Cybersecurity Headlines

Hackers turn up the heat on French supermarkets: https://www.infosecurity-magazine.com/news/french-supermarket-chains/
Ahold Delhaize offline after cyber attack: https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhize-takes-systems-offline-after-cyberattack/
Spy chip used in crypto wallet thefts: https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/
Russian digital services disrupted from drone strike: https://therecord.media/ukraine-strikes-third-yandex-data-center
Microsoft wants AI "emergency brakes": https://www.bbc.com/news/articles/c6rmy7zmvx3lo
UK's AI Security Institute to get early model access: https://www.reuters.com/legal/litigation/us-reverses-course-britains-testing-ai-models-telegraph-says-2026-10-11/ and https://www.telegraph.co.uk/news/2026/10/11/britain-get-first-look-ai-systems-after-white-house-u-turn/
Threat actors trying to use critical SonicWall SMA flaw: https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html
Threat actors drop the mic with karaoke hack: https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/
Get the show notes here: https://cisoseries.com/cybersecurity-news-october-13-2026/ 
Huge thanks to our episode sponsor, Guardsquare

Your backend is only as secure as your frontend. Research shows that client-side compromise is now a primary driver of API risk. With sixty-three percent of leaders detecting mobile app tampering or cloning last year, don't leave your mobile app security to chance. Get multilayered protection for your entire mobile app ecosystem from the outside in. Learn more at Guardsquare.com.

CISA's KEV catalog grows by five
https://securityaffairs.com/200734/security/u-s-cisa-adds-proftpd-onlyoffice-docs-strapi-apache-struts-and-isc-bind-flaws-to-its-known-exploited-vulnerabilities-catalog.html
Calendar phishing becomes a thing
https://www.theguardian.com/money/2026/oct/11/calendar-phishing-scam-meeting-renewal-google-microsoft-paypal
Canadian cybersecurity executive arrested in FBI hack
https://www.cnn.com/2026/10/09/politics/fbi-arrest-shinyhunters-hack
Hackers abuse Google Ads, Bing redirects to deliver Claude ClickFix attacks
https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/
Biosensor firm iRhythm announces data breach numbers
https://therecord.media/irhythm-data-breach-reports
Japan confirms arrest of Russian Qilin operative
https://therecord.media/japan-germany-ransomware-arrest
Anthropic cuts live internet access for internal AI tests after exploitative behaviors
https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html
Leader of money mule operation pleads guilty
https://therecord.media/leader-of-money-mule-operation-for-cybercriminals-pleads-guilty

Get the show notes here: https://cisoseries.com/cybersecurity-news-october-12-2026/
Huge thanks to our episode sponsor, Guardsquare

Mobile app security isn't just a tech issue; it's a revenue issue. A recent global study found that seventy-two percent of organizations experienced a mobile app security incident last year. Even worse? Sixty-five percent saw customer churn or uninstalls as a result. Protect your brand and your bottom line with layered mobile app protection. Learn more at Guardsquare.com.

Read the full stories at CISOSeries.com. 
This week's Department of Know is hosted by Rich Stroffolino, with guests Derek Fisher, Director of the Cyber Defense and Information Assurance Program, Temple University, and Chris Ray, field CTO, GigaOm.
Missed the live show? Check it out on YouTube.
The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com.
Big thanks to our sponsor, Vanta! 

Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Attackers hijack three top level domains to obtain Google certificates
https://www.infosecurity-magazine.com/news/attackers-hijack-cctlds-obtain/
Major Yandex data center in Russia hit by Ukrainian drone
https://therecord.media/yandex-russia-drone-ukraine
Cisco warns of critical flaws allowing Nexus switch takeover
https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-flaws-allowing-nexus-switch-takeover/
Attackers target Atlassian vulnerability shortly after PoC publication
https://www.securityweek.com/attackers-target-critical-atlassian-vulnerability-within-hours-of-poc-publication/
Wazza Phishkit targets banking, government, and manufacturing
https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html
Shai-Hulud worm moves to AI infrastructure with Tensorlake compromise
https://www.theregister.com/security/2026/10/08/shai-hulud-worm-makes-jump-to-ai-infrastructure-with-tensorlake-compromise/5302054
Japan sees sharp rise in web data leaks
https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html
DOJ charges ransomware recovery CEO for secretly paying hackers
https://therecord.media/ransomware-recovery-charges-doj
Get the show notes here: https://cisoseries.com/cybersecurity-news-top-level-domain-theft-yandex-attacked-cisco-nexus-flaws/
Huge thanks to our sponsor, Vanta

Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.

Botnet takes orders from a poem
https://cyberscoop.com/poellm-malware-botnet-poem-lumen-black-lotus-labs/
Flock's warrantless tracking hits a roadblock
https://therecord.media/oklahoma-flock-ruing-supreme-court-chatrie-decision
npm packages come with unwanted extras
https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html
AWS gives AI agents a sandbox with house rules
https://www.theregister.com/ai-and-ml/2026/10/07/aws-launches-open-source-ai-agent-sandbox-to-prevent-yolo-mode-disasters/5301687
Outlook closes the door on risky installers
https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-to-block-msix-attachments-used-in-attacks/
Arizona court breach reaches back 30 years
https://therecord.media/arizona-courts-say-hackers-stole-info-on-over-1-million
Utility customers' accounts exposed
https://www.securityweek.com/georgia-power-alabama-power-data-breach-hits-400000-accounts/
FortiBleed changes the locks on VPN admins
https://www.bleepingcomputer.com/news/security/fbi-ongoing-fortibleed-attacks-lock-out-fortigate-vpn-admins/
Get the show notes here: https://cisoseries.com/cybersecurity-news-october-8-2026/
Huge thanks to our sponsor, Vanta

Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.