Welcome to our weekly newsletter where we share some of the major developments on the future of cybersecurity that you need to know about. Make sure to follow my LinkedIn page as well as Echelon’s LinkedIn page to receive updates on the future of cybersecurity!
To receive these and other curated updates to your inbox on a regular basis, please sign up for our email list here: https://echeloncyber.com/ciw-subscribe
The Human Side of Cybersecurity Before we turn to this week's edition of Cyber Intelligence Weekly, I want to share something I've been building toward for a while.
The Human Side of Cybersecurity is back for Season 2, and the first episode is live today. For those new to the series, this is a podcast where I sit down with CISOs and security leaders who are in the seat, navigating real leadership pressure, complex risk decisions, and the human realities of building and sustaining security programs. What they share is experience, earned through moments of progress, frustration, growth, and reflection.
Last season, 15 conversations across industries pointed to the same truth: the human side of this work is what actually moves the needle. Season 2 goes deeper into exactly that, and we're kicking it off with a conversation I think you'll really enjoy. Danny Manimbo (Schellman) — "If it matters to you, you'll make the time."
In this episode, I sat down with Danny Manimbo, Managing Principal at Schellman, for a conversation that ended up being one of the most personal and honest I've had in this series. Danny's path into leadership started with a professor at the University of Miami who pulled him out of class after a mediocre exam and told him — point blank — that he had the potential to become a rainmaker. Danny didn't believe it at the time. But that one conversation changed his major, his career, and eventually his entire outlook on what he was capable of. Fourteen years later, he's a managing principal at a top 50 CPA firm.
What stood out most was how clearly Danny connects his professional growth to his personal transformation. In 2020, he made a hard decision to step back, reassess, and rebuild physically, mentally, and professionally. What followed was one of the most remarkable personal journeys I've heard in this series, and the leadership lessons he drew from it are ones I think many people in this industry need to hear.
Additional takeaways from the conversation:
- One person believing in you can change everything. Danny still thinks about the professor who saw his potential before he could see it himself, and the ripple effect of that moment has followed him throughout his entire career.
- Managing projects and leading people are fundamentally different skills. It wasn't until Danny invested in formal leadership development and started reading deeply on the subject that he understood what it actually meant to lead a team versus run an engagement.
- Leadership is a skill you build, not a quality you're born with. The leaders who grow are the ones who treat it like any other discipline by studying it, practicing it, and staying humble enough to keep learning.
- Having something outside of work that challenges you makes you a better leader at work. Danny doesn't prescribe what that looks like for everyone, but he's seen the difference it makes in how people show up, how they handle pressure, and how long they last.
- The uncomfortable conversations you avoid always become bigger problems later. Small tensions that go unaddressed quietly compound into culture issues, and Danny has made it a point to coach his team through that rather than around it.
- The people around you notice everything, especially the moments when you choose to be present. Whether it's your team, your family, or yourself, showing up consistently and intentionally is what defines the kind of leader you actually are.
His billboard message was simple: If it matters to you, you'll make the time. If you keep saying you don't have time for the things that matter like your health, your team, your family, the real question is whether you've decided they matter yet.
If there was one thread that ran through this conversation, it was this: the leaders who last are not the ones who grind the hardest. They are the ones who take care of themselves, invest in the people around them, and keep showing up for their teams, their families, and themselves.
Watch the Full Interview Here: https://youtu.be/y-nqp52rgps
Echelon Events & Thought Leadership Highlight
AI is being adopted across almost every organization. In many cases, leadership teams want to move even faster with it.
But there's a problem with that. Most security and compliance programs weren’t built for AI.
On November 18, join our very own Josh Fleming along with Vanta's Connor Snyder, CPA, CISA to talk about what security leaders can do about it.
Save your spot: https://lnkd.in/eUs9iaq5
Away we go!
1. Chinese Espionage Group Exploits BeyondTrust Zero-Day to Steal Credentials and Infiltrate Networks
A suspected Chinese state-sponsored hacking group has been exploiting a previously unknown vulnerability in BeyondTrust Remote Support, a widely used platform that allows IT teams to remotely access and troubleshoot computers and other systems. The flaw, tracked as CVE-2026-102764, was exploited in attacks dating back to August 29, well before the vulnerability was publicly disclosed. BeyondTrust, Google Threat Intelligence Group and Mandiant have confirmed the activity and published findings detailing how the attackers compromised affected appliances. BeyondTrust has released a security update, but researchers are warning that organizations with vulnerable systems exposed to the internet should investigate whether attackers gained access before the patch became available.
The group behind the attacks, tracked as Armory Castle or UNC5221, appears to have a particularly sophisticated understanding of BeyondTrust's technology. According to Mandiant, the attackers exploited the vulnerability to elevate their privileges, move laterally through victim networks and establish persistent access. Researchers identified custom malware known as Sawfly and Bareclaw, along with techniques that allowed the attackers to extract all credentials stored on compromised appliances. They also modified files in ways that could survive reboots and configuration resets. This is especially concerning because remote support platforms often have privileged access to numerous systems across an organization. Compromising one appliance can potentially provide access to credentials and systems far beyond the original point of entry.
Google and Mandiant have linked the activity to a suspected Chinese espionage operation focused on long-term intelligence collection. The group has previously targeted government agencies, law firms, technology companies, SaaS providers and business-process outsourcing organizations. Researchers believe technology companies are particularly attractive targets because they can provide access to other organizations or valuable information about additional vulnerabilities. Armory Castle has also been associated with attacks exploiting vulnerabilities in Ivanti and Citrix products. Its established pattern is especially troubling: use previously unknown vulnerabilities against selected targets, then expand exploitation to a much larger population of vulnerable systems once the flaws become public.
