November Issue 54 November 1st 2026

Welcome

Hello and Welcome!

Be sure to attend our monthly meetings. Lots of good information there. Register for our Thursday December 3rd on our siteISC2CT.ORG

Upcoming Events:

*Security Week’s CISO Forum Virtual Summit | November 10-11, 2026 | Free to Attend Virtually * Designed for senior level cybersecurity leaders to discuss, share and learn innovative cybersecurity and risk management strategies. The event features live panel discussions, technical demos, and an interactive expo hall focused on Zero Trust architectures, supply chain risk management, and cutting-edge security program frameworks.Agenda & Registration

*Hands-On Security for Agentic Web Applications | Saturday, November 14th 2026 9 AM-11:30AM EST Free to Attend Virtually * Build agentic web apps that can use powerful tools without giving the model unrestricted control. Agentic web applications introduce a fundamentally different security problem. In this hands-on workshop, you’ll work with a deliberately vulnerable agentic web application and see how these weaknesses are exploited in practice. You’ll trace how an unsafe instruction can move through an agent, trigger a privileged tool, and result in an unauthorized action. Then, you’ll rebuild the application’s security layer using deterministic authorization, least-privilege access, validation, approval gates, and audit logging. Information & Registration

*BSides Pyongyang | November 18th Free to Attend Virtually * Don’t let the satirical name fool you BSides Pyongyang is a highly technical, legitimate threat intelligence conference focused entirely on defending against North Korean state-sponsored cyber operations. Held on November 18, 2026 (deliberately set on North Korea's "Missile Industry Day") inside a custom Roblox digital venue. Operating with a heavy layer of dark comedy and propaganda-style parody, the free, virtual event brings together top global security researchers to dissect real malware, tracking efforts, and defense strategies. Our inaugural virtual edition available to international audiences was held on 18 November 2025, and every talk is now available to watch. We return on 18 November 2026 Schedule & Registration

CPE Cybersecurity Practitioners Event at Mohegan Sun | Friday February 26th 2027 | Uncas Ballroom at Mohegan Sun, Sky Convention Center Uncasville, CTJoin us for an exciting conference dedicated to cybersecurity professionals at the stunning Mohegan Sun. This event will cover current and relevant topics in the field, providing valuable insights and hands-on sessions for industry practitioners. Key Features of the Conference Current Topics: Explore the latest trends and challenges in cybersecurity, including emerging threats and technologies. Hands-On Sessions: Participate in interactive workshops and labs designed to enhance your practical skills and knowledge. Networking Opportunities: Connect with fellow professionals, industry leaders, and experts to share experiences and insights. Expert Speakers: Learn from renowned speakers who will share their expertise and real-world experiences in cybersecurity. Why You Should Attend Stay updated on the latest cybersecurity practices and innovations. Gain practical skills that can be applied directly to your work. Enhance your professional network within the cybersecurity community. Earn Continuing Professional Education (CPE) credits to maintain your certifications. This is a conference you won't want to miss—mark your calendars and prepare for an enriching experience at Mohegan Sun! Agenda & Early Bird Tickets (when they go on sale)

Quinnipiac University is committed to helping advance the field of cybersecurity through its School of Computing & Engineering. To support the growth of professionals within cybersecurity and computing, Quinnipiac offers flexible online and on-campus opportunities that deliver practical skills you can immediately apply on the job. Both its MS in Cybersecurity and MS in Computer Science programs feature hands-on experience in lab settings that simulate real-world scenarios. To learn more about these exciting opportunities, Visit Quinnipiac University

Cyber News

PHP is the cyber equivalent of an unexploded bomb

It has been a dramatic, public and global response, but the cyber event hasn't happened yet.

AI Now Writing Code That Humans Can't Even Understand

AI coding has gotten to the point where some engineers are no longer able to make sense of the code being spat out.

3 Frameworks to Protect CISOs & Orgs Against AI Liability

Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors.

Hackers stole millions of US military personnel records during months-long data breach

The Department of Defense notified millions of current and former U.S. military personnel that their personal information had been stolen in a months-long breach.

FBI Probes Service Selling 153M+ Drivers Licenses

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana.

Security Threats Don't Stop at the Office: Why Executives' Families Need Training, Too

Those closest to executives must match their security postures because the weakest link in a family can become the entry point for attacks.

Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

Ubuntu and RHEL lack fixes for a Linux TCP use-after-free that Anthropic says it exploited to run commands as root on MPTCP servers.

ChatGPT-6 Astra cracks 85-year-old 1941 Enigma-coded message in two days autonomous AI coded its own simulator to crack code that was unsolved since it was shared online back in 2005

Before it started cracking, the LLM developed Python and C++ software for an Enigma simulator and Enigma Bombe.

PHP Armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internet

This is the kind of security issue that was found and prevented by AI, but is also a high risk because of AI.

The Internet goes on high alert after discovery of 8 compromised TLS certs

Intermediate certs allow anyone to mint web credentials for any Internet server.

Meta Muse exposes users' personal and business secrets when they share conversations

Meta is suspending the sharing feature while it investigates its privacy.

Cohere says Alibaba’s Qwen model tried to send a file to Beijing

An AI model said it wouldn’t use any tools, then tried to send something to a server in Beijing anyway, and while researchers say it’s probably a training quirk and not espionage, the whole thing has people asking how much to trust free Chinese AI.

AI Made StarCraft Bot Swaps In Human Made Bot In Tournament

In a showdown between AI generated Brood War bots and human made ones, OpenAI’s champion resorted to its natural playbook: lie, cheat and steal

Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List - Phoronix

Seemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list

Feds crack down on North Korean IT-worker schemes with new raids, charges and arrests

The latest operation targeted “laptop farms” across Texas that allegedly aided North Korea’s moneymaking plots

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group