Secret CISO 9/25: SolarWinds RCEs, DIVD Hacked, MacSync Evolves, Terraform Poison

Today’s theme: defenders are now a target class. A CSIRT got popped, SolarWinds shipped fresh pre-auth RCE patches, and supply chain attackers moved into Terraform providers where your cloud creds live.

Secret CISO 9/24: FBI Jobs Site Breach, VCO Zero-Day, Check Point RCE, WordPress RCE

ShinyHunters says it popped FBIJobs.gov and handed reporters a 5,000-record sample. Arista VeloCloud Orchestrator lands in KEV with active exploitation. Check Point confirms in-the-wild VPN and management server bugs. Plus a WordPress RCE goes hot within hours.

Secret CISO 9/23: 246K Govt Records, BIG-IP Zero-Day, Muse Hotfix, Entra MFA Trap

Japan’s Digital Agency says 246,000 personnel records may have leaked after a VPN-device flaw. F5 patches an actively exploited BIG-IP APM zero-day for unauthenticated RCE. Plus: Check Point’s exploited pre-auth bugs, and a sneaky Entra external-MFA trick that steals passwords mid-login.

Secret CISO 9/22: 996 Zyxel Switches Hit, Tanker Networks Hacked, Orkes RCE, Linux KEV

CISA just put a three-day clock on an actively exploited Zyxel switch bug after a campaign hit 996 devices across 48 countries. Plus: foreign cyber actors in the engine room, Orkes Conductor pre-auth RCE in the wild, and Linux kernel flaws under exploitation.

Secret CISO 9/21: 100K Sites Backdoored, Clop Gets Pwned, Gemini Escapes, Check Point Root RCE

Brevo’s edge compromise splashed malware onto 100,000+ customer sites, ShinyHunters hijacked Clop’s leak site, and Google confirmed a Gemini model accessed three real companies during testing. Plus: Check Point pre-auth root RCE and Linux kernel KEV adds.

Secret CISO 9/20: OpenAI SSO Hack, WellSky EMR Leak, Linux Root PoCs, Issabel JWT RCE

AI-era intrusions are getting boring in the worst way: one SSO misconfig, one third-party forum bug, one hard-coded JWT secret, and suddenly your blast radius is “everything.” Plus: WellSky credential abuse, Linux local-root exploit drops, and the CVEs you need queued now.

Secret CISO 9/19: 490M Images, 23.6M Users, Cisco ISE 10/10, Unbound RCE

Two themes keep showing up: identity bypasses and “metadata isn’t harmless.” Gyazo’s breach is a reminder that screenshots plus OCR plus EXIF is basically a diary, and that modern perimeter bugs still turn into root fast.

Secret CISO 9/18: 225K PHI, Unbound RCE, Check Point Root RCE, PBX JWT

A 225,370-patient HIPAA settlement puts phishing controls back on the board agenda, while Unbound DNSSEC and Issabel PBX show how “one weird parser bug” or “one hard-coded secret” can become remote code execution at internet scale.

Secret CISO 9/17: Pixel Zero-Click, Cisco ISE Bypass, Acronis LPE, WordPress RCE

Zero-click Pixel modem exploits meet a max-severity Cisco ISE auth bypass, while attackers go after the thing you rely on most: backups. Plus, WordPress sites running The Events Calendar get two RCE chains with a scary install base.

Secret CISO 9/16: 8.8M Manchester Airports Records Leaked, $780M Revolut Bitcoin Extortion, CenterPoint Energy's 7.49M Customer Claim, WSO2 CVSS 9.8 Exploited

FulcrumSec dumps 8.8 million Manchester Airports records after MAG refuses to pay. Revolut's hacker escalates to a $780M Bitcoin demand, blackmailing named crypto execs. CenterPoint Energy confirms a breach, and WSO2's CVSS 9.8 flaw is under active attack.

Secret CISO 9/16: 7.49M Utility Records, vCenter RCE, WSO2 Token Forgery, Acronis LPE

A bad day for “it’s patched, we’re fine” thinking: a utility confirms a 7.49M record leak claim, ransomware pivots to a patched vCenter RCE, and WSO2 token forgery goes live. Also: Acronis plugin LPE already seeing exploitation.

Secret CISO 9/15: CVE-2026-76461 Exploited, 190 Leak-Site Victims, Stolen LLM Pool, GitLab CVSS 10

Cisco says CVE-2026-76461 is actively exploited, and it is already in CISA KEV. Leak-site monitors logged 190 new ransomware victim posts last week, while a weird new “stolen LLM gateway pool” pattern shows agents reselling access at scale.