Cybersecurity Headlines

Read the full stories at CISOSeries.com.  This week's Department of Know is hosted by Rich Stroffolino, with guests Jason Elrod, CISO, MultiCare Health System, and DJ Schleen, head of infrastructure and security, Boats Group. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, GuardSquare Guardsquare delivers mobile app security without compromise, providing advanced protections for both Android and iOS apps. From app security testing to code hardening to real-time visibility into the threat landscape, Guardsquare solutions provide enhanced mobile application security from early in the development process through publication. Learn more about how to protect your app at Guardsquare.com.

French energy company ENGIE suffers data breach https://securityaffairs.com/201985/data-breach/engie-data-breach-exposes-customer-details-and-energy-contracts.html NIST publishes guidance to meet federal post-quantum deadlines https://www.infosecurity-magazine.com/news/nist-guidance-post-quantum/ MR ROBOT Malware-as-a-Service targets Indian bank customers https://www.infosecurity-magazine.com/news/robot-malware-indian-bank-customers/ Hackers exploit Cisco SD-WAN flaw to install encryption key stealing malware https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html Japan Airlines warns of data breach https://therecord.media/japan-airlines-warns-of-breach-country-grapples-with-incidents GitHub launches npm firewall to block malicious packages before installation https://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.html Pentagon treating military base freezer malfunctions as suspected cyberattack https://www.reuters.com/technology/pentagon-treating-military-base-freezer-malfunctions-suspected-cyberattack-2026-10-29/  Get more info here: https://cisoseries.com/cybersecurity-news-french-energy-breach-pentagon-freezer-hack-japan-airlines-breach/ Attackers are treating your mobile app like an open book. Sixty-three percent of security leaders recently detected app tampering, cloning, or unauthorized modifications. When your code runs in an untrusted environment, you need runtime self-protection and code hardening to keep attackers out. Address tampering before it starts. Learn more at Guardsquare.com.

OpenAI opens an election war room https://www.politico.com/news/2026/10/28/openai-election-war-room-interference-01137690 Hack attempt disrupts FEC disclosures https://www.reuters.com/technology/hacker-trying-breach-us-federal-election-commission-system-email-shows-2026-10-27/ Google gives cyber defenders first access to Carbon https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/ Attackers probe newly patched Oracle flaw https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html Volt Typhoon's Silent Train network exposed https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html Entra admins face authentication deadline https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys/ Belarusian hackers move closer to Russia and Ukraine https://therecord.media/belarus-russia-hackers-ukraine-war Software inventory can't tell the whole story https://www.darkreading.com/cyber-risk/sboms-alone-scope-supply-chain-attack Get the show notes here: https://cisoseries.com/cybersecurity-news-october-29-2026/ Huge thanks to our sponsor, Guardsquare AI is speeding up development, but at what cost? While 96% of teams now use AI tools, 81% report that AI-generated code has introduced new vulnerabilities into their mobile apps. In a world with automated threats, you need multi-layered, polymorphic security to stay ahead of the curve. Learn more at Guardsquare.com.

Authenticator flaw exposes work accounts https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html Tailworm flaws put Tailscale SSH at risk https://www.securityweek.com/tailscale-rushes-patches-after-uncoordinated-disclosure-of-tailworm-flaws/ UK police suppliers repeatedly breached https://therecord.media/uk-police-data-breached-from-suppliers-watchdog-report Rural hospitals get a cyber lifeline https://cyberscoop.com/oncd-rural-hospital-cybersecurity-pilot-project-lifeline-250/ Cyberattack disrupts UNM health services https://www.theregister.com/cyber-crime/2026/10/27/day-2-of-canceled-classes-at-university-of-new-mexico-after-health-sciences-center-cyberattack/5305690 Warp breach exposes AI agent logs https://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data/ Malware hides from online store scanners https://www.infosecurity-magazine.com/news/hackers-infect-953-online-stores/ Apple patches exploited flaw on older devices https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html Get the show notes here: https://cisoseries.com/cybersecurity-news-october-28-2026/ Huge thanks to our sponsor, Guardsquare Is your mobile app truly protected? Relying on the OS isn't enough. A global study of thirteen-hundred security and developer leaders found that ninety-six percent of teams using layered protection reported significantly fewer security incidents. Don't wait for a breach to harden your defenses. Get the protection needed for modern security risks. Learn more at Guardsquare.com.

HTTP2Shell sparks emergency patches https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/ PHP2Shell: patch, then investigate https://www.securitymagazine.com/articles/102693-php2shell-exploited-in-the-wild GitHub worm hides in oversized files https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570 Cathedral gets inside Anthropic https://www.washingtonpost.com/technology/2026/10/26/researchers-cybersecurity-start-up-cathedral-got-inside-anthropic/?pwapi_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZWFzb24iOiJnaWZ0IiwibmJmIjoxNzkyOTg3MjAwLCJpc3MiOiJzdWJzY3JpcHRpb25zIiwiZXhwIjoxNzk0MzczMTk5LCJpYXQiOjE3OTI5ODcyMDAsImp0aSI6ImI1M2RjZmEzLThkNTItNGE3NC05ZjI4LWU1ZGJkZTIyZDFmOSIsInVybCI6Imh0dHBzOi8vd3d3Lndhc2hpbmd0b25wb3N0LmNvbS90ZWNobm9sb2d5LzIwMjYvMTAvMjYvcmVzZWFyY2hlcnMtY3liZXJzZWN1cml0eS1zdGFydC11cC1jYXRoZWRyYWwtZ290LWluc2lkZS1hbnRocm9waWMvIn0.k3b70wv6ePisrPvCYfDOPAjt5vHweVxm4rBnhcnDU-M Ukraine's satellite service returns https://therecord.media/ukraine-disputes-musk-claims-of-starlink-misuse Gheist raids GitHub secrets https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets Fake Teams support delivers ransomware https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html Scam laundering suspect extradited https://therecord.media/dutch-police-extradite-chinese-national-money-laundering-scams Get the show notes here: https://cisoseries.com/cybersecurity-news-october-27-2026/ Huge thanks to our sponsor, Guardsquare Your backend is only as secure as your frontend. Research shows that client-side compromise is now a primary driver of API risk. With sixty-three percent of leaders detecting mobile app tampering or cloning last year, don't leave your mobile app security to chance. Get multilayered protection for your entire mobile app ecosystem from the outside in. Learn more at Guardsquare.com.