could stay live after you hang up https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528 OpenAI agents disable safeguards during coding tasks https://www.theverge.com/ai-artificial-intelligence/1015316/openai-ai-agent-disabling-monitoring-systems Plex2Shell attacks hit media servers https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/ Poisoned LiteLLM update steals secrets & adds a backdoor https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548 Meta faces a big Cambridge Analytica penalty https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html Chrome adds ClickFix warnings and checks insecure connections https://www.securityweek.com/google-hardens-chrome-against-clickfix-attacks-insecure-http-connections/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-22-2026/ Huge thanks to our episode sponsor, ThreatLocker AI is compressing the timeline between initial access and impact. That leaves security teams less time to identify, investigate, and contain malicious activity. Faster response helps, but prevention can remove actions from the attack chain entirely. Give your responders a more controlled environment. Book a ThreatLocker demo at threatlocker.com/ciso.
Wednesday · 7 min
Naval hack, Muse exposes secrets, Army researching offensive AI hacking
Russian-linked attacks hit naval shipbuilder https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html Muse exposes secrets when sharing chats https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/ Army Cyber Command looking to offload attacks to AI https://web.archive.org/web/20261020134149/https://theintercept.com/2026/10/19/army-autonomous-ai-agents-arcyber/ DeepSeek booted from federal agencies https://www.wsj.com/tech/ai/dhs-orders-deepseek-technology-removed-from-federal-civilian-it-systems-060b6d3d?st=m6DV2n DHS asked CISA to hack voting machine https://www.propublica.org/article/cisa-election-security-donald-trump EU doesn't require patching hacked freezers https://therecord.media/eu-cyber-law-wont-force-fixes-for-fridges-in-french-attack Cairn platform abused by threat actors Security Week: https://www.securityweek.com/ai-platform-cairn-abused-to-hack-over-100-organizations/ Reuters: https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/ Palo Alto still seeing active PAN-OS exploits https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html LLMs getting better at COBOL https://openai.com/index/low-resource-programming-languages/ Get the show notes here: https://cisoseries.com/naval-hack-muse-exposes-secrets-army-researching-offensive-ai-hacking/ Huge thanks to our episode sponsor, ThreatLocker Attackers do not always bring their own tools. AI can help them find ways to misuse software already trusted by the organization. Today's tip: approval should not mean unlimited access. Define what trusted applications can reach and what they can do. Learn how ThreatLocker applies this principle at threatlocker.com/ciso today.
Tuesday · 7 min
OpenCode keys exposed, AI agents raid websites, Rank Math backdoor
OpenCode breach exposes users' AI keys https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/ One hacker puts AI agents to work on 1,200 sites https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/ Rank Math PRO updates deliver a persistent backdoor https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html Nikkei discloses its third breach in a month https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/ Microsoft adds controls for rogue AI agents https://www.geekwire.com/2026/microsoft-unveils-tools-to-monitor-and-corral-rogue-ai-agents/ ClickFix attackers borrow Siemens' signature https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/ Pegasus targets Serbian government critics before elections https://therecord.media/serbia-spyware-pegasus-elections Bullhorn takes staffing platform offline after attack https://www.bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-20-2026/ Huge thanks to our episode sponsor, ThreatLocker An attacker uses AI to create a payload your security tools have never seen. Detection now has to recognize it before the payload can act. ThreatLocker approaches the problem earlier by controlling whether that code is permitted to run at all. Explore a deny by default approach for your organization at threatlocker.com/ciso.
October 19 · 6 min
Cybersecurity jobs report, ConnectWise suspends cloud backup, Drupal patches flaws
Cybersecurity jobs report reveals mixed bag https://www.securityweek.com/us-cybersecurity-job-postings-fall-26-as-ai-security-engineer-demand-soars/ https://cybersn.com/resources/reports/cybersecurity-jobs-report ConnectWise Suspends cloud backup after supply chain attack https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html Drupal patches critical RCE flaws, warns of exploits https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/ Chinese espionage attackers suspected of BeyondTrust zero-day https://therecord.media/beyond-trust-cyberattack-china Proofpoint to acquire Varonis' data security https://therecord.media/proofpoint-varonis-cybersecurity-acquisition Burger King Japan data breach exposes 11 million customer records https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/ BAE Systems cyberattack disrupts US federal court operations https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/ CikaBika Bot RAT abuses Discord https://www.securityweek.com/cikabika-bot-rat-uses-discord-for-cc/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-19-2026/ Huge thanks to our episode sponsor, ThreatLocker AI is helping attackers research targets, create malicious code, and adapt faster. But the fundamentals have not changed. Code still needs to execute, applications still need access, and attackers still need privileges. Today's tip: control those actions instead of trying to predict every threat. Learn more from ThreatLocker at threatlocker.com/ciso.
