FBI Warns Staff Assume ShinyHunters Stole Everyone's Data; Clop Dismisses Rival Hack; Kiteworks Restores Service Cybersecurity Today host David Shipley reports the FBI has told employees to assume ShinyHunters accessed the personal information of every FBI employee after the fbijobs.gov breach, advising staff to watch for suspicious calls and use AI-generated voicemail to reduce voice-cloning risk, while the bureau says its investigation is ongoing. ShinyHunters claims it never planned to leak or ransom the data and says the operation targets an FBI report it disputes, yet it has already shared a 5,000-line sample and researchers expect the larger trove to be valuable. Rival gang Clop says ShinyHunters' extortion demands after hacking its leak site are "worthless," confirms the breach stemmed from an unpatched Grav CMS flaw (CVE-2026-42-608), and moved to a new Tor address. The episode also covers Dutch police arresting an alleged ShinyHunters leader as sources suggest a new leader, and Kiteworks bringing services back online after patching a critical bug and finding no compromise. 00:00 FBI Breach Fallout 01:21 Protecting Agents From Scams 02:31 ShinyHunters Walkback 03:36 Data Sample Spreads 05:20 Clop Versus ShinyHunters 06:55 Grav CMS Vulnerability 07:53 Dutch Arrest And New Boss 10:48 FBI Cyber Division Warning 11:56 Kiteworks Back Online 13:33 Wrap Up And Sign Off

FBI Warns Staff Assume ShinyHunters Stole Everyone's Data; Clop Dismisses Rival Hack; Kiteworks Restores Service Cybersecurity Today host David Shipley reports the FBI has told employees to assume ShinyHunters accessed the personal information of every FBI employee after the fbijobs.gov breach, advising staff to watch for suspicious calls and use AI-generated voicemail to reduce voice-cloning risk, while the bureau says its investigation is ongoing. ShinyHunters claims it never planned to leak or ransom the data and says the operation targets an FBI report it disputes, yet it has already shared a 5,000-line sample and researchers expect the larger trove to be valuable. Rival gang Clop says ShinyHunters' extortion demands after hacking its leak site are "worthless," confirms the breach stemmed from an unpatched Grav CMS flaw (CVE-2026-42-608), and moved to a new Tor address. The episode also covers Dutch police arresting an alleged ShinyHunters leader as sources suggest a new leader, and Kiteworks bringing services back online after patching a critical bug and finding no compromise. 00:00 FBI Breach Fallout 01:21 Protecting Agents From Scams 02:31 ShinyHunters Walkback 03:36 Data Sample Spreads 05:20 Clop Versus ShinyHunters 06:55 Grav CMS Vulnerability 07:53 Dutch Arrest And New Boss 10:48 FBI Cyber Division Warning 11:56 Kiteworks Back Online 13:33 Wrap Up And Sign Off

ShinyHunters Leader Busted

Brotli Emergency Patches, PHP-to-Shell Exploited, and Australia Disrupts 180K Amadey Infections | Cybersecurity Today On Cybersecurity Today (Oct. 28, 2026), Microsoft issues out-of-band .NET updates for a critical flaw in Google's Brotli library (CVE-2026-111497) that can enable remote privilege escalation and potentially remote code execution, with proof-of-concept exploits public and widespread exposure across ecosystems. The episode also covers CISA confirming active exploitation of two "PHP to Shell" vulnerabilities (CVE-2026-109618/109619), with federal agencies facing an urgent patch deadline and broad impact across millions of PHP services and many vendors. In legal news, U.S. prosecutors allege Canadian ransomware negotiator Eduard Dubrovsky secretly worked for threat actors. South Korean police say a former penetration tester used the Artex AI framework to breach 90+ organizations and steal 8.2 million records. Finally, Australia's Signals Directorate disrupts an Amadey botnet, cutting off 180,000 infected computers and destroying stolen data offered for sale. 00:00 Top Stories Rundown 00:32 Brotli Bug Emergency Patches 02:36 AI Noise in Vulnerability Hype 03:41 PHP to Shell Exploited Now 06:10 Ransomware Negotiator Accused 07:41 Artex AI Hacking Spree 10:04 Australia Disrupts Amadey Botnet 11:32 Wrap Up and Sign Off

