Hello, stay ahead with CISO Brief 🚀

🔍 Cloudflare examined traffic impacts after reported strikes on Yandex data centers, which caused dramatic drops in HTTP volume for two Yandex ASNs: AS13238 (Search) and AS200350 (Cloud). Using Cloudflare Radar and Bot Management, the team found both ASNs saw reduced traffic but with different automation profiles: Yandex Search was overwhelmingly verified crawler activity, while Yandex.Cloud showed unverified, app-like bot traffic. The outage reduced requests from those networks but did not produce measurable, lasting reductions in global malicious or social media manipulation traffic.

🔒 This post describes using AWS Continuum for penetration testing as a post-deployment gate in CI/CD pipelines. It explains how Continuum scopes tests to the commit range of the deployed change, runs server-side in your AWS account, and can block promotion when validated exploitable findings meet a chosen severity threshold. The article outlines setup, OIDC authentication, policy scoping, provider-specific considerations, and rollout guidance.

🛡️ The U.S. Department of Justice disrupted the Famous Chollima (WageMole) network by charging 14 individuals, arresting two U.S. nationals, and seizing about 187 laptops linked to North Korean remote IT worker schemes. Operation "Lonestar Roundup" involved searches of 40 residences in Texas where facilitators hosted employer-issued devices used to mask DPRK operatives. CrowdStrike has tracked these schemes since April 2025, noting methods like fake theft reports and address rotation to divert shipments. An Ohio indictment describes a scheme from 2019–July 2025 that impacted 70 companies and generated roughly $3 million for the threat actors.

🔒 Cisco patched a critical zero-day (CVE-2026-76519) in its Secure Email Gateway involving a relative path traversal in the AMP File Reputation feature that allows remote unauthenticated actors to write files and execute commands as root. Affected devices have Content Scanner Tools prior to 25.3.0.5525 with File Reputation enabled; admins should check versions via contentscannerstatus and verify AMP settings in mail policies. Cisco provided IOCs, has deployed cloud mitigations, and urged customers to inspect logs, restore compromised devices, rotate credentials, and restrict appliance access.

🔍 Microsoft, Health-ISAC, JC3 and private-sector partners disrupted three Chinese-language phishing kits — CoGUI, Haozi and Iron Man System — linked to a marketplace called YAM Store. The court-authorized operation follows an investigation launched in late 2025 after targeted campaigns in Japan; since January 2026 the kits helped send over one billion phishing emails and SMS messages. Microsoft attributes the kits and marketplace to interconnected actors tracked as Storm-2990 and Storm-3119, who used compromised cloud environments and automated tooling to scale credential-stealing campaigns against organizations worldwide.

🔒 AWS License Manager now supports in-place upgrades of EC2 Ubuntu LTS instances to Ubuntu Pro from the AWS Marketplace, enabling security and compliance improvements without rebuilding AMIs or migrating workloads. Ubuntu Pro subscriptions deliver up to 10 years of security patching (extendable to 15 years with the Legacy add-on), coverage for thousands of additional packages, and Kernel Livepatch to apply critical fixes without reboots. Customers can upgrade during the conversion workflow if they already have an Ubuntu Pro subscription through the Marketplace or subscribe from the AWS License Manager console. The feature is available in all commercial regions where AWS License Manager operates.

🔑 Amazon SageMaker Studio now allows new users to sign up using Google, GitHub, or Apple credentials and land in a fully configured Studio environment without creating a traditional AWS account or providing a credit card. The change removes console navigation and IAM setup for first-time users, enabling immediate model fine-tuning, evaluation, and deployment. Teams can invite collaborators by email, who sign in with their own social credentials to access shared Studio resources without configuring IAM users or permissions.

🧬 AWS HealthOmics now supports a resource fallback directive for Nextflow tasks, allowing users to specify an ordered list of preferred accelerator types and an optional CPU fallback. This feature automatically cycles through alternatives when a preferred accelerator is unavailable, with configurable timeouts per accelerator profile to control wait behavior. The capability is available in multiple AWS HealthOmics Regions and aims to reduce resubmissions and keep bioinformatics workflows running smoothly.