October 16 · 34 min
The Department of Know: Hacked fridges, hiring humans to fix Mythos bugs, targeted ad spyware
See the full stories at cisoseries.com This week's Department of Know is hosted by Rich Stroffolino, with guests Dennis Pickett, vp and CISO, RTI International, and David Cross, CISO, Atlassian. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Huge thanks to our sponsor, Guardsquare Mobile security incidents are no longer the exception—they are the norm. Last year, seventy-two percent of companies suffered a mobile app security incident. As the primary gateway to your APIs and data, your mobile app requires more than just basic encryption; it needs a multi-layered security strategy. Protect your brand and your bottom line with layered mobile app protection. Learn more at Guardsquare.com.
October 16 · 7 min
Candiru spyware infects Al Jazeera, Senators AI request, Microsoft crashes phishers
CenterPoint Energy reveals data breach numbers https://www.securitymagazine.com/articles/102658-1m-impacted-by-centerpoint-energy-data-breach Zero-Click Candiru spyware infections at Al Jazeera tracked to targeted online ads https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html UK Legal Aid Agency Hack Scope Widens After Forensic Review https://www.securityweek.com/uk-legal-aid-agency-hack-scope-widens-after-forensic-review/ Bank of America needed 1,000 contractors to patch bugs found by Mythos https://www.theregister.com/security/2026/10/15/bank-of-america-had-to-bring-in-1000-contractors-to-patch-all-the-bugs-mythos-identified/5303275 Microsoft takes down 3 major China-based phishing platforms https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms Windows Server 2022 reaches end of mainstream support https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2022-reached-end-of-mainstream-support/ Senators press for AI safety and security https://cyberscoop.com/congress-presses-trump-administration-ai-safety-cybersecurity/ French supermarket refrigeration attack widens https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-16-2026/ Huge thanks to our episode sponsor, Guardsquare Attackers are treating your mobile app like an open book. Sixty-three percent of security leaders recently detected app tampering, cloning, or unauthorized modifications. When your code runs in an untrusted environment, you need runtime self-protection and code hardening to keep attackers out. Address tampering before it starts. Learn more at Guardsquare.com.
October 15 · 6 min
FBI raids laptop farms, Meta loses GitHub data, Cisco gateways under attack
FBI shuts down North Korean laptop farms https://www.bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested/ Meta's stolen credentials open GitHub repositories https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/ Cisco email gateways face active attacks https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html Ledger tells Asian sellers to stop sales https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/ CISA urges Ivanti VPN updates https://www.securitymagazine.com/articles/102655-newly-exploited-vulnerability-in-ivanti-connect-secure Microsoft's patch count breaks the annual record https://cyberscoop.com/microsoft-patch-tuesday-october-2026/ Six days, three Chrome bugs, one sandbox escape https://www.theregister.com/security/2026/10/14/security-researchers-spent-6-days-doing-their-chromework-built-1b-user-exploit/5303134 Windows gets its Always On VPN back https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-vpn-issues-caused-by-september-windows-updates/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-15-2026/ Huge thanks to our episode sponsor, Guardsquare AI is speeding up development, but at what cost? While ninety-six percent of teams now use AI tools, eighty-one percent report that AI-generated code has introduced new vulnerabilities into their mobile apps. In a world with automated threats, you need multi-layered, polymorphic security to stay ahead of the curve. Learn more at Guardsquare.com.
October 14 · 7 min
Webcams go to war, Kimsuky sends invites, Anthropic blocks copycats
Webcams get drafted into war https://www.wsj.com/tech/cybersecurity/video-cameras-webcams-hacked-war-b00b8a24?st=RRCsaw Kimsuky's invitations come with malware https://therecord.media/north-korea-hackers-russia-ukraine Anthropic makes copycats work harder https://www.anthropic.com/research/distillation-defenses Adobe's patch pile hits 140 https://www.securityweek.com/adobe-patches-140-vulnerabilities-across-10-products/ Scam crackdown nets 28 arrests https://cyberscoop.com/west-african-scammers-international-scam-crackdown-joint-disruption-week/ Fashion brands hit an IT snag https://www.bleepingcomputer.com/news/security/tfg-london-cyberattack-disrupts-systems-at-hobbs-and-whistles-retailers/ npm closes a name-stealing loophole https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html Chrome bug bounties bounce back https://www.securityweek.com/google-partially-reverses-chrome-bug-bounty-cuts/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-14-2026/ Huge thanks to our episode sponsor, Guardsquare Is your mobile app truly protected? Relying on the OS isn't enough. A global study of thirteen-hundred security and developer leaders found that ninety-six percent of teams using layered protection reported significantly fewer security incidents. Don't wait for a breach to harden your defenses. Get the protection needed for modern secuirty risks. Learn more at Guardsquare.com.
