Secret CISO 10/16: 1.4M Patient Files, BeyondTrust Spies, LiteLLM Chains, Cisco Email Exploits

Healthcare keeps leaking at population scale, while attackers quietly pivot from laptops to appliances and AI gateways. Today: 1.4M COPC patients, BeyondTrust zero-day post-exploitation tradecraft, LiteLLM takeover chains, and an exploited Cisco email gateway bug.

Secret CISO 10/15: 1,500 Meta Staff Hit, PAN-OS Zero-Day, Linux ‘Vghost’, Docker Hub Token Swap

A stolen employee credential turned Meta’s GitHub into an unexpected HR data leak. Palo Alto shipped an exploited PAN-OS management RCE, while Linux vhost “Vghost” raised the VM-escape stakes. Plus, Docker Hub’s PAT transfer bug is a supply-chain nightmare in disguise.

Secret CISO 10/14: 1,411 Microsoft Flaws, Ivanti Zero-Day Chain, Trump Phone Leak, Windows MotW Bypass

Patch Tuesday broke the odometer at 1,411 fixes, while Ivanti’s Connect Secure got hit with an in-the-wild auth bypass chain. Plus: a Trump Phone customer leak claim and the Mark-of-the-Web bypass you really do not want in your inbox.

Secret CISO 10/13: 350 French Stores’ Fridges Hacked, Ahold Systems Offline, GitLab RCE, SonicWall SSRF

Retail and OT had a rough night: attackers remotely defrosted refrigeration at up to 350 French supermarkets, Ahold Delhaize pulled systems offline, GitLab dropped a max-severity RCE fix, and SonicWall SMA exploits are already knocking.

Secret CISO 10/12: 8.6M Karaoke Records Exposed, Cloud Ransomware Spillover, One-Prompt AWS Agent Hijack, Citrix SAML RCE Risk

A contractor PC exposed 8.6M karaoke fan records in Japan, cloud ransomware ripple effects keep growing, Zenity shows how one prompt can yank cloud creds from AWS agents, and Citrix SAML configs get a critical RCE/DoS bulletin.

Secret CISO 10/11: DexCom Extortion Claim, IDCF Cloud Ransomware, Cisco NX-API RCE, Exchange Mailbox Bug

Today’s thread: attackers keep skipping “endpoints” and going straight for the control plane, identity flows, and notification rails. Extortion crews name-name-shame, while exploited network and mail server bugs keep giving them an easy on-ramp.

Secret CISO 10/10: 360K iRhythm Patients, Live Nation IDs, Frontline SSNs, Atlassian File-Read

Today’s thread is “trusted third parties, trusted defaults.” iRhythm’s breach is a reminder that attackers don’t need your core systems if they can reach your hosted apps, your vendors, or your employee HR stack. Plus: Frontline’s K-12 ripple, Live Nation’s silent filing, and a critical Atlassian Da

Secret CISO 10/9: 20M Cerner Patients, 400K Utility Accounts, TP-Link Lawsuits, SonicWall SSRF

Credential theft is back on top: Oracle Health’s Cerner blast radius jumps to nearly 20M, utilities lose 400K accounts via a portal, and ASOS gets popped by straight-up impersonation. Plus: Atlassian file-read scans, FortiBleed lockouts, and a CVSS 10 SonicWall SSRF.

Secret CISO 10/8: $19M Ransom ‘Recovery’ Fraud, 1M Emails Leaked, Google ccTLD Hijack, Pwn2Own 32 Zero-Days

A bad day for “trusted third parties”: an IR vendor allegedly paid ransoms in secret, a forgotten analytics box leaked 1M emails, and ccTLD operators let attackers mint Google TLS certs. Plus: Atlassian exploitation, SonicWall SSRF, and fresh pods.

Secret CISO 10/7: 1.3M Court Records Stolen, ASOS App Hijack, Atlassian File-Read, Citrix SAML DoS

Arizona courts say 1.3M people had data copied after one click. ASOS pushes “HACKED” alerts via its own app stack. Atlassian drops a critical file-read across eight Data Center products. Plus: Citrix SAML NetScaler DoS and npm malware that hid for years.

Secret CISO 10/6: 8.8M Denmark IDs Exposed, Nikkei Phish Blitz, UIC Ransomware, Citrix SAML Zero-Day

Identity data keeps leaking through “trusted access” and “trusted login” paths: Denmark’s CPR registry, Nikkei’s M365 mailbox, and a medical school ransomware case. Plus: Citrix SAML DoS zero-day, Rejetto HFS RCE scanning, and Google pauses OSS bug bounties due to AI spam.

Secret CISO 10/5: Cisco ISE Auth Bypass, FTAPI Ransomware, PeopleSoft WAF Trick, FortiMail 0-day

Today’s theme is “control-plane trust.” One stolen user mailbox, one unauth API endpoint, one edge appliance feature, and one WAF rule gap are all it takes to turn “we’re fine” into “we’re filing notices.”