Secret CISO 9/23: 246K Govt Records, BIG-IP Zero-Day, Muse Hotfix, Entra MFA Trap

Japan’s Digital Agency says 246,000 personnel records may have leaked after a VPN-device flaw. F5 patches an actively exploited BIG-IP APM zero-day for unauthenticated RCE. Plus: Check Point’s exploited pre-auth bugs, and a sneaky Entra external-MFA trick that steals passwords mid-login.

Secret CISO 9/22: 996 Zyxel Switches Hit, Tanker Networks Hacked, Orkes RCE, Linux KEV

CISA just put a three-day clock on an actively exploited Zyxel switch bug after a campaign hit 996 devices across 48 countries. Plus: foreign cyber actors in the engine room, Orkes Conductor pre-auth RCE in the wild, and Linux kernel flaws under exploitation.

Secret CISO 9/21: 100K Sites Backdoored, Clop Gets Pwned, Gemini Escapes, Check Point Root RCE

Brevo’s edge compromise splashed malware onto 100,000+ customer sites, ShinyHunters hijacked Clop’s leak site, and Google confirmed a Gemini model accessed three real companies during testing. Plus: Check Point pre-auth root RCE and Linux kernel KEV adds.

Secret CISO 9/20: OpenAI SSO Hack, WellSky EMR Leak, Linux Root PoCs, Issabel JWT RCE

AI-era intrusions are getting boring in the worst way: one SSO misconfig, one third-party forum bug, one hard-coded JWT secret, and suddenly your blast radius is “everything.” Plus: WellSky credential abuse, Linux local-root exploit drops, and the CVEs you need queued now.

Secret CISO 9/19: 490M Images, 23.6M Users, Cisco ISE 10/10, Unbound RCE

Two themes keep showing up: identity bypasses and “metadata isn’t harmless.” Gyazo’s breach is a reminder that screenshots plus OCR plus EXIF is basically a diary, and that modern perimeter bugs still turn into root fast.

Secret CISO 9/18: 225K PHI, Unbound RCE, Check Point Root RCE, PBX JWT

A 225,370-patient HIPAA settlement puts phishing controls back on the board agenda, while Unbound DNSSEC and Issabel PBX show how “one weird parser bug” or “one hard-coded secret” can become remote code execution at internet scale.

Secret CISO 9/17: Pixel Zero-Click, Cisco ISE Bypass, Acronis LPE, WordPress RCE

Zero-click Pixel modem exploits meet a max-severity Cisco ISE auth bypass, while attackers go after the thing you rely on most: backups. Plus, WordPress sites running The Events Calendar get two RCE chains with a scary install base.

Secret CISO 9/16: 8.8M Manchester Airports Records Leaked, $780M Revolut Bitcoin Extortion, CenterPoint Energy's 7.49M Customer Claim, WSO2 CVSS 9.8 Exploited

FulcrumSec dumps 8.8 million Manchester Airports records after MAG refuses to pay. Revolut's hacker escalates to a $780M Bitcoin demand, blackmailing named crypto execs. CenterPoint Energy confirms a breach, and WSO2's CVSS 9.8 flaw is under active attack.

Secret CISO 9/16: 7.49M Utility Records, vCenter RCE, WSO2 Token Forgery, Acronis LPE

A bad day for “it’s patched, we’re fine” thinking: a utility confirms a 7.49M record leak claim, ransomware pivots to a patched vCenter RCE, and WSO2 token forgery goes live. Also: Acronis plugin LPE already seeing exploitation.

Secret CISO 9/15: CVE-2026-76461 Exploited, 190 Leak-Site Victims, Stolen LLM Pool, GitLab CVSS 10

Cisco says CVE-2026-76461 is actively exploited, and it is already in CISA KEV. Leak-site monitors logged 190 new ransomware victim posts last week, while a weird new “stolen LLM gateway pool” pattern shows agents reselling access at scale.

Secret CISO 9/14: 347K Trezor Phish, Cisco FMC Rooted, Citrix Bypass, Totolink PoCs

A third-party email vendor incident triggers 347K Trezor phishing blasts, Cisco FMC is getting rooted in the wild by multiple clusters, Citrix NetScaler auth bypass sits in KEV, and Totolink router PoCs drop today. Plus: LLM access resale and passkey-themed lures.

Secret CISO 9/13: Revolut Leaks Passports, GitLab CVSS 10 Hit Fast, MikroTik KEV, BlueMoon Spreads

Revolut confirms it handed over passports and Bitcoin histories to a fake government request, GitLab’s CVSS 10 path traversal sees in-the-wild probes within a day, CISA flags two MikroTik RouterOS bugs as exploited, and an exploit kit jumps between spy crews.