Cybersecurity Headlines

Russian-linked attacks hit naval shipbuilder
https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html 

Muse exposes secrets when sharing chats
https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/ 

Army Cyber Command looking to offload attacks to AI
https://web.archive.org/web/20261020134149/https://theintercept.com/2026/10/19/army-autonomous-ai-agents-arcyber/ 

DeepSeek booted from federal agencies 
https://www.wsj.com/tech/ai/dhs-orders-deepseek-technology-removed-from-federal-civilian-it-systems-060b6d3d?st=m6DV2n 

DHS asked CISA to hack voting machine
https://www.propublica.org/article/cisa-election-security-donald-trump 
EU doesn't require patching hacked freezers
https://therecord.media/eu-cyber-law-wont-force-fixes-for-fridges-in-french-attack 

Cairn platform abused by threat actors
Security Week: https://www.securityweek.com/ai-platform-cairn-abused-to-hack-over-100-organizations/ 
Reuters: https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/ 

Palo Alto still seeing active PAN-OS exploits
https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html 

LLMs getting better at COBOL
https://openai.com/index/low-resource-programming-languages/ 
Get the show notes here: https://cisoseries.com/naval-hack-muse-exposes-secrets-army-researching-offensive-ai-hacking/ 
Huge thanks to our episode sponsor, ThreatLocker

Attackers do not always bring their own tools. AI can help them find ways to misuse software already trusted by the organization. Today's tip: approval should not mean unlimited access. Define what trusted applications can reach and what they can do. Learn how ThreatLocker applies this principle at threatlocker.com/ciso today.

OpenCode breach exposes users' AI keys
https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/
One hacker puts AI agents to work on 1,200 sites
https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/
Rank Math PRO updates deliver a persistent backdoor
https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html
Nikkei discloses its third breach in a month
https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/
Microsoft adds controls for rogue AI agents
https://www.geekwire.com/2026/microsoft-unveils-tools-to-monitor-and-corral-rogue-ai-agents/
ClickFix attackers borrow Siemens' signature
https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/
Pegasus targets Serbian government critics before elections
https://therecord.media/serbia-spyware-pegasus-elections
Bullhorn takes staffing platform offline after attack
https://www.bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack/
Get the show notes here: https://cisoseries.com/cybersecurity-news-october-20-2026/
Huge thanks to our episode sponsor, ThreatLocker

An attacker uses AI to create a payload your security tools have never seen. Detection now has to recognize it before the payload can act. ThreatLocker approaches the problem earlier by controlling whether that code is permitted to run at all. Explore a deny by default approach for your organization at threatlocker.com/ciso.

Cybersecurity jobs report reveals mixed bag
https://www.securityweek.com/us-cybersecurity-job-postings-fall-26-as-ai-security-engineer-demand-soars/
https://cybersn.com/resources/reports/cybersecurity-jobs-report
ConnectWise Suspends cloud backup after supply chain attack
https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html
Drupal patches critical RCE flaws, warns of exploits
https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/
Chinese espionage attackers suspected of BeyondTrust zero-day
https://therecord.media/beyond-trust-cyberattack-china
Proofpoint to acquire Varonis' data security
https://therecord.media/proofpoint-varonis-cybersecurity-acquisition
Burger King Japan data breach exposes 11 million customer records
https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/
BAE Systems cyberattack disrupts US federal court operations
https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/
CikaBika Bot RAT abuses Discord
https://www.securityweek.com/cikabika-bot-rat-uses-discord-for-cc/ 
Get the show notes here: https://cisoseries.com/cybersecurity-news-october-19-2026/
Huge thanks to our episode sponsor, ThreatLocker

AI is helping attackers research targets, create malicious code, and adapt faster. But the fundamentals have not changed. Code still needs to execute, applications still need access, and attackers still need privileges. Today's tip: control those actions instead of trying to predict every threat. Learn more from ThreatLocker at threatlocker.com/ciso.

See the full stories at cisoseries.com
This week's Department of Know is hosted by Rich Stroffolino, with guests Dennis Pickett, vp and CISO, RTI International, and David Cross, CISO, Atlassian.
Missed the live show? Check it out on YouTube.
The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com.
Huge thanks to our sponsor, Guardsquare
Mobile security incidents are no longer the exception—they are the norm. Last year, seventy-two percent of companies suffered a mobile app security incident. As the primary gateway to your APIs and data, your mobile app requires more than just basic encryption; it needs a multi-layered security strategy. Protect your brand and your bottom line with layered mobile app protection. Learn more at Guardsquare.com.

CenterPoint Energy reveals data breach numbers
https://www.securitymagazine.com/articles/102658-1m-impacted-by-centerpoint-energy-data-breach
Zero-Click Candiru spyware infections at Al Jazeera tracked to targeted online ads
https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html
UK Legal Aid Agency Hack Scope Widens After Forensic Review
https://www.securityweek.com/uk-legal-aid-agency-hack-scope-widens-after-forensic-review/
Bank of America needed 1,000 contractors to patch bugs found by Mythos
https://www.theregister.com/security/2026/10/15/bank-of-america-had-to-bring-in-1000-contractors-to-patch-all-the-bugs-mythos-identified/5303275
Microsoft takes down 3 major China-based phishing platforms
https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms
Windows Server 2022 reaches end of mainstream support
https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2022-reached-end-of-mainstream-support/
Senators press for AI safety and security
https://cyberscoop.com/congress-presses-trump-administration-ai-safety-cybersecurity/
French supermarket refrigeration attack widens
https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/
Get the show notes here: https://cisoseries.com/cybersecurity-news-october-16-2026/
Huge thanks to our episode sponsor, Guardsquare

Attackers are treating your mobile app like an open book. Sixty-three percent of security leaders recently detected app tampering, cloning, or unauthorized modifications. When your code runs in an untrusted environment, you need runtime self-protection and code hardening to keep attackers out. Address tampering before it starts. Learn more at Guardsquare.com.