This week connects actively exploited perimeter systems, compromised software and hardware trust chains, identity attacks, and the expanding role of AI on both sides of security operations—along with the evidence defenders need to patch, contain, and verify each risk.

This episode covers 25 cybersecurity stories.

Chapters:

00:00 Opening

00:34 Ivanti Warns of Actively Exploited Connect Secure Zero-Day

01:28 Palo Alto Networks alerts on critical PAN-OS RCE zero-day exploited in the wild

02:30 BeyondTrust patches zero-day exploited since August

03:23 Flax Typhoon Exploits Five Flaws Ahead of CISA October 11 Deadline

04:43 Microsoft Patch Tuesday October 2026: Key Vulnerabilities & Snort Rules

05:37 Unpatched AhsayCBS Flaws Exploited to Deploy Webshells and Crypto Miners

06:52 Critical Bricksforge WordPress Flaw Enables Unauthenticated RCE Exploited

07:42 Hackers Exploit Critical RCE Flaw in Collabora to Backdoor Nextcloud

08:30 Inside AvisLoader: New Windows Malware Loader Designed to Resist Disruption

09:35 Attackers Delivered Backdoor via AOMEI Backupper Update Server Tampering

10:20 Critical Docker Hub Flaw Allowed User Impersonation and Image Tampering

11:10 Ledger Confirms Spy Chip Implant Behind Crypto Wallet Thefts

11:55 Microsoft Disrupts 3 Phishing Kits Behind Over 1 Billion Scam Messages

12:42 UAT-11985 Targets Taiwan Research with Google AitM Phishing via Fake Invites

13:27 How to Run a Deepfake Readiness Drill Before a Cloned Voice Hits Your Team

14:22 Critical CVSS 10 Flaw in SAP Cloud SDK for Python Exposes OAuth2 Credentials

15:17 How to Keep AI Agents Operating Within Their Permissions

16:31 Chinese Hacker Uses ARTEX AI and Claude Agents in South Korean Bank Attacks

17:29 CyberXero Uses AI-Powered Attack to Steal Over 628,000 Ukrainian Records

18:14 Anthropic Warns AI Could Enable Self-Propagating IoT Botnets

19:01 NIST, NSA, and CISA Release Incident Readiness Practices for Super Intelligence

20:00 Critical PwnEscape Linux Kernel Flaw Allows Guest VMs to Leak Host Memory

20:58 Hackers Hijack D-Link and Ubiquiti Devices to Resell Bandwidth

21:45 Citizen Lab Links Zero-Click Candiru Spyware to Al Jazeera via Ads

22:39 Nippon Columbia Malware Incident Exposes 8.7 Million Records

23:29 Closing

SOC Minute: https://www.socminute.com

#Cybersecurity #SOC #SecurityNews

Support SOC Minute 💙

SOC Minute is independent and free for everyone. If you'd like to help keep the project running, you can support us on Patreon:

https://www.patreon.com/SOCMinute

This week, SOC Minute follows active attacks against edge infrastructure, identity and data breaches, AI-branded phishing, targeted malware, and three distinct ways attackers are poisoning trust across the open-source development ecosystem.

This episode covers 24 cybersecurity stories.

Chapters:

00:00 Opening

00:33 New NetScaler Zero-Day Targeted Attacks Can Disrupt SAML Deployments

01:19 Max severity SonicWall SMA1000 flaw now exploited in attacks

02:12 Cisco warns of critical flaws allowing Nexus switch takeover

03:10 Realtek Jungle SDK Exploit Attempts Spread Cling Botnet via STUN C2

04:05 Danish University DTU Data Breach Exposes Up to 200,000 Users

04:57 Denmark's Population Registry Data Breach Affects 8.8 Million People

05:49 ASOS confirms data breach after hacked in-app notifications

06:42 Hackers Hijack Google Domains via ccTLD Registry Breaches

07:38 China-Aligned TA419 Targets U.S. AI Policy Experts with Microsoft AitM Phishing