October 13 · 7 min
Supermarket freezer hack, Ahold Delhaize offline, spy chip in crypto wallets
Hackers turn up the heat on French supermarkets: https://www.infosecurity-magazine.com/news/french-supermarket-chains/ Ahold Delhaize offline after cyber attack: https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhize-takes-systems-offline-after-cyberattack/ Spy chip used in crypto wallet thefts: https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/ Russian digital services disrupted from drone strike: https://therecord.media/ukraine-strikes-third-yandex-data-center Microsoft wants AI "emergency brakes": https://www.bbc.com/news/articles/c6rmy7zmvx3lo UK's AI Security Institute to get early model access: https://www.reuters.com/legal/litigation/us-reverses-course-britains-testing-ai-models-telegraph-says-2026-10-11/ and https://www.telegraph.co.uk/news/2026/10/11/britain-get-first-look-ai-systems-after-white-house-u-turn/ Threat actors trying to use critical SonicWall SMA flaw: https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html Threat actors drop the mic with karaoke hack: https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-13-2026/ Huge thanks to our episode sponsor, Guardsquare Your backend is only as secure as your frontend. Research shows that client-side compromise is now a primary driver of API risk. With sixty-three percent of leaders detecting mobile app tampering or cloning last year, don't leave your mobile app security to chance. Get multilayered protection for your entire mobile app ecosystem from the outside in. Learn more at Guardsquare.com.
October 12 · 7 min
Anthropic restricts Claude, Google Calendar phishing, FBI hack arrest
CISA's KEV catalog grows by five https://securityaffairs.com/200734/security/u-s-cisa-adds-proftpd-onlyoffice-docs-strapi-apache-struts-and-isc-bind-flaws-to-its-known-exploited-vulnerabilities-catalog.html Calendar phishing becomes a thing https://www.theguardian.com/money/2026/oct/11/calendar-phishing-scam-meeting-renewal-google-microsoft-paypal Canadian cybersecurity executive arrested in FBI hack https://www.cnn.com/2026/10/09/politics/fbi-arrest-shinyhunters-hack Hackers abuse Google Ads, Bing redirects to deliver Claude ClickFix attacks https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/ Biosensor firm iRhythm announces data breach numbers https://therecord.media/irhythm-data-breach-reports Japan confirms arrest of Russian Qilin operative https://therecord.media/japan-germany-ransomware-arrest Anthropic cuts live internet access for internal AI tests after exploitative behaviors https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html Leader of money mule operation pleads guilty https://therecord.media/leader-of-money-mule-operation-for-cybercriminals-pleads-guilty Get the show notes here: https://cisoseries.com/cybersecurity-news-october-12-2026/ Huge thanks to our episode sponsor, Guardsquare Mobile app security isn't just a tech issue; it's a revenue issue. A recent global study found that seventy-two percent of organizations experienced a mobile app security incident last year. Even worse? Sixty-five percent saw customer churn or uninstalls as a result. Protect your brand and your bottom line with layered mobile app protection. Learn more at Guardsquare.com.
October 9 · 33 min
The Department of Know: South Korean bank hacks, agents target Wikipedia, ransomware recovery fraud
Read the full stories at CISOSeries.com. This week's Department of Know is hosted by Rich Stroffolino, with guests Derek Fisher, Director of the Cyber Defense and Information Assurance Program, Temple University, and Chris Ray, field CTO, GigaOm. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, Vanta! Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.
October 9 · 8 min
Top level domain theft, Yandex attacked, Cisco Nexus flaws
Attackers hijack three top level domains to obtain Google certificates https://www.infosecurity-magazine.com/news/attackers-hijack-cctlds-obtain/ Major Yandex data center in Russia hit by Ukrainian drone https://therecord.media/yandex-russia-drone-ukraine Cisco warns of critical flaws allowing Nexus switch takeover https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-flaws-allowing-nexus-switch-takeover/ Attackers target Atlassian vulnerability shortly after PoC publication https://www.securityweek.com/attackers-target-critical-atlassian-vulnerability-within-hours-of-poc-publication/ Wazza Phishkit targets banking, government, and manufacturing https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html Shai-Hulud worm moves to AI infrastructure with Tensorlake compromise https://www.theregister.com/security/2026/10/08/shai-hulud-worm-makes-jump-to-ai-infrastructure-with-tensorlake-compromise/5302054 Japan sees sharp rise in web data leaks https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html DOJ charges ransomware recovery CEO for secretly paying hackers https://therecord.media/ransomware-recovery-charges-doj Get the show notes here: https://cisoseries.com/cybersecurity-news-top-level-domain-theft-yandex-attacked-cisco-nexus-flaws/ Huge thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.
