Cybersecurity Headlines

HTTP2Shell sparks emergency patches
https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/
PHP2Shell: patch, then investigate
https://www.securitymagazine.com/articles/102693-php2shell-exploited-in-the-wild
GitHub worm hides in oversized files
https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570
Cathedral gets inside Anthropic
https://www.washingtonpost.com/technology/2026/10/26/researchers-cybersecurity-start-up-cathedral-got-inside-anthropic/?pwapi_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZWFzb24iOiJnaWZ0IiwibmJmIjoxNzkyOTg3MjAwLCJpc3MiOiJzdWJzY3JpcHRpb25zIiwiZXhwIjoxNzk0MzczMTk5LCJpYXQiOjE3OTI5ODcyMDAsImp0aSI6ImI1M2RjZmEzLThkNTItNGE3NC05ZjI4LWU1ZGJkZTIyZDFmOSIsInVybCI6Imh0dHBzOi8vd3d3Lndhc2hpbmd0b25wb3N0LmNvbS90ZWNobm9sb2d5LzIwMjYvMTAvMjYvcmVzZWFyY2hlcnMtY3liZXJzZWN1cml0eS1zdGFydC11cC1jYXRoZWRyYWwtZ290LWluc2lkZS1hbnRocm9waWMvIn0.k3b70wv6ePisrPvCYfDOPAjt5vHweVxm4rBnhcnDU-M
Ukraine's satellite service returns
https://therecord.media/ukraine-disputes-musk-claims-of-starlink-misuse
Gheist raids GitHub secrets
https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets
Fake Teams support delivers ransomware
https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html
Scam laundering suspect extradited
https://therecord.media/dutch-police-extradite-chinese-national-money-laundering-scams
Get the show notes here:
https://cisoseries.com/cybersecurity-news-october-27-2026/
Huge thanks to our sponsor, Guardsquare

Your backend is only as secure as your frontend. Research shows that client-side compromise is now a primary driver of API risk. With sixty-three percent of leaders detecting mobile app tampering or cloning last year, don't leave your mobile app security to chance. Get multilayered protection for your entire mobile app ecosystem from the outside in. Learn more at Guardsquare.com.

Microsoft Teams to get AI-powered, context-aware phishing detection
https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection/
Quest Diagnostics confirms data breach including exposed patient records
https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/
Senators say targeted ads are a security risk. Ad groups disagree
https://cyberscoop.com/targeted-ads-spyware-government-threat/
Bipartisan bill urges federal guidance for distillation attacks
https://cyberscoop.com/bipartisan-bill-combat-ai-distillation-attacks-nist/
CISA adds Collabora Online and Arista VeloCloud flaws to KEV
https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
Autonomous attack agent in Skynet mode hijacks other AI models
https://www.theregister.com/security/2026/10/24/autonomous-attack-agent-in-skynet-mode-hijacks-other-models-to-carry-out-its-evil-deeds/5305215
Researchers find a third PHP2Shell bug
https://www.theregister.com/security/2026/10/23/theres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix/5305208
Data breach takes a bite out of crime stoppers organization
https://therecord.media/toronto-crime-tips-org-freezes-ops-after-breach
Get the shownotes here: https://cisoseries.com/cybersecurity-news-ai-powered-phishing-detection-third-php2shell-bug-quest-medical-breach/

Mobile app security isn't just a tech issue; it's a revenue issue. A recent global study found that seventy-two percent of organizations experienced a mobile app security incident last year. Even worse? Sixty-five percent saw customer churn or uninstalls as a result. Protect your brand and your bottom line with layered mobile app protection. Learn more at Guardsquare.com.

Read the full stories at CISOSeries.com.
This week's Department of Know is hosted by Rich Stroffolino, with guests Gary Chan, CISO, SSM Health, and Doug Mayer, CISO, RXSense.
Also check out Gary's work at Security Mentalist.
Missed the live show? Check it out on YouTube.
The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com.
Big thanks to our sponsor, ThreatLocker!

An AI-generated attack may be new, but it still needs to execute, access
data, and move through your environment. ThreatLocker applies enforceable controls at
each of those points, limiting what attackers can do regardless of how their code was
created. Book a demo at threatlocker.com/ciso.

Railway says intruder may have accessed customer secrets
https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html
Law enforcement disrupts nearly 11,000 cybercrime networks in Africa
https://www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/
ConnectWise breach let Chinese AI spies move in on cloud tenants
https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687
GitLab warns of new maximum severity code execution vulnerability
https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/
Hundreds of websites taken offline due to PHP vulnerabilities (continuing coverage)
https://therecord.media/php-script-vulnerabilities-warnings
https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/
Splunk, SolarWinds release fresh security updates
https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/
Lazarus hackers use post-quantum cryptography for malware delivery
https://www.bleepingcomputer.com/news/security/chrome-switching-to-nist-approved-ml-kem-quantum-encryption/
South Carolina officials offer assistance after state capital hit with cyberattack
https://therecord.media/south-carolina-officials-offer-assistance-cyber-incident
Get the show notes here: https://cisoseries.com/cybersecurity-news-october-23-2026/
Huge thanks to our episode sponsor, ThreatLocker

AI risk does not only come from attackers. Employees are adopting AI tools faster than many organizations can evaluate them. Today's tip: an AI policy should be backed by enforceable controls over what tools can access and do. See how ThreatLocker can help you govern AI use at threatlocker.com/ciso.

PHP rushes out emergency fixes for PHP2Shell
https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
Compromised certificates trigger internet cleanup
https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
Signal calls could stay live after you hang up
https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528
OpenAI agents disable safeguards during coding tasks
https://www.theverge.com/ai-artificial-intelligence/1015316/openai-ai-agent-disabling-monitoring-systems
Plex2Shell attacks hit media servers
https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/
Poisoned LiteLLM update steals secrets & adds a backdoor
https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548
Meta faces a big Cambridge Analytica penalty
https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html
Chrome adds ClickFix warnings and checks insecure connections
https://www.securityweek.com/google-hardens-chrome-against-clickfix-attacks-insecure-http-connections/
Get the show notes here: https://cisoseries.com/cybersecurity-news-october-22-2026/
Huge thanks to our episode sponsor, ThreatLocker

AI is compressing the timeline between initial access and impact. That leaves security teams less time to identify, investigate, and contain malicious activity. Faster response helps, but prevention can remove actions from the attack chain entirely. Give your responders a more controlled environment. Book a ThreatLocker demo at threatlocker.com/ciso.