Show notes
HTTP2Shell sparks emergency patches
https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/
PHP2Shell: patch, then investigate
https://www.securitymagazine.com/articles/102693-php2shell-exploited-in-the-wild
GitHub worm hides in oversized files
https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570
Cathedral gets inside Anthropic
https://www.washingtonpost.com/technology/2026/10/26/researchers-cybersecurity-start-up-cathedral-got-inside-anthropic/?pwapi_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZWFzb24iOiJnaWZ0IiwibmJmIjoxNzkyOTg3MjAwLCJpc3MiOiJzdWJzY3JpcHRpb25zIiwiZXhwIjoxNzk0MzczMTk5LCJpYXQiOjE3OTI5ODcyMDAsImp0aSI6ImI1M2RjZmEzLThkNTItNGE3NC05ZjI4LWU1ZGJkZTIyZDFmOSIsInVybCI6Imh0dHBzOi8vd3d3Lndhc2hpbmd0b25wb3N0LmNvbS90ZWNobm9sb2d5LzIwMjYvMTAvMjYvcmVzZWFyY2hlcnMtY3liZXJzZWN1cml0eS1zdGFydC11cC1jYXRoZWRyYWwtZ290LWluc2lkZS1hbnRocm9waWMvIn0.k3b70wv6ePisrPvCYfDOPAjt5vHweVxm4rBnhcnDU-M
Ukraine's satellite service returns
https://therecord.media/ukraine-disputes-musk-claims-of-starlink-misuse
Gheist raids GitHub secrets
https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets
Fake Teams support delivers ransomware
https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html
Scam laundering suspect extradited
https://therecord.media/dutch-police-extradite-chinese-national-money-laundering-scams
Get the show notes here:
https://cisoseries.com/cybersecurity-news-october-27-2026/
Huge thanks to our sponsor, Guardsquare
Your backend is only as secure as your frontend. Research shows that client-side compromise is now a primary driver of API risk. With sixty-three percent of leaders detecting mobile app tampering or cloning last year, don't leave your mobile app security to chance. Get multilayered protection for your entire mobile app ecosystem from the outside in. Learn more at Guardsquare.com.
Website: cisoseries.libsyn.com
