Cybersecurity Headlines

Osad

• 
  The Department of Know: NCSC's AI "inconvenient truth," automated payment skimming, CISA's CVE plan 25.09.2026 34min

  Read all the stories at CISOSeries.com. This week's Department of Know is hosted by Rich Stroffolino, with guests Dmitriy Sokolovskiy, senior vice president, information security, Semrush, and Christian Frösch, CISO, CH Media. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, Nudge Security. Nudge Security now includes AI Agent Discovery, in addition to Day One discovery of every other AI and SaaS app. For each agent, you'll see who created it, what it's connected to, and risks like destructive permissions. And, smart automation helps you engage the right person to fix the risk.
• 
  OpenAI hacks Australia health, Astrana Health breached, TeamCity flaw exploited 25.09.2026 7min

  OpenAI program hacks Australia's government health portal Astrana Health suffers data breach Ransomware gangs exploiting TeamCity flaw Get the show notes here: https://cisoseries.com/cybersecurity-news-september-25-2026/ Huge thanks to our episode sponsor, Nudge Security Here's a question that might make you sweat…how many AI agents are running in your org right now? Not sure? You're not alone. But, we have good news. Nudge Security now includes AI Agent Discovery, in addition to Day One discovery of every other AI and SaaS app. For each agent, you'll see who built it, what it's connected to, and risks like destructive permissions. And, Nudge gives you smart automation to engage the right person to fix the risk. No chasing people down for answers. Give it a try for free at nudgesecurity.com/cisoseries
• 
  ShinyHunters peeks at FBI assignments, WordPress flaw wastes no time, Pentagon's cyber appetite grows 24.09.2026 7min

  ShinyHunters peeks at FBI assignments WordPress flaw wastes no time Pentagon's cyber appetite grows Get the show notes here: https://cisoseries.com/cybersecurity-news-september-24-2026/ Huge thanks to our episode sponsor, Nudge Security Here's a question that might make you sweat…how many AI agents are running in your org right now? Not sure? You're not alone. But, we have good news. Nudge Security now includes AI Agent Discovery, in addition to Day One discovery of every other AI and SaaS app. For each agent, you'll see who built it, what it's connected to, and risks like destructive permissions. And, Nudge gives you smart automation to engage the right person to fix the risk. No chasing people down for answers. Give it a try for free at nudgesecurity.com/cisoseries
• 
  CAIRN framework, Muse zero-day, BigDiskBuster 23.09.2026 6min

  Cisco releases open-source CAIRN framework Muse zero-day opens the door to account takeovers Microsoft can't wake up from Nightmare Eclipse Get the show notes here: https://cisoseries.com/cybersecurity-news-cairn-framework-muse-zero-day-bigdiskbuster/  Huge thanks to our episode sponsor, Nudge Security Here's a question that might make you sweat…how many AI agents are running in your org right now? Not sure? You're not alone. But, we have good news. Nudge Security now includes AI Agent Discovery, in addition to Day One discovery of every other AI and SaaS app. For each agent, you'll see who built it, what it's connected to, and risks like destructive permissions. And, Nudge gives you smart automation to engage the right person to fix the risk. No chasing people down for answers. Give it a try for free at nudgesecurity.com/cisoseries
• 
  ShinyHunters hijacks Clop, fake LastPass kills security tools, trusted npm release carries malware 22.09.2026 7min

  ShinyHunters hijacks Clop's own leak site Fake LastPass installers kill security tools Trusted npm release carries GHAPPIER malware Huge thanks to our episode sponsor, Nudge Security Here's a question that might make you sweat…how many AI agents are running in your org right now? Not sure? You're not alone. But, we have good news. Nudge Security now includes AI Agent Discovery, in addition to Day One discovery of every other AI and SaaS app. For each agent, you'll see who built it, what it's connected to, and risks like destructive permissions. And, Nudge gives you smart automation to engage the right person to fix the risk. No chasing people down for answers. Give it a try for free at nudgesecurity.com/cisoseries Get the show notes here: https://cisoseries.com/cybersecurity-news-september-22-2026/
• 
  OpenAI Codex sandbox escape, President proposes AI Force, Cyber Command suicides 21.09.2026 8min

