Today on CISO Series…
Security You Should Know: “Proving Defense with Horizon3”
In todays cybersecurity news…
Cybersecurity jobs report reveals mixed bag
Published by workforce intelligence company
CyberSN
, the October jobs report is an assessment of the job market by skills required rather than by the recruiting companies’ role titles. This year to date, there has been a decline in cybersecurity job postings to a new four-year low, while two specific AI and data roles have seen dramatic growth due to market demand: AI Security Engineer and Cyber Data Scientist. For these, demand has grown 203.5% over last year. CISO postings declined, but this is seemingly only in comparison to an unusually strong 2025. A link to the report is available in the show notes to this episode.
(Security Week and CyberSN
ConnectWise suspends cloud backup after supply chain attack
The IT management software provider took this action on Saturday, disabling seven
ConnectWise
application identities as it “continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants.” It has also suspended Cloud Backup service by revoking certificates used for affected application connections across all users. The company adds scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable.
Drupal patches critical RCE flaws, warns of exploits
Engineers at
Drupal
, a free, open-source content management system used to build and manage websites, have patched two critical vulnerabilities that “could allow attackers to execute code remotely on websites running any of its supported versions. Admins are urged to apply updates promptly, because, as the security team states, “exploits might be developed within hours or days.” According to the Drupal website, more than one million websites run on the system.
Chinese espionage attackers suspected of BeyondTrust zero-day
Mandiant (part of Google Cloud)
, the
Google
Threat Intelligence Group (GTIG), and
BeyondTrust
itself all confirmed the zero-day last Thursday evening. An alleged Chinese state-backed group is using a new zero-day in the BeyondTrust software to conduct espionage attacks. The CVE numbered vulnerability (CVE-2026-102764) affects its Remote Support appliances that “enable IT teams to securely access and troubleshoot remote endpoints.” A patch has been released. The group behind the attacks, named Armory Castle or UNC5221, used a “deep understanding of BeyondTrust appliance internals” to achieve its goals.
Big thanks to our sponsor,
ThreatLocker
Proofpoint to acquire Varonis’ data security
This is set to occur as an all-cash transaction worth $6.3 billion. The combined company will “serve more than 16,000 enterprises and millions of organizations globally, creating one of the world’s leading pure-play cybersecurity companies and establishing the industry’s largest data and AI cybersecurity organization,”
Proofpoint
said in its announcement made last Thursday.
Burger King Japan data breach exposes 11 million customer records
The Japanese subsidiary of global fast-food giant Burger King has disclosed a major data breach involving just over 11 million customer records. The data was stolen in the first week of October and has been leaked online. The servers that were breached stored the PII of users of the company’s official smartphone app, but did not store customer credit card numbers, company representatives said, adding that they had found no evidence that the threat actors accessed user credentials.
BAE Systems cyberattack disrupts U.S. federal court operations
The attack has taken down the notice system used by federal bankruptcy courts says the
Administrative Office of the United States Courts
(AOUSC). This includes a halt to the production and distribution of bankruptcy notices. “BAE Systems is actively investigating this incident and working to restore operations,” it added. The disruption means “access to systems and websites that BAE Systems operates on behalf of the Judiciary and the related bankruptcy noticing process are unavailable at this time. A list of the affected sites is available in the show notes. Court systems affected: bnc.uscourts.gov, notices.uscourts.gov
CikaBika Bot RAT abuses Discord
This malware is distributed via document-themed lures and provides reconnaissance, remote execution, and data exfiltration capabilities on infected systems. “Victims receive a PDF file containing a disk image with a Windows shortcut (LNK) posing as a Word document. Once opened, it displays a decoy document and launches a hidden PowerShell process to decode and run an embedded executable.” Its final payload is the CikaBika Bot RAT, which “immediately registers the infected machine with
Discord
and starts its reconnaissance routine, harvesting system information, processes, and network configuration, and taking screenshots.”
Subscribe to Cybersecurity Headlines podcast
Subscribe to Cybersecurity Headlines and all our shows at cisoseries.com/subscribe.
——————————————————-
Click Here For The Original Source.