October 8 · 7 min
Poetry-powered botnet, Flock hits a roadblock, Outlook blocks risky installers
Botnet takes orders from a poem https://cyberscoop.com/poellm-malware-botnet-poem-lumen-black-lotus-labs/ Flock's warrantless tracking hits a roadblock https://therecord.media/oklahoma-flock-ruing-supreme-court-chatrie-decision npm packages come with unwanted extras https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html AWS gives AI agents a sandbox with house rules https://www.theregister.com/ai-and-ml/2026/10/07/aws-launches-open-source-ai-agent-sandbox-to-prevent-yolo-mode-disasters/5301687 Outlook closes the door on risky installers https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-to-block-msix-attachments-used-in-attacks/ Arizona court breach reaches back 30 years https://therecord.media/arizona-courts-say-hackers-stole-info-on-over-1-million Utility customers' accounts exposed https://www.securityweek.com/georgia-power-alabama-power-data-breach-hits-400000-accounts/ FortiBleed changes the locks on VPN admins https://www.bleepingcomputer.com/news/security/fbi-ongoing-fortibleed-attacks-lock-out-fortigate-vpn-admins/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-8-2026/ Huge thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.
October 7 · 7 min
Agents vs Wikipedia, South Korean bank hacks, ASOS breached
Agents trying to compromise Wikipedia tools https://thehackernews.com/2026/10/wikimedia-says-openai-agents-tried-to.html South Korea claims agents were used in bank hacks https://therecord.media/south-korean-bank-hacks-ai-agents ASOS confirms data breach https://www.ft.com/content/eab7052d-6640-4928-a128-8df73455ba0a https://www.bleepingcomputer.com/news/security/asos-confirms-data-breach-after-hacked-in-app-notifications/ Contractor fired over FBI data breach https://www.reuters.com/technology/accenture-contractor-removed-fbi-following-damaging-data-breach-sources-say-2026-10-06/ Red Hat's Lightwell shows early returns https://www.infosecurity-magazine.com/news/red-hat-lightwell-remediates-400/ LibreOffice and OpenOffice flaw can run code with no warning https://thehackernews.com/2026/10/libreoffice-and-openoffice-flaws-let.html Ransomware cancels classes at Japanese university https://therecord.media/osaka-university-cancels-classes-ransomware ATM malware creator in court https://therecord.media/atm-malware-creator-appears-in-nebraska-court OpenAI pledges disclosure changes after Australian attack https://www.abc.net.au/news/2026-10-06/openai-hearing-apology-key-takeaways/107235640 Get the show notes here: https://cisoseries.com/cybersecurity-news-agents-vs-wikipedia-south-korean-bank-hacks-asos-breached/ Huge thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.
October 6 · 7 min
Google pauses bug bounties, ATB faces extortion, Exchange flaw exposes mailboxes
Google pauses open-source bug bounties amid AI spam Ukraine's largest grocery chain hit by extortion attack Exchange flaw exposes other users' mailboxes Get the show notes here: https://cisoseries.com/cybersecurity-news-october-6-2026/ Huge thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.
October 5 · 7 min
Warlock continues SharePoint exploits, ShinyHunters member flips China's AI espionage
Warlock ransomware continues to exploit year-old SharePoint flaws ShinyHunters member detained in Jordan China-aligned espionage group targets American AI policy experts Get the show notes here: https://cisoseries.com/cybersecurity-news-warlock-continues-sharepoint-exploits-shinyhunters-member-flips-chinas-ai-espionage/ Huge thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.
October 2 · 38 min
The Department of Know: ShinyHunters vs FBI, Kiteworks shutdown, and hundreds of orgs hit by rogue AI
Read all the stories at CISOSeries.com. This week's Department of Know is hosted by Rich Stroffolino, with guests Brett Conlon, CISO, American Century Investments, and Nick Espinosa, host, Deep Dive Radio Show. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, Intezer. If you caught our tips this week, they pointed one direction: investigate everything, and keep the evidence. That's a hard promise to make with people. It's an easy one to make with forensics that run in under a minute. Intezer. The AI SOC trusted by Salesforce, MGM Resorts and Nvidia. See it yourself at intezer.com/headlines.
October 2 · 8 min
AI readiness reports, KillSec takedown, OpenAI website scraping
Report suggests AI and quantum threat preparedness is lacking Authorities seize KillSec extortion group arrest leader Dozens more prominent websites scraped by OpenAI software Get the show notes here: https://cisoseries.com/cybersecurity-news-ai-readiness-reports-killsec-takedown-openai-website-scraping/ Huge thanks to our episode sponsor, Intezer Today's tip: treat every false positive like a bug report against a detection rule. Fix the rule, and that noise stops coming back. Intezer does that for you, so your SOC gets quieter over time instead of louder. Intezer. The AI SOC trusted by Salesforce, MGM Resorts and Nvidia. See it yourself at intezer.com/headlines.

Showing 1–20 of 82 episodes