Frontline Education Breach Impacts K-12 School District Staff
https://www.infosecurity-magazine.com/news/frontline-education-breach-k12/
Cyber extortion group comes forward as culprit behind Slate Valley School District attack
https://www.rutlandherald.com/news/local/cyber-extortion-group-comes-forward-as-culprit-behind-slate-valley-school-district-attack/article_b103977f-99fa-5e7f-9d51-021f9a4ce9cc.html
Cybersecurity incident affects local server at Indiana Area School District in Pennsylvania
https://dysruptionhub.com/indiana-area-district-cyber-incident/
Ransomware disrupts University of Illinois Chicago medical school; hackers steal data
https://dysruptionhub.com/uic-college-medicine-ransomware/
Ransomware group threatens to leak customer data from top insurance companies in South Africa
https://databreaches.net/2026/10/05/ransomware-group-threatens-to-leak-customer-data-from-top-insurance-companies-in-south-africa/
University of Illinois Chicago affected by ransomware attack on medical school
https://therecord.media/ransomware-university-illinois-chicago
Legacy sign-on service comes back to bite school software provider Bromcom
https://www.theregister.com/security/2026/10/06/legacy-sign-on-service-comes-back-to-bite-school-software-provider-bromcom/5301156
https://news.lavx.hu/article/legacy-sign-on-service-comes-back-to-bite-school-software-provider-bromcom
CISA’s K-12 Cybersecurity Foundations
https://www.i-programmer.info/news/149-security/19195-cisas-k-12-cybersecurity-foundations.html#google_vignette
Counter-fraud educational materials from Cifas and PSHE Association
https://www.educatemagazine.com/counter-fraud-educational-materials-from-cifas-and-pshe-association/
Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds
https://www.infosecurity-magazine.com/news/affiliate-doublecrosses-raas/
Ransomware disrupts Vicksburg utility payments
https://www.vicksburgpost.com/news/ransomware-disrupts-vicksburg-utility-payments-e9f5b884
Kimberly School District warns parents after phishing email targets students
https://www.wbay.com/2026/10/07/kimberly-school-district-warns-parents-after-phishing-email-targets-students/
Clio, Mich., Schools Targeted by Phishing Scam
https://www.govtech.com/education/k-12/clio-mich-schools-targeted-by-phishing-scam
Clio schools warns of phishing scam emails from ‘compromised’ district account
https://www.mlive.com/news/flint/2026/10/clio-schools-warns-of-phishing-scam-emails-from-compromised-district-account.html
Are you oversharing online? Learn the risks before scammers make you their target
https://www.bitdefender.com/en-us/blog/hotforsecurity/oversharing-online-scams-deepfakes-privacy
Why DNS and Content Filtering Are K–12’s Most Versatile Security Tool
https://edtechmagazine.com/k12/article/2026/10/why-dns-and-content-filtering-are-k-12s-most-versatile-security-tool
DOJ charges ransomware recovery CEO for secretly paying hackers
https://therecord.media/ransomware-recovery-charges-doj
APS Cybersecurity Month: AI-Powered Phishing
https://www.aps.edu/news/news-from-2026-2027/aps-cybersecurity-month-ai-powered-phishing
FMCSA Warns of Fraudulent Emails Targeting Motor Carrier Registrations
https://stnonline.com/news/fmcsa-warns-of-fraudulent-emails-targeting-motor-carrier-registrations/
Cybersecurity expert warns shoppers to be on the lookout for scams as the holiday season approaches
https://www.wfxg.com/community/cybersecurity-expert-warns-shoppers-to-be-on-the-lookout-for-scams-as-the-holiday-season/article_f3c1c63c-07e8-4824-8911-8253cbc319b9.html
Santee School District Foundation
https://www.ransomware.live/id/U2FudGVlIFNjaG9vbCBEaXN0cmljdCBGb3VuZGF0aW9uQHRoZWdlbnRsZW1lbg
Zscaler: GenAI Tools Fuel Ransomware’s $432K Payouts [2026]
https://shattered.io/zscaler-genai-ransomware-432k-payouts-2026/
TTY Logs and the Data it Captures
https://isc.sans.edu/diary/TTY%20Logs%20and%20the%20Data%20it%20Captures/33396
Citrix Netscaler SAML Vulnerability (0-Day) CVE-2026-88779
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/
Microsoft Exchange September 2026 V2 Update CVE-2026-96940
https://techcommunity.microsoft.com/blog/exchange/released-september-2026-v2-exchange-server-security-updates/4561718
More RMM Tools In the Wild
https://isc.sans.edu/diary/More%20RMM%20Tools%20In%20the%20Wild/33400
WORDPRESS LIBHEIF RCE