Brotli Emergency Patches, PHP-to-Shell Exploited, and Australia Disrupts 180K Amadey Infections | Cybersecurity Today On Cybersecurity Today (Oct. 28, 2026), Microsoft issues out-of-band .NET updates for a critical flaw in Google's Brotli library (CVE-2026-111497) that can enable remote privilege escalation and potentially remote code execution, with proof-of-concept exploits public and widespread exposure across ecosystems. The episode also covers CISA confirming active exploitation of two "PHP to Shell" vulnerabilities (CVE-2026-109618/109619), with federal agencies facing an urgent patch deadline and broad impact across millions of PHP services and many vendors. In legal news, U.S. prosecutors allege Canadian ransomware negotiator Eduard Dubrovsky secretly worked for threat actors. South Korean police say a former penetration tester used the Artex AI framework to breach 90+ organizations and steal 8.2 million records. Finally, Australia's Signals Directorate disrupts an Amadey botnet, cutting off 180,000 infected computers and destroying stolen data offered for sale. 00:00 Top Stories Rundown 00:32 Brotli Bug Emergency Patches 02:36 AI Noise in Vulnerability Hype 03:41 PHP to Shell Exploited Now 06:10 Ransomware Negotiator Accused 07:41 Artex AI Hacking Spree 10:04 Australia Disrupts Amadey Botnet 11:32 Wrap Up and Sign Off

Microsoft Rushes out Fixes for .NET

PHP2Shell Hits European Government, New PHP RCE (No Patch Yet), Brotli "Node to Shell," and Capcom Breach Attackers exploited the PHP2Shell remote code execution flaws to compromise a European government entity within two hours, stealing password hashes and MFA secrets, pivoting via NTLM relay toward Active Directory, and showing command output patterns Unit 42 says suggest an agentic AI attacker. Widespread scanning continues, with Cloudflare logging millions of attempts, Cyfirma reporting low-and-slow probing from nodes linked with moderate confidence to the Lazarus ecosystem, and defenders urged to watch for telltale crash sequences. PHP also disclosed a third RCE (CVE-2026-115560) with no patch yet but high exploitation requirements and a mitigation to disable session upload progress. Separately, a Brotli decoder memory corruption bug (CVE-2026-111497) affects Node.js and other software, with fixes delayed into October releases. Finally, Capcom says criminals breached Capcom ID, exposing data tied to 11.7 million accounts and resetting impacted passwords. 00:00 Headlines Overview 00:35 Government Breach Details 01:13 Global Scanning Surge 03:11 Third PHP RCE 05:00 Wildfire Or Smoke 06:08 Patch Race Warning 06:53 Brotli Node To Shell 08:47 Capcom Account Breach 10:21 Wrap Up And Outro

PHP2Shell Hits European Government, New PHP RCE (No Patch Yet), Brotli "Node to Shell," and Capcom Breach Attackers exploited the PHP2Shell remote code execution flaws to compromise a European government entity within two hours, stealing password hashes and MFA secrets, pivoting via NTLM relay toward Active Directory, and showing command output patterns Unit 42 says suggest an agentic AI attacker. Widespread scanning continues, with Cloudflare logging millions of attempts, Cyfirma reporting low-and-slow probing from nodes linked with moderate confidence to the Lazarus ecosystem, and defenders urged to watch for telltale crash sequences. PHP also disclosed a third RCE (CVE-2026-115560) with no patch yet but high exploitation requirements and a mitigation to disable session upload progress. Separately, a Brotli decoder memory corruption bug (CVE-2026-111497) affects Node.js and other software, with fixes delayed into October releases. Finally, Capcom says criminals breached Capcom ID, exposing data tied to 11.7 million accounts and resetting impacted passwords. 00:00 Headlines Overview 00:35 Government Breach Details 01:13 Global Scanning Surge 03:11 Third PHP RCE 05:00 Wildfire Or Smoke 06:08 Patch Race Warning 06:53 Brotli Node To Shell 08:47 Capcom Account Breach 10:21 Wrap Up And Outro

AI-assisted attackers breach European government via PHP2Shell

PHP Exploited Before Patch, Unpatched Linux SMB Bugs, GitLab Max-Severity Fix, and AI Agents in ConnectWise & Japan Breaches Cybersecurity Today (Oct. 23, 2026) covers active exploitation of two critical PHP RCE flaws beginning at least four days before patches shipped, with multiple firms seeing failed pre-disclosure attempts and the UK NCSC urging immediate patching or taking servers offline. It also details two publicly disclosed, unpatched Linux kernel ksmbd SMB RCE bugs (one unauthenticated on port 445), exposed after ZDI credited Trend Micro's AI scanner and copied public mailing lists without patches. GitLab issued fixes for a maximum-severity unauthenticated RCE (CVE-2026-11-0264) in its regex compiler, following recent high-severity GitLab issues. Microsoft attributed the ConnectWise cloud backup compromise to China-aligned Storm-0940 using the Artex agentic AI framework, and Artex-related activity was also found in attacks on Japanese companies amid a broader breach wave, including a malware incident affecting up to 26,739 Haname Desktopcloud customer servers. 00:00 Headlines And Intro 00:33 PHP To Shell Exploitation 02:07 Patch Now Impact Scope 02:47 Linux KSMBD Bugs Exposed 04:10 AI Disclosure Process Drama 05:25 GitLab Max Severity Patch 07:30 ConnectWise Breach AI Agents 09:24 Artex Spreads In Japan 11:18 GMO Haname VPS Malware 12:24 Closing And Sign Off