  Researchers escape OpenAI Codex sandbox to run commands on host AI Force proposed to monitor technology Congress eyes new support for Cyber Command after recent suicide deaths Get the show notes here: https://cisoseries.com/cybersecurity-news-openai-codex-sandbox-escape-president-proposes-ai-force-cyber-command-suicides/ Huge thanks to our episode sponsor, Nudge Security Here's a question that might make you sweat…how many AI agents are running in your org right now? Not sure? You're not alone. But, we have good news. Nudge Security now includes AI Agent Discovery, in addition to Day One discovery of every other AI and SaaS app. For each agent, you'll see who built it, what it's connected to, and risks like destructive permissions. And, Nudge gives you smart automation to engage the right person to fix the risk. No chasing people down for answers. Give it a try for free at nudgesecurity.com/cisoseries
• 
  The Department of Know: Passkeys phished, Cisco hits root, nuclear red lines for AI 18.09.2026 34min

  Read the full stories at CISOSeries.com. This week's Department of Know is hosted by Sarah Lane, with guests Jason Thomas, senior director of technology security, governance, and risk at the Cystic Fibrosis Foundation, and Jay Wilson, CISO and CIO at Insurity. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.
• 
  Nuclear-style AI safeguards, AI legislation shelved, CISA's decoy guidance 18.09.2026 7min

  Nuclear-style safeguards proposed for AI risks Key lawmaker suggests action on AI safety legislation will wait until 2027 CISA releases cyber decoy guidance for infrastructure defenses Get the show notes here: https://cisoseries.com/cybersecurity-news-september-18-2026/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.
• 
  Flock gets plucked, OpenAI agents arrived even earlier, inside China's AI spy shop 17.09.2026 6min

  Flock gets plucked OpenAI agents arrived early China's AI spy shop Get the show notes here: https://cisoseries.com/cybersecurity-news-september-17-2026/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.
• 
  Cisco zero-day goes straight to root, BambooToken branches into Linux, CenterPoint breach claim hits 7M+ 16.09.2026 7min

  Cisco zero-day goes straight to root BambooToken branches into Linux CenterPoint breach claim hits 7M+ Get the show notes here: https://cisoseries.com/cybersecurity-news-september-16-2026/ Huge thanks to our episode sponsor, Vanta Risk and regulation are ramping up, and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure and keeps your deals moving. Learn more at vanta.com/ciso.
• 
  China hits fast-forward on AI security, Hacking Cat shows its claws, Vite servers spill cloud secrets 15.09.2026 9min

  China hits fast-forward on AI security Hacking Cat shows its claws Vite servers spill cloud secrets Get the show notes here: https://cisoseries.com/cybersecurity-news-september-15-2026/ Huge thanks to our episode sponsor, Vanta Risk and regulation are ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.
• 
  Passkey phishing attack, Anthropic's blockbuster report, airline cybersecurity loophole 14.09.2026 7min

  Attackers use passkey phishing to hijack Microsoft cloud accounts Anthropic blockbuster report reveals sophisticated hacks Airlines compliance with new cybersecurity regulations means fewer passenger conveniences Get the show notes here: https://cisoseries.com/cybersecurity-news-september-14-2026/ Huge thanks to our episode sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso.
• 
  The Department of Know: Liquid drained, CISA urges change, agentic whistleblowers 11.09.2026 33min

  Read the full stories at CISOSeries.com This week's Department of Know is hosted by Rich Stroffolino, with guests Alexandra Landegger, global head of cyber strategy & transformation, RTX, Mark Eggleston, CISO-at-large. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. Big thanks to our sponsor, ThreatLocker This week, we looked at how AI is making attacks faster, less predictable, and easier to execute. But an AI-generated attack still needs permission to run, access data, use trusted applications, and move through the environment. ThreatLocker helps organizations control those actions before they become incidents. Book a demo at threatlocker.com/ciso.
• 
  NetScaler vulnerability exploited, AdaptHealth suffers breach, new Android malware 11.09.2026 7min

  Critical NetScaler vulnerability exploited in attacks AdaptHealth data breach impacts 4.1 million people MantaxOtax Android malware delivers ransomware and spyware together Get the show notes here: https://cisoseries.com/cybersecurity-news-netscaler-vulnerability-exploited-adapthealth-suffers-breach-new-android-malware/ Huge thanks to our episode sponsor, ThreatLocker AI risk does not only come from attackers. Employees are adopting AI tools faster than many organizations can evaluate them. Today's tip: an AI policy should be backed by enforceable controls over what tools can access and do. See how ThreatLocker can help you govern AI use at threatlocker.com/ciso.
• 
  Fortinet auth holes, China distills AI, Mythos vulnerability 10.09.2026 7min

