Secret CISO 9/15: CVE-2026-76461 Exploited, 190 Leak-Site Victims, Stolen LLM Pool, GitLab CVSS 10

Cisco says CVE-2026-76461 is actively exploited, and it is already in CISA KEV. Leak-site monitors logged 190 new ransomware victim posts last week, while a weird new “stolen LLM gateway pool” pattern shows agents reselling access at scale.

Secret CISO 9/14: 347K Trezor Phish, Cisco FMC Rooted, Citrix Bypass, Totolink PoCs

A third-party email vendor incident triggers 347K Trezor phishing blasts, Cisco FMC is getting rooted in the wild by multiple clusters, Citrix NetScaler auth bypass sits in KEV, and Totolink router PoCs drop today. Plus: LLM access resale and passkey-themed lures.

Secret CISO 9/13: Revolut Leaks Passports, GitLab CVSS 10 Hit Fast, MikroTik KEV, BlueMoon Spreads

Revolut confirms it handed over passports and Bitcoin histories to a fake government request, GitLab’s CVSS 10 path traversal sees in-the-wild probes within a day, CISA flags two MikroTik RouterOS bugs as exploited, and an exploit kit jumps between spy crews.

Secret CISO 9/12: Novo Nordisk's 1.3TB Extortion, 800K Hospice Patients Exposed, Conti Hacker Gets 4 Years, Windows Zero-Days Under Attack

Novo Nordisk lost 1.3TB to a token left in public JavaScript, a hospice pharmacy breach hits 800,000 patients, a Conti affiliate is off to prison, and two Windows zero-days are being exploited right now. Today's Secret CISO.

Secret CISO 9/11: One Missed Call Hijacks WeChat, ShinyHunters Hits 1M Students, Anthropic Catches AI Hackers, Fake Claude App Drains Crypto

A zero-click worm hijacks WeChat before you answer, ShinyHunters hits 1 million Mathspace students, Anthropic catches AI running its own hacking campaigns, and a fake Claude app drains crypto wallets. Plus PaperCut's twice-broken patch and today's top CVEs.

Secret CISO 9/10: AI Breaches 11 Firms in 26 Seconds, Ransomware Grounds Air Canada, 3.5M Patient SSNs Held Hostage, Four Spy Crews Share One Exploit Kit

A Russian-speaking crew's AI agents hit 11 orgs in 26 seconds, Air Canada gets hit by ransomware, Veradigm's patient SSNs face a Friday ransom deadline, and four spy groups quietly share the same Chrome-Windows exploit kit.

Secret CISO 9/9: ShinyHunters Breaches Florida's DMV, $320M Bitcoin Heist Hits Liquid Network, ChatGPT's Cross-Account Gmail Leak, Record 973-Flaw Patch Tuesday

ShinyHunters claims Florida's DMV database, a mysterious 'white hat' drains $320M from Bitcoin's Liquid Network, Check Point exposes a ChatGPT flaw that leaks Gmail across accounts, and Patch Tuesday sets a new record with 973 CVEs.

Secret CISO 9/8: 220 Million Traveler Records Exposed, BigBear Bypasses MFA at 258 Orgs, Magento's StyleSmuggler Zero-Day, N-able N-central Under Attack

A 220M-record traveler database exposed, BigBear's MFA-bypassing phishing kit hits 258 orgs, an unpatched Magento zero-day backdoors stores, and a perfect-10 N-able RCE gets actively exploited.

Secret CISO 9/7: 153 Million Driver's Licenses Leaked, ATF Case Files Dumped, Magento's Unpatched Zero-Day, AI Agents Breach a Network in 10 Hours

153 million driver's licenses hit the dark web, Qilin dumps ATF case files, Magento's unpatched zero-day backdoors stores, and an AI agent breaches a network in under 10 hours.

Secret CISO 9/6: McKesson's $55M Ultimatum, Wesco Data Dump, CrowdStrike Zero-Day Exposed, Citrix NetScaler Under Siege

McKesson faces a $55M extortion deadline, Wesco's CRM data hits the dark web, a CrowdStrike zero-day drops without warning, and attackers race to exploit Citrix NetScaler and SonicWall flaws.

Secret CISO 9/5: McKesson Breach, Berlin Ransomware Extortion, 153M IDs Leaked, Chrome Zero-Day Patched

McKesson's healthcare breach hits 284M records, Berlin refuses a Rhysida ransom, 153M driver's licenses surface tied to IDScan, and Google patches an actively exploited Chrome zero-day.

Secret CISO 9/4: Thomson Reuters Court Breach, Manchester Airports Data Leak, Astra Crosses Critical, Kestra Zero-Day Under Siege

A Thomson Reuters court platform breach exposes sealed records in 11 states, Manchester Airports data leaks after a ransom refusal, OpenAI's Astra hits a critical cyber threshold, and a 10.0-severity Kestra flaw joins a wave of actively exploited CVEs.