Cybersecurity Today

Microsoft 365 Supply-Chain Break-Ins via ConnectWise, US Bankruptcy Notices Down, Phishing Market Takedown, BeyondTrust Zero-Day, Japan Cyber Emergency
Cybersecurity Today Host David Shipley covers multiple incidents: ConnectWise shut down its cloud backup service after an attacker stole the app credential and used its broad Microsoft 365 permissions to access at least 173 customer tenants in a supply-chain attack, with guidance to disable affected apps and review service principal sign-ins.
A cyberattack on BAE Systems knocked out the U.S. federal Bankruptcy Noticing Center, halting all bankruptcy notices with no restoration timeline. Microsoft and Health ISAC seized domains of three Chinese-language phishing marketplaces tied to over a billion malicious messages and disabled thousands of related accounts.
Forescout detailed Romulus, a ClickFix-based malware delivery platform serving LegionLoader and other payloads. Google/Mandiant reported Armory Castle exploiting a BeyondTrust Remote Support zero-day (CVE-2026-102764).
Japan declared its first-ever cybersecurity state of emergency after a breach and cascading ransomware impacts.
00:00 Top Stories Preview
00:34 ConnectWise Backup Breach
02:54 Bankruptcy Courts Outage
04:37 Phishing Markets Takedown
06:28 Romulus Malware Platform
08:54 BeyondTrust Zero Day
11:28 Japan Cyber Emergency
13:06 Wrap Up and Sign Off

ShinyHunters Arrests, Ransomware Negotiator Ethics,  Refrigerators Turned Into Ovens and UnPatch Wednesday, Part Two?
A Cybersecurity Today panel with Michael Joyce, Laura Payne, and David Shipley discusses major recent stories: the ShinyHunters gang's alleged hack of FBI personnel data and a string of arrests including a Canadian cybersecurity executive, raising ethical and legal concerns around the ransomware negotiation industry and calls for vetting or licensing. They also cover allegations that MonsterCloud charged customers for "proprietary" decryption while actually paying ransoms and skimming large margins. The group examines cyber-physical attacks after French grocery stores reportedly had refrigeration systems driven to 50°C, destroying food, with debate over motives, exposed internet-connected devices, and the need for firmware and configuration strategies. The conversation touches on AI doomerism and the Hugging Face/OpenAI incident as misdirection versus basic security failures, then ends on Microsoft's record-breaking Patch Tuesday and the emerging reality of "Unpatch Wednesday," questioning the sustainability of monthly bulk patching.
00:00 Welcome and Panel Intro
00:45 ShinyHunters FBI Hack Fallout
03:53 Ransom Negotiation Ethics
10:15 MonsterCloud Decryption Scam
14:05 Fridge Hacks Destroy Food
17:15 Why Smart Fridges Exist
21:38 Firmware Risk and Strategy
22:57 Grocery Cybersecurity Reality
25:05 Practical Mitigations for Chains
26:28 Food Chain Cyber Lessons
27:23 Grocery Ransomware Fallout
29:01 Lockout Switch Fix
29:56 AI Botnet Doom Debate
32:48 Hugging Face Missed Alarms
36:19 Centralized vs Local AI
40:29 Patch Tuesday Chaos
42:09 Unpatch Wednesday Reality
46:41 Simpler OS Future
47:44 Wrap Up and Thanks

Zero-Click Spyware Ads, Palo Alto Firewall Zero-Day, Critical Drupal Flaw, and OpenAI Bugging Charge
Cybersecurity Today Host David Shipley reports on Citizen Lab findings that Israeli spyware maker Candiru, now reportedly rebranded as Integrity Labs, used targeted online ads bought through DiscoverTech's Controlium platform to profile and, in some cases, zero-click infect Al Jazeera journalists' devices, with ad-bid records showing broad reach across nearly 200,000 sites and apps and extensive profiling of sensitive networks; Google and IAB Europe have cut off DiscoverTech.
The episode also covers active exploitation of Palo Alto Networks PAN-OS management interface zero-day CVE-2026-0322, the company's patches and mitigation guidance, and CISA adding it to the KEV catalog. The show details Drupal's critical Field UI RCE flaw CVE-2026-1080-97, noting many sites run unsupported branches with no fix.
Finally, we cover charges that an OpenAI engineer planted encrypted recording devices in an executive conference room.
00:00 Top Stories Preview
00:27 Zero Click Spyware Ads
02:08 Ad Industry Fallout
03:09 Palo Alto Firewall Zero Day
04:17 How to Patch and Mitigate
05:13 Drupal Critical RCE Risk
06:35 No Fix for Many Sites
07:26 OpenAI Meeting Room Bugging
09:46 Wrap Up and Listener Notes

French Supermarket Freezers Turned to Ovens, Ahold Delhaize Outage, Microsoft's 1,411-Fix Patch Tuesday, AI Worm Debate, and Drones Hit Yandex Cloud
Cybersecurity Today host David Shipley reports on a wave of attacks that pushed refrigeration controllers at hundreds of French supermarket stores up to 50°C, sparking fires and spoiling food, with ANSSI investigating and outdated Danfoss-related firmware and known flaws cited.
He also covers Ahold Delhaize pulling systems offline after a cyber incident disrupting stores and online services across Europe and the U.S.
Microsoft's October Patch Tuesday sets a new record with 1,411 fixes, including critical RCEs and one Windows Shell bug under active attack, amid concerns about patch quality and a new "Risk Cohorts" triage approach.
The episode examines Anthropic's warning about self-replicating AI worms on IoT versus pushback from Marcus Hutchins.
Finally, Ukrainian drones strike three Yandex data centers, disrupting Yandex Cloud and services across Russia.
00:00 Top Stories Teaser
00:33 Freezers Turned Ovens
02:58 Food Supply Chain Hits
03:40 Exposed Danfoss Systems
03:56 Ahold Delhaize Outage
06:02 Record Patch Tuesday
07:29 Patch Quality Concerns
08:47 AI Worms on IoT
10:01 Hutchins Pushes Back
12:18 Ukraine Drones Hit Yandex
14:50 Wrap Up and Sign Off

FBI Arrests Canadian Ransomware Negotiator; MonsterCloud CEO Charged; Qilin Leader Extradited


David Shipley covers major cybercrime and safety headlines: the FBI arrests Canadian ransomware negotiator Eduard Dubrovsky in the Shiny Hunters investigation, with charges filed and the complaint sealed; prosecutors also charge MonsterCloud owner Zohar Pinhasi with wire fraud for allegedly paying ransoms while claiming he could decrypt without payment and marking up client bills.
 
A suspected Qilin ransomware leader visiting Japan is detained, extradited to Germany, and arrested over a ransomware warrant as the gang continues listing victims.
 
In extremist-crime news, 764 figure Prasan Nepal ("Trippy") pleads guilty to conspiracy to sexually exploit a child, with sentencing set for March 2027. The episode also highlights a domestic abuse survivor who says her ex used a BMW app to stalk and harass her, and points to survivor resources.
 
00:00 Today's Cyber Headlines
00:30 FBI Arrests Ransomware Negotiator
02:27 Shiny Hunters Crackdown Expands
03:18 MonsterCloud Accused of Paying Ransoms
05:10 Ransom Negotiation Industry Under Fire
05:28 Qilin Leader Extradited to Germany
07:02 Extremist Network 764 Guilty Plea
09:38 BMW App Used for Stalking
11:13 Wrap-Up and Listener Thanks