Cybersecurity Today

Vishing Breaches Top Canadian Law Firms, FBI Pins Record Binance Heist on North Korea, and GM Pays $220M Privacy Settlement
David Shipley covers major cybersecurity headlines for Nov. 2, 2026: four large Canadian law firms (McCarthy Tétrault, Davies, Bennett Jones, and BLG) were breached via vishing impersonating IT on Teams and spoofed phone numbers, leading to compromised accounts and alleged large-scale file theft, while firms share intel and bring in CrowdStrike and Mandiant.
The FBI attributes the $6.36B Binance crypto theft to North Korea's TraderTraitor/Lazarus, details laundering tactics and wallet addresses, and Binance says it has covered 95% of losses.
Chainalysis discloses a breach exposing limited customer directory data.
CrowdStrike reports China-linked Vapor Panda using Artex AI at scale.
A fake Claude code extension briefly appeared in Cursor's marketplace.
GM agrees to a $220M settlement over Smart Driver data sales.
00:00 Top Stories Rundown
00:35 Vishing Law Firm Breaches
02:52 North Korea Binance Heist
05:18 Chainalysis Gets Hacked
07:07 Agentic AI Attack Surge
09:33 Fake Claude Extension Scam
11:15 GM Driver Data Settlement
13:25 Wrap Up and Sign Off

AI agents are changing both sides of cybersecurity. Attackers can move faster, while defenders face another challenge: securing the agents inside their own organizations.
On this Cybersecurity Today Weekend Interview, I'm joined by Adam Ely, General Manager of AI Agent Security at Check Point Software. We talk about what AI is changing for security teams—and what still comes down to getting the basics right.
Adam brings the perspective of a former CISO at Fidelity Investments and deputy CISO at Walmart. We discuss the pressure on security leaders, the promise of AI for defenders, and how organizations can adopt agents while controlling what they can access and do.
In this conversation:
• Why AI changes the speed and scale of cyberattacks.
• CISO burnout, accountability, and the value of sharing experiences.
• How AI agents can influence one another's behaviour.
• Why security teams need to rehearse and test AI-assisted incident response.
• The identity and access challenges of agents that can create other agents.
• What it means when companies put agents on the organizational chart.
• Why segmentation, access controls, monitoring, and other security basics matter more than ever.
• Using AI as a sounding board that challenges your thinking.
Where could AI help your security team—and where would you draw the line on its access? Share your thoughts in the comments.
Hosted by Jim Love.
Cybersecurity Today — Weekend Interview
October 31, 2026
Subscribe to Cybersecurity Today for cybersecurity news and interviews.
More episodes and contact:
https://technewsday.com
https://technewsday.ca
To support the show, visit the Donate tab.
Guest biography, Check Point Software:
https://www.checkpoint.com/about-us/leadership/
Check Point Software research discussed in the interview:
https://blog.checkpoint.com/security/peer-pressure-ai-agents
Adam's article on the changing CISO role:
https://blog.checkpoint.com/ai-security/redefining-the-ciso-contract-from-securing-the-business-to-securely-doing-business/

Black October in Cybersecurity: PHP RCE Panic, Brotli Surprise, and Why Basics Still Matter
In this special episode of Cyber Security Today, Jim and David discuss why the industry is calling the month "Black October," beginning with chaotic disclosure and leaked details of multiple PHP remote code execution vulnerabilities that triggered widespread anxiety and even service shutdowns by governments and other organizations.
They cover additional tensions from weak certificates issued by an intermediate CA in India, a breach disclosure by LiteLLM, and a major RCE initially thought to affect React/Node.js but later tied to Google's Brotli, which is widely deployed.
They note that while attacks began before patches and at least one European government was compromised, exploitation proved difficult and defenses often held, with limited confirmed victims so far. They argue AI is accelerating vulnerability discovery and democratizing capabilities, but emphasize "don't panic," focus on cyber hygiene basics, prioritize crown jewels, train staff, and address growing human fatigue as incident response capacity strains
00:00 Black October Begins
00:44 PHP Zero Day Chaos
03:51 More Hits Keep Coming
04:53 AI Hype And Reality
07:01 Exploitation In The Wild
09:15 Japan Breach Wave
13:23 Dont Panic Do Basics
15:38 Turn Crisis Into Budget
18:07 Training Beats Tools
21:21 Burnout On The Frontline
23:45 Know Your Crown Jewels
24:16 Final Thoughts And Outreach

Brotli Emergency Patches, PHP-to-Shell Exploited, and Australia Disrupts 180K Amadey Infections | Cybersecurity Today
On Cybersecurity Today (Oct. 28, 2026), Microsoft issues out-of-band .NET updates for a critical flaw in Google's Brotli library (CVE-2026-111497) that can enable remote privilege escalation and potentially remote code execution, with proof-of-concept exploits public and widespread exposure across ecosystems.
The episode also covers CISA confirming active exploitation of two "PHP to Shell" vulnerabilities (CVE-2026-109618/109619), with federal agencies facing an urgent patch deadline and broad impact across millions of PHP services and many vendors. In legal news, U.S. prosecutors allege Canadian ransomware negotiator Eduard Dubrovsky secretly worked for threat actors.
South Korean police say a former penetration tester used the Artex AI framework to breach 90+ organizations and steal 8.2 million records. Finally, Australia's Signals Directorate disrupts an Amadey botnet, cutting off 180,000 infected computers and destroying stolen data offered for sale.
00:00 Top Stories Rundown
00:32 Brotli Bug Emergency Patches
02:36 AI Noise in Vulnerability Hype
03:41 PHP to Shell Exploited Now
06:10 Ransomware Negotiator Accused
07:41 Artex AI Hacking Spree
10:04 Australia Disrupts Amadey Botnet
11:32 Wrap Up and Sign Off

PHP2Shell Hits European Government, New PHP RCE (No Patch Yet), Brotli "Node to Shell," and Capcom Breach
Attackers exploited the PHP2Shell remote code execution flaws to compromise a European government entity within two hours, stealing password hashes and MFA secrets, pivoting via NTLM relay toward Active Directory, and showing command output patterns Unit 42 says suggest an agentic AI attacker. Widespread scanning continues, with Cloudflare logging millions of attempts, Cyfirma reporting low-and-slow probing from nodes linked with moderate confidence to the Lazarus ecosystem, and defenders urged to watch for telltale crash sequences. PHP also disclosed a third RCE (CVE-2026-115560) with no patch yet but high exploitation requirements and a mitigation to disable session upload progress. Separately, a Brotli decoder memory corruption bug (CVE-2026-111497) affects Node.js and other software, with fixes delayed into October releases. Finally, Capcom says criminals breached Capcom ID, exposing data tied to 11.7 million accounts and resetting impacted passwords.
00:00 Headlines Overview
00:35 Government Breach Details
01:13 Global Scanning Surge
03:11 Third PHP RCE
05:00 Wildfire Or Smoke
06:08 Patch Race Warning
06:53 Brotli Node To Shell
08:47 Capcom Account Breach
10:21 Wrap Up And Outro