PHP Exploited Before Patch, Unpatched Linux SMB Bugs, GitLab Max-Severity Fix, and AI Agents in ConnectWise & Japan Breaches Cybersecurity Today (Oct. 23, 2026) covers active exploitation of two critical PHP RCE flaws beginning at least four days before patches shipped, with multiple firms seeing failed pre-disclosure attempts and the UK NCSC urging immediate patching or taking servers offline. It also details two publicly disclosed, unpatched Linux kernel ksmbd SMB RCE bugs (one unauthenticated on port 445), exposed after ZDI credited Trend Micro's AI scanner and copied public mailing lists without patches. GitLab issued fixes for a maximum-severity unauthenticated RCE (CVE-2026-11-0264) in its regex compiler, following recent high-severity GitLab issues. Microsoft attributed the ConnectWise cloud backup compromise to China-aligned Storm-0940 using the Artex agentic AI framework, and Artex-related activity was also found in attacks on Japanese companies amid a broader breach wave, including a malware incident affecting up to 26,739 Haname Desktopcloud customer servers. 00:00 Headlines And Intro 00:33 PHP To Shell Exploitation 02:07 Patch Now Impact Scope 02:47 Linux KSMBD Bugs Exposed 04:10 AI Disclosure Process Drama 05:25 GitLab Max Severity Patch 07:30 ConnectWise Breach AI Agents 09:24 Artex Spreads In Japan 11:18 GMO Haname VPS Malware 12:24 Closing And Sign Off

PHP Exploited Before Patch, Unpatched Linux SMB Bugs, GitLab Max-Severity Fix, and AI Agents in ConnectWise &amp; Japan Breaches Cybersecurity Today (Oct. 23, 2026) covers active exploitation of two critical PHP RCE flaws beginning at least four days before patches shipped, with multiple firms seeing failed pre-disclosure attempts and the UK NCSC urging immediate patching or taking servers offline. It also details two publicly disclosed, unpatched Linux kernel ksmbd SMB RCE bugs (one unauthenticated on port 445), exposed after ZDI credited Trend Micro's AI scanner and copied public mailing lists without patches. GitLab issued fixes for a maximum-severity unauthenticated RCE (CVE-2026-11-0264) in its regex compiler, following recent high-severity GitLab issues. Microsoft attributed the ConnectWise cloud backup compromise to China-aligned Storm-0940 using the Artex agentic AI framework, and Artex-related activity was also found in attacks on Japanese companies amid a broader breach wave, including a malware incident affecting up to 26,739 Haname Desktopcloud customer servers. 00:00 Headlines And Intro 00:33 PHP To Shell Exploitation 02:07 Patch Now Impact Scope 02:47 Linux KSMBD Bugs Exposed 04:10 AI Disclosure Process Drama 05:25 GitLab Max Severity Patch 07:30 ConnectWise Breach AI Agents 09:24 Artex Spreads In Japan 11:18 GMO Haname VPS Malware 12:24 Closing And Sign Off

AI agents behind ConnectWise breach, PHP2Shell exploited days before patches, Japanese cloud hack

Microsoft 365 Supply-Chain Break-Ins via ConnectWise, US Bankruptcy Notices Down, Phishing Market Takedown, BeyondTrust Zero-Day, Japan Cyber Emergency Cybersecurity Today Host David Shipley covers multiple incidents: ConnectWise shut down its cloud backup service after an attacker stole the app credential and used its broad Microsoft 365 permissions to access at least 173 customer tenants in a supply-chain attack, with guidance to disable affected apps and review service principal sign-ins. A cyberattack on BAE Systems knocked out the U.S. federal Bankruptcy Noticing Center, halting all bankruptcy notices with no restoration timeline. Microsoft and Health ISAC seized domains of three Chinese-language phishing marketplaces tied to over a billion malicious messages and disabled thousands of related accounts. Forescout detailed Romulus, a ClickFix-based malware delivery platform serving LegionLoader and other payloads. Google/Mandiant reported Armory Castle exploiting a BeyondTrust Remote Support zero-day (CVE-2026-102764). Japan declared its first-ever cybersecurity state of emergency after a breach and cascading ransomware impacts. 00:00 Top Stories Preview 00:34 ConnectWise Backup Breach 02:54 Bankruptcy Courts Outage 04:37 Phishing Markets Takedown 06:28 Romulus Malware Platform 08:54 BeyondTrust Zero Day 11:28 Japan Cyber Emergency 13:06 Wrap Up and Sign Off

