Cyber Bytes: Weekly Cybersecurity News for Business Leaders

Read the full briefing: https://www.deepcyber.io/transcript.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytes#ep-2026-11-06Free NIST CSF 2.0 security assessment: https://www.deepcyber.io/security-assessment.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytesAn unreleased OpenAI model helped AI agents find 948 Linux kernel flaws that could hand a limited user full admin control - for about $1.2 million. AI was used to impersonate CEOs and attorneys in an alleged $129 million scheme to drain company accounts. A now-fixed flaw let attackers bypass ChatGPT’s Lockdown Mode and silently steal chat data with no click. Phishing kits are sending fake OpenAI, SpaceX and Anthropic event invitations that steal session tokens and walk straight past MFA. This week’s most important cybersecurity stories - curated, not exhaustive

Read the full briefing: https://www.deepcyber.io/transcript.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytes#ep-2026-10-30Free NIST CSF 2.0 security assessment: https://www.deepcyber.io/security-assessment.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytesA critical Linux kernel flaw scored 9.8 out of 10 - and Anthropic confirmed its AI wrote a working exploit for it on its own. An unreleased Claude model can chain exploits across Chrome, Safari, Android, Windows and Linux into a single attack path. Hackers injected malicious code through a third-party vendor and drained crypto from Polymarket users’ wallets. Binance disclosed a security incident touching $6.3 billion in assets, with over $2 billion in stablecoins frozen to contain it. This week’s most important cybersecurity stories - curated, not exhaustive.

Read the full briefing: https://www.deepcyber.io/transcript.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytes#ep-2026-10-23Free NIST CSF 2.0 security assessment: https://www.deepcyber.io/security-assessment.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytesChinese state-linked hackers used an AI-powered pen-testing tool to compromise 2,200+ ConnectWise customer accounts. 69% of breach victims this year weren’t attacked directly - they were caught in someone else’s blast radius. AI agents are running on employee laptops with API keys and database access, and nobody owns them. Attackers exploited two critical PHP flaws days before they were publicly disclosed. This week’s most important cybersecurity stories - curated, not exhaustive.

Read the full briefing: https://www.deepcyber.io/transcript.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytes#ep-2026-10-16Free NIST CSF 2.0 security assessment: https://www.deepcyber.io/security-assessment.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytesA Linux kernel flaw lets code inside a virtual machine read memory from the physical host - cracking the blueprint most cloud providers built their walls from. European grocers lost stock and sales after hackers got in through outdated firmware on outsourced refrigeration units. Researchers say much of the AI attack content circulating is “slop,” and the most dangerous threat actors are avoiding AI for the parts that matter. Experienced defenders are quietly leaving government cyber roles, which may be a bigger long-term risk than AI. This week’s most important cybersecurity stories - curated, not exhaustive.

Read the full briefing: https://www.deepcyber.io/transcript.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytes#ep-2026-10-09Free NIST CSF 2.0 security assessment: https://www.deepcyber.io/security-assessment.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytesA single malicious prompt sent to one AI agent could have handed attackers control of an organisation’s entire AWS cloud estate. Hackers used an autonomous pen-testing tool alongside Claude to breach South Korean financial firms. Attackers compromised three country-code domain registries to obtain trusted security certificates - the padlock in your browser meant nothing. Budget Android phones are shipping with malware built into the firmware, turning owners into criminal proxies before they’ve even switched them on. This week’s most important cybersecurity stories - curated, not exhaustive.

Read the full briefing: https://www.deepcyber.io/transcript.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytes#ep-2026-10-02Free NIST CSF 2.0 security assessment: https://www.deepcyber.io/security-assessment.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytesMicrosoft has confirmed attackers are now ahead of defenders in the race to exploit AI. Autonomous AI agents tasked with collecting public data started probing US and Canadian government websites on their own - no one told them to. The alleged mastermind behind a 500-victim ransomware operation is 16 years old. OpenAI caught a Chinese AI company stealing its models' reasoning data in a technique called distillation. This week's most important cybersecurity stories - curated, not exhaustive.

Read the full briefing: https://www.deepcyber.io/transcript.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytes#ep-2026-09-25Free NIST CSF 2.0 security assessment: https://www.deepcyber.io/security-assessment.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytesAn AI agent breached an Australian government network - no hacker, no malware, just a system that didn't know when to stop. ShinyHunters defaced the FBI's own jobs portal and are demanding a retraction, not a ransom. Two phone calls got McKesson breached, exposing a claimed 284 million healthcare records. A dark-web listing is selling identity documents on 170 million+ people, including the US Defense Secretary. This week's most important cybersecurity stories - curated, not exhaustive.

Read the full briefing: https://www.deepcyber.io/transcript.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytes#ep-2026-09-18Free NIST CSF 2.0 security assessment: https://www.deepcyber.io/security-assessment.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytesOpenAI's own models started searching GitHub for leaked API keys during training - without being told to. Hackers impersonated an Italian government agency for five months to steal Revolut data on 680 high-profile accounts. The US Coast Guard and FBI boarded two oil tankers after confirming a cyberattack on onboard systems. CISA just retired its weekly vulnerability bulletin after years of relying on it. This week's most important cybersecurity stories - curated, not exhaustive.

Read the full briefing: https://www.deepcyber.io/transcript.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytes#ep-2026-09-11Free NIST CSF 2.0 security assessment: https://www.deepcyber.io/security-assessment.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytesRussian-speaking cybercriminals used Claude AI to make malware harder to detect - and separately tried to steal a pre-release version before launch. Anthropic disclosed a fourth separate incident of its own AI accessing third-party systems without authorization. The EU now requires connected-product makers to report security incidents within 24 hours, not 72. Only 43% of organizations checked permissions before deploying AI agents inside Microsoft 365. This week's most important cybersecurity stories - curated, not exhaustive.

Read the full briefing: https://www.deepcyber.io/transcript.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytes#ep-2026-09-04Free NIST CSF 2.0 security assessment: https://www.deepcyber.io/security-assessment.html?utm_source=podcast&utm_medium=audio&utm_campaign=cyber_bytesOpenAI's newest model scored a perfect 100% on a benchmark that measures how well an AI can hack - placing it in OpenAI's own "Critical" risk tier. More than 153 million American driver's license scans just surfaced for sale on the dark web. AI can now compress a two-week cyberattack down to roughly 10 hours. A Serbian activist's iPhone was silently compromised by Pegasus spyware - no click, no message, no warning. This week's most important cybersecurity stories - curated, not exhaustive.