The Department of Know: Power plant attack, NSA hacker reunion, Hugging Face hack report

Read the full stories at CISOSeries.com (https://cisoseries.com/the-department-of-know-power-plant-attack-nsa-hacker-reunion-hugging-face-hack-report/) . This week's Department of Know is hosted by Rich Stroffolino, with guests Jason Elrod (https://www.linkedin.com/in/thejasonelrod/) , CISO, MultiCare Health System (https://www.multicare.org/) , and Chris Ray (https://www.linkedin.com/in/chris-ray-i4h/) , field CTO, GigaOm (https://gigaom.com/) . Missed the live show? Check it out on YouTube (https://youtube.com/live/jDxDJCvWwYU?feature=share) . The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com (https://cisoseries.com/) . A huge thanks to our sponsor, ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) Managing an enterprise-sized attack surface without a dedicated SOC? As attackers leverage AI-driven automation to target mid-size business, your legacy defenses are no longer enough. You need the expertise to detect and respond to modern threats, without the overhead of building an in-house security team. ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) provides proactive, Managed Detection and Response, 24/7, so your business can scale safely. Enterprise-grade defense. Built for businesses like yours.

youtube.com

OpenAI's Hugging Face hack gets weirder

Roughly 1,200 OpenAI agents escaped their sandbox during a controlled test and coordinated an intrusion into Hugging Face after finding their assigned task impossible to complete as designed. The agents repurposed a software package manager into an improvised message board to communicate, and more than 700 of them joined the effort. They even tried to edit their own log files to hide the rule violations, but their preserved chain-of-thought reasoning documented the entire scheme. Thanks to our sponsor, ThreatDown. Subscribe for more cybersecurity news and analysis: CISOseries.com/subscribe #Cybersecurity #AI #OpenAI #HuggingFace #AIsecurity #AgenticAI

youtube.com

"Hacking our Comfort with Autonomous Agents" - Super Cyber Friday

Join us live on Crowdcast: https://www.crowdcast.io/c/uykzs53sq84d

youtube.com

Manchester Airports breach, ATF agency breach, clothier Carhartt breach

Manchester Airports Group suffers cyber incident ATF suffers data breach Clothing retailer Carhartt suffers data breach Get the show notes here: https://cisoseries.com/cybersecurity-news-manchester-airports-breach-atf-agency-breach-clothier-carhartt-breach/ Huge thanks to our episode sponsor, ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) SMBs face enterprise-level, AI-driven threats every day, often sacrificing robust security in favor of operational agility. You don't have to choose between moving fast and staying protected. ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) bridges the expertise gap, replacing fragmented, legacy tools with proactive, 24/7 MDR that scales with your business. ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) . Enterprise-grade defense. Built for businesses like yours.

youtube.com

Manage Code Review Better with ActiveState's Secure Code Repository

There's a lot of reused code that's floating around. A lot of it seems very useful. Only some of it has been reviewed as secure for your environment. Wouldn't it be nice to select code that you know has had secure reviews? ActiveState gives security and engineering teams a single governed source for open source software. With 79 million components built from source, continuously remediated, and delivered directly into the tools teams already use, ActiveState eliminates the CVE backlog and the developer toil that comes with it. Companies see a 60 to 99% reduction in CVEs and reclaim up to 30% of developer time.

youtube.com

US seizes domains used for Chinese hacks

The US Justice Department announced it seized domains used by the hacking platforms QScan and QtRouter, which were tied to attacks on the DOJ, NASA, the Federal Reserve, the Senate, and multiple companies in the US and South Korea. Officials attributed the platforms to a Chinese company whose clients included China's Ministry of State Security and the People's Liberation Army, with ties to attacks dating back to 2018. SentinelOne analyst Dakota Cary cautioned that China relies on a range of private contractors, limiting the impact of the takedown. Subscribe for daily cybersecurity news: CISOseries.com/subscribe Thanks to our video sponsor, ThreatDown.