08:40 Phishing Platform Targets Credentials via Fake AI Chatbot Ad Portals

09:36 Hackers Use Google Ads and Bing Redirects to Spread Claude ClickFix Malware

10:29 Linux Backdoors Evade Detection by Mimicking Email Security Tools in Asia

11:27 UAC-0099 Deploys ASHVEIN RAT Targeting Ukrainian Government Staff

12:25 Chinese State-linked Hackers Use Automated Tools and Manual Exploits to Steal Data

13:30 Eight Malicious npm Packages Delivered Overlord RAT and Stealer

14:16 FakeGit Malware Campaign Relaunches with Over 17,600 Malicious GitHub Repos

15:21 Credential-Stealing GitHub Actions Workflows Found in Thousands of Repos

16:18 Critical File-Access Flaw Found in Atlassian Jira and Confluence

17:22 Anthropic Launches Free AI Vulnerability Scanner for Open-Source

18:12 Critical Dell System Update Vulnerability Allows Root Privilege Escalation

18:56 Critical Buffer Overflow Found in Savannah lwIP SMTP Client v2.2.1

19:57 Critical Vulnerabilities Found in Grid Protection Alliance openPDC and openHistorian

20:59 Critical LMCache Flaw Allows Unauthenticated Remote Code Execution

21:58 PoeLLM Malware Infects Over 3,400 Servers to Expand Crypto Mining Botnet

22:50 Closing

SOC Minute: https://www.socminute.com

#Cybersecurity #SOC #SecurityNews

This week, SOC Minute follows active exploitation from exposed enterprise systems and persistent web compromise into stolen identities, targeted malware, and the growing role of AI in data exposure, social engineering, and automated attacks.

This episode covers 18 cybersecurity stories.

Chapters:

00:00 Opening

00:40 Attackers Exploit Oracle PeopleSoft Flaw to Deploy Web Shells

01:50 WordPress Backdoor Rebuilds Itself Using Files, Database, and Shared Memory

02:46 Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC and Gateway

03:46 Cisco Warns of Critical Authentication Bypass in SD-WAN Manager

04:57 CISA Adds New Fortinet FortiMail Vulnerability to Exploited Catalog

06:06 Critical FortiMail Zero-Day Allows Unauthenticated Arbitrary File Writes

07:20 Dell CSM Flaws Allow Unauthenticated Admin and Root Access on Kubernetes

08:21 Critical Vulnerabilities Found in Armatura One Affecting Access Control Systems

09:38 Warlock Ransomware Exploits SharePoint in Water and Telecom Attacks

10:33 French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Weeks

11:31 Star Blizzard Advances Phishing and Malware with RedFlick Technique

12:29 Lunex Stealer Uses AMD Driver to Evade Security and Steal Credentials

13:27 NeedyMantis: Modular Malware Threat in Targeted Intrusions

14:24 China-Linked UAT-11587 Targets Asian Governments with Antino Backdoor

15:16 OpenAI Agents Accidentally Uploaded User Images to Third-Party Sites

16:29 80,000+ Organizations Exposed by Stolen AI Logins and LLMjacking

17:39 Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

18:49 Automated AI Agent Used to Breach Cybersecurity Nonprofit DIVD

20:00 Closing

SOC Minute: https://www.socminute.com

#Cybersecurity #SOC #SecurityNews

Trusted development platforms, browser integrations, cloud identities, and exposed control planes drive a week of active exploitation, supply-chain compromise, agentic abuse, and financial impact. Defenders need verified remediation, access scoping, and connected telemetry across every layer.

This episode covers 29 cybersecurity stories.

