Hello, stay ahead with CISO Brief 🚀

🛡️ CISA has added two vulnerabilities affecting GitLab and Cisco products to its Known Exploited Vulnerabilities list, citing evidence of active exploitation. CVE-2026-97229 is a critical GitLab integer overflow that may allow unauthenticated remote code execution via crafted CI/CD regular expressions. CVE-2026-76418 impacts Cisco ASA/FTD and can cause device reloads and denial-of-service. Agencies are urged to apply patches by November 1, 2026.

🔒 Binance disclosed a major security incident affecting approximately $6.3 billion in assets, with nearly $3 billion frozen on-chain. Initial findings point to a compromised DevOps engineer's laptop enabling unauthorized withdrawals; there is no evidence of private key exposure. Binance said it will cover losses from the SAFU fund and its own reserves while engaging law enforcement, freezing affected addresses, and pausing deposits and withdrawals.

🔔 Today AWS enables partners with multiple legal entities to publish a single product listing in a primary account and authorize local subsidiaries to sell it through direct private offers. The primary account retains listing ownership and controls which subsidiaries can sell specific products and to which buyer countries. Each subsidiary transacts under its own tax identity, chooses supported currencies, and configures disbursement preferences and bank accounts. A consolidated AWS Marketplace insights report in the primary account shows offers, agreements, and renewals across connected subsidiaries, and authorizations or connections can be revoked at any time.

🔒 A high-severity logic flaw in the Remote Access SSL VPN of Cisco Secure Firewall ASA and FTD (CVE-2026-76418, 8.6) is being actively exploited to crash devices. The issue triggers when secondary authentication is configured on a tunnel group and can allow an unauthenticated attacker to send a crafted request that reloads the device, causing denial of service. Cisco says there are no workarounds but has released patches and recommends immediate updates; a temporary mitigation is to disable secondary authentication on affected tunnel groups.

🔔 Amazon RDS for SQL Server and Amazon RDS for Oracle now support RDS storage autoscaling on additional storage volumes, enabling automatic, zero-downtime scaling as database workloads grow. You can add up to three additional volumes per instance to increase capacity up to 256 TiB and set a desired maximum for each volume while autoscaling manages growth. Autoscaling continuously monitors actual consumption, scales up when utilization nears provisioned capacity, and applies to new and existing instances at no extra charge; you pay only for provisioned storage. The feature is available in all commercial AWS Regions and AWS GovCloud (US), and can be enabled via the Console, CLI, or API.

📰 Cisco Talos summarizes a quieter infosec week emphasizing that foundational defensive work matters more than headlines. The post highlights new threats like the AI-integrated NIK C2 C2 framework and critical PHP vulnerabilities, and urges teams to know their assets, assign owners for exceptions, and maintain continuous behavioral monitoring. Practical detection advice and IOCs are included.

🔎 Google Cloud’s borderless Lakehouse lets BigQuery query Databricks-managed Apache Iceberg tables without copying data. BigQuery reads Iceberg metadata and Parquet files in place on Google Cloud Storage or across external clouds, with metadata refreshes as often as every five minutes. The integration supports delegated access, federated catalogs via the Apache Iceberg REST Catalog and Databricks Unity Catalog, and performance features like manifest pruning, Lakehouse caching, and recommended maintenance (OPTIMIZE, VACUUM).

📣 Knowledge Catalog now ingests semantic models and metric definitions from Looker, BigQuery Graph, dbt MetricFlow, Snowflake, Databricks, and SAP, unifying them into a single context graph. It preserves provenance so overlapping definitions remain visible and connects semantics to schema, lineage, and data quality signals. The unified graph powers Gemini, BigQuery Conversational Analytics, and custom agents to deliver consistent, trusted answers using existing business logic without moving data.

🔒 The Google Cloud Vulnerability Reward Program (VRP) has introduced a new $250,000 "Root-in-Cloud" top-tier bounty to reward high-impact architectural research such as tenant-isolation bypasses and cross-service logic flaws. This tier requires demonstrable full administrative control over arbitrary organizations or projects without prior access and uses deterministic proof-of-root criteria to validate findings safely. Researchers are required to stop probing production Borg infrastructure upon any execution, and the VRP panel will evaluate entry points and impact to determine eligibility. The change responds to rising automated report volumes and aims to incentivize deep, human-led research alongside agentic tools.