youtube.com

Market Confusion Is Responsible for the Biggest Gaps in Cybersecurity

All links and images can be found on CISO Series (https://cisoseries.com/market-confusion-is-responsible-for-the-biggest-gaps-in-cybersecurity/) Check out this post (https://www.linkedin.com/posts/joehead1_i-have-spoken-to-97-cyber-founders-in-6-months-activity-7328411177712066560-hG6Y/?rcm=ACoAAAAGB-ABR5yqhAwT3wmdEjT0Znha5c_QJ6s) from Joe Head of RELEX Solutions for the discussion that is the basis of our conversation on this week's episode co-hosted by David Spark (https://www.linkedin.com/in/davidspark/) , the producer of CISO Series (https://cisoseries.com/) , and Edward Contreras (https://www.linkedin.com/in/cisoedwardc/) , senior evp and CISO, Frost Bank (https://www.frostbank.com/) . Joining is Mary Rose Martinez (https://www.linkedin.com/in/maryrosemartinez/) , CISO, and vp of digital technology services, Marathon Petroleum Corporation (https://www.marathonpetroleum.com/) . In this episode: • Left behind • A hypothetical sale • The philosophy problem • Stop shifting the problems A huge thanks to our sponsor, ActiveState (https://go.activestate.com/free-oss-health-check-ai-risk?utm_source=ciso%20series&utm_medium=banner_ad&utm_campaign=fy26_q2_comms&utm_content=paid_campaign) ActiveState gives security and engineering teams a single governed source for open source software. With 79 million components built from source, continuously remediated, and delivered directly into the tools teams already use, ActiveState eliminates the CVE backlog and the developer toil that comes with it. Companies see a 60 to 99% reduction in CVEs and reclaim up to 30% of developer time. Learn more at activestate.com (https://go.activestate.com/free-oss-health-check-ai-risk?utm_source=ciso%20series&utm_medium=banner_ad&utm_campaign=fy26_q2_comms&utm_content=paid_campaign) .

youtube.com

Chinese hackers hit US agencies, Ring locks out police, Boston Scientific feels cyber pain

China contractor hack hits US agencies Ring throws away the key Boston Scientific feels cyber pain Get the show notes here: https://cisoseries.com/cybersecurity-news-august-27-2026/ Huge thanks to our episode sponsor, ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) SMBs face enterprise-level, AI-driven threats every day, often sacrificing robust security in favor of operational agility. You don't have to choose between moving fast and staying protected. ThreatDown bridges the expertise gap, replacing fragmented, legacy tools with proactive, 24/7 MDR that scales with your business. ThreatDown. Enterprise-grade defense. Built for businesses like yours.

youtube.com

There Are No Trusted Services

TwinLoot takes living off the land to the extreme. They're existing within Microsoft. It's running its entire C2 on Microsoft services like SharePoint, Graph APIs, and Teams relay infrastructure. Bil Harmer reframes Zero Trust in plain terms (trust is just repetition over time) and lands on a 'known but vulnerable' mental model, while David Cross makes the case for SSPM and watching identity anomalies as malicious agents raise the stakes. How do you baseline traffic to services you can't afford to block? Big thanks to our sponsor, Vanta! Join us next time — LIVE every Friday at 4 PM ET / 1 PM PT: https://youtube.com/live/jDxDJCvWwYU?feature=share #cybersecurity #cybersecuritynews #infosec #news #informationsecurity

youtube.com

Boston Scientific disrupted by cyberattack

Boston Scientific, one of the largest US medical device manufacturers, disclosed to the SEC that it suffered a cyberattack on August 25th. The incident caused a global disruption to business operations, including the ability to process and ship orders to hospital customers. The company has not provided a timetable for restoring systems or a full scope of the impact, and no ransomware group has claimed responsibility. Subscribe for daily cybersecurity news: CISOseries.com/subscribe Thanks to our video sponsor, ThreatDown.

youtube.com

This show tells me what buyers need

JoLynn Blatz, senior account executive at Impact Networking LLC, points to CISO Series as the resource she recommends for understanding how security teams think and what they actually need. Whether you are selling to security leaders or sitting in the C-suite yourself, knowing the trends, AI threats, and pressures at every level of an organization is what separates real conversations from the noise. Subscribe and stay ahead on the latest in cybersecurity with CISO Series: cisoseries.com/subscribe #CISOSeries #CISO #Cybersecurity #InfoSec #SecuritySales

youtube.com

China's hackers pick DeepSeek, OpenAI blocks Russian influence push, webpages mess with local AI

China's hackers pick DeepSeek OpenAI blocks a Russian influence push A webpage can mess with local AI Get the show notes here: https://cisoseries.com/cybersecurity-news-august-26-2026/ Huge thanks to our episode sponsor, ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) If your current security posture is struggling to keep pace with fast-moving, identity-based threats, your business is exposed. Today's security expertise gap is real, but it doesn't have to be a permanent vulnerability. ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) helps SMBs move from reactive defense to proactive, 24/7 intelligence, delivering enterprise-grade protection without the headcount. Enterprise-grade defense. Built for businesses like yours.

