Show Notes
FBI shuts down North Korean laptop farms https://www.bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested/ Meta's stolen credentials open GitHub repositories https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/ Cisco email gateways face active attacks https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html Ledger tells Asian sellers to stop sales https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/ CISA urges Ivanti VPN updates https://www.securitymagazine.com/articles/102655-newly-exploited-vulnerability-in-ivanti-connect-secure Microsoft's patch count breaks the annual record https://cyberscoop.com/microsoft-patch-tuesday-october-2026/ Six days, three Chrome bugs, one sandbox escape https://www.theregister.com/security/2026/10/14/security-researchers-spent-6-days-doing-their-chromework-built-1b-user-exploit/5303134 Windows gets its Always On VPN back https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-vpn-issues-caused-by-september-windows-updates/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-15-2026/ Huge thanks to our episode sponsor, Guardsquare
AI is speeding up development, but at what cost? While ninety-six percent of teams now use AI tools, eighty-one percent report that AI-generated code has introduced new vulnerabilities into their mobile apps. In a world with automated threats, you need multi-layered, polymorphic security to stay ahead of the curve. Learn more at Guardsquare.com.
More from Cybersecurity Headlines
Read the full stories at CISOSeries.com. This week's Department of Know is hosted by Rich Stroffolino, with guests Gary Chan, CISO, SSM Health, and Doug Mayer, CISO, RXSense. Also check out Gary's work at Security Mentalist. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, ThreatLocker!
Railway says intruder may have accessed customer secrets https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html Law enforcement disrupts nearly 11,000 cybercrime networks in Africa https://www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/ ConnectWise breach let Chinese AI spies move in on cloud tenants https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687 GitLab warns of new maximum severity code execution vulnerability https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/ Hundreds of websites taken offline due to PHP vulnerabilities (continuing coverage) https://therecord.media/php-script-vulnerabilities-warnings https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/ Splunk, SolarWinds release fresh security updates https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/ Lazarus hackers use post-quantum cryptography for malware delivery https://www.bleepingcomputer.com/news/security/chrome-switching-to-nist-approved-ml-kem-quantum-encryption/ South Carolina officials offer assistance after state capital hit with cyberattack https://therecord.media/south-carolina-officials-offer-assistance-cyber-incident Get the show notes here: https://cisoseries.com/cybersecurity-news-october-23-2026/ Huge thanks to our episode sponsor, ThreatLocker
PHP rushes out emergency fixes for PHP2Shell https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/ https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ Compromised certificates trigger internet cleanup https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/ Signal calls could stay live after you hang up https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528 OpenAI agents disable safeguards during coding tasks https://www.theverge.com/ai-artificial-intelligence/1015316/openai-ai-agent-disabling-monitoring-systems Plex2Shell attacks hit media servers https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/ Poisoned LiteLLM update steals secrets & adds a backdoor https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548 Meta faces a big Cambridge Analytica penalty https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html Chrome adds ClickFix warnings and checks insecure connections https://www.securityweek.com/google-hardens-chrome-against-clickfix-attacks-insecure-http-connections/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-22-2026/ Huge thanks to our episode sponsor, ThreatLocker
Russian-linked attacks hit naval shipbuilder https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html
OpenCode breach exposes users' AI keys https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/ One hacker puts AI agents to work on 1,200 sites https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/ Rank Math PRO updates deliver a persistent backdoor https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html Nikkei discloses its third breach in a month https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/ Microsoft adds controls for rogue AI agents https://www.geekwire.com/2026/microsoft-unveils-tools-to-monitor-and-corral-rogue-ai-agents/ ClickFix attackers borrow Siemens' signature https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/ Pegasus targets Serbian government critics before elections https://therecord.media/serbia-spyware-pegasus-elections Bullhorn takes staffing platform offline after attack https://www.bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-20-2026/ Huge thanks to our episode sponsor, ThreatLocker