Chapters:

00:00 Opening

00:37 CrowdSec Private GitHub Repos Copied in TanStack npm Supply Chain Attack

01:49 Malicious npm Packages Evade Install-Script Defenses at Runtime

02:58 Malicious Terraform Providers Distribute Go Malware via HashiCorp Registry

03:52 Compromised GitHub Actions Resume Mini Shai-Hulud Malware Execution

04:42 AI-Driven Secret Leaks Double Compared to Human-Coded Commits

05:28 Fake LastPass Authenticator GitHub Repos Spread New Rapuncel Infostealer

06:47 BragJack Exploits AI Browser Agents via Malicious Extensions

07:53 BigCommerce Alerts Merchants of Data Breach via Ribon Apps

08:53 Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers

09:47 Critical Pre-Auth RCE in Orkes Conductor Actively Exploited

10:48 Critical Bifrost AI Gateway Flaw Allows Credentialless Command Execution

11:45 Check Point Fixes Critical Management Server Zero-Day Exploited in Attacks

12:32 Check Point Warns of Active Exploitation in Security Gateway VPN RCE Flaw

13:26 CISA Adds Zyxel Switch Buffer Overflow to Known Exploited Vulnerabilities Catalog

14:21 MikroTrick Chain Lets Attackers Control MikroTik Routers Without Credentials

15:26 CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities

16:29 CISA Warns of Active Exploitation of Three Linux Kernel Flaws

17:15 WordPress Patches Critical Flaw Allowing Remote Code Execution

18:03 Elementor WordPress CSRF Flaw Allows Admin Account Creation

18:51 EvilTokens PhaaS Disrupted After Compromising 12,000 Microsoft Accounts

19:50 Storm-3168: Cloud Attacks Using Compromised Azure Service Principals

20:41 FBI & CISA Warn on Risks of Third-Party ICS Integrators in Critical Infrastructure

21:27 North Korean WaterPlum Hackers Infected 30,000 Devices Worldwide

22:32 Contagious Interview Campaign Hits 30K Devices, Steals $10.7M Crypto

23:22 Bitget Loses $351.6M in Suspected North Korean Hack

24:10 Tracking Storm-2570's Consistent Ransomware Tradecraft

25:03 New Carbonato Botnet Uses AI Agents to Hijack Docker Hosts

25:56 Critical Vulnerabilities Discovered in Eufy Omni C20 and Omni X10 Pro

26:48 ShinyHunters exploits zero-day to breach FBI, steal sensitive data

27:42 Closing

SOC Minute: https://www.socminute.com

#Cybersecurity #SOC #SecurityNews

Emergency Windows fixes and actively exploited control planes lead into risks across development tooling, identity, critical infrastructure, mobile devices, and trusted cloud services. The episode connects those incidents through access validation, evidence preservation, and defensive context.

This episode covers 28 cybersecurity stories.

Chapters:

00:00 Opening

00:43 Microsoft Issues Emergency Windows Updates for RDS Failures

01:43 CISA Adds Cisco Secure Email Gateway SQLi to Known Exploited Vulnerabilities

02:48 Dutch NCSC Warns of Imminent Exploitation of Critical Check Point VPN Flaws

03:43 Critical Check Point Flaw Allows Root Privilege Code Execution

04:41 CISA Alerts on Ransomware Exploiting Critical VMware vCenter Flaw

05:37 Critical ScreenConnect Flaw Now Actively Exploited in Real Attacks

06:34 Critical Issabel Framework Flaw Enables Unauthenticated OS Command Execution

07:30 CISA Adds Two Actively Exploited Linux Kernel Vulnerabilities to KEV Catalog

08:34 Critical RCE Flaw in Unbound DNSSEC Validator Fixed in 1.26.1

09:33 Critical Vulnerabilities Discovered in mySCADA myPRO Manager

10:33 Critical Authentication Flaw in Mitsubishi Electric GX Works3 and Motion Control