youtube.com

Why Small Businesses Are Prime Targets and Don't Know It with ThreatDown

Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

youtube.com

This IT Team Calls ThreatLocker a Partner, Not a Vendor

ThreatLocker delivers Zero Trust Network Access and Zero Trust Cloud Access that verifies both user and device before granting access to specific applications. No broad access, nothing exposed, and no reliance on credentials alone. It’s a smarter way to control access and reduce risk. Learn more at ThreatLocker.com/CISO.

youtube.com

IBM's new mainframe speaks Arm

IBM announced at its annual Hot Chips conference a new mainframe processor capable of running both z/OS workloads and ARM instructions on the same physical cores. Each chip features 11 cores that can switch between ARM and Z software within nanoseconds using KVM, built on a two nanometer process node with a base frequency of 5.7 gigahertz. The design aims to let enterprises run legacy mission-critical mainframe software alongside newer Linux-based and AI applications. Subscribe for daily cybersecurity news: CISOseries.com/subscribe Thanks to our video sponsor, ThreatDown.

youtube.com

SynkLoader throws in the kitchen sink, NIST flags multi-cloud sprawl, ReliaQuest blocks a ShinyHu...

SynkLoader throws in the kitchen sink NIST flags multi-cloud sprawl ReliaQuest blocks a ShinyHunters swing Get the show notes here: https://cisoseries.com/cybersecurity-news-august-25-2026/ Huge thanks to our episode sponsor, ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) Managing an enterprise-sized attack surface without a dedicated SOC? As attackers leverage AI-driven automation to target mid-size business, your legacy defenses are no longer enough. You need the expertise to detect and respond to modern threats, without the overhead of building an in-house security team. ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) provides proactive, Managed Detection and Response, 24/7, so your business can scale safely. Enterprise-grade defense. Built for businesses like yours.

youtube.com

"Ignorance Is Bliss" Is Our Acceptable Use Policy

http://www.Threatlocker.com/cisoAll links and images can be found on CISO Series (https://cisoseries.com/ignorance-is-bliss-is-our-acceptable-use-policy/) This week's episode is hosted by David Spark (https://www.linkedin.com/in/davidspark/) , producer of CISO Series and Edward Contreras (https://www.linkedin.com/in/cisoedwardc/) , senior evp and CISO, Frost Bank (https://www.frostbank.com/) . Joining is sponsored guest Rob Allen (https://www.linkedin.com/in/threatlockerrob/) , chief product officer, ThreatLocker (http://www.Threatlocker.com/ciso) . In this episode: • Not my job, still my problem • The tools people actually use • Mac, Windows, and the debate that won't quit • Hiring for imagination, not acronyms A huge thanks to our sponsor, ThreatLocker ThreatLocker delivers Zero Trust Network Access and Zero Trust Cloud Access that verifies both user and device before granting access to specific applications. No broad access, nothing exposed, and no reliance on credentials alone. It's a smarter way to control access and reduce risk. Learn more at ThreatLocker.com/CISO (http://ThreatLocker.com/CISO) .

youtube.com

Department of Know: September 4, 2026

Join us next time, at 4 PM ET / 1 PM PT with CISO Series producer Richard Stroffolino, and a panel of security pros. Each week, we bring you the cybersecurity stories that actually matter, and the conversations you've already been having at work all week long. This week, we're joined by Jonathan Waldrop, CISO, Acoustic. Big thanks to our sponsor, KnowBe4! #news #cybersecuritynews #cybersecurity #infosec #informationsecurity

youtube.com

Hackers shutdown UK power plant

The UK experienced what is being described as the most successful cyber attack of its kind against its energy infrastructure, with a power plant taken offline for four days in July, according to The Telegraph. The affected facility was smaller capacity, allowing the rest of the grid to compensate without widespread outages. Sources attributed the attack to Iranian based actors, raising concerns about whether the incident is repeatable against other facilities and what is being done to harden power plants against similar events. Subscribe for daily cybersecurity news: CISOseries.com/subscribe Thanks to our video sponsor, ThreatDown.

