Hello, stay ahead with CISO Brief 🚀

🔒 This post demonstrates using ClusterNetworkPolicy (CNP) in Google Kubernetes Engine (GKE) to enforce cluster-wide, multi-tier networking controls. It describes an experiment protecting an LLM workload (Gemma 4) running on TPU-backed GKE nodes and shows how CNP admin, network policy, and baseline tiers interact. The setup includes a custom VPC, Cloud NAT, GKE Dataplane V2 (eBPF), and namespace-scoped NetworkPolicies to allow only authorized clients while blocking metadata access.

📝 A new Omdia report models the financial impact of Fortinet Unified SASE, using customer interviews across education, government, and healthcare to estimate a three-year 493% ROI and 47% lower TCO. The study models a 50,000-employee composite organization and attributes savings to reduced infrastructure costs, decreased administrative effort, vendor consolidation, improved productivity, and greater resilience. The report frames findings against rising infrastructure demands and recommends building a business case with organization-specific data.

🔍 Turla, a Russia-linked threat actor, has deployed a new toolset called Cereal on compromised Microsoft Exchange servers to collect targeted emails. ESET attributes the toolset to Turla with high confidence and identified victims in Kazakhstan and Romania, noting the servers were used as their own C2 infrastructure. Cereal runs in memory, uses encrypted payloads and unusual .NET execution techniques, and was configured at the Romanian victim to harvest NATO and EU correspondence.

🔍 Datadog's State of Cloud Security 2026 found a sharp rise in high and critical vulnerabilities in cloud workloads after the release of frontier AI models. The median count climbed from four in May to 14 in June and 16 by November, driven largely by vulnerable third-party libraries identified via Datadog Code Security. The report also warns about long-lived credentials for AI inference and CI/CD pipelines and urges use of short-lived identities and dependency cooldowns to reduce risk.

🛡️ Check Point was recognized as a Leader in The Forrester Wave™: Enterprise Firewall Solutions, Q4 2026, scoring highest in current offering and receiving strong customer feedback. The post emphasizes the shrinking window between vulnerability disclosure and exploitation, underscoring the need for proactive, preemptive protection across all environments. It highlights unified policy management, AI-driven runtime threat intelligence, and flexible subscription pricing as key strengths.

🛡️ Microsoft researchers used their AI-powered Hyenas system to uncover multiple memory-safety and undefined-behavior bugs in Rust’s standard library, including a nearly 11-year-old issue in process::exit. Two of the findings affect stable Rust and could lead to use-after-free or incorrect signal handling under unusual conditions. The team reproduced issues, reported fixes to Rust maintainers, and assessed practical exploitation as unlikely.

⚠️ Binance warned that an iOS sandbox escape published on GitHub can let apps read other apps' files on iOS 26 and 27, potentially exposing seed phrases, private keys, and credentials. The exploit, released by researcher forcequit as "worse_query," can access app data containers and some system folders; a file manager built on it (WQ Files) demonstrates reading and modifying data without jailbreaking. Apple’s recent iOS updates do not list a fix, and Binance urged users to delete untrusted apps, update software, and move funds if they suspect compromise.

🔒 Security researchers discovered administration consoles for two automakers' login servers that still accepted ForgeRock OpenIDM default credentials, enabling account takeover. They bypassed a web application firewall, changed account details on a test account, and remotely unlocked and started a vehicle while exposing telemetry and location. Both affected automakers remediated the issue within hours; a related Australian incident involved hardcoded admin credentials and MFA misconfiguration.

🔒 Researchers from Wiz, Sentra, and Mandiant detailed a supply-chain attack (Oct 14–26) in which an attacker abused Qubole’s AWS IAM credentials to assume cross-account roles in dozens of customer environments. The intruder enumerated resources, accessed Secrets Manager and Parameter Store, downloaded S3 buckets, and harvested credentials including AWS keys, Microsoft Entra ID service principal secrets, and Okta OAuth client credentials. Investigators found role-assumption requests originating from VPN and OVH-hosted IPs and a suspicious ISO image named sso_agent.iso on attacker infrastructure. Wiz recommends auditing CloudTrail, removing unused integrations, and tightening trust policies and network conditions.

