Cybersecurity Headlines

Railway says intruder may have accessed customer secrets
https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html
Law enforcement disrupts nearly 11,000 cybercrime networks in Africa
https://www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/
ConnectWise breach let Chinese AI spies move in on cloud tenants
https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687
GitLab warns of new maximum severity code execution vulnerability
https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/
Hundreds of websites taken offline due to PHP vulnerabilities (continuing coverage)
https://therecord.media/php-script-vulnerabilities-warnings
https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/
Splunk, SolarWinds release fresh security updates
https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/
Lazarus hackers use post-quantum cryptography for malware delivery
https://www.bleepingcomputer.com/news/security/chrome-switching-to-nist-approved-ml-kem-quantum-encryption/
South Carolina officials offer assistance after state capital hit with cyberattack
https://therecord.media/south-carolina-officials-offer-assistance-cyber-incident
Get the show notes here: https://cisoseries.com/cybersecurity-news-october-23-2026/
Huge thanks to our episode sponsor, ThreatLocker

AI risk does not only come from attackers. Employees are adopting AI tools faster than many organizations can evaluate them. Today's tip: an AI policy should be backed by enforceable controls over what tools can access and do. See how ThreatLocker can help you govern AI use at threatlocker.com/ciso.

PHP rushes out emergency fixes for PHP2Shell
https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
Compromised certificates trigger internet cleanup
https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
Signal calls could stay live after you hang up
https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528
OpenAI agents disable safeguards during coding tasks
https://www.theverge.com/ai-artificial-intelligence/1015316/openai-ai-agent-disabling-monitoring-systems
Plex2Shell attacks hit media servers
https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/
Poisoned LiteLLM update steals secrets & adds a backdoor
https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548
Meta faces a big Cambridge Analytica penalty
https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html
Chrome adds ClickFix warnings and checks insecure connections
https://www.securityweek.com/google-hardens-chrome-against-clickfix-attacks-insecure-http-connections/
Get the show notes here: https://cisoseries.com/cybersecurity-news-october-22-2026/
Huge thanks to our episode sponsor, ThreatLocker

AI is compressing the timeline between initial access and impact. That leaves security teams less time to identify, investigate, and contain malicious activity. Faster response helps, but prevention can remove actions from the attack chain entirely. Give your responders a more controlled environment. Book a ThreatLocker demo at threatlocker.com/ciso.

Russian-linked attacks hit naval shipbuilder
https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html 

Muse exposes secrets when sharing chats
https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/ 

Army Cyber Command looking to offload attacks to AI
https://web.archive.org/web/20261020134149/https://theintercept.com/2026/10/19/army-autonomous-ai-agents-arcyber/ 

DeepSeek booted from federal agencies 
https://www.wsj.com/tech/ai/dhs-orders-deepseek-technology-removed-from-federal-civilian-it-systems-060b6d3d?st=m6DV2n 

DHS asked CISA to hack voting machine
https://www.propublica.org/article/cisa-election-security-donald-trump 
EU doesn't require patching hacked freezers
https://therecord.media/eu-cyber-law-wont-force-fixes-for-fridges-in-french-attack 

Cairn platform abused by threat actors
Security Week: https://www.securityweek.com/ai-platform-cairn-abused-to-hack-over-100-organizations/ 
Reuters: https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/ 

Palo Alto still seeing active PAN-OS exploits
https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html 

LLMs getting better at COBOL
https://openai.com/index/low-resource-programming-languages/ 
Get the show notes here: https://cisoseries.com/naval-hack-muse-exposes-secrets-army-researching-offensive-ai-hacking/ 
Huge thanks to our episode sponsor, ThreatLocker

Attackers do not always bring their own tools. AI can help them find ways to misuse software already trusted by the organization. Today's tip: approval should not mean unlimited access. Define what trusted applications can reach and what they can do. Learn how ThreatLocker applies this principle at threatlocker.com/ciso today.

OpenCode breach exposes users' AI keys
https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/
One hacker puts AI agents to work on 1,200 sites
https://www.reuters.com/legal/government/how-one-hacker-used-ai-agents-few-thousand-dollars-break-into-scores-sites-2026-10-19/
Rank Math PRO updates deliver a persistent backdoor
https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html
Nikkei discloses its third breach in a month
https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/
Microsoft adds controls for rogue AI agents
https://www.geekwire.com/2026/microsoft-unveils-tools-to-monitor-and-corral-rogue-ai-agents/
ClickFix attackers borrow Siemens' signature
https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/
Pegasus targets Serbian government critics before elections
https://therecord.media/serbia-spyware-pegasus-elections
Bullhorn takes staffing platform offline after attack
https://www.bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack/
Get the show notes here: https://cisoseries.com/cybersecurity-news-october-20-2026/
Huge thanks to our episode sponsor, ThreatLocker

An attacker uses AI to create a payload your security tools have never seen. Detection now has to recognize it before the payload can act. ThreatLocker approaches the problem earlier by controlling whether that code is permitted to run at all. Explore a deny by default approach for your organization at threatlocker.com/ciso.

Cybersecurity jobs report reveals mixed bag
https://www.securityweek.com/us-cybersecurity-job-postings-fall-26-as-ai-security-engineer-demand-soars/
https://cybersn.com/resources/reports/cybersecurity-jobs-report
ConnectWise Suspends cloud backup after supply chain attack
https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html
Drupal patches critical RCE flaws, warns of exploits
https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/
Chinese espionage attackers suspected of BeyondTrust zero-day
https://therecord.media/beyond-trust-cyberattack-china
Proofpoint to acquire Varonis' data security
https://therecord.media/proofpoint-varonis-cybersecurity-acquisition
Burger King Japan data breach exposes 11 million customer records
https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/
BAE Systems cyberattack disrupts US federal court operations
https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/
CikaBika Bot RAT abuses Discord
https://www.securityweek.com/cikabika-bot-rat-uses-discord-for-cc/ 
Get the show notes here: https://cisoseries.com/cybersecurity-news-october-19-2026/
Huge thanks to our episode sponsor, ThreatLocker

AI is helping attackers research targets, create malicious code, and adapt faster. But the fundamentals have not changed. Code still needs to execute, applications still need access, and attackers still need privileges. Today's tip: control those actions instead of trying to predict every threat. Learn more from ThreatLocker at threatlocker.com/ciso.