153M licenses for sale, Anthropic reverses course, Astra enters the red zone
Cybersecurity HeadlinesShow Notes
Dark web shop stocks 153 million driver's licenses Nexus, a new dark web service, claims it's selling scans of more than 153 million US and Canadian driver's licenses, plus over 10 million ID cards, three million travel and international IDs, and at least 579,000 medical cards. The images appear tied to Louisiana-based IDScan.net, which provides identity verification to retailers, rental-car companies, and others. KrebsOnSecurity matched some records to licenses scanned during Hertz rentals. IDScan says it's investigating and hasn't determined the breach's nature or scope. The FBI's New Orleans office has opened an inquiry. (KrebsOnSecurity) Anthropic puts 30-day data retention in reverse After customer pushback, Anthropic is revising a policy that stored 30 days of traffic from its Fable and Mythos models. Under new Enterprise Frontier Safeguards, customers can keep data in their own cloud and block Anthropic employees from reviewing it while automated abuse monitoring continues. Anthropic calls that privacy equivalent to zero data retention. Developed with more than 100 customers, including Salesforce, the system is due later this year. (CNBC) Astra enters OpenAI's cyber red zone OpenAI says Astra is its first model to reach a "Critical" cybersecurity threshold, meaning it can find unknown flaws and build exploits across well-defended systems without step-by-step human help. It's due soon, but the advanced cyber capabilities will start with a small test group before expanding through Daybreak Blue. OpenAI says Astra refused 91.5% of cyber jailbreak requests, versus 59% for GPT-5.6 Sol, and monitoring can pause suspicious activity. The Information reports Astra's latent reasoning may hide parts of its process, raising doubts about chain-of-thought monitoring. (WIRED, The Information) Get the full show notes here: https://cisoseries.com/153m-licenses-for-sale-anthropic-reverses-course-astra-red-zone/ Huge thanks to our episode sponsor, KnowBe4 Your employees have always been the target, but the threats they face are evolving. AI empowers cybercriminals to clone a coworker's voice, fake a video call with your CEO, or personalize a phishing email using details scraped from your own website. KnowBe4's AI-native Security Awareness Training (SAT) fights back with 12 autonomous defense agents that allow you to deliver personalized, relevant, and engaging training that adapts as fast as the threats your people face every day. More than 70,000 organizations trust KnowBe4 worldwide. Find out why at KnowBe4.com.
More from Cybersecurity Headlines
Read the full stories at CISOSeries.com. This week's Department of Know is hosted by Rich Stroffolino, with guests Gary Chan, CISO, SSM Health, and Doug Mayer, CISO, RXSense. Also check out Gary's work at Security Mentalist. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, ThreatLocker!
Railway says intruder may have accessed customer secrets https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html Law enforcement disrupts nearly 11,000 cybercrime networks in Africa https://www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/ ConnectWise breach let Chinese AI spies move in on cloud tenants https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687 GitLab warns of new maximum severity code execution vulnerability https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/ Hundreds of websites taken offline due to PHP vulnerabilities (continuing coverage) https://therecord.media/php-script-vulnerabilities-warnings https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/ Splunk, SolarWinds release fresh security updates https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/ Lazarus hackers use post-quantum cryptography for malware delivery https://www.bleepingcomputer.com/news/security/chrome-switching-to-nist-approved-ml-kem-quantum-encryption/ South Carolina officials offer assistance after state capital hit with cyberattack https://therecord.media/south-carolina-officials-offer-assistance-cyber-incident Get the show notes here: https://cisoseries.com/cybersecurity-news-october-23-2026/ Huge thanks to our episode sponsor, ThreatLocker
PHP rushes out emergency fixes for PHP2Shell https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/ https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ Compromised certificates trigger internet cleanup https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/ Signal calls could stay live after you hang up https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528 OpenAI agents disable safeguards during coding tasks https://www.theverge.com/ai-artificial-intelligence/1015316/openai-ai-agent-disabling-monitoring-systems Plex2Shell attacks hit media servers https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/ Poisoned LiteLLM update steals secrets & adds a backdoor https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548 Meta faces a big Cambridge Analytica penalty https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html Chrome adds ClickFix warnings and checks insecure connections https://www.securityweek.com/google-hardens-chrome-against-clickfix-attacks-insecure-http-connections/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-22-2026/ Huge thanks to our episode sponsor, ThreatLocker
Russian-linked attacks hit naval shipbuilder https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html
OpenCode breach exposes users' AI keys https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/ One hacker puts AI agents to work on 1,200 sites https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/ Rank Math PRO updates deliver a persistent backdoor https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html Nikkei discloses its third breach in a month https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/ Microsoft adds controls for rogue AI agents https://www.geekwire.com/2026/microsoft-unveils-tools-to-monitor-and-corral-rogue-ai-agents/ ClickFix attackers borrow Siemens' signature https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/ Pegasus targets Serbian government critics before elections https://therecord.media/serbia-spyware-pegasus-elections Bullhorn takes staffing platform offline after attack https://www.bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack/ Get the show notes here: https://cisoseries.com/cybersecurity-news-october-20-2026/ Huge thanks to our episode sponsor, ThreatLocker