Today on CISO Series…
Security You Should Know:”Proving Defense with Horizon3″
In todays cybersecurity news…
Cybersecurity jobs report reveals mixed bag
ConnectWise suspends cloud backup after supply chain attack
The IT management software provider took this action on Saturday, disabling sevenConnectWiseapplication identities as it “continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants.” It has also suspended Cloud Backup service by revoking certificates used for affected application connections across all users. The company adds scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable.
Drupal patches critical RCE flaws, warns of exploits
Engineers atDrupal, a free, open- have patched two critical vulnerabilities that “could allow attackers to execute code remotely on websites running any of its supported versions. Admins are urged to apply updates promptly, because, as the security team states, “exploits might be developed within hours or days.” According to the Drupal website, more than one million websites run on the system
Chinese espionage attackers suspected of BeyondTrust zero-day
Mandiant (part of Google Cloud), theGoogleThreat Intelligence Group (GTIG), andBeyondTrustitself all confirmed the zero-day last Thursday evening. An alleged Chinese state-backed group is using a new zero-day in the BeyondTrust software to conduct espionage attacks. The CVE numbered vulnerability (CVE-2026-102764) affects its Remote Support appliances that “enable IT teams to securely access and troubleshoot remote endpoints.” A patch has been released. The group behind the attacks, named Armory Castle or UNC5221, used a “deep understanding of BeyondTrust appliance internals” to achieve its goals.
Big thanks to our sponsor,ThreatLocker
Proofpoint to acquire Varonis’ data security
This is set to occur as an all-cash transaction worth $6.3 billion. The combined company will “serve more than 16,000 enterprises and millions of organizations globally, creating one of the world’s leading pure-play cybersecurity companies and establishing the industry’s largest data and AI cybersecurity organization,”Proofpointsaid in its announcement made last Thursday.
Burger King Japan data breach exposes 11 million customer records
The Japanese subsidiary of global fast-food giant Burger King has disclosed a major data breach involving just over 11 million customer records. The data was stolen in the first week of October and has been leaked online. The servers that were breached stored the PII of users of the company’s official smartphone app, but did not store customer credit card numbers, company representatives said, adding that they had found no evidence that the threat actors accessed user credentials.
BAE Systems cyberattack disrupts U.S. federal court operations
The attack has taken down the notice system used by federal bankruptcy courts says theAdministrative Office of the United States Courts(AOUSC). This includes a halt to the production and distribution of bankruptcy notices. “BAE Systems is actively investigating this incident and working to restore operations,” it added. The disruption means “access to systems and websites that BAE Systems operates on behalf of the Judiciary and the related bankruptcy noticing process are unavailable at this time. A list of the affected sites is available in the show notes. Court systems affected:bnc.uscourts.gov,bankruptcynotices.uscourts.gov,notices.uscourts.gov, and the National Creditor Registration Service.
CikaBika Bot RAT abuses Discord
This malware is distributed via document-themed lures and provides reconnaissance, remote execution, and data exfiltration capabilities on infected systems. “Victims receive a PDF file containing a disk image with a Windows shortcut (LNK) posing as a Word document. Once opened, it displays a decoy document and launches a hidden PowerShell process to decode and run an embedded executable.” Its final payload is the CikaBika Bot RAT, which “immediately registers the infected machine withDiscordand starts its reconnaissance routine, harvesting system information, processes, and network configuration, and taking screenshots.”