https://fortbridge.co.uk/research/wordpress-libheif-rce/
SONICWALL SMA1000 SERIES APPLIANCES Vulnerabilities CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017
OpenSSH 10.6 Released
https://seclists.org/oss-sec/2026/q4/58
DNSSEC Root Key Signing Key Rollover
https://blog.cloudflare.com/root-ksk-2024-rollover/
Scans for Atlassian vulnerablity (CVE-2026-21589)
https://isc.sans.edu/diary/Scans%20for%20Atlassian%20vulnerablity%20%28CVE-2026-21589%29/33406
.gh, .sl and .as ccTLD Compromise
https://blog.google/security/chromes-response-to-recent-cctld-registry-hijacks/
Cisco Nexus 3000 and 9000 Series Switches Remote Code Execution Vulnerabilities
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU
Outlook Blocking MSIX Files
https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-to-block-msix-attachments-used-in-attacks/
In today’s episode: new scripts for reconstructing AI agent activity during forensic investigations, an attacker’s Claude chat history recovered after breaches at South Korean financial institutions, internationalized domain name (IDN) lookalikes that still get past Chrome, and an unpatched Cisco Finesse server-side request forgery (SSRF) vulnerability.
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review
Jim Clausing released two scripts that turn the logs left behind by the OpenCode and Hermes AI agents into searchable JSON, so incident responders can see what an AI agent did on an attacker’s or a victim’s system.
https://isc.sans.edu/diary/Reconstructing%20AI%20Agent%20Activity%3A%20Two%20New%20Scripts%20for%20Forensic%20Review/33410
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
While investigating breaches at South Korean financial institutions, CrowdStrike recovered the attacker’s CLAUDE.md file and Claude chat history, a rare look at how a low-skill “prompt kiddie” uses AI to run an attack.
https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
Turning IDN Edge Cases into Typosquats
Attackers can still register convincing lookalike domains using Unicode characters that resemble Latin letters but are not on Chrome’s list of known confusables. One test domain impersonating Apple displayed in Chrome but not in Safari.
https://haveibeensquatted.com/blog/turning-idn-edge-cases-into-typosquats
Cisco Finesse SSRF Vulnerability (CVE-2026-20362)
Cisco disclosed an unauthenticated server-side request forgery vulnerability in the Cisco Finesse web-based management interface, rated High (CVSS 7.2). Details are already public, there is no workaround, and fixed releases are not expected until January or February 2027.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS
In today’s episode: why the Traffic Light Protocol (TLP) should not replace internal data classification, a server-side request forgery (SSRF) flaw in Amazon Bedrock AI agents that exposed credentials through the EC2 instance metadata service (IMDS), and ransomware groups exploiting a Palo Alto Networks GlobalProtect authentication bypass.
Why TLP Should Not Replace Your Internal Information Classification
The Traffic Light Protocol from FIRST defines who threat intelligence may be shared with, from TLP:CLEAR to TLP:RED, but not how to protect it in transit. Organizations still need their own classification and safeguards, such as encryption, instead of sending TLP:AMBER data in plain email.
https://isc.sans.edu/forums/diary/Why%20TLP%20should%20not%20replace%20your%20internal%20information%20classification/33414/
AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model
Zenity Labs found a now-fixed server-side request forgery vulnerability in Amazon Bedrock AI agents. A prompt could make an agent fetch and reveal credentials from the EC2 instance metadata service, made possible by IMDSv1 and overly broad permissions. Restrict the URLs your AI agents can reach and always use IMDSv2.
https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model
Palo Alto GlobalProtect VPN Vulnerability Exploited by Ransomware (CVE-2026-0257)
ReliaQuest reports ransomware actors exploiting an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access to open unauthorized VPN sessions. Patch VPN gateways, and keep VPN clients updated too.
https://x.com/ReliaQuestTR/status/2108647641240465707
https://security.paloaltonetworks.com/CVE-2026-0257