Cybersecurity Headlines

See the full stories at cisoseries.com

This week's Department of Know is hosted by Rich Stroffolino, with guests Dennis Pickett, vp and CISO, RTI International, and David Cross, CISO, Atlassian.

Missed the live show? Check it out on YouTube.

The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com.

CenterPoint Energy reveals data breach numbers

https://www.securitymagazine.com/articles/102658-1m-impacted-by-centerpoint-energy-data-breach

Zero-Click Candiru spyware infections at Al Jazeera tracked to targeted online ads

https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html

UK Legal Aid Agency Hack Scope Widens After Forensic Review

https://www.securityweek.com/uk-legal-aid-agency-hack-scope-widens-after-forensic-review/

Bank of America needed 1,000 contractors to patch bugs found by Mythos

https://www.theregister.com/security/2026/10/15/bank-of-america-had-to-bring-in-1000-contractors-to-patch-all-the-bugs-mythos-identified/5303275

Microsoft takes down 3 major China-based phishing platforms

https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms

Windows Server 2022 reaches end of mainstream support

https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2022-reached-end-of-mainstream-support/

Senators press for AI safety and security

https://cyberscoop.com/congress-presses-trump-administration-ai-safety-cybersecurity/

French supermarket refrigeration attack widens

https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-16-2026/

Huge thanks to our episode sponsor, Guardsquare

Attackers are treating your mobile app like an open book. Sixty-three percent of security leaders recently detected app tampering, cloning, or unauthorized modifications. When your code runs in an untrusted environment, you need runtime self-protection and code hardening to keep attackers out. Address tampering before it starts. Learn more at Guardsquare.com.

FBI shuts down North Korean laptop farms https://www.bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested/

Meta's stolen credentials open GitHub repositories https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/

Cisco email gateways face active attacks https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html

Ledger tells Asian sellers to stop sales https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/

CISA urges Ivanti VPN updates https://www.securitymagazine.com/articles/102655-newly-exploited-vulnerability-in-ivanti-connect-secure

Microsoft's patch count breaks the annual record https://cyberscoop.com/microsoft-patch-tuesday-october-2026/

Six days, three Chrome bugs, one sandbox escape https://www.theregister.com/security/2026/10/14/security-researchers-spent-6-days-doing-their-chromework-built-1b-user-exploit/5303134

Windows gets its Always On VPN back https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-vpn-issues-caused-by-september-windows-updates/

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-15-2026/

Huge thanks to our episode sponsor, Guardsquare

AI is speeding up development, but at what cost? While ninety-six percent of teams now use AI tools, eighty-one percent report that AI-generated code has introduced new vulnerabilities into their mobile apps. In a world with automated threats, you need multi-layered, polymorphic security to stay ahead of the curve. Learn more at Guardsquare.com.

Webcams get drafted into war https://www.wsj.com/tech/cybersecurity/video-cameras-webcams-hacked-war-b00b8a24?st=RRCsaw

Kimsuky's invitations come with malware https://therecord.media/north-korea-hackers-russia-ukraine

Anthropic makes copycats work harder https://www.anthropic.com/research/distillation-defenses

Adobe's patch pile hits 140 https://www.securityweek.com/adobe-patches-140-vulnerabilities-across-10-products/

Scam crackdown nets 28 arrests https://cyberscoop.com/west-african-scammers-international-scam-crackdown-joint-disruption-week/

Fashion brands hit an IT snag https://www.bleepingcomputer.com/news/security/tfg-london-cyberattack-disrupts-systems-at-hobbs-and-whistles-retailers/

npm closes a name-stealing loophole https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html

Chrome bug bounties bounce back https://www.securityweek.com/google-partially-reverses-chrome-bug-bounty-cuts/

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-14-2026/

Huge thanks to our episode sponsor, Guardsquare

Is your mobile app truly protected? Relying on the OS isn't enough. A global study of thirteen-hundred security and developer leaders found that ninety-six percent of teams using layered protection reported significantly fewer security incidents. Don't wait for a breach to harden your defenses. Get the protection needed for modern secuirty risks. Learn more at Guardsquare.com.

Hackers turn up the heat on French supermarkets: https://www.infosecurity-magazine.com/news/french-supermarket-chains/

Ahold Delhaize offline after cyber attack: https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhize-takes-systems-offline-after-cyberattack/

Spy chip used in crypto wallet thefts: https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/

Russian digital services disrupted from drone strike: https://therecord.media/ukraine-strikes-third-yandex-data-center

Microsoft wants AI "emergency brakes": https://www.bbc.com/news/articles/c6rmy7zmvx3lo

UK's AI Security Institute to get early model access: https://www.reuters.com/legal/litigation/us-reverses-course-britains-testing-ai-models-telegraph-says-2026-10-11/ and https://www.telegraph.co.uk/news/2026/10/11/britain-get-first-look-ai-systems-after-white-house-u-turn/

Threat actors trying to use critical SonicWall SMA flaw: https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html

Threat actors drop the mic with karaoke hack: https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-13-2026/

Huge thanks to our episode sponsor, Guardsquare

Your backend is only as secure as your frontend. Research shows that client-side compromise is now a primary driver of API risk. With sixty-three percent of leaders detecting mobile app tampering or cloning last year, don't leave your mobile app security to chance. Get multilayered protection for your entire mobile app ecosystem from the outside in. Learn more at Guardsquare.com.