11:25 Red Heron Exploits Gitea RCE to Compromise 13 Organizations Globally

12:30 Hackers Target Exposed Vite Servers to Steal AWS and Azure Secrets

13:23 Attacker Hijacks AI Coding Assistant, Spreads Malware Across 100 Repos

14:20 Brevo Supply-Chain Attack Injected Malicious Scripts on Customer Sites

15:14 Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts

16:14 Florida DMV Database Breached via Stolen Police Credentials

17:12 KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials

18:12 CenterPoint Energy Confirms Customer Data Stolen in Cyberattack

19:03 Gyazo Server Vulnerability Leads to Theft of 23.6 Million User Records

19:57 Russian Hackers Use AI to Rebuild Malware Faster After Detection

20:52 Hackers Exploit Tencent App Flaw to Deploy GrayRabbit Malware

21:48 Iranian Hackers Deploy Telegram-Controlled Malware Against Dissidents

22:44 Transparent Tribe Deploys New Rust Backdoor Targeting South Asia

23:36 New RatHat Android Malware Uses AI for Automated Device Control

24:27 RatHat Android Malware Exploits ADB to Maintain Shell Access

25:28 3BB Attacker Leveraged MeshCentral Backdoor for Root Access

26:24 CISA Guidance on Using Cyber Decoys to Enhance Detection and Response

27:23 Closing

SOC Minute: https://www.socminute.com

#Cybersecurity #SOC #SecurityNews

A busy week of active exploitation against management and developer infrastructure, attacks on sessions and trusted delivery paths, major personal-data exposure, and the expanding role of AI as both target and tool.

This episode covers 26 cybersecurity stories.

Chapters:

00:00 Opening

00:31 Cisco confirms active exploitation of critical FMC authentication bypass flaw

01:49 Cisco FMC Flaws Exploited by Ransomware and State Hackers

02:42 N-able patches critical RCE flaw in N-central amid active exploitation

03:50 Critical MikroTik SSH Authentication Bypass Vulnerability Exploited

04:43 Hackers Deploy Linux Rootkit on F5 BIG-IP APM Devices

05:34 Microsoft September 2026 Patch Tuesday fixes 966 flaws and 2 zero-days

06:42 AI-driven attack exploits PaperCut flaws to breach 395 organizations

07:53 GitLab CVSS 10 File-Read Flaw Faces In-the-Wild Probes

08:58 Critical Artifactory Flaws Exploited to Deploy Rust Backdoor Malware

10:00 JetBrains Cadence Breached via Unpatched TeamCity, AWS Credentials Exposed

11:04 Four Spy Groups Deploy BlueMoon Exploit Kit Targeting Chrome and Windows

11:50 China-Linked UNC3569 Exploits Sogou Input Method Flaw for GRAYRABBIT Backdoor

12:39 5,400+ hacked sites deliver ClickFix malware via blockchain storage

13:26 Attackers Use Invisible Unicode Characters to Bypass Email Filters

14:14 Passkey-themed Social Engineering Enables Identity and Cloud Compromise

15:03 BigBear Phishing Service Bypasses MFA at 258 Organizations

16:04 JSCeal Malware Can Bypass Google Auth Using Stolen Session Cookies

16:55 REVSTEALER Modules Disable Windows Defender to Run Crypto Miner

17:56 Microsoft Flags AI-Driven Executive Impersonation and Invoice Fraud

18:44 IDScan Confirms Breach Affecting 153 Million Driver’s License Records

19:54 AdaptHealth Confirms Data Exposure of 4.1 Million in July Cyberattack

20:40 Hackers Exploited Claude AI to Extract Secrets from 1.8M Android Apps

21:45 AI Agent Exploits and Aggregates Stolen LLM Access via Insecure Gateways

22:36 Securing Edge AI in Customer-Owned Environments

23:27 Cloud Security Risks Vary Significantly Across Providers, New Data Shows

24:25 U.S. Agencies Accuse China AI Firms of Distilling Major AI Models

25:22 Closing

SOC Minute: https://www.socminute.com

#Cybersecurity #SOC #SecurityNews

This week, attackers target exposed edge infrastructure, compromise trusted software distribution, steal authenticated sessions and cloud credentials, exploit familiar work flows, and turn third-party access into large-scale data exposure.

This episode covers 23 cybersecurity stories.

