Cybersecurity Today

France Blames Iran for Supermarket Fridge Sabotage, Vanderbilt Restores Systems After Cyberattack, and Microsoft Patches 1,235 Flaws France has formally blamed Shahid Kaveh, a cyber unit linked to Iran's Revolutionary Guard, for an October sabotage campaign that hijacked Danfoss and Dixell refrigeration controllers in roughly 700 French supermarkets, spoiling food, causing fires, and prompting pot...

French Bank Loses $133M in Crypto Laundering, Chainalysis Breach Deepens, OpenSSH 'SSH Hole' Exploited Cybersecurity Today host David Shipley reports a $133M theft from French bank Crédit Mutuel Arkéa after attackers entered via an unnamed third-party provider, moved funds from the bank's own accounts, and laundered them into USDC/USDT; investigators say delays allowed millions to be washed before...

Do We Still Need Cybersecurity Awareness Month in the Age of AI Agents and Deepfakes? (Denis Villeneuve, Kyndryl Canada) Recorded after a brutal October of rapid-fire zero-days, Cybersecurity Today host David Shipley asks whether Cybersecurity Awareness Month still matters; Denis Villeneuve, who leads cyber resilience and connectivity at Kyndryl Canada, argues it does—and should be continuous. The...

French Blood Bank Refrigeration Hacked, AI Tools Hit India's Banks, DreamHost Breach, Extradition, and Malware That "Values" Victims Cybersecurity Today host David Shipley reports France's National Blood Service (EFS) says a November 2 cyberattack manipulated cold-storage settings at three sites via its refrigerator supplier's remote monitoring software, but alarms and staff response prevented pro...

Binance's $6.34B Crypto Heist, Europe's Supermarket Fridge Hacks, and the Rise of LLM Jacking Cybersecurity Today host David Shipley reports Binance's $6.34B October 29 crypto theft, which Binance says began with a June supply-chain compromise and escalated via a fake hiring process that delivered poisoned developer tools, leading to access to the internal wallet signing service and abuse of Ether...

Vishing Breaches Top Canadian Law Firms, FBI Pins Record Binance Heist on North Korea, and GM Pays $220M Privacy Settlement David Shipley covers major cybersecurity headlines for Nov. 2, 2026: four large Canadian law firms (McCarthy Tétrault, Davies, Bennett Jones, and BLG) were breached via vishing impersonating IT on Teams and spoofed phone numbers, leading to compromised accounts and alleged la...

AI agents are changing both sides of cybersecurity. Attackers can move faster, while defenders face another challenge: securing the agents inside their own organizations. On this Cybersecurity Today Weekend Interview, I'm joined by Adam Ely, General Manager of AI Agent Security at Check Point Software. We talk about what AI is changing for security teams—and what still comes down to getting the ba...

Black October in Cybersecurity: PHP RCE Panic, Brotli Surprise, and Why Basics Still Matter In this special episode of Cyber Security Today, Jim and David discuss why the industry is calling the month "Black October," beginning with chaotic disclosure and leaked details of multiple PHP remote code execution vulnerabilities that triggered widespread anxiety and even service shutdowns by governments...

Brotli Emergency Patches, PHP-to-Shell Exploited, and Australia Disrupts 180K Amadey Infections | Cybersecurity Today On Cybersecurity Today (Oct. 28, 2026), Microsoft issues out-of-band .NET updates for a critical flaw in Google's Brotli library (CVE-2026-111497) that can enable remote privilege escalation and potentially remote code execution, with proof-of-concept exploits public and widespread...

PHP2Shell Hits European Government, New PHP RCE (No Patch Yet), Brotli "Node to Shell," and Capcom Breach Attackers exploited the PHP2Shell remote code execution flaws to compromise a European government entity within two hours, stealing password hashes and MFA secrets, pivoting via NTLM relay toward Active Directory, and showing command output patterns Unit 42 says suggest an agentic AI attacker....

PHP Exploited Before Patch, Unpatched Linux SMB Bugs, GitLab Max-Severity Fix, and AI Agents in ConnectWise & Japan Breaches Cybersecurity Today (Oct. 23, 2026) covers active exploitation of two critical PHP RCE flaws beginning at least four days before patches shipped, with multiple firms seeing failed pre-disclosure attempts and the UK NCSC urging immediate patching or taking servers offline. It...

PHP2Shell: Emergency PHP RCE Patches, Leaks, and Early Exploitation (CVE-2026-109618/109619) In a special edition of Cybersecurity Today, host David Shipley covers emergency PHP patches for two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP 5.4+ and essentially all PHP deployments serving web requests across major stacks. He explains the sh...

Staples Gift Card Hack, Nikkei's Third Breach, Burger King Japan Leak, Broadcom Wi‑Fi "Foreverday," and Ledger Spy Implants Host David Shipley covers a Chinese crime ring that breached Staples by abusing heap dump requests to hijack customer service sessions, issuing over 15,000 gift cards worth more than $5 million and redeeming thousands at retailers before merchandise was shipped to China; thre...

