The week of Oct 26–Nov 1, 2026 brought exploited flaws in edge and DevOps systems: PHP2Shell on Palo Alto Networks management interfaces, a max-severity GitLab CI/CD flaw, and a Cisco ASA/FTD VPN denial-of-service bug, all confirmed exploited.…
CVE-2026-97229 is an unauthenticated remote code execution flaw (CVSS 10.0) in self-managed GitLab CE/EE, triggered by a crafted regular expression in a CI/CD configuration. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on…
CVE-2026-76418 is an actively exploited denial-of-service flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. An unauthenticated remote attacker can force the device to reload…
On October 28, 2026, a hacktivist group calling itself "Department of Peace" released records on more than 41,000 current and former U.S. Department of Homeland Security employees and contractors, which it says came from an Okta single sign-on…
Five things need a decision this week: patch PHP2Shell (CISA deadline passed Oct 29), hunt for the poisoned LiteLLM release, audit Microsoft 365 app consents after Storm-0940, rotate any secrets stored on Railway, and check the eight new KEV…
Two CVSS 9.2 flaws allow unauthenticated RCE in PHP. CISA KEV deadline Oct 29. Timeline, root cause, exposure figures, affected vendor appliances, hunting indicators and a 24h / this-week / strategic action…
Stolen maintainer tokens ran LiteLLM’s own release pipeline to ship a credential stealer through PyPI, Docker Hub and GHCR. What it stole, how it persisted, and everything you need to rotate.
TL;DR
- On 21 October 2026,…
A China-aligned actor used stolen ConnectWise app identities to sign into 2,250+ Microsoft 365 tenants with no user MFA in the loop. Attack chain, Entra ID checks, and why disabling the vendor app does not clean your…
AI Pentest Series
Research for security leaders, not sales material
Field Notes from Black Hat & DEF CON 2026What changed in the attacker playbook this year.20 Years of AppSec: What AI Changes and What It Doesn’tWhere AI actually moves the needle in application security.Safe AI Agents: Guardrails and Scope EnforcementPractical strategies for keeping agents inside their lane.Evaluating AI Pentesting VendorsA technical buyer’s checklist.How an AI Reached the HackerOne Top 3What the team learned on the way.Turbo Talks: the webinar seriesWhy traditional ASM and CTEM tools will fail in the next 12 months.
Get the Monday briefing
Exploited vulnerabilities, breach teardowns and peer answers, every week. For CISOs and their deputies. No vendor pitches.
Join free as a security leader6,989 members · USA · Middle East · APAC · India
This week's threat watch
- CRITICAL · EXPLOITED
GitLab CVE-2026-97229: CI/CD RCE added to CISA KEV - EXPLOITED · EDGE
Cisco ASA/FTD VPN flaw reloads firewalls (CVE-2026-76418) - EXPLOITED
PHP2Shell now hitting Palo Alto Networks management interfaces - SUPPLY CHAIN
LiteLLM 1.107.0 poisoned on PyPI and Docker - IDENTITY LEAK
DHS "Icepick": 41,000 staff records from an SSO directory - PATCH TABLE
Plex2Shell, Arista, VeloCloud, Collabora
Upcoming events
Recent
Members only
Hear it from the CISOs who were in the room
Jim Routh on SolarWinds accountability. Bruce Schneier. Anton Chuvakin on practical AI. Members get every peer talk, the Monday threat briefing and closed-door roundtables in the USA, Middle East, APAC and India.
Join free — security leaders only →Free · approval within 48h · no vendor pitchesContact: contact@cisoplatform.com · +91 99002 62585
