Sometimes the first warning is spoiled food. |
I’m watching a Pentagon investigation with an unusual starting point. Elsewhere, attackers exploit trusted access and AI tests SOC budgets. - Ken
Missed a newsletter? Read past issues here. |
|
|
|
Here’s what you need to know: |
|
|
| Pentagon Investigates Freezer Failures at Six Military Bases |
The Pentagon is investigating whether cyberattacks caused refrigeration failures that spoiled food at at least six U.S. military commissaries. While the cause remains unconfirmed, the incidents highlight the importance of protecting equipment that keeps essential supplies usable. |
My Take: I’d ask facilities who would detect an unexpected refrigeration settings change. Then I’d confirm who checks whether it was authorized and who can override it. Assign a response owner and test alerts for unauthorized equipment settings changes. |
Amadeus Hack Exposes 53,000 Cathay Pacific Bookings |
An unauthorized party accessed about 53,000 Cathay Pacific bookings using Amadeus system-account credentials. The exposed travel details could make phishing messages more convincing, although no misuse has been confirmed.
My Take: I’d be asking how many customer records a single supplier account can retrieve before anyone intervenes. Limit supplier accounts to necessary records and test alerts for unusually large data retrievals. |
Linux Flaw Gives Attackers Root on Palo Alto Firewalls |
Researchers reported that threat actors compromised 25 firewall and management servers. The attacks chained PAN-OS management vulnerabilities with Fragnesia, a Linux privilege escalation flaw.
My Take: I’d extend your investigation to any credentials stored on or used through the compromised firewall. Investigate unexplained outbound tunnels, rotate exposed credentials, and check related accounts for suspicious logins. |
|
|
|
Cloudflare Blocks 18.2 Million DDoS Attacks in Three Months
|
Cloudflare reported mitigating 18.2 million network-layer DDoS attacks in the third quarter of 2026. Of those attacks, 96% lasted less than 10 minutes, leaving little time for security teams to respond. |
My Take: I’d check whether essential tasks still worked during each attack. Uptime reports can miss failed logins or stalled transactions.
Test automatic DDoS mitigation and confirm essential services remain usable during short attacks. |
AI Speeds SOC Investigations but Runs Up the Bill |
Anthropic’s CLUE demonstration showed how an LLM could reduce hours of security investigation to minutes. However, investigating hundreds of thousands of alerts could become too costly, forcing teams to prioritize which ones get reviewed.
My Take: I’d measure how many missed threats automation uncovers for the budget available. Test automation on past alerts and compare threats detected with total investigation costs. |
|
|
|
How Ready Are You for DDoS Attacks? |
DDoS attacks can knock services offline before security teams can react, making automated protection essential to keeping those services available. |
How to strengthen your DDoS protection: |
- Use DDoS protection solutions that automatically detect attacks and filter malicious traffic.
-
Coordinate filtering with your ISP and use a content delivery network with rate limits to reduce server load.
- Monitor for other suspicious activity during attacks and verify that legitimate users can still access services.
|
Report DDoS-related downtime and its business cost to the board, including how quickly critical services were restored. |
|
|
|
Security Tools You Can Use |
|
|
|
Freezers fail. Cyberattacks suspected. Where do you stand? |
|
|
|
Yesterday's Pulse Check Results |
An attacker starts exporting your customer database. What happens next? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