  Fortinet plugs two critical auth holes US says China is distilling AI at scale Mythos vulnerability hits human bottleneck Get the show notes here: https://cisoseries.com/cybersecurity-news-september-10-2026/ Huge thanks to our episode sponsor, ThreatLocker AI is compressing the timeline between initial access and impact. That leaves security teams less time to identify, investigate, and contain malicious activity. Faster response helps, but prevention can remove actions from the attack chain entirely. Give your responders a more controlled environment. Book a ThreatLocker demo at threatlocker.com/ciso.
• 
  Florida DMV breach, zero-click WeChat worm, AI whistleblowers 09.09.2026 7min

  ShinyHunters claimed it breached Florida DMV Zero-click WeChat worm spreads over incoming calls AI cheaters and whistleblowers emerge Get the show notes here: https://cisoseries.com/cybersecurity-news-florida-dmv-breach-zero-click-wechat-worm-ai-whistleblowers/  Huge thanks to our episode sponsor, ThreatLocker Attackers do not always bring their own tools. AI can help them find ways to misuse software already trusted by the organization. Today's tip: approval should not mean unlimited access. Define what trusted applications can reach and what they can do. Learn how ThreatLocker applies this principle at threatlocker.com/ciso today.
• 
  PEEP browser backdoors, $320M Liquid exploit, BigBear beats MFA 08.09.2026 8min

  PEEP turns browsers into backdoors Liquid loses $320M, hackers play hero BigBear claws past MFA Get the full show notes here: https://cisoseries.com/cybersecurity-news-september-8-2026/ Huge thanks to our episode sponsor, ThreatLocker An attacker uses AI to create a payload your security tools have never seen. Detection now has to recognize it before the payload can act. ThreatLocker approaches the problem earlier by controlling whether that code is permitted to run at all. Explore a deny by default approach for your organization at threatlocker.com/ciso.
• 
  MikroTik routers hijacked, Russian data center threats, UK cybercrime losses surge 07.09.2026 7min

  MikroTik routers hijacked through internet-exposed SSH Russian data centers face new security requirements UK account-hack losses surge thanks to new reporting system Get the show notes here: https://cisoseries.com/cybersecurity-news-mikrotik-routers-hijacked-russian-data-center-threats-uk-cybercrime-losses-surge/ Huge thanks to our episode sponsor, ThreatLocker AI is helping attackers research targets, create malicious code, and adapt faster. But the fundamentals have not changed. Code still needs to execute, applications still need access, and attackers still need privileges. Today's tip: control those actions instead of trying to predict every threat. Learn more from ThreatLocker at threatlocker.com/ciso.
• 
  The Department of Know: Astra launches, CISA cuts programs, McKesson breached 04.09.2026 34min

  Read the full stories at CISOSeries.com This week's Department of Know is hosted by Rich Stroffolino, with guests Montez Fitzpatrick, director, information security, global head of cybersecurity, Energizer Holdings, and Jonathan Waldrop, CISO, Acoustic. Missed the live show? Check it out on YouTube. The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com. A huge thanks to our sponsor, KnowBe4 Your employees have always been the target, but the threats they face are evolving. AI empowers cybercriminals to clone a coworker's voice, fake a video call with your CEO, or personalize a phishing email using details scraped from your own website. KnowBe4's AI-native Security Awareness Training (SAT) fights back with 12 autonomous defense agents that allow you to deliver personalized, relevant, and engaging training that adapts as fast as the threats your people face every day. More than 70,000 organizations trust KnowBe4 worldwide. Find out why at KnowBe4.com.  
• 
  Court records breach, Breeze Comet hits Brazil, Aesto records breach 04.09.2026 8min

  U.S. and Canadian court records breached in Thomson Reuters incident Cybercrime Breeze Comet causing problems in Brazil Aesto record system hit by data breach Get the full show notes here: https://cisoseries.com/cybersecurity-news-court-records-breach-breeze-comet-hits-brazil-aesto-records-breach/ Huge thanks to our episode sponsor, KnowBe4 Your employees have always been the target, but the threats they face are evolving. AI empowers cybercriminals to clone a coworker's voice, fake a video call with your CEO, or personalize a phishing email using details scraped from your own website. KnowBe4's AI-native Security Awareness Training (SAT) fights back with 12 autonomous defense agents that allow you to deliver personalized, relevant, and engaging training that adapts as fast as the threats your people face every day. More than 70,000 organizations trust KnowBe4 worldwide. Find out why at KnowBe4.com.