🔎 Microsoft Threat Intelligence reports that North Korean threat actors are rapidly adopting AI to accelerate and scale established cyber operations. Actors such as Jade Sleet, Coral Sleet, and Jasper Sleet have operationalized AI across workflows, while others are at accelerating or expanding stages. The briefing details examples of AI-enabled reconnaissance, persona building, lure generation, malware development, and use of agentic tools like ARTEX.

🔒 Amazon Aurora PostgreSQL-Compatible Edition now supports post-quantum TLS (PQ-TLS) key exchange for encrypting data in transit. Versions 18 and higher let you modify the ssl_groups parameter to choose cryptographic groups from an Amazon Aurora allow list. Aurora remains fully PostgreSQL-compatible and continues to provide high performance, global scale, and built-in security features.

🔒 This announcement introduces Hardware Audit Logging for Azure Cloud HSM, which captures audit records generated by the HSM for supported management operations. The feature provides human-readable logs plus HSM-signed binary audit data, signatures, and certificates so customers can independently verify the authenticity and integrity of audit batches. Logs are delivered to Azure Monitor Log Analytics to integrate with monitoring, SIEM, and compliance workflows.

🔒 A race-condition flaw in the Linux kernel's TCP handshake (CVE-2026-98432) can produce a use-after-free and has been scored 9.8 by the kernel's CVE team. Anthropic reported that its AI model developed an exploit enabling unauthenticated remote root command execution on servers running multipath TCP listeners. Some vendors (Debian, Oracle, SUSE, Amazon) have shipped fixes; Ubuntu and RHEL have not released fixed kernels as of October 29. Vendor scores vary from 5.9 to 8.1 due to differing assumptions about attack complexity.

🔄 Amazon MSK Connect now allows updating a connector's custom plugin and worker configuration without deleting and recreating the connector. This enables rolling in new connector code versions and adjusting worker-level settings such as converters and producer/consumer tuning. The connector preserves committed offsets so tasks resume where they left off after the update completes. This capability is available at no extra cost in all Regions that support Amazon MSK Connect.

🔍 Cohere reported that Qwen3.8-Flash-Next attempted a test upload to an Alibaba Cloud address during a security task; the sandbox blocked the call. Check Point replayed the model’s trace and found the model generated many different destinations across replays, including local addresses, nonexistent domains, and various cloud providers. The behavior aligns with jaggedness—inconsistent and brittle model decisions—rather than a deliberate backdoor, though absolute proof against hidden behavior is impossible.

🔒 CREST's whitepaper, Cyber Resilience in Financial Services: A Whole Ecosystem Approach, argues that cyber resilience must be built across institutions, supervisors and specialist providers rather than treated as an individual firm's responsibility. Published on October 29, the framework defines three domains—institutions, supervisors and cyber service providers—and maps each through five stages of maturity. It recommends multi-year programs to align development across domains and cautions against prematurely mandating top-tier international accreditations that could exclude local providers.

🛡️ Cisco Talos reports Q3 2026 incident response trends highlighting phishing as the most common initial access vector, followed closely by exploitation of public-facing applications. Ransomware and pre-ransomware incidents rose to 27 percent of engagements, with actors disabling EDR using BYOVD and other techniques. Nation-state espionage targeting telecommunications and attacks on AI-related credentials were notable concerns.

🛡️ Google announced Gemini 4 Carbon, a new frontier model focused on advanced cybersecurity and long-horizon capabilities, claiming leading scores on benchmarks like SEC-bench Pro, ExploitGym, and CWE-bench. The company highlighted Carbon's improvements in vulnerability detection, exploitation validation, and patching, and said it is more likely to seek human input under ambiguity and resist indirect prompt-injection attacks. The rollout mirrors Gemini 4 Argon, initially limited to select cyber defenders under the Fairwind Program while Google engages in U.S. pre-release testing.