🧭 Stephanie Kiel outlines Google Cloud’s new public Gemini Notebook, Prepare for Post-Quantum Cryptography, designed to help CISOs, executives, and policymakers understand and act on PQC risks. The notebook aggregates Google’s research, engineering blogs, migration guidance, and interactive tools — including Q&A, audio overviews, flashcards, and visualizations — to accelerate organizational readiness. Google emphasizes urgent timelines, recommends migration planning by 2029, and provides practical steps for building crypto-agility and internal PQC playbooks.

🧾 Google Cloud describes token-based cost management for BigQuery generative AI functions, now GA, enabling administrators to set daily quotas for input and output tokens at project and per-user scopes. The post lists four quotas, explains global aggregation and inclusion of "thinking" tokens, and notes embedding functions are excluded. It shows how to view and edit quotas in IAM & Admin, warns about required permissions, and highlights programmatic management via APIs and Terraform.

🔒 Microsoft’s October Patch Tuesday addresses a record 1,414 vulnerabilities and introduces grouped risk cohorts to help organizations rapidly assess exposure. Of these, 1,102 affect Windows, with many leading to privilege escalation and remote code execution. A single actively exploited zero-day (CVE-2026-96951) in Windows Shell was patched, and several high-impact flaws across Microsoft, Adobe, and SAP warrant immediate attention. Vendors continue to see surge in discoveries, some attributed to neural networks.

🔒 Phishing techniques have evolved as AI enables highly polished, personalized lures that hide familiar warning signs. Attackers use AI to scale spear phishing, generate convincing domains, and produce synthetic media to impersonate trusted contacts. Organizations must shift emphasis from spotting poor grammar to validating identity, context, and intent, and enforce independent verification and established approval processes.

🔒 The Fortinet AI-Enabled OT Security Platform consolidates visibility, segmentation, secure remote access, and AI-driven operations to address rising ransomware and geopolitically motivated threats targeting industrial environments. It pairs independently validated development and product certifications with ruggedized connectivity and OT-specific controls to help organizations reduce risk from unpatched devices and modernize securely. The platform adds FortiOS enhancements, FortiGuard virtual patching, and expanded industrial hardware to extend protection across distributed operations.

🔧 Microsoft resolved a Windows 11 Always On VPN failure introduced by the September 2026 security updates. The bug impacted connections when automatic protocol selection or fallback (IKEv2/SSTP) was used, leaving VPNs stuck in a Connecting state or reporting "The specified port is already in use." The company released KB5127648 and KB5127646 cumulative updates and provided a temporary mitigation to force a single tunneling protocol until the patch is applied.

📝 The U.K. has imposed sanctions on Cryptomus (aka Certa Payments, Xeltox, Heleket) for processing cryptocurrency payments that benefit Russian state-linked actors and help cybercrime. The measures freeze Cryptomus assets in U.K. banks and bar British firms from dealing with it; related platforms VexPay, TokenSpot and Tsunami Payments are also targeted. Sanctions follow prior Canadian fines and long-running investigations that linked the service to ransomware, darknet markets and other illicit activity.

🛡️ Security researchers at Vedere Labs (part of Forescout Research) discovered a server hosting a panel called ROMULUS while investigating an incident, revealing a reusable ClickFix delivery platform. The ROMULUS ecosystem appears capable of distributing multiple payloads and was linked to at least six servers, suggesting toolkit-style reuse by various cybercriminals. Analysts observed tactics to evade detection, including encrypted archives with oversized executables used to deliver LegionLoader and other malware.

🛡️ Microsoft uncovered a Chinese-language cybercriminal ecosystem comprising phishing kit developers, an access broker marketplace (YAM Store/Storm-3119), and downstream operators. The kits—CoGUI, Haozi, and Iron Man System (Storm-2990)—enabled the distribution of over one billion phishing emails and SMS messages since January 2026, targeting healthcare, finance, distribution, and IT organizations across multiple countries. Microsoft and partners disrupted the developers and infrastructure in coordination with law enforcement.

🔧 Hyperdrive now supports MySQL and the feature is generally available after a beta period focused on reliability and real-world usage. Hyperdrive is Cloudflare’s distributed connection pooler for Workers that holds warm SQL connections, shares them across requests, and can cache query results in the CDN. The team fixed encoding and protocol-translation bugs — including charset negotiation and capability mismatches — and adjusted caching to store a canonical result format. These fixes raised connection success rates to 99.99% and MySQL support is ready for customers to create Hyperdrives via dashboard or wrangler.