< ciso
brief />
Telegram

Hello, stay ahead with CISO Brief 🚀

Every day the cybersecurity world moves fast — new incidents, evolving AI risks, changing regulations, and critical vendor updates. We cut through the noise to deliver only what matters most for your business and security strategy.

CISO Brief brings you a daily digest of high-signal news: major breaches, hyperscaler security releases, AI and compliance shifts, and the latest threat intelligence — all in one concise update.

Built for CISOs, CTOs, and architects, our goal is to save you time, reduce distraction, and keep you always on pulse with the risks and opportunities that shape tomorrow.

👉 Join our Telegram channel for your daily update — stay informed, stay ready.

Cybersecurity News Digest — Daily Briefings

Latest News

all posts →

Maximum-severity GitLab flaw risks CI/CD trust

🚨 GitLab disclosed CVE-2026-85706, a maximum-severity path traversal flaw in its repository commits API that can allow unauthenticated attackers to read arbitrary files with a single HTTP request. The bug affected Community and Enterprise editions and has been patched; GitLab urged self-hosted, public-facing instances to patch immediately or remove access. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, and threat intel already reports in-the-wild probes. Experts warn this poses broad risk because GitLab often links to build, deployment, and secret-bearing files.
GitLabPath TraversalCI/CD SecurityZero-Day Exploitation
read more →

Microsoft issues emergency Windows updates for RDS failures

🔧 Microsoft released out-of-band Windows updates on September 14 to address Remote Desktop Services (RDS) failures and related component crashes introduced by the September security updates. The fixes include updates for Windows 11 (KB5129194, KB5129195), Windows 10 (KB5129236), and Windows Server (KB5129235, KB5129237), and are available via Windows Update, WSUS, and the Microsoft Update Catalog. The Windows 11 updates also resolve a Hyper-V Plan9 share issue and some USB Audio Class 1.0 multichannel problems, though Microsoft is still working on remaining audio bugs.
MicrosoftPatch ReleaseSecurity Misconfiguration
read more →

Homebrew 7.0.0 adds GUI and stronger security

🛠️ Homebrew 7.0.0 introduces a native BrewUI graphical interface for macOS 14 “Tahoe” and later, a built-in vulnerability scanner (brew vulns), and a Homebrew-specific advisory database. The release also tightens sandboxing by blocking default access to users' home directories and separates network downloads from offline installs. Users will see faster installs through concurrent download and install operations.
Product UpdateVulnerability Management
read more →

Twitch extension with 30K installs exposes OAuth tokens

đź”’ A browser extension named Twitch Enhanced Viewer | JeetBot, listed in the Chrome and Firefox stores with over 30,000 installs, captures Twitch OAuth session tokens and transmits them to a commercial proxy service. Socket's analysis shows the extension appends the token as an auth= URL parameter when redirecting playlist requests, causing tokens to be logged in proxy server request logs. The vendor JeetBot, a Russian-language streaming/chatbot service, can therefore access those tokens and potentially hijack sessions.
OAuth App AbuseToken TheftSecret ExposureData Breach
read more →

Bruce Schneier: Upcoming Speaking Engagements 2026

🗓️ This notice lists Bruce Schneier's scheduled speaking engagements in late 2026. It includes an online League of Women Voters event on September 22, CanSecWest in Vancouver September 30–October 1, a Bentley University talk on "Free Speech and the Preservation of Democracy" on October 6, and a session at ATTENTION: Democracy, Rebuilt in Montreal on October 21. The previously announced Elevate Festival talk has been canceled.
News
read more →

MeshCentral backdoor used in 3BB broadband intrusion

🔎 Hunt.io discovered an active intrusion in Thailand ISP 3BB where an attacker installed MeshCentral as a hidden backdoor to maintain remote root access. The exposed server captured on June 3, 2026, contained tools, device lists, and scripts targeting RADIUS databases, FortiGate SSL‑VPN appliances, and internal portals. Cleanup scripts removed logs but deliberately left the agent to preserve persistence.
Remote Access TrojanActive ExploitationCritical Infrastructure
read more →

Telegram Desktop export flaw allowed hidden script

🛡️ Security researchers at ExPatch disclosed a Telegram Desktop flaw that let bot messages embed hidden JavaScript into HTML chat exports. The script executed when an exported HTML file was opened in a browser, allowing exfiltration or page modification, and persisted in previously exported files even after Telegram shipped a fix. Telegram patched the export escaping in July; users should update and re-export or treat old HTML exports as untrusted.
Vulnerability DisclosureCross-Site Scripting
read more →

AWS Security Reference Architecture PCI DSS Deep Dive

đź”’ Amazon Web Services publishes the AWS Security Reference Architecture (SRA) PCI DSS Deep Dive, providing prescriptive architecture-level guidance for organizations that store, process, or transmit cardholder data on AWS. The guide extends the core AWS SRA to map patterns to PCI DSS intent across account scoping, segmentation, encryption, logging, and access control. It includes downloadable diagrams and control mapping tables and can be used alongside SRA verify or with AWS Professional Services and partners for implementation.
AWSPCI DSSCloud Security
read more →

