CISO Intelligence

CISO Intelligence

Senator presses CISA for answers about alleged GitHub repository leak

Source: The Record  ·  Category: Ransomware & Breach Senator Hassan requests CISA answers on alleged GitHub repository breach involving government contractor Nightwing. If firm houses government client work on GitHub or shared repositories, assess whether firm data exposure is possible; congressional scrutiny signals escalating oversight. → Read the full article

CISO Intelligence

Verizon DBIR: AI Helped Hackers Exploit Vulnerabilities in 31% of Recent Breaches

Source: Hackread  ·  Category: Security News — Technology Verizon DBIR 2026: AI aided hackers in exploiting vulnerabilities in 31% of recent breaches; software flaws now outpace stolen passwords as attack vector. AI-accelerated exploitation of unpatched software is now mainstream attack pattern; law firms must prioritize vulnerability management. → Read the full article

CISO Intelligence

A malicious VS code extension just breached GitHub ‘s internal repositories

Source: Security Affairs  ·  Category: Supply Chain Trojanized VS Code extension led to breach of ~3,800 GitHub internal repositories; TeamPCP claims credit and demands $50K ransom. Developer tooling supply chain risk; law firms using GitHub for internal or matter-related code face similar extension-based compromise vectors. → Read the full article

CISO Intelligence

GitHub investigates internal repositories breach claimed by TeamPCP

Source: BleepingComputer  ·  Category: Ransomware & Breach GitHub investigating breach of ~4,000 internal repositories by TeamPCP. Corroborates earlier GitHub incident reports (articles 7 & 12). Multiple GitHub breaches in short timeframe elevate threat; if firm uses GitHub, prioritize repository audit and access controls now. → Read the full article

CISO Intelligence

Drupal critical update to fix bug with high exploitation risk

Source: BleepingComputer  ·  Category: Security News — Technology Drupal core security patch scheduled with high exploitation risk; exploits expected within hours. If firm runs Drupal websites or client portals, apply patch immediately upon release; monitor for active exploitation. → Read the full article

CISO Intelligence

Microsoft shares mitigation for YellowKey Windows zero-day

Source: BleepingComputer  ·  Category: Security News — Technology Microsoft releases mitigations for YellowKey, a Windows BitLocker zero-day allowing full-disk encryption bypass. Zero-day affects endpoint security; if firm laptops use BitLocker (likely for mobile attorneys), apply mitigation immediately and escalate to IT. → Read the full article

CISO Intelligence

Critical Microsoft Vulnerabilities Doubled: From Exposure to Escalation

Source: BleepingComputer  ·  Category: Security News — Technology Critical Microsoft vulnerabilities surged year-over-year in 2025; attackers increasingly targeting privilege escalation and identity abuse. Law firms rely heavily on Microsoft 365 and endpoints—escalating attack surface warrants vulnerability management review. → Read the full article

CISO Intelligence

New Shai-Hulud malware wave compromises 600 npm packages

Source: BleepingComputer  ·  Category: Supply Chain 600+ malicious npm packages (Shai-Hulud campaign) published to Node Package Manager. If firm's development, matter management, or infrastructure teams use npm dependencies, conduct urgent supply chain audit; recommend blocking or re-vetting npm packages in use. → Read the full article

CISO Intelligence

Siemens RUGGEDCOM APE1808 Devices

Source: CISA Cybersecurity Advisories  ·  Category: Government Advisory CISA advisory: Palo Alto Networks PAN-OS buffer overflow (User-ID captive portal) allows unauthenticated root code execution on PA/VM firewalls. Critical if firm uses Palo Alto for network perimeter or VPN—confirm deployed versions and patch immediately. Recommend CISO escalation to network ops.

CISO Intelligence

Microsoft dismantled malware-signing network Fox Tempest

Source: Security Affairs  ·  Category: Threat Actor & Campaign Microsoft disrupted Fox Tempest, malware-signing-as-a-service operation abusing Artifact Signing to issue fake certificates. Attackers legitimizing malware; enterprises vulnerable to trojanized software that appears signed and trusted. → Read the full article

CISO Intelligence

Pwn2Own Berlin 2026 Closes With $1.3 Million in Zero-Day Payouts

Source: Hackread  ·  Category: Security News — Technology 47 zero-day exploits demonstrated at Pwn2Own Berlin 2026 targeting enterprise software and AI platforms, resulting in $1.3M in payouts. Signals active adversary interest in enterprise attack surfaces; law firms using targeted platforms (Microsoft, Adobe, browsers) should monitor patch velocity and vendor disclosures. → Read

CISO Intelligence

Hackers Actively Exploit ‘Nginx Rift’ Vulnerability Affecting NGINX, F5 Products

Source: Hackread  ·  Category: Security News — Technology Nginx Rift vulnerability in NGINX and F5 products actively exploited in the wild; enables denial-of-service attacks. Law firms using NGINX for web services or F5 load balancers should confirm patch status immediately to prevent service disruption. → Read the full article