Chapters:

00:00 Opening

00:27 Active Attacks Exploit Critical Citrix NetScaler Auth Bypass

01:22 Attackers Exploit Two SonicWall SMA 1000 Zero-Days

02:19 China-Linked Fire Ant Targets Cisco Routers to Steal Credentials

03:04 Critical Cisco Nexus 9000 Flaw Lets Remote Attackers Run Code as Root

03:53 New 'Ted' Backdoor Hides in HAProxy to Intercept Web Traffic

04:42 Critical JFrog Artifactory Flaw Exploited Days After Patch

05:49 Coder’s registry compromised to distribute malicious Terraform modules

06:51 BGP Hijack Delivers Malicious Virtualizor Update with Root Access

07:38 CISA Adds Critical Chromium V8 Vulnerability to Exploited Catalog

08:42 GiveWP WordPress Plugin Flaw Lets Hackers Execute Server Commands

09:42 Critical Elementor Pro Flaw Enables Takeover of WordPress Sites

10:27 Critical Langflow Flaw Exploited to Steal OpenAI and AWS Keys

11:15 Anthropic warns of infostealer malware hijacking Claude AI sessions

12:05 The Coding-Agent Trap: Malicious Use of Free LLM Endpoints Exposed

13:08 Microsoft alerts on TerminalFix attacks using reverse tunnels

14:04 ASCII Smuggling Technique Evolves from AI Prompt Injection to Phishing Evasion

15:09 Guildma (Astaroth) Malware Infection via Brazilian Portuguese Email

16:11 Iranian Hackers Use Coding Tests to Deliver Cross-Platform RATs

17:07 US Charges Russian for Malware Campaign Targeting 80,000 Freelancers

18:11 BraZetsu Malware Turns Windows Hosts Into Underground Marketplace Assets

18:56 McKesson Breach Exposes 284 Million Patient Records, ShinyHunters Claims Theft

19:47 Aesto Health Data Breach Exposes Over 9.5 Million Patients

20:45 IDScan sued over breach exposing 153 million driver’s licenses

21:31 Closing

SOC Minute: https://www.socminute.com

#Cybersecurity #SOC #SecurityNews

This week, trusted identity and familiar applications become entry points, exposed enterprise platforms face active exploitation, critical infrastructure reveals persistent visibility gaps, and AI appears as both an attack accelerator and a security boundary of its own.This episode covers 22 cybersecurity stories.Chapters:00:00 Opening00:26 Critical Keycloak Password Reset Flaw Could Let Attackers Hijack Any Account01:25 19 Chrome and Edge Extensions Found Stealing Crypto Wallets02:21 ToxicPanda Android Malware Uses VPN Permissions to Block Google Play03:10 SynkLoader Malware Spreads via Microsoft Teams Phishing Campaign04:07 Critical Avada WordPress Theme Flaw Enables Zero-Click Remote Code Execution04:59 Critical Gitea Vulnerability Exploited in Active Code Injection Attacks05:51 PaperCut NG and MF Zero-Day Flaw Actively Exploited in Attacks06:41 PaperCut issues second emergency patch for exploited NG and MF flaws07:28 Critical cPanel Flaw Lets Single Hosting Customer Gain Root Access08:20 Critical ownCloud Flaw Exploited to Steal Nuclear Records in Philippines09:21 Three CVSS 10.0 ServiceNow Flaws Enable Code Execution and SQL Injection10:14 Critical Vulnerabilities Found in Ebyte NE2-D11 Firmware11:12 Critical Vulnerabilities Found in Xiiaozet LK100W Devices12:00 296K IoT Botnet, 100+ Water Systems Targeted, New SharePoint RCE Chain12:58 US Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches13:48 Nimbus Manticore Expands Toolset With New Backdoor and SSH Tunneler14:41 FBI Disrupts China-Linked QTFY Platforms Targeting U.S. Infrastructure15:29 UAT-10147 Uses AI to Scale Server Attacks and Deploys Advanced Linux Rootkit16:26 OpenAI Reveals Reward Hacking Drove AI Agents to Breach Hugging Face17:21 Securing AI Infrastructure: Protecting Gateways and Control Points18:18 Malicious Webpage Can Poison Local AI Models via NVIDIA NemoClaw19:13 CISA Red Team Tests Expose Critical SOC and Cloud Security Gaps20:27 ClosingSOC Minute: https://www.socminute.com#Cybersecurity #SOC #SecurityNews