Secret CISO 10/6: 8.8M Denmark IDs Exposed, Nikkei Phish Blitz, UIC Ransomware, Citrix SAML Zero-Day

Identity data keeps leaking through “trusted access” and “trusted login” paths: Denmark’s CPR registry, Nikkei’s M365 mailbox, and a medical school ransomware case. Plus: Citrix SAML DoS zero-day, Rejetto HFS RCE scanning, and Google pauses OSS bug bounties due to AI spam.

Secret CISO 10/5: Cisco ISE Auth Bypass, FTAPI Ransomware, PeopleSoft WAF Trick, FortiMail 0-day

Today’s theme is “control-plane trust.” One stolen user mailbox, one unauth API endpoint, one edge appliance feature, and one WAF rule gap are all it takes to turn “we’re fine” into “we’re filing notices.”

Secret CISO 10/4: 200K Uni IDs Exposed, KillSec Teen Arrest, ShinyHunters Flips, GitLab AI RCE

Identity systems keep failing loud and wide: a Danish university IAM breach hits 200,000, K-12 staff SSNs spill via a vendor flaw, and a hospice manager loses PHI for 35,916 Texans. Meanwhile, law enforcement squeezes extortion crews, and AI features ship with command execution footguns.

Secret CISO 10/3: 6.6M Times Car IDs Stolen, K-12 SSNs Leaked, M365 C2, Dell K8s Storage Keys

Big breaches keep landing in the “verification” layer: identity docs and SSNs on one side, and enterprise cloud control planes on the other. Today’s thread is trust reuse, attackers hiding in systems you already allow.

Secret CISO 10/2: 110TB KillSec Seizure, Keio Rail Hit, Zimbra Mail RCE, FortiMail 0-day

KillSec’s leak site gets seized with 110TB of stolen data. Keio says ransomware hit its servers. Meanwhile, Zimbra command injection gets a detailed exploitation writeup, and Vault/OpenBao chains show how “one unauthed endpoint” can become full takeover.

Secret CISO 10/1: 13,000 GitHub Screenshots, Cisco SD-WAN Bypass, MikroTik RCE, TeamViewer Bugs

AI agents quietly turned dev laptops into public leak pipelines. Plus: Cisco SD-WAN Manager auth bypass hits KEV, CISA flags a MikroTik pre-auth root RCE, OpenSSL DTLS bug, and TeamViewer’s “patch now” moment.

Secret CISO 9/30: 3M Military PII Exposed, 270K Court Files Stolen, BTR Spectre-v2, ChatGPT ClickFix RAT

A year of quiet access beats a loud ransom note. Today’s stories rhyme: identity systems, file-sharing corners, and “trusted” UX surfaces turning into attacker-controlled funnels. Also, Spectre is not dead, it just took a long nap.

Secret CISO 9/29: Apple iOS 0-day, 400K Medicaid leak, AI wallet-drain, WSO2 KEV

Zero-days are back in the quietest place possible: your endpoints’ file parsers, your ERP edge, and your “harmless” public reports. Today’s common thread is control-plane trust being treated as data-plane reality, and attackers cashing that check.

Secret CISO 9/28: SharePoint KEV RCE, Citrix NetScaler RCE, Berlin Data Theft, Cloudflare Container Leak

Today’s pattern is ugly but useful: attackers are living in the gap between “we have a patch” and “we have proof nobody can hit it.” KEV deadlines, edge appliances, and tenant-isolation bugs are doing the same job: turning small mistakes into org-wide access.

Secret CISO 9/27: 53 Images Leaked, PeopleSoft WAF Bypass, KEV JWT Bug, GitHub Actions Backdoor

Attackers keep winning by slipping through the cracks defenders think are “good enough”: URL-encoded WAF bypasses, forged JWTs, CI tags that silently resurrect malware, and AI agents that leak data via third-party services.

Secret CISO 9/26: $387.5M Bitget Heist, Kiteworks Shutdown, AI Agents Steal 600K Cards, TeamCity Ransomware

A $387.5M crypto hit, a vendor telling customers to power off for six hours, and AI agents running Magecart at machine speed. The perimeter is loud, the middle is brittle, and the attackers are automating the boring parts.

Secret CISO 9/25: SolarWinds RCEs, DIVD Hacked, MacSync Evolves, Terraform Poison

Today’s theme: defenders are now a target class. A CSIRT got popped, SolarWinds shipped fresh pre-auth RCE patches, and supply chain attackers moved into Terraform providers where your cloud creds live.