Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Two Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, were exploited in the wild before a patch existed, and 88771 hits every configuration with no login required. Tova Dvorin and Adrian Culley break down Citrix bulletin CTX697096 and all eight CVEs, why this is NetScaler’s third CISA KEV entry in five weeks, and why patching won’t tell you whether you were already breached.

Ten government agencies across seven countries put their names on one advisory. AA26-281A profiles Integrity Technology Group — a China-based, for-profit contractor that builds, sells and hosts the tooling behind large-scale intrusions, and whose domains the FBI seized on October 8. Tova Dvorin and Adrian Culley break down MicroScan’s 1,300 pentest scripts, the eBurst spray that tries ten interfaces into one Microsoft 365 mailbox, SoftEther VPN hiding behind trusted Windows process names, and a 12-year-old Bash CVE still exploited in the wild.

The FBI and US Secret Service just dropped joint advisory JCSA 2026-1601 on FortiBleed—and there is no CVE to patch. Tova Dvorin and Adrian Culley walk the full chain: credential stuffing against internet-facing FortiGate SSL VPNs, legacy SHA-256 admin hashes cracked on rented GPUs, fake vendor-style admin accounts, and attackers deleting your accounts to lock you out of your own firewall. Plus the INC/Lynx ransomware link, what the 86,000 figure really means, and the question that matters: would a new admin on your edge device at 3am fire anything?

ShinyHunters breached FBIJobs.gov, leaked personal data on roughly 5,000 Bureau personnel—including 14 staffers tied to China-focused counterintelligence—and triggered arrests in Amsterdam and Jordan. We separate what the FBI confirmed from what the crew claimed: the unverified Oracle PeopleSoft zero-day, the vishing and OAuth token abuse behind 140+ breaches, and why the arrests wound the brand but not the playbook. Plus, the four controls worth validating this week, starting with FIDO2.

An AI agent that drifts from your intent looks exactly like an insider attack: legitimate credentials, sanctioned tools, plausible actions, at machine speed. In this episode, we break down Anthropic's "Zero Risk Isn't the Job" CISO guide: a four-question review framework, seven vendor-neutral controls, and why egress allowlisting is the strongest defense against prompt injection. Plus: the Claude Opus 4.5 upgrade that had an incident-response agent recruit another agent, and why agentic AI needs continuous adversarial exposure validation.

Is your AI compliance up to par? Anthropic's deputy CISO reveals that Claude Cowork activity isn't captured in compliance logs. If you're in a regulated EMEA sector, DORA's ICT logging and the EU AI Act's obligations are here. Relying on a self-configured OTel stream isn't enough for formal audits. Stay informed about data boundaries and privacy reviews before enabling streams.

Isolation is not the same thing as security. Ron Ben Yizhak from SafeBreach Labs presented this research at Black Hat USA and DEF CON: when Microsoft shipped Python in Excel, the code didn't run on a machine. It ran in an isolated container in Azure. So he asked the obvious question. How isolated is it, really? An isolated environment still has an attack surface. It just moves. See how Ron: If your teams are evaluating cloud-executed code features, this one is worth the full read—the methodology matters as much as the findings.

An AI orchestration harness called SecFlow told itself an exploit had worked—then burned 27 follow-on tasks on a foothold that never existed. Listen to Ep.

A math function in Excel became a path to root in Microsoft's cloud. SafeBreach Labs researcher Ron Ben Yizhak reverse-engineered the isolated Azure containers behind Microsoft's Python in Excel feature—and found the "isolated" part didn't fully hold. Cloud isolation claims are a trust boundary. Trust boundaries get tested. What he found: Both issues were responsibly disclosed to Microsoft and patched between March and June 2026, and the research debuted at DEF CON 34.

A voice note from your CFO on WhatsApp. Her cadence, her urgency—and a reference to a confidential acquisition discussed in a real meeting last Tuesday. North Korea's Blue Noroff builds these backwards: compromise a junior employee's calendar or inbox first, then train a voice model on the stolen context. By the time anyone thinks to verify, the emergency transfer is already sitting in an offshore account.