Today’s vibe: attackers are treating your org chart like an attack surface, and your patch window like a dare. The technical stuff is nasty, but the operational stuff is what keeps paying out.

Today's Top 5

1. $207M law-firm extortion ledger: A leaked chat archive paints a phone-first extortion crew tracking payouts like a sales pipeline, no encryption required. The uncomfortable part is who they target when confidentiality is the product. Source
2. 2.6TB county data for sale: After the county went public, a ransomware crew claims it stole terabytes of files and is now advertising them for Bitcoin. The question is what ends up inside those “just files” buckets once investigators start sampling. Source
3. Drupal core critical RCE: Drupal shipped a critical core fix with a known release window, and researchers are already talking about PoC timing and scanning pressure. If your CMS fleet is “someone else’s problem,” it is about to become yours. Source
4. LearnPress CVE-2026-104736: A critical unauthenticated PHP object injection in a widely deployed WordPress LMS plugin is the kind of bug that turns “marketing’s side site” into an internal incident. The scary bit is how fast a PoC becomes mass traffic. Source
5. Stormcast flags exploited edge flaws: SANS Stormcast keeps the exploit treadmill honest, and this week’s lineup reads like a perimeter inventory checklist. If you are still triaging by headlines, you will lose to calendars. Source

Why today matters: The “ransomware” label is getting less useful. Crews are monetizing theft with social pressure, public leak ops, and CFO-grade bookkeeping, while defenders are still debating whether a copy event is “confirmed PII.” Meanwhile, web platforms are back to release-window exploitation, which punishes slow change control more than weak code.

XERJ Corpus Hub: If LearnPress CVE-2026-104736 is anywhere in your WordPress footprint, an AI agent loading nuclei-templates can draft an internal-only detector for the vulnerable checkout path and help your team quickly enumerate exposed instances from scan results. Then go grab another corpus at hub.xerj.org.

Alright, let’s get into the receipts.

Data Breaches

1. Leaked chats allege $207M Silent Ransom Group haul from law firms: A cache of leaked internal chats and ledger-style notes suggests Silent Ransom Group (aka Luna Moth / UNC3753) pressured U.S. law firms via phone social engineering and data theft, with claimed totals reaching $207 million across 27 firms. The leak is being analyzed publicly, but payment totals are not independently confirmed, and that uncertainty is part of the risk calculus for victims. Source: UBStandard
2. GuidePoint analysis of the Silent Ransom Group chat leak: GuidePoint Security published a breakdown of why the dataset looks like a genuine export, including internal consistency checks and operational details (Google Drive staging, SSH servers, negotiation patterns). For CISOs, the value is tradecraft, not gossip: it reads like a playbook for coercion without encryption. Source: GuidePoint Security
3. Anne Arundel County: Rhysida claims 2.6TB stolen, data advertised for sale: Reporting says Rhysida claimed responsibility after the county disclosed the incident and is advertising what it says is 2.6TB of stolen data for 25 bitcoin. The county has confirmed file copying, but the scope of resident impact is still being assessed, which is the exact gap extortion crews exploit. Source: WarBrief Live
4. Anne Arundel County incident page update timeline: The county’s dedicated incident page shows ongoing updates and serves as the canonical reference for what is confirmed versus rumored. If you support public-sector peers, this is a good example of why a single source of truth page beats scattered PDFs and press quotes. Source: Anne Arundel County Government

Security Research

1. Drupal core critical RCE advisory window and updates: Drupal’s security advisories page covers the critical core release (including SA-CORE-2026-014) and the supported branch releases. The practical risk is predictable: a public release window compresses defender response time and helps scanners synchronize. Source: Drupal.org
2. LearnPress unauthenticated PHP object injection (CVE-2026-104736): Patchstack’s database entry describes an unauthenticated PHP object injection affecting LearnPress versions up to 4.4.10. If you have WordPress sprawl, treat LMS plugins like identity systems because they often touch accounts, checkout flows, and email. Source: Patchstack
3. Operational guidance writeup for LearnPress fix: A separate writeup urges updating and highlights what to review post-fix (sessions, files, logs). Even if you do not love WordPress, your marketing team does, and that is enough to make it your problem. Source: WpZone
4. Huntress: AhsayCBS flaws abused for crypto-mining: Huntress reporting (via TechRadar) notes attackers abusing business backup servers, with the initial lure masquerading as Microsoft Edge and activity turning into crypto mining. Backup infrastructure keeps getting treated as “trusted, always on, and ignored,” which is attacker poetry. Source: TechRadar
5. Researchers warn about fake exploit PoCs that infect analysts: A talk recap circulating points to a campaign where malicious “PoC” code bites researchers who run it. If your SOC pulls GitHub PoCs into lab sandboxes, this is your reminder to treat PoCs as malware until proven otherwise. Source: Reddit

Top CVEs

1. CVE-2026-104736: LearnPress for WordPress is reported vulnerable to unauthenticated PHP object injection via deserialization of untrusted input. Impact can range from app compromise to full site takeover depending on gadget chains and environment. Source
2. CVE-2026-108097: A critical Drupal core issue tied to the Field UI module is being discussed as an RCE risk with fast-moving PoC timelines. Treat exposed admin surfaces as urgent patch targets, and assume opportunistic scanning follows. Source
3. CVE-2026-102764: BeyondTrust Remote Support is flagged in reporting as exploited in the wild, with government advisories tracking it. If remote support tooling is in your stack, assume it is a privilege boundary and monitor it like VPN. Source
4. CVE-2025-61624: Fortinet products (including FortiOS and related components) have an exploited path traversal vulnerability tracked by multiple sources and noted in KEV-related reporting. Edge device compromise still prints money, and it keeps bypassing endpoint controls entirely. Source

Podcasts & Talks

1. SANS Stormcast (Oct 16, 2026): exploited edge flaws roundup: This episode format is useful for CISOs because it forces a blunt question: which of these products are in our inventory, and who owns the patch SLA. It is also a good way to spot when “in the wild” becomes table stakes. Listen: Listennotes

Final Words

Today’s underlying pattern is coercion scaling faster than encryption. The hard part is not restoring systems, it is controlling disclosure, validating what was actually taken, and denying attackers the operational leverage they get from uncertainty. If your incident process still starts at “was anything encrypted,” you are already behind.

This week, do three things:

• Patch Drupal core anywhere you run it, and verify the exact deployed version matches the fixed branch releases referenced in the Drupal advisories.
• Find and update LearnPress on any WordPress site you own or host for business units, then review checkout-related logs for abuse patterns tied to CVE-2026-104736.
• Run a tabletop for phone-driven extortion aimed at Legal and IT helpdesk, using the Silent Ransom Group playbook as the scenario, and write down who can authorize any response.

Your turn: If a credible caller claimed they already stole your firm’s most sensitive client files and gave Legal 24 hours, do you have a written rule for who verifies, who negotiates, and who says “no”? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know a GC or law-firm CISO who still thinks “no ransomware” means “no crisis”? Forward them this issue, it costs 30 seconds and the alternative costs a lot more. For everyone else, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!