A (0:00)

From the CISO series, it's Cybersecurity Headlines.

B (0:07)

These are the cybersecurity headlines for Tuesday, October 28, 2025. I'm Lauren Verno. OpenAI Atlas browser hijacked Researchers have discovered a new attack vector for OpenAI's Atlas web browser, where its Omnibox can be tricked into executing malicious prompts disguised as seemingly harmless URLs. Now, if a user pastes one of these crafted URLs into the omnibox, Atlas interprets the input as trusted user intent, allowing attackers to redirect users, steal credentials, or even delete files from connected apps. The flaw stems from Atlas failing to strictly separate trusted user input from untrusted content, a common weakness in these kinds of browsers. AI versus Cybersecurity Vendors if you had listened to the department of Node yesterday, you would know this by now. But ex CISA head Jen Easterly warned that AI could could eventually make cybersecurity breaches the exception not the norm by spotting software flaws faster than ever. She says most cybercrime isn't about advanced hackers. It's about sloppy software with old vulnerabilities like SQL injection and cross site scripting still causing trouble decades later. She believes that AI can help defenders catch these flaws, clean up technical debt, and push software towards secure by design principles. The real way to cut risk, Easterly said, is demanding better software from vendors, not just reacting to attacks. I'm curious, what do you think? Bye bye Twitter Birdie it's not a security breach, it's the end of Twitter X Formerly Twitter caused a stir after announcing users must re enroll their security keys by November 10 or risk account lockouts, initially without explanation. The platform later clarified the change is not due to a security breach, but that physical keys tied to the twitter.com domain must be re registered under the x.com domain ahead of the Twitter domain's retirement. Dante spyware Surfaces Italian spyware from Memento Labs, formerly the notorious hacking team, has been linked to attacks on Russian and Belarusian organizations. As Kaspersky reports, the malware known as Dante was discovered while investigating Operation Forum Troll, a campaign that exploited a Chrome zero day to target media, universities and government institutions. While Dante itself wasn't used in that phishing campaign, Kaspersky traced the spyware in other forum troll operations. Thanks to today's episode sponsor Conveyor security reviews don't have to feel like a hurricane. Most teams are buried in back and forth emails and never ending customer requests for documentation or answers. But Conveyor takes all that chaos and turns it into calm, AI fills in the questionnaires, your trust center is always ready, and sales cycles move without stalls. Breathe easier. Check out conveyor@conveyor.com that's C O N V E Y-O-R.com Millions of exploit attempts in WordPress plugin Active attacks are exploiting three critical vulnerabilities in the Gutenkit and Hunk Companion WordPress plugins, with roughly 9 million exploit attempts blocked since October 8th. That's according to WordPress security firm Defiant. The flaws let attackers install plugins, execute code remotely and take over sites, often using a malicious zip file on GitHub containing backdoors and scripts for persistence and mass defacement. Technically, these vulnerabilities were patched over a year ago, but but these new campaigns reveal the need for another round of plug in updates. Iran Cyber Academy Hacked Iran's state linked Raven Academy, which trains cyber attackers for the Ministry of Intelligence or mois, confirmed a breach exposing names, phone numbers and telegram usernames of students and associates. The stolen data also included national ID numbers and class details, with many affected linked to STEM fields at Western universities founded by MOIs, tied individuals and previously sanctioned by the US, UK and EU. Raven Academy sits within a broader Iranian cyber ecosystem that remains active despite sanctions. Blue screen of death Fix Microsoft may have a solution to the impending doom that is the blue screen of death. Microsoft is testing a new Windows 11 feature that prompts users to run a memory scan after a blue screen of death to catch potential memory issues before they can cause more crashes. The proactive memory diagnostics run during the next reboot and notify users if issues are found and mitigated. Though it's not yet available on ARM64 devices or systems with certain security protections, the feature is rolling out to Windows insiders in the dev and beta channels. Quilen's Linux Ransomware bypasses EDR the Quilen Ransomware Group has launched cross platform attacks using using a Linux based ransomware binary on Windows hosts, bypassing conventional Windows Focused Security Solutions and EDR platforms. The group deployed the malware via legitimate remote management and file transfer tools like AnyDesk, RMM, WinSCP and Screen Connect, targeting Veeam backup systems to steal credentials and and block recovery options. Live in Boston Work in cybersecurity maybe you're just studying and you want to work in cyber. If any of those are true then you must join us Monday, November 24, 2025 for our Boston based CISO Series meetup. It's happening at the City taphouse Boston from 5 to 7pm Be sure to head to the events page at cisoseries.com to register to join us. And if you have some thoughts on the news from today or about the show in general, be sure to reach out to us@feedbackisoseries.com we'd love to hear from you. I'm Lauren Verno reporting for the CISO series.