Microsoft 365 Supply-Chain Break-Ins via ConnectWise, US Bankruptcy Notices Down, Phishing Market Takedown, BeyondTrust Zero-Day, Japan Cyber Emergency Cybersecurity Today Host David Shipley covers multiple incidents: ConnectWise shut down its cloud backup service after an attacker stole the app credential and used its broad Microsoft 365 permissions to access at least 173 customer tenants in a supply-chain attack, with guidance to disable affected apps and review service principal sign-ins. A cyberattack on BAE Systems knocked out the U.S. federal Bankruptcy Noticing Center, halting all bankruptcy notices with no restoration timeline. Microsoft and Health ISAC seized domains of three Chinese-language phishing marketplaces tied to over a billion malicious messages and disabled thousands of related accounts. Forescout detailed Romulus, a ClickFix-based malware delivery platform serving LegionLoader and other payloads. Google/Mandiant reported Armory Castle exploiting a BeyondTrust Remote Support zero-day (CVE-2026-102764). Japan declared its first-ever cybersecurity state of emergency after a breach and cascading ransomware impacts. 00:00 Top Stories Preview 00:34 ConnectWise Backup Breach 02:54 Bankruptcy Courts Outage 04:37 Phishing Markets Takedown 06:28 Romulus Malware Platform 08:54 BeyondTrust Zero Day 11:28 Japan Cyber Emergency 13:06 Wrap Up and Sign Off

ConnectWise backup app breaches 173 Microsoft tenants, Chinese spies exploit BeyondTrust zero-day, Japan declares first cyber state of emergency

July 30, 2018 - Samsung’s IoT hub hacked; 10 years of automotive data compromised; Why Twitter won’t let you call yourself ‘Elon Musk’

July 27, 2018 - Privacy tips for the connected home

July 26, 2018 - Tips for safely disposing of devices

Monday, July 23 - Tips for protecting mobile devices

Welcome to Cyber Security Today. It’s Friday, July 20th. I’m Howard Solomon.

Friday, July 20 - Google Help forums can be scammed, beware of that robot vacuum cleaner and are you sure that’s a bug?

July 18, 2018 - Cyber Security Today: No shortage of ransomware, toughen those passwords

A phishing scam that really leaves you feeling exposed, why you should lock down your remote desktop connections, and your smartphone isn't spying on you the way you think it is.

A phishing scam that really leaves you feeling exposed, why you should lock down your remote desktop connections, and your smartphone isn't spying on you the way you think it is.

Jyly 16, 2018 - Sextortion, close off remote computer access and watch those mobile apps

July 13, 2018 - Don’t bet on World Cup, don’t get boxed in and more Spectre bugs found

July 11, 2018 -  Another cryptocurrency wallet theft, more on password security and why you shouldn’t contribute to a privacy breach

Welcome to Cyber Security Today. It’s Monday July 9th. I’m Howard Solomon.

I mentioned earlier this week that criminals are finding ways to hide cryptomining software on computers. Kaspersky just detailed an even craftier scheme – malware that makes a choice of what to put on a victim’s PC.

Welcome to Cyber Security Today. It’s Monday July 9th. I’m Howard Solomon. I mentioned earlier this week that criminals are finding ways to hide cryptomining software on computers. Kaspersky just detailed an even craftier scheme – malware that makes a choice of what to put on a victim’s PC.

July 9, 2018 - Malware has two weapons, another macro attack and more Android security patches

Updates on the latest cybersecurity threats to businesses, data breach disclosures, and how you can secure your firm in an increasingly risky time.

Share Cybersecurity Today

Sign up to save your podcasts

Cybersecurity Today

Cybersecurity Today episodes

About Cybersecurity Today

Best of Cybersecurity Today

More shows like Cybersecurity Today

Hacked

Security Now (Audio)

Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec

Risky Business

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

CyberWire Daily

Smashing Security

Click Here

Darknet Diaries

Hacking Humans

CISO Series Podcast

Defense in Depth

Cybersecurity Headlines

Risky Bulletin

Hacker And The Fed