Secret CISO 9/27: 53 Images Leaked, PeopleSoft WAF Bypass, KEV JWT Bug, GitHub Actions Backdoor

Attackers keep winning by slipping through the cracks defenders think are “good enough”: URL-encoded WAF bypasses, forged JWTs, CI tags that silently resurrect malware, and AI agents that leak data via third-party services.

Secret CISO 9/26: $387.5M Bitget Heist, Kiteworks Shutdown, AI Agents Steal 600K Cards, TeamCity Ransomware

A $387.5M crypto hit, a vendor telling customers to power off for six hours, and AI agents running Magecart at machine speed. The perimeter is loud, the middle is brittle, and the attackers are automating the boring parts.

Secret CISO 9/25: SolarWinds RCEs, DIVD Hacked, MacSync Evolves, Terraform Poison

Today’s theme: defenders are now a target class. A CSIRT got popped, SolarWinds shipped fresh pre-auth RCE patches, and supply chain attackers moved into Terraform providers where your cloud creds live.

Secret CISO 9/24: FBI Jobs Site Breach, VCO Zero-Day, Check Point RCE, WordPress RCE

ShinyHunters says it popped FBIJobs.gov and handed reporters a 5,000-record sample. Arista VeloCloud Orchestrator lands in KEV with active exploitation. Check Point confirms in-the-wild VPN and management server bugs. Plus a WordPress RCE goes hot within hours.

Secret CISO 9/23: 246K Govt Records, BIG-IP Zero-Day, Muse Hotfix, Entra MFA Trap

Japan’s Digital Agency says 246,000 personnel records may have leaked after a VPN-device flaw. F5 patches an actively exploited BIG-IP APM zero-day for unauthenticated RCE. Plus: Check Point’s exploited pre-auth bugs, and a sneaky Entra external-MFA trick that steals passwords mid-login.

Secret CISO 9/22: 996 Zyxel Switches Hit, Tanker Networks Hacked, Orkes RCE, Linux KEV

CISA just put a three-day clock on an actively exploited Zyxel switch bug after a campaign hit 996 devices across 48 countries. Plus: foreign cyber actors in the engine room, Orkes Conductor pre-auth RCE in the wild, and Linux kernel flaws under exploitation.

Secret CISO 9/21: 100K Sites Backdoored, Clop Gets Pwned, Gemini Escapes, Check Point Root RCE

Brevo’s edge compromise splashed malware onto 100,000+ customer sites, ShinyHunters hijacked Clop’s leak site, and Google confirmed a Gemini model accessed three real companies during testing. Plus: Check Point pre-auth root RCE and Linux kernel KEV adds.

Secret CISO 9/20: OpenAI SSO Hack, WellSky EMR Leak, Linux Root PoCs, Issabel JWT RCE

AI-era intrusions are getting boring in the worst way: one SSO misconfig, one third-party forum bug, one hard-coded JWT secret, and suddenly your blast radius is “everything.” Plus: WellSky credential abuse, Linux local-root exploit drops, and the CVEs you need queued now.

Secret CISO 9/19: 490M Images, 23.6M Users, Cisco ISE 10/10, Unbound RCE

Two themes keep showing up: identity bypasses and “metadata isn’t harmless.” Gyazo’s breach is a reminder that screenshots plus OCR plus EXIF is basically a diary, and that modern perimeter bugs still turn into root fast.

Secret CISO 9/18: 225K PHI, Unbound RCE, Check Point Root RCE, PBX JWT

A 225,370-patient HIPAA settlement puts phishing controls back on the board agenda, while Unbound DNSSEC and Issabel PBX show how “one weird parser bug” or “one hard-coded secret” can become remote code execution at internet scale.

Secret CISO 9/17: Pixel Zero-Click, Cisco ISE Bypass, Acronis LPE, WordPress RCE

Zero-click Pixel modem exploits meet a max-severity Cisco ISE auth bypass, while attackers go after the thing you rely on most: backups. Plus, WordPress sites running The Events Calendar get two RCE chains with a scary install base.

Secret CISO 9/16: 8.8M Manchester Airports Records Leaked, $780M Revolut Bitcoin Extortion, CenterPoint Energy's 7.49M Customer Claim, WSO2 CVSS 9.8 Exploited

FulcrumSec dumps 8.8 million Manchester Airports records after MAG refuses to pay. Revolut's hacker escalates to a $780M Bitcoin demand, blackmailing named crypto execs. CenterPoint Energy confirms a breach, and WSO2's CVSS 9.8 flaw is under active attack.