🩺 Gemini for healthcare is a purpose-built industry solution that extends the universal Gemini agent to orchestrate clinical, financial, and administrative workflows while preserving enterprise-grade access controls and governance. It offers reusable skills, secure connectors to EHRs, claims and operational systems, an open partner ecosystem, and a governed platform with model choice to support HIPAA requirements. Available in preview in the U.S., it aims to reduce clinician administrative burden and improve payer-review and patient coverage transparency.

🛑 Vanderbilt University reported an active cyber incident on November 9 that prompted shutdowns of systems and applications and advisories to disconnect devices from campus Wi‑Fi. The university urged the community to power down university devices and monitor for unusual activity such as unexpected pop‑ups, file changes, or authentication prompts. By the evening update, campus Wi‑Fi, classes and student services were confirmed operational, but access to most systems and applications remained restricted while Vanderbilt IT works with government partners. Cyber intelligence reports suggest the BYOD ransomware group has claimed responsibility and listed stolen data on its leak site.

🛒 French authorities have attributed a coordinated October cyber-attack that disrupted refrigeration controls at some 700 supermarket sites to Iranian-linked hacking groups. Investigators cited links to the IRGC-affiliated Shahid Kaveh and Shahid Shoostari units, IP addresses pointing to Iran, Farsi artifacts in forensic traces, and matching TTPs. CERT-FR named three alleged leaders and France has opened a judicial probe while preparing diplomatic and punitive responses.

🔒 Apple released updates to fix two iMessage vulnerabilities that could allow a remote attacker to join a group chat and, separately, access messages sent before being added. The company also patched a Brotli compression library flaw and multiple Bluetooth and AirPlay issues across iPhone, iPad, and Apple Watch releases. Some recent builds for specific models do not yet list the iMessage or Brotli fixes, and Apple did not disclose whether the issues were exploited or whether updates must be applied by all group members to be protected. Security advisories identify the iMessage flaws as CVE-2026-113961 and CVE-2026-113960, and the Brotli decoder out-of-bounds write as CVE-2026-111497.

🛡️ Turla, a Russia-aligned threat actor, is using a newly identified modular espionage framework called Cereal to infiltrate Microsoft Exchange servers and harvest emails. ESET observed Cereal in late 2025 against government targets in Kazakhstan and Romania; the toolset operates stealthily by executing .NET components in memory, abusing Exchange processes, and avoiding external C2 infrastructure. Cereal includes multiple components that load, inject, and run assemblies, and a specialized module, CerealBox, that filters and exfiltrates attachments and messages of interest.

🔒 SAP's November Patch Day addressed four remote‑exploitable vulnerabilities, each rated CVSS 10.0, across NetWeaver components and Web Dispatcher. Three affect the NetWeaver application server (ICM, SAML2 service provider, Gateway) and one affects the Web Dispatcher; none require user interaction. The issues can allow unauthenticated attackers to run code, impersonate internal servers, or log in as arbitrary users, and SAP provides individual notes with versioned fixes.

🔍 Anthropic released Claude Fable 5.2 and Mythos 5.2, improving software engineering and vulnerability detection while reducing API prices by 20%. Fable is generally available; Mythos access is restricted to vetted cyber and life sciences customers. Both models share the same core but differ in safeguards, are faster, and show marked gains on coding and CVE rediscovery benchmarks. Data retention and operational reliability remain key enterprise considerations.

🔍 Binance is investigating claims by extortion group ShinyHunters that it holds 335.9 million customer records, including KYC documents and wallet keys. The group demanded $900,000, but Binance says the sample data suggest a scam rather than a systems breach and found no evidence of compromised internal infrastructure, plaintext passwords or custodial private keys. The exchange warned users to watch for phishing attempts, while also managing fallout from a separate $6.3bn theft and ongoing laundering via meme coins.

🛡️ France says an October cyberattack on refrigeration controllers at roughly 700 retail sites was conducted by the IRGC-linked unit Shahid Kaveh, causing food losses and at least 15 fires. Attackers changed defrost settings and disabled temperature alerts by exploiting web interfaces on Danfoss and Dixell controllers, and some Schneider Electric devices showed reconnaissance activity. French authorities opened a judicial probe, seek international warrants, and plan to summon Iran's ambassador while urging new sanctions. CERT-FR issued mitigation guidance including removing internet exposure, updating firmware, and using VPNs or protected networks.