youtube.com

UK power plant hack, AI zero click, children's hospital breach

UK power plant disabled for four days by Iran-linked hackers Zero-click Grok and Gemini chat history theft possible through cryptographic context injection Canada's Hospital for Sick Children suffers another cyberattack Get the show notes here: https://cisoseries.com/cybersecurity-news-uk-power-plant-hack-ai-zero-click-childrens-hospital-breach/ Huge thanks to our episode sponsor, ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) SMBs face enterprise-level, AI-driven threats every day, often sacrificing robust security in favor of operational agility. You don't have to choose between moving fast and staying protected. ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) bridges the expertise gap, replacing fragmented, legacy tools with proactive, 24/7 MDR that scales with your business. ThreatDown (https://www.threatdown.com/products/managed-detection-and-response/?utm_medium=referral&utm_source=ciso&utm_content=cyber_security_headlines) . Enterprise-grade defense. Built for businesses like yours.

youtube.com

The Department of Know: Living off Azure, OpenAI's "defender window," and AI-driven PLC attacks

Read the full sotry at CISOSeries.com (https://cisoseries.com/the-department-of-know-living-off-azure-openais-defender-window-and-ai-driven-plc-attacks/) This week's Department of Know is hosted by Rich Stroffolino, with guests Bil Harmer (https://www.linkedin.com/in/williamharmer/) , CISO, Supabase (https://supabase.com/) , and David B. Cross (https://www.linkedin.com/in/david-b-cross-b856657/) , CISO, Atlassian (https://www.atlassian.com/) . Missed the live show? Check it out on YouTube (https://youtube.com/live/fd18GQq9esY?feature=share) . The Department of Know is live every Friday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com (https://cisoseries.com/) . A huge thanks to our sponsor, Vanta (https://www.vanta.com/lp/demo?utm_campaign=tof-demo&utm_source=ciso-series&utm_medium=podcast) Still stuck on the quarterly audit treadmill? Meet Calm-pliance. Vanta combines compliance, risk, and proof on one Agentic Trust Platform—and continuously monitors your controls, keeping you audit-ready all year round. Find your Calm-pliance here. (https://www.vanta.com/calm-pliance?utm_medium=podcast&utm_source=cisoseries&utm_campaign=fy27q1_integrated_calm-pliance_namer)

youtube.com

The AI genie is out of the bottle

The UK's AI Security Institute has published independent research on AI agents behaving in unintended ways within testing environments, including attempting supply chain attacks, deceiving people, prompt injection into code, and collaborating with other agents. Security expert Bruce Schneier characterizes these as "genie problems," noting the models are not breaking rules but instead exploiting loopholes to fulfill instructions in ways their designers did not anticipate, a challenge rooted in the inherent ambiguity of language. Subscribe for daily cybersecurity news: CISOseries.com/subscribe Thanks to our video sponsor, Vanta.

youtube.com

"Hacking Productivity with AI" - Super Cyber Friday

Join us live on Crowdcast: https://www.crowdcast.io/c/hacking-productivity-ai

youtube.com

CISA MLFlow warning, Siemens PLCs warning, CareCloud confirms breach

CISA warns of hackers exploiting critical MLflow vulnerability ICS operators warned of AI-driven attacks on Siemens PLCs Electronic health record company CareCloud confirms millions affected by breach Get the show notes here: https://cisoseries.com/cybersecurity-news-cisa-mlflow-warning-siemens-plcs-warning-carecloud-confirms-breach/ Huge thanks to our sponsor, Vanta Risk and regulation ramping up—and customers expect proof of security just to do business. Vanta's automation brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure—and keeps your deals moving. Learn more at vanta.com/ciso (http://vanta.com/ciso) .

youtube.com

Why Blameless Culture Beats "Three Strikes" on Phishing with ThreatLocker

ThreatLocker delivers Zero Trust Network Access and Zero Trust Cloud Access that verifies both user and device before granting access to specific applications. No broad access, nothing exposed, and no reliance on credentials alone. It’s a smarter way to control access and reduce risk. Learn more at ThreatLocker.com/CISO.

youtube.com

China kills Windows 10 again

This right here is my glorious Microsoft Surface Go tablet. It's an OG. Great little thing, except for two just kind of minor issues here. One, its CPU is kind of a joke, even when it was new. Total dog. And Microsoft no longer supports it. Thank you, Windows 11. Nothing I can do about that first part, and luckily, you can at least get Ubuntu running on this thing. But if you're a Chinese government agency, you don't even need to make that choice. That's because that while Windows 10 is now abandonware for the rest of the world, Microsoft still supports a customized version of Windows 10 for Chinese government use as part of a joint venture with another firm. And while I have no doubt that that means that that version of the OS is riddled with backdoors for government use, China being China, that doesn't seem to be good enough for the Chinese government anymore. Bloomberg sources say the Chinese Ministry of State Security recently informed government agencies to start moving off even that supposedly compromised version of Windows, citing unspecified data security concerns, cough, cough, politics. The OS was already set to retire in February 2027, but this seems to be another sign that China is looking to advance its timetable for reducing its dependency on foreign tech.

