On October 28, 2026, a hacktivist group calling itself "Department of Peace" released records on more than 41,000 current and former U.S. Department of Homeland Security employees and contractors, which it says came from an Okta single sign-on…
Five things need a decision this week: patch PHP2Shell (CISA deadline passed Oct 29), hunt for the poisoned LiteLLM release, audit Microsoft 365 app consents after Storm-0940, rotate any secrets stored on Railway, and check the eight new KEV…
Two CVSS 9.2 flaws allow unauthenticated RCE in PHP. CISA KEV deadline Oct 29. Timeline, root cause, exposure figures, affected vendor appliances, hunting indicators and a 24h / this-week / strategic action…
Stolen maintainer tokens ran LiteLLM’s own release pipeline to ship a credential stealer through PyPI, Docker Hub and GHCR. What it stole, how it persisted, and everything you need to rotate.
TL;DR
- On 21 October 2026,…
A China-aligned actor used stolen ConnectWise app identities to sign into 2,250+ Microsoft 365 tenants with no user MFA in the loop. Attack chain, Entra ID checks, and why disabling the vendor app does not clean your…
Railway’s build infrastructure was compromised and a subset of encrypted customer secrets decrypted; Zeabur is shutting down after its second breach. What this means for every production credential sitting in a…
Eight KEV additions in four days plus a CVSS 10.0 GitLab RCE. Patch table with fixed versions and deadlines, root cause per flaw, and why CVSS-only prioritisation would have missed the Plex chain.
TL;DR
Between October 20 and 23,…
AI Pentest Series
Research for security leaders, not sales material
Field Notes from Black Hat & DEF CON 2026What changed in the attacker playbook this year.20 Years of AppSec: What AI Changes and What It Doesn’tWhere AI actually moves the needle in application security.Safe AI Agents: Guardrails and Scope EnforcementPractical strategies for keeping agents inside their lane.Evaluating AI Pentesting VendorsA technical buyer’s checklist.How an AI Reached the HackerOne Top 3What the team learned on the way.Turbo Talks: the webinar seriesWhy traditional ASM and CTEM tools will fail in the next 12 months.
Get the Monday briefing
Exploited vulnerabilities, breach teardowns and peer answers, every week. For CISOs and their deputies. No vendor pitches.
Join free as a security leader6,989 members · USA · Middle East · APAC · India
This week's threat watch
- IDENTITY LEAK
DHS "Icepick": 41,000 staff records from an SSO directory - CRITICAL · EXPLOITED
PHP2Shell: unauthenticated RCE in PHP, KEV deadline Oct 29 - SUPPLY CHAIN
LiteLLM 1.107.0 poisoned on PyPI and Docker - NATION-STATE
Storm-0940 hijacks ConnectWise app identities in M365 - BREACH
Railway and Zeabur: PaaS customer secrets exposed - PATCH TABLE
Plex2Shell, VeloCloud, Collabora, Siemens, GitLab 10.0
Upcoming events
Recent
Members only
Hear it from the CISOs who were in the room
Jim Routh on SolarWinds accountability. Bruce Schneier. Anton Chuvakin on practical AI. Members get every peer talk, the Monday threat briefing and closed-door roundtables in the USA, Middle East, APAC and India.
Join free — security leaders only →Free · approval within 48h · no vendor pitchesContact: contact@cisoplatform.com · +91 99002 62585