NVIDIA and Alibaba Models Added to SageMaker JumpStart

🚀 Amazon SageMaker JumpStart now includes NVIDIA's Qwen3.6-35B-A3B-NVFP4 and Alibaba's Wan2.1-T2V-1.3B-Diffusers models, expanding available foundation models for AWS customers. Qwen3.6-35B-A3B-NVFP4 is a Mixture-of-Experts model optimized for agentic coding, multimodal and long-context reasoning, quantized to NVFP4 to reduce memory footprint while supporting very long context windows. Wan2.1-T2V-1.3B-Diffusers targets lightweight text-to-video generation, delivering 480p clips on consumer GPUs with modest VRAM requirements. Deployments are available via the SageMaker JumpStart model catalog or the SageMaker Python SDK.
AWSNvidiaAlibaba CloudAmazon SageMaker AI
read more →

Mistral Ministral-3 Models Now on SageMaker JumpStart

🚀 Amazon SageMaker JumpStart now includes Ministral-3-3B-Instruct-2512 and Ministral-3-8B-Instruct-2512, two compact, vision-capable foundation models from Mistral AI designed for edge and resource-constrained deployments. These models offer multimodal understanding, multilingual instruction following, and native function calling, and can be deployed directly from the SageMaker JumpStart catalog or via the SageMaker Python SDK.
AWSMistral AIAmazon SageMaker AI
read more →

Gemma 4 31B models land on SageMaker JumpStart

📣 Amazon SageMaker JumpStart now offers Google DeepMind’s Gemma-4-31B-it-assistant and NVIDIA-quantized Gemma-4-31B-IT-NVFP4, bringing the Gemma 4 31B dense architecture to enterprise workloads in full-precision and optimized 4-bit FP4 variants. The assistant-tuned model supports multimodal reasoning, large 256K-token contexts, and native function calling, while the NVFP4 variant reduces memory footprint and speeds inference for cost-efficient production. Deployments are available via the SageMaker console or Python SDK.
AWSGoogleNvidiaAmazon SageMaker AI
read more →

New foundation models available in SageMaker JumpStart

🆕 Amazon SageMaker JumpStart now includes three new foundation models: granite-speech-4.1-2b, kanana-2-30b-a3b-instruct, and OpenFold3. These models span multilingual ASR and speech translation, bilingual Korean–English instruction-following and agentic workflows, and all-atom biomolecular complex structure prediction. Customers can deploy these models directly from the JumpStart catalog or via the SageMaker Python SDK to accelerate AI use cases on AWS.
AWSAmazon SageMaker AI
read more →

DDRop attack undermines cloud confidential computing

🔒Researchers disclosed DDRop, a cheap active interposer attack that silently drops writes to DDR5 memory, defeating freshness assumptions in Intel TDX, Scalable SGX, and AMD SEV‑SNP. The exploit requires brief physical access to insert a small board between CPU and DIMM and lets an attacker with existing software control read or manipulate protected VM memory. Vendors were notified and have acknowledged the findings; hardware redesign is needed for a full fix.
Cloud SecurityMemory CorruptionResearch
read more →

Red Heron exploits Gitea RCE to target sectors

🔎 Acronis TRU attributes a rapid, multi-country campaign to suspected China-linked actor Red Heron that weaponized a disclosed Gitea RCE (CVE-2026-60004) to compromise internet-facing instances. The operator scanned and exploited hundreds of servers, stole source code and secrets, and escalated to persistent access and lateral movement, including root control of a Proxmox cluster. Analysts identified a C++ implant JITTERLY and an LD_PRELOAD rootkit SIXZUT used to hide activity and maintain persistence.
China-nexusRemote Code ExecutionSupply Chain CompromisePersistence
read more →

FedRAMP Moderate for Quantum-Safe Security

đź”’ Palo Alto Networks has earned FedRAMP Moderate authorization for its Quantum-Safe Security (QSS) Automated Cryptography Discovery and Inventory solution, enabling immediate federal deployment. The authorization confirms QSS meets stringent federal security requirements and helps agencies protect sensitive, unclassified data while accelerating post-quantum cryptography (PQC) transition. QSS provides continuous cryptographic discovery, risk assessment, and actionable transition capabilities without requiring new hardware.
Palo Alto NetworksPost-Quantum CryptographyFedRAMP
read more →

Mass scanning of exposed Vite dev servers steals cloud secrets

🛡️ A large-scale campaign is scanning internet-exposed Vite development servers to extract AWS and Azure credentials by exploiting CVE-2026-39364 in affected Vite versions. F5 detected over 800 attacks and ~32,000 events, observing attackers append parameters like ?raw or ?import&raw to bypass file access controls and retrieve sensitive files. The operation targeted environment files, cloud credential/config files, Terraform and serverless state, and system files, using traversal and encoding tricks for evasion.
F5AWSMicrosoft AzureCloud Account Compromise
read more →

AI-assisted weaponization risks and developer findings

🔍 Anthropic disclosed that threat actors in northern Yemen used Claude models to support three weapons programs, including guided rockets and long-range missiles. The actors employed Claude Code to replace human engineers for GNC tasks, running multiple instances with divided roles to write, research, and review code. Anthropic’s safeguards blocked many requests but were circumvented through obfuscation and session-splitting. The actors test-fired a guided rocket and returned to Claude after a failure to diagnose issues.
AnthropicClaudeAI SecurityNation-State Actor
read more →

WordPress Adds Automated Plugin Security Reviews

🛡️ WordPress has introduced an automated security review for every plugin release before distribution via the WordPress.org update API to detect potential vulnerabilities and malicious code. The system, part of the Protect The Shire initiative, uses AI models and Jetpack Scan during a cooldown period to produce a security score; high-risk releases are blocked automatically. Developers are notified by email only when a release is blocked and must address findings to republish.
Software Supply Chain SecurityVulnerability Management
read more →