Secret CISO 10/29: 2.6M Sony ISP Records, Volt Typhoon Relays, Virtualine Seized, Node2Shell Exploited

Japan’s Sony Network Communications says 2.6M customer records were exposed. Volt Typhoon’s “Silent Train” shows how relay chains + zero-days hide operator hands. Plus: bulletproof hoster Virtualine seized, and CISA flags Node2Shell exploitation.

Secret CISO 10/28: 36,000 UNM Systems, 400K Bank Records, Genesys CRM, PHP Upload CVE

UNM Health diverted ambulances during a cyber event while a ransomware group claimed 36,000 systems. A Japanese survey site warns ~400K records including bank details may be exposed. Genesys confirms internal LMS/CRM access. Plus: Brotli decoder RCE fallout and a new PHP upload-progress CVE.

Secret CISO 10/27: 27K Servers Hit, 3,897 Bank PII, WordPress Master Keys, AI Agents Tricked

Today’s theme: trust gets you owned. A Japanese VPS provider shut down after malware landed on up to 26,739 customer servers, SBI confirmed 3,897 leaked customer records, UpdraftCentral keys got abused to backdoor WordPress sites, and AI coding agents got steered by a file dropped into Downloads.

Secret CISO 10/26: 1.5M Crime Tips Leaked, EyeMed Breach, Snort Flaws, KSMBD Leak

Anonymity is brittle: a “safe tips” program leaked 1.5M submissions, while healthcare and benefits vendors keep turning lawyers and third parties into blast-radius multipliers. Plus: Snort bugs and a leaked Linux KSMBD RCE report with no patch.

Secret CISO 10/25: 18M AI Chats Exposed, Capcom 11.7M, KEV Collabora RCE, VeloCloud Exploited

This week’s pattern is ugly: high-blast-radius bugs and identity-first intrusions keep colliding with “everyone uses this” platforms. Today: an 18M-file AI data spill, a fresh Capcom account breach, and two KEV-listed exploited enterprise bugs you can’t ignore.

Secret CISO 10/24: 6.38M Members Leaked, SBI Leak Probe, LiteLLM Backdoor, Signal Hot-Mic Bug

Two themes today: supply chain trust keeps snapping (LiteLLM shipped malware through official channels) and “minor” logic bugs turn into major privacy failures (Signal calls that won’t die). Also, a 6.38M-member disclosure reminds us how fast consumer datasets become phishing fuel.

Secret CISO 10/23: Quest Lab Records Breached, Student PII Stolen, Node2Shell RCE, PHP PoC Spreads

Healthcare portals, school nonprofits, and your web stack all took hits in the same 48 hours. The theme is simple: attacker-controlled input is everywhere, and “edge” now includes your dependencies.

Secret CISO 10/22: 600+ SafePay Victims, 3.2M Zeabur Secrets, PHP2Shell RCE, Nextcloud Backdoors

Edge access is the new perimeter again: SafePay’s 600+ victim runbook, Zeabur’s 3.2M environment-variable spill, and PHP2Shell’s unauth RCE are all the same story. Plus: Collabora RCE backdooring Nextcloud, and SonicWall SMA SSRF exploitation attempts.

Secret CISO 10/21: 8 TLS CA Keys Burned, NEC Vendor Encrypts Files, Siemens ClickFix, FortiSIEM PoC Drops

When a certificate authority’s intermediate keys are recoverable, the blast radius is everything that forgot to update. Plus: NEC’s vendor account abuse with encryption, Siemens ClickFix abusing a signed app, and a FortiSIEM RCE PoC you can’t ignore.

Secret CISO 10/20: Plex2Shell Hits, 1.83M Nikkei Records, Rank Math Backdoor, BeyondTrust KEV

Today’s theme is “trusted paths betrayed”: media servers exposed for convenience, signed installers used as carriers, and official plugin and CLI distribution channels quietly poisoned. Patch fast, then hunt like you were already late.

Secret CISO 10/19: $207M Law-Firm Shakedown, 2.6TB County Data, Drupal RCE, LearnPress 9.8

Extortion crews are doing finance-grade ops without ransomware, counties are getting bulk file-theft at terabyte scale, and web platforms are back in the “patch window is the exploit window” era. Plus: Drupal core RCE and a critical LearnPress deserialization bug.

Secret CISO 10/18: 173 M365 Tenants Hit, CA Student Files Copied, Bankruptcy Notices Halted, curl HTTP/2 RCE

Supply-chain trust got abused three different ways: a backup app jumped tenants, a testing vendor’s SFTP got scraped, and a court-critical contractor outage broke statutory workflows. Plus, new PoCs keep turning “client-side” bugs into exec paths.