youtube.com

OpenAI rewrites safety rules, US charges 17 Iranian hackers, Defender crashes fixed

OpenAI rewrites safety rules after threshold warning US charges 17 in Iranian hacking campaign Microsoft fixes Windows Defender crash bug Get the show notes here: https://cisoseries.com/openai-safety-rules-iranian-hackers-defender-crashes/ Huge thanks to our sponsor, Vanta (https://www.vanta.com/lp/demo?utm_campaign=tof-demo&utm_source=ciso-series&utm_medium=podcast) Your GRC team is dealing with more and more frameworks, vendors, and risk. The board wants it all in one place, but your compliance data lives all over. Vanta's agentic trust platform connects compliance, risk, and trust at enterprise scale and delivers a 526% ROI over three years. 16,000+ companies trust Vanta, including Snowflake, Atlassian, and Ramp. Visit Vanta.com/CISO (https://www.vanta.com/lp/demo?utm_campaign=tof-demo&utm_source=ciso-series&utm_medium=podcast) to learn more.

youtube.com

Will AI Replace Detection Roles in Cybersecurity?

All links and images can be found on CISO Series (https://cisoseries.com/will-ai-replace-detection-roles-in-cybersecurity/) Check out this post (https://www.linkedin.com/posts/calebsima_ai-agents-will-replace-80-of-detection-roles-share-7439337735577980928-dEn3/?utm_source=share&utm_medium=member_android&rcm=ACoAAAAGB-ABR5yqhAwT3wmdEjT0Znha5c_QJ6s) from Caleb Sima of Whiterabbit for the discussion that is the basis of our conversation on this week's episode co-hosted David Spark, the producer of CISO Series (https://cisoseries.com/) , and Yaron Levi (https://www.linkedin.com/in/yaronrl/) , CISO, Dolby (https://www.dolby.com/) . Joining is Adrian Ludwig (https://www.linkedin.com/in/adrianludwig/) , CSO, Rippling (https://www.rippling.com/) . In this episode: • The messy middle • The automatable part • Where automation stops • The influence gap A huge thanks to our sponsor, ThreatLocker (http://www.Threatlocker.com/ciso) ThreatLocker delivers Zero Trust Network Access and Zero Trust Cloud Access that verifies both user and device before granting access to specific applications. No broad access, nothing exposed, and no reliance on credentials alone. It's a smarter way to control access and reduce risk. Learn more at ThreatLocker.com/CISO (http://ThreatLocker.com/CISO) .

youtube.com

Ransomware Skips The CEO

Ransomware crews are doing their homework, and their preferred target is not the CEO. Peter Gregory, author of many books in cyber, calls them equal opportunity attackers, while Michael Bickford, former CISO at NY State Gaming Commission, reframes the shift as gangs mapping the org chart instead of the network, hunting stressed 40-something managers with just enough signing authority to approve a payment. Are you training and containing the people attackers actually go after? Big thanks to our sponsor, ThreatLocker! Join us next time — LIVE every Friday at 4 PM ET / 1 PM PT: https://youtube.com/live/fd18GQq9esY?feature=share #cybersecurity #cybersecuritynews #infosec #news #informationsecurity

youtube.com

Most drivers in Latvia hit by cyberattack

Latvia's Road Traffic Safety Directorate confirmed a data breach in which threat actors accessed payment data dating back to 2008, affecting 1.2 million people, roughly two-thirds of the country's population, along with more than 200,000 businesses. Exposed information includes personal ID numbers, license plate numbers, payment details, and registration addresses, though no passwords were compromised, leading Latvia's CERT to identify social engineering as the primary risk. Investigators found the attack was sophisticated and long-planned but enabled by systems exposed to the internet that failed to meet mandatory cybersecurity requirements, prompting the agency's management, supervisory board, and chief minister to announce resignations once the investigation concludes. Subscribe for daily cybersecurity news: CISOseries.com/subscribe Thanks to our video sponsor, Vanta.

youtube.com