Cybersecurity Headlines

OpenAI opens an election war room
https://www.politico.com/news/2026/10/28/openai-election-war-room-interference-01137690
Hack attempt disrupts FEC disclosures
https://www.reuters.com/technology/hacker-trying-breach-us-federal-election-commission-system-email-shows-2026-10-27/
Google gives cyber defenders first access to Carbon
https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
Attackers probe newly patched Oracle flaw
https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html
Volt Typhoon's Silent Train network exposed
https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html
Entra admins face authentication deadline
https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys/
Belarusian hackers move closer to Russia and Ukraine
https://therecord.media/belarus-russia-hackers-ukraine-war
Software inventory can't tell the whole story
https://www.darkreading.com/cyber-risk/sboms-alone-scope-supply-chain-attack
Get the show notes here:
https://cisoseries.com/cybersecurity-news-october-29-2026/
Huge thanks to our sponsor, Guardsquare

AI is speeding up development, but at what cost? While 96% of teams now use AI tools, 81% report that AI-generated code has introduced new vulnerabilities into their mobile apps. In a world with automated threats, you need multi-layered, polymorphic security to stay ahead of the curve. Learn more at Guardsquare.com.

Authenticator flaw exposes work accounts
https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html
Tailworm flaws put Tailscale SSH at risk
https://www.securityweek.com/tailscale-rushes-patches-after-uncoordinated-disclosure-of-tailworm-flaws/
UK police suppliers repeatedly breached
https://therecord.media/uk-police-data-breached-from-suppliers-watchdog-report
Rural hospitals get a cyber lifeline
https://cyberscoop.com/oncd-rural-hospital-cybersecurity-pilot-project-lifeline-250/
Cyberattack disrupts UNM health services
https://www.theregister.com/cyber-crime/2026/10/27/day-2-of-canceled-classes-at-university-of-new-mexico-after-health-sciences-center-cyberattack/5305690
Warp breach exposes AI agent logs
https://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data/
Malware hides from online store scanners
https://www.infosecurity-magazine.com/news/hackers-infect-953-online-stores/
Apple patches exploited flaw on older devices
https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html
Get the show notes here:
https://cisoseries.com/cybersecurity-news-october-28-2026/
Huge thanks to our sponsor, Guardsquare

Is your mobile app truly protected? Relying on the OS isn't enough. A global study of thirteen-hundred security and developer leaders found that ninety-six percent of teams using layered protection reported significantly fewer security incidents. Don't wait for a breach to harden your defenses. Get the protection needed for modern security risks. Learn more at Guardsquare.com.

HTTP2Shell sparks emergency patches
https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/
PHP2Shell: patch, then investigate
https://www.securitymagazine.com/articles/102693-php2shell-exploited-in-the-wild
GitHub worm hides in oversized files
https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570
Cathedral gets inside Anthropic
https://www.washingtonpost.com/technology/2026/10/26/researchers-cybersecurity-start-up-cathedral-got-inside-anthropic/?pwapi_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZWFzb24iOiJnaWZ0IiwibmJmIjoxNzkyOTg3MjAwLCJpc3MiOiJzdWJzY3JpcHRpb25zIiwiZXhwIjoxNzk0MzczMTk5LCJpYXQiOjE3OTI5ODcyMDAsImp0aSI6ImI1M2RjZmEzLThkNTItNGE3NC05ZjI4LWU1ZGJkZTIyZDFmOSIsInVybCI6Imh0dHBzOi8vd3d3Lndhc2hpbmd0b25wb3N0LmNvbS90ZWNobm9sb2d5LzIwMjYvMTAvMjYvcmVzZWFyY2hlcnMtY3liZXJzZWN1cml0eS1zdGFydC11cC1jYXRoZWRyYWwtZ290LWluc2lkZS1hbnRocm9waWMvIn0.k3b70wv6ePisrPvCYfDOPAjt5vHweVxm4rBnhcnDU-M
Ukraine's satellite service returns
https://therecord.media/ukraine-disputes-musk-claims-of-starlink-misuse
Gheist raids GitHub secrets
https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets
Fake Teams support delivers ransomware
https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html
Scam laundering suspect extradited
https://therecord.media/dutch-police-extradite-chinese-national-money-laundering-scams
Get the show notes here:
https://cisoseries.com/cybersecurity-news-october-27-2026/
Huge thanks to our sponsor, Guardsquare

Your backend is only as secure as your frontend. Research shows that client-side compromise is now a primary driver of API risk. With sixty-three percent of leaders detecting mobile app tampering or cloning last year, don't leave your mobile app security to chance. Get multilayered protection for your entire mobile app ecosystem from the outside in. Learn more at Guardsquare.com.

Microsoft Teams to get AI-powered, context-aware phishing detection
https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection/
Quest Diagnostics confirms data breach including exposed patient records
https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/
Senators say targeted ads are a security risk. Ad groups disagree
https://cyberscoop.com/targeted-ads-spyware-government-threat/
Bipartisan bill urges federal guidance for distillation attacks
https://cyberscoop.com/bipartisan-bill-combat-ai-distillation-attacks-nist/
CISA adds Collabora Online and Arista VeloCloud flaws to KEV
https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
Autonomous attack agent in Skynet mode hijacks other AI models
https://www.theregister.com/security/2026/10/24/autonomous-attack-agent-in-skynet-mode-hijacks-other-models-to-carry-out-its-evil-deeds/5305215
Researchers find a third PHP2Shell bug
https://www.theregister.com/security/2026/10/23/theres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix/5305208
Data breach takes a bite out of crime stoppers organization
https://therecord.media/toronto-crime-tips-org-freezes-ops-after-breach
Get the shownotes here: https://cisoseries.com/cybersecurity-news-ai-powered-phishing-detection-third-php2shell-bug-quest-medical-breach/

Mobile app security isn't just a tech issue; it's a revenue issue. A recent global study found that seventy-two percent of organizations experienced a mobile app security incident last year. Even worse? Sixty-five percent saw customer churn or uninstalls as a result. Protect your brand and your bottom line with layered mobile app protection. Learn more at Guardsquare.com.

Read the full stories at CISOSeries.com.
This week's Department of Know is hosted by Rich Stroffolino, with guests Gary Chan, CISO, SSM Health, and Doug Mayer, CISO, RXSense.
Also check out Gary's work at Security Mentalist.
Missed the live show? Check it out on YouTube.
The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com.
Big thanks to our sponsor, ThreatLocker!

An AI-generated attack may be new, but it still needs to execute, access
data, and move through your environment. ThreatLocker applies enforceable controls at
each of those points, limiting what attackers can do regardless of how their code was
created. Book a demo at threatlocker.com/ciso.