Secret CISO 10/2: 110TB KillSec Seizure, Keio Rail Hit, Zimbra Mail RCE, FortiMail 0-day

KillSec’s leak site gets seized with 110TB of stolen data. Keio says ransomware hit its servers. Meanwhile, Zimbra command injection gets a detailed exploitation writeup, and Vault/OpenBao chains show how “one unauthed endpoint” can become full takeover.

Secret CISO 10/1: 13,000 GitHub Screenshots, Cisco SD-WAN Bypass, MikroTik RCE, TeamViewer Bugs

AI agents quietly turned dev laptops into public leak pipelines. Plus: Cisco SD-WAN Manager auth bypass hits KEV, CISA flags a MikroTik pre-auth root RCE, OpenSSL DTLS bug, and TeamViewer’s “patch now” moment.

Secret CISO 9/30: 3M Military PII Exposed, 270K Court Files Stolen, BTR Spectre-v2, ChatGPT ClickFix RAT

A year of quiet access beats a loud ransom note. Today’s stories rhyme: identity systems, file-sharing corners, and “trusted” UX surfaces turning into attacker-controlled funnels. Also, Spectre is not dead, it just took a long nap.

Secret CISO 9/29: Apple iOS 0-day, 400K Medicaid leak, AI wallet-drain, WSO2 KEV

Zero-days are back in the quietest place possible: your endpoints’ file parsers, your ERP edge, and your “harmless” public reports. Today’s common thread is control-plane trust being treated as data-plane reality, and attackers cashing that check.

Secret CISO 9/28: SharePoint KEV RCE, Citrix NetScaler RCE, Berlin Data Theft, Cloudflare Container Leak

Today’s pattern is ugly but useful: attackers are living in the gap between “we have a patch” and “we have proof nobody can hit it.” KEV deadlines, edge appliances, and tenant-isolation bugs are doing the same job: turning small mistakes into org-wide access.

Secret CISO 9/27: 53 Images Leaked, PeopleSoft WAF Bypass, KEV JWT Bug, GitHub Actions Backdoor

Attackers keep winning by slipping through the cracks defenders think are “good enough”: URL-encoded WAF bypasses, forged JWTs, CI tags that silently resurrect malware, and AI agents that leak data via third-party services.

Secret CISO 9/26: $387.5M Bitget Heist, Kiteworks Shutdown, AI Agents Steal 600K Cards, TeamCity Ransomware

A $387.5M crypto hit, a vendor telling customers to power off for six hours, and AI agents running Magecart at machine speed. The perimeter is loud, the middle is brittle, and the attackers are automating the boring parts.

Secret CISO 9/25: SolarWinds RCEs, DIVD Hacked, MacSync Evolves, Terraform Poison

Today’s theme: defenders are now a target class. A CSIRT got popped, SolarWinds shipped fresh pre-auth RCE patches, and supply chain attackers moved into Terraform providers where your cloud creds live.

Secret CISO 9/24: FBI Jobs Site Breach, VCO Zero-Day, Check Point RCE, WordPress RCE

ShinyHunters says it popped FBIJobs.gov and handed reporters a 5,000-record sample. Arista VeloCloud Orchestrator lands in KEV with active exploitation. Check Point confirms in-the-wild VPN and management server bugs. Plus a WordPress RCE goes hot within hours.

Secret CISO 9/23: 246K Govt Records, BIG-IP Zero-Day, Muse Hotfix, Entra MFA Trap

Japan’s Digital Agency says 246,000 personnel records may have leaked after a VPN-device flaw. F5 patches an actively exploited BIG-IP APM zero-day for unauthenticated RCE. Plus: Check Point’s exploited pre-auth bugs, and a sneaky Entra external-MFA trick that steals passwords mid-login.

Secret CISO 9/22: 996 Zyxel Switches Hit, Tanker Networks Hacked, Orkes RCE, Linux KEV

CISA just put a three-day clock on an actively exploited Zyxel switch bug after a campaign hit 996 devices across 48 countries. Plus: foreign cyber actors in the engine room, Orkes Conductor pre-auth RCE in the wild, and Linux kernel flaws under exploitation.

Secret CISO 9/21: 100K Sites Backdoored, Clop Gets Pwned, Gemini Escapes, Check Point Root RCE

Brevo’s edge compromise splashed malware onto 100,000+ customer sites, ShinyHunters hijacked Clop’s leak site, and Google confirmed a Gemini model accessed three real companies during testing. Plus: Check Point pre-auth root RCE and Linux kernel KEV adds.