Microsoft 365 Supply-Chain Break-Ins via ConnectWise, US Bankruptcy Notices Down, Phishing Market Takedown, BeyondTrust Zero-Day, Japan Cyber Emergency Cybersecurity Today Host David Shipley covers multiple incidents: ConnectWise shut down its cloud backup service after an attacker stole the app credential and used its broad Microsoft 365 permissions to access at least 173 customer tenants in a su...

ShinyHunters Arrests, Ransomware Negotiator Ethics,  Refrigerators Turned Into Ovens and UnPatch Wednesday, Part Two? A Cybersecurity Today panel with Michael Joyce, Laura Payne, and David Shipley discusses major recent stories: the ShinyHunters gang's alleged hack of FBI personnel data and a string of arrests including a Canadian cybersecurity executive, raising ethical and legal concerns around...

Zero-Click Spyware Ads, Palo Alto Firewall Zero-Day, Critical Drupal Flaw, and OpenAI Bugging Charge Cybersecurity Today Host David Shipley reports on Citizen Lab findings that Israeli spyware maker Candiru, now reportedly rebranded as Integrity Labs, used targeted online ads bought through DiscoverTech's Controlium platform to profile and, in some cases, zero-click infect Al Jazeera journalists'...

French Supermarket Freezers Turned to Ovens, Ahold Delhaize Outage, Microsoft's 1,411-Fix Patch Tuesday, AI Worm Debate, and Drones Hit Yandex Cloud Cybersecurity Today host David Shipley reports on a wave of attacks that pushed refrigeration controllers at hundreds of French supermarket stores up to 50°C, sparking fires and spoiling food, with ANSSI investigating and outdated Danfoss-related firm...

FBI Arrests Canadian Ransomware Negotiator; MonsterCloud CEO Charged; Qilin Leader Extradited David Shipley covers major cybercrime and safety headlines: the FBI arrests Canadian ransomware negotiator Eduard Dubrovsky in the Shiny Hunters investigation, with charges filed and the complaint sealed; prosecutors also charge MonsterCloud owner Zohar Pinhasi with wire fraud for allegedly paying ransoms...

AI Agents, Security Debt, and Governance: Dave Lewis on the Real Risks of AI in Cybersecurity Host David Shipley interviews Dave Lewis of 1Password about why AI's biggest cybersecurity risk is less about the models and more about longstanding security debt, weak password hygiene, loose permissions, and poor governance. Lewis argues organizations are rushing AI adoption, bypassing basic controls, a...

OpenAI Fires Safety Researchers, FTC Probes AI Labs, ChatGPT Linked to Violence, and Connected Cars Share Your Data Host David Shipley covers multiple cybersecurity and AI accountability stories: OpenAI fired three safety researchers for allegedly sharing confidential infrastructure details with an outside safety group amid broader reports of risky agent behavior and unauthorized web scraping, whi...

ShinyHunters Leader Detained in Jordan, KillSec Takedown, Vicksburg Ransomware, and OpenAI Agent Lawsuit Host David Shipley reports that Jordan detained an alleged ShinyHunters member known as Rey (Saif Aldin Khadr), with sources saying he is cooperating with the FBI as the group's leak site went dark and a new one later appeared amid claims of an FBI breach tied to an alleged Oracle PeopleSoft ze...

Host David Shipley interviews Field Effect CEO Matt Holland about how AI coding agents can behave like malware and why visibility into their actions is essential. Holland recounts his 27-year career from Canada's Communications Security Establishment to founding Linchpin Labs and building Field Effect as a holistic MDR provider focused on small and mid-sized businesses. He explains Field Effect's...

FBI Warns Staff Assume ShinyHunters Stole Everyone's Data; Clop Dismisses Rival Hack; Kiteworks Restores Service Cybersecurity Today host David Shipley reports the FBI has told employees to assume ShinyHunters accessed the personal information of every FBI employee after the fbijobs.gov breach, advising staff to watch for suspicious calls and use AI-generated voicemail to reduce voice-cloning risk...

Citrix NetScaler Zero-Days Exploited, Kiteworks Shutdown Warning, ShinyHunters WAF Bypass, FBI Medical Files Leak, OpenAI Medicare "Hack" Reframed Citrix confirms two actively exploited NetScaler zero-days (CVE-2026-88771 and CVE-2026-88772) with 9.5 severity scores and urges immediate patching to fixed builds, warning that organizations may already be compromised and should preserve evidence, iso...

Is Privacy Dead—or on Life Support? Ross Saunders on Breaches, GDPR, AI, and Saving Privacy In this episode of Cybersecurity Today on the Weekend, host David Shipley speaks with Toronto-based privacy and cybersecurity consultant Ross Saunders about whether privacy is "dead" amid major breaches, including a database allegedly exposing 153 million North American driver's licenses through compromised...