Today’s theme is “internet-facing blast radius”: recruiting portals, SD-WAN orchestrators, VPN gateways, and CMS endpoints. All the stuff you cannot quietly turn off without someone important calling you.

Today's Top 5

1. 5,000 FBI records sampled: ShinyHunters’ FBIJobs.gov breach claim now includes a 5,000-record sample that multiple outlets say they could validate. If this becomes a broader identity exposure, the downstream risk is people, not systems. Source
2. Arista VCO zero-day in KEV: CVE-2026-93952 for on-prem VeloCloud Orchestrator is being exploited, and Arista is telling customers to patch immediately. The ugly part is what “orchestrator compromise” means for every managed edge behind it. Source
3. Check Point confirms active exploitation: Check Point says attackers are actively exploiting CVE-2026-85102 (VPN certificate handling pre-auth RCE) and CVE-2026-93616 (management pre-auth bug). If your gateways are internet-facing, treat this like a fire drill. Source
4. WordPress RCE weaponized fast: CVE-2026-87902 is already seeing in-the-wild exploitation attempts, including attackers dropping PHP files via pearcmd.php. The “but we only run the blog” argument expires the second it sits in your SSO session path. Source
5. Astrana Health files material incident: A healthcare org just told the SEC it has a material cybersecurity incident. These filings are a reminder that “materiality” is now a calendar, not a vibe. Source

Why today matters: Attackers are prioritizing control-plane targets and identity-adjacent systems because one foothold buys them scale. The defensive tell is simple: if your business cannot tolerate downtime on a portal, VPN, or orchestrator, attackers already priced that in. Healthcare, government, and anyone running on-prem management planes should be especially nervous.

Okay, let’s get specific.

Data Breaches

1. FBI investigates alleged breach of FBIJobs.gov: The FBI says it is investigating unauthorized activity affecting FBIjobs.gov after ShinyHunters defaced the site and claimed to have stolen employee and applicant data. Reporting says a sample of 5,000 records was shared with media and partially validated. Source: The Record
2. Ars Technica: FBI scrambles to verify ShinyHunters claim: Additional reporting frames this as an extortion play for reputational leverage, not cash, with ShinyHunters demanding a retraction of an FBI threat advisory. The interesting risk is not the defacement, it is how quickly “HR systems” becomes “identity intel.” Source: Ars Technica
3. ShinyHunters details and motive claims: ShinyHunters claims it is not seeking money and positioned the incident as retaliation tied to FBI guidance about extortion tactics. Whether or not the full story holds, this is what weaponized PR looks like when it is backed by real data. Source: The Register
4. Astrana Health discloses material cybersecurity incident (SEC 8-K): Astrana Health filed an Item 1.05 8-K describing a material cybersecurity incident, noting the investigation is ongoing and that sensitive data could be involved. If you are in healthcare, expect plaintiffs and regulators to treat this as a template. Source: SEC EDGAR

Security Research

1. Arista VeloCloud Orchestrator zero-day exploited (CVE-2026-93952): SecurityWeek reports Arista urged immediate patching after active exploitation, with the flaw landing in CISA KEV. If you run on-prem orchestrators, assume the attacker goal is “control plane first, edges later.” Source: SecurityWeek
2. Check Point: active exploitation of CVE-2026-85102 and CVE-2026-93616: Check Point published an action-required advisory describing in-the-wild exploitation affecting Security Gateway and Security Management. The practical takeaway is boring and painful: patch, then hunt using the vendor’s detection guidance. Source: Check Point
3. WordPress CVE-2026-87902 exploited within hours: The Hacker News says exploitation attempts began September 23, and notes attacker behavior shifting from recon to writing files to disk using pearcmd.php. If you have WordPress anywhere near auth flows or internal networks, treat this as more than “marketing’s problem.” Source: The Hacker News
4. CERT Polska details MikroTrick, including KEV-added bugs: CERT Polska published a technical analysis of the MikroTrick chain and describes its disclosure process and the related CVEs added to KEV. This is worth reading because it shows how quickly defenders lose the “quiet patch window.” Source: CERT Polska
5. Ryuk operator sentencing details: The Record reports a Ryuk ransomware operator received a 24-month sentence and was ordered to pay $1,219,106 restitution. Enforcement does not stop incidents, but it changes the calculus for affiliates when opsec mistakes get expensive. Source: The Record

Top CVEs

1. CVE-2026-93952: Arista VeloCloud Orchestrator (on-prem) improper input validation that can lead to unauthenticated access to privileged internal functions, with active exploitation and KEV inclusion. If your SD-WAN control plane is reachable, patch like you mean it. Source
2. CVE-2026-85102: Check Point Security Gateway pre-auth remote code execution in VPN certificate handling, confirmed exploited in the wild. If you delayed because “it’s just VPN,” congratulations, you just described the attacker’s favorite perimeter. Source
3. CVE-2026-93616: Check Point Security Management pre-auth vulnerability with active exploitation confirmed by the vendor and a fix available. Management servers are the keys to the kingdom, so assume compromise equals policy abuse and log tampering. Source
4. CVE-2026-87902: WordPress remote code execution being exploited shortly after disclosure, with reports of attackers leveraging pearcmd.php to write PHP files. Inventory your WordPress instances before the internet inventories them for you. Source
5. CVE-2026-93616: If you are tracking KEV-driven deadlines, confirm whether your environment maps to affected Check Point versions and hotfixes, then document the patch and validation path for auditors. (Yes, I am listing it twice in your internal tracker too.) Source

Podcasts & Talks

1. Risky Bulletin Podcast: “Bring on the AI lawsuits”: Today’s episode is a good boardroom listen because it frames liability as a forcing function for better engineering controls. If your org is betting on “we will settle,” at least know what you are buying. Listen: Risky Business Media
2. CISO Series Podcast: “Our AI Agents Are So Safe and …”: A timely conversation if your roadmap includes autonomous agents touching production data and workflows. You should care because “agent guardrails” tends to mean “new bypass class” unless it is tested like auth. Listen: Apple Podcasts
3. Enterprise AI Defenders Episode 45 (Equifax CISO): This one is useful if you are trying to sell passwordless and SOC modernization internally, because it pairs strategy with operational constraints. The value is hearing what actually survived contact with reality. Listen: Buzzsprout

Final Words

The underlying pattern today is attackers going after identity-rich choke points and control planes, then using the resulting data to create second-order harm. The uncomfortable implication is that “availability events” on public portals and “management-plane bugs” are now leading indicators for personal safety risk and long-tail fraud, not just downtime.

This week, do three things:

• Patch Arista on-prem VeloCloud Orchestrator for CVE-2026-93952, then rotate any credentials and tokens the orchestrator can see (API keys, edge enrollment secrets, automation accounts).
• Apply Check Point fixes for CVE-2026-85102 and CVE-2026-93616, then run the vendor’s compromise checks and validate management-server integrity from a clean admin workstation.
• Inventory every WordPress instance, patch for CVE-2026-87902, and add detections for pearcmd.php abuse patterns and unexpected PHP file writes in web roots.

Your turn: If an attacker dumped a 5,000-record sample of your employee data tomorrow, do you have a playbook that treats it as a physical safety and counterintelligence problem, not just “privacy comms”? Hit reply with your answer, or drop a comment on the web version, I read every reply.

Know someone who still treats recruiting portals like “not production”? Forward them this issue, because FBIJobs.gov just became a case study. For forwarded readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!