CISA's KEV catalog grows by five

https://securityaffairs.com/200734/security/u-s-cisa-adds-proftpd-onlyoffice-docs-strapi-apache-struts-and-isc-bind-flaws-to-its-known-exploited-vulnerabilities-catalog.html

Calendar phishing becomes a thing

https://www.theguardian.com/money/2026/oct/11/calendar-phishing-scam-meeting-renewal-google-microsoft-paypal

Canadian cybersecurity executive arrested in FBI hack

https://www.cnn.com/2026/10/09/politics/fbi-arrest-shinyhunters-hack

Hackers abuse Google Ads, Bing redirects to deliver Claude ClickFix attacks

https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/

Biosensor firm iRhythm announces data breach numbers

https://therecord.media/irhythm-data-breach-reports

Japan confirms arrest of Russian Qilin operative

https://therecord.media/japan-germany-ransomware-arrest

Anthropic cuts live internet access for internal AI tests after exploitative behaviors

https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html

Leader of money mule operation pleads guilty

https://therecord.media/leader-of-money-mule-operation-for-cybercriminals-pleads-guilty

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-12-2026/

Huge thanks to our episode sponsor, Guardsquare

Mobile app security isn't just a tech issue; it's a revenue issue. A recent global study found that seventy-two percent of organizations experienced a mobile app security incident last year. Even worse? Sixty-five percent saw customer churn or uninstalls as a result. Protect your brand and your bottom line with layered mobile app protection. Learn more at Guardsquare.com.

Read the full stories at CISOSeries.com.

This week's Department of Know is hosted by Rich Stroffolino, with guests Derek Fisher, Director of the Cyber Defense and Information Assurance Program, Temple University, and Chris Ray, field CTO, GigaOm.

Missed the live show? Check it out on YouTube.

The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com.

Big thanks to our sponsor, Vanta!

Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Attackers hijack three top level domains to obtain Google certificates

https://www.infosecurity-magazine.com/news/attackers-hijack-cctlds-obtain/

Major Yandex data center in Russia hit by Ukrainian drone

https://therecord.media/yandex-russia-drone-ukraine

Cisco warns of critical flaws allowing Nexus switch takeover

https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-flaws-allowing-nexus-switch-takeover/

Attackers target Atlassian vulnerability shortly after PoC publication

https://www.securityweek.com/attackers-target-critical-atlassian-vulnerability-within-hours-of-poc-publication/

Wazza Phishkit targets banking, government, and manufacturing

https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html

Shai-Hulud worm moves to AI infrastructure with Tensorlake compromise

https://www.theregister.com/security/2026/10/08/shai-hulud-worm-makes-jump-to-ai-infrastructure-with-tensorlake-compromise/5302054

Japan sees sharp rise in web data leaks

https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html

DOJ charges ransomware recovery CEO for secretly paying hackers

https://therecord.media/ransomware-recovery-charges-doj

Get the show notes here: https://cisoseries.com/cybersecurity-news-top-level-domain-theft-yandex-attacked-cisco-nexus-flaws/

Huge thanks to our sponsor, Vanta

Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Botnet takes orders from a poem https://cyberscoop.com/poellm-malware-botnet-poem-lumen-black-lotus-labs/

Flock's warrantless tracking hits a roadblock https://therecord.media/oklahoma-flock-ruing-supreme-court-chatrie-decision

npm packages come with unwanted extras https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html

AWS gives AI agents a sandbox with house rules https://www.theregister.com/ai-and-ml/2026/10/07/aws-launches-open-source-ai-agent-sandbox-to-prevent-yolo-mode-disasters/5301687

Outlook closes the door on risky installers https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-to-block-msix-attachments-used-in-attacks/

Arizona court breach reaches back 30 years https://therecord.media/arizona-courts-say-hackers-stole-info-on-over-1-million

Utility customers' accounts exposed https://www.securityweek.com/georgia-power-alabama-power-data-breach-hits-400000-accounts/

FortiBleed changes the locks on VPN admins https://www.bleepingcomputer.com/news/security/fbi-ongoing-fortibleed-attacks-lock-out-fortigate-vpn-admins/

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-8-2026/

Huge thanks to our sponsor, Vanta

Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Agents trying to compromise Wikipedia tools https://thehackernews.com/2026/10/wikimedia-says-openai-agents-tried-to.html

South Korea claims agents were used in bank hacks https://therecord.media/south-korean-bank-hacks-ai-agents

ASOS confirms data breach https://www.ft.com/content/eab7052d-6640-4928-a128-8df73455ba0a https://www.bleepingcomputer.com/news/security/asos-confirms-data-breach-after-hacked-in-app-notifications/

Contractor fired over FBI data breach https://www.reuters.com/technology/accenture-contractor-removed-fbi-following-damaging-data-breach-sources-say-2026-10-06/

Red Hat's Lightwell shows early returns https://www.infosecurity-magazine.com/news/red-hat-lightwell-remediates-400/

LibreOffice and OpenOffice flaw can run code with no warning https://thehackernews.com/2026/10/libreoffice-and-openoffice-flaws-let.html

Ransomware cancels classes at Japanese university https://therecord.media/osaka-university-cancels-classes-ransomware

ATM malware creator in court https://therecord.media/atm-malware-creator-appears-in-nebraska-court

OpenAI pledges disclosure changes after Australian attack https://www.abc.net.au/news/2026-10-06/openai-hearing-apology-key-takeaways/107235640

Get the show notes here: https://cisoseries.com/cybersecurity-news-agents-vs-wikipedia-south-korean-bank-hacks-asos-breached/

Huge thanks to our sponsor, Vanta

Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.