For organizations using BeyondTrust Remote Support, the priority should be to apply the vendor's security update and investigate for evidence of compromise, not simply assume the patch resolves every risk. Security teams should review appliance exposure, examine logs and indicators of compromise, investigate unauthorized configuration changes and assess whether stored credentials need to be rotated. Because the attackers reportedly established persistence that could survive ordinary resets, potentially compromised appliances may require a more thorough forensic investigation and recovery process. The larger lesson extends to every privileged remote access platform. When attackers compromise the tools your IT team uses to manage the environment, they may inherit the same access and trust your administrators rely on every day. These systems deserve some of the strongest security controls and most continuous monitoring in the enterprise.
AWS Patches Encryption Flaw That Could Expose Sensitive S3 Data
Amazon Web Services disclosed a security vulnerability on October 14 affecting the Amazon S3 Encryption Client for .NET, a software library used by developers to encrypt data before storing it in Amazon S3. Tracked as CVE-2026-110310, the vulnerability could allow an attacker with access to encrypted S3 objects to manipulate encryption metadata and potentially decrypt information that was supposed to remain protected. The issue involves a downgrade to an older RSA padding scheme, PKCS#1 v1.5, which is susceptible to a well-known cryptographic attack.
Consider a financial services company storing sensitive customer documents in S3 using client-side encryption. The organization may have carefully configured bucket permissions and encryption keys, believing that encrypted files would remain confidential even if an unauthorized party gained access to the stored objects. Under the conditions described in the advisory, an attacker who can read encrypted objects and alter their encryption metadata could potentially exploit the vulnerable encryption client to recover the encryption key protecting an object. This is not a general vulnerability in S3 itself, but it illustrates how weaknesses in the software handling encryption can undermine otherwise sound cloud security practices.
AWS has released fixes, and affected organizations should upgrade immediately:
- Version 3.x: Upgrade to Amazon S3 Encryption Client for .NET 3.2.2 or later.
- Version 4.x: Upgrade to 4.0.3 or later.
- Version 2.x: Migrate to a supported, patched release. AWS will not issue fixes for the 1.x or 2.x branches.
AWS has not identified a workaround. Security teams should inventory applications using the affected .NET encryption library, update dependencies, redeploy affected workloads and review whether unauthorized users have been able to access or modify encrypted objects and their metadata.
Why it matters: Encryption is often treated as a final safeguard when other defenses fail. But encryption is only as strong as its implementation, including the libraries, key-management practices and application logic surrounding it. Organizations should include cryptographic libraries in vulnerability management programs and regularly verify that their applications use current, supported encryption methods. Storing data in the cloud does not eliminate the responsibility to secure the software protecting that data.
2. Microsoft Patches More Than 1,400 Security Flaws in Record October Update
Microsoft's October 2026 Patch Tuesday release has set a new record, addressing approximately 1,413 security vulnerabilities across its products, including a Windows flaw already being exploited by attackers. The update surpasses September's previous record of 974 vulnerabilities and includes dozens of critical issues affecting widely used enterprise software. Among the most urgent is CVE-2026-96951, a Windows Shell vulnerability that allows attackers to bypass Mark of the Web, a security feature designed to identify files downloaded from untrusted sources. Microsoft confirmed active exploitation of the flaw, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities catalog. Federal agencies subject to the applicable directive were given just three days to address the issue.
The Windows Shell vulnerability carries a CVSS severity score of 8.8 and requires a victim to interact with a specially crafted malicious file. Successful exploitation could allow an attacker to bypass protections that normally warn users about potentially dangerous content. Other notable fixes include CVE-2026-108398, a publicly disclosed .NET Framework security bypass involving an untrusted search path, and CVE-2026-70571, a stack-based buffer overflow in Microsoft Exchange Server that could allow remote code execution. Microsoft also addressed ten remote code execution vulnerabilities in Windows DHCP Server, five of which were rated critical, along with numerous issues affecting Microsoft Office. The breadth of affected products creates a substantial workload for security and IT teams responsible for keeping enterprise environments protected.
Recognizing that organizations cannot realistically investigate more than a thousand vulnerabilities individually, Microsoft introduced a vulnerability prioritization approach called Risk Cohorts. Rather than treating every CVE as an isolated issue, the framework encourages security teams to group vulnerabilities according to common characteristics such as how affected software is deployed, whether systems are exposed to attackers, and which security boundaries could be crossed. For example, a business might prioritize vulnerabilities affecting internet-facing servers, critical identity infrastructure and heavily used employee applications before addressing lower-risk issues on isolated systems. The goal is to make vulnerability management more practical by connecting technical findings to the actual exposure and business importance of affected systems.
For cybersecurity leaders, October's release illustrates why vulnerability management must evolve beyond simply counting outstanding patches. Organizations should immediately prioritize known exploited vulnerabilities, identify affected assets and accelerate updates for systems that present the greatest risk. Automated patch deployment, accurate asset inventories and continuous validation of remediation are increasingly important as the volume of disclosed vulnerabilities grows. Microsoft's Risk Cohorts approach offers a useful way to organize the work, but it should complement rather than replace a disciplined patching program. The measure of an effective vulnerability management program is not how many CVEs a team reviews. It is how quickly the organization reduces the risks that matter most.
AWS SageMaker Vulnerability Could Expose Source Code Credentials Through CloudWatch Logs
AWS disclosed a vulnerability on October 14 affecting the Amazon SageMaker Python SDK, a widely used development library for building, training and deploying machine learning models. Tracked as CVE-2026-110248, the flaw could cause sensitive Git repository credentials to be written into Amazon CloudWatch Logs when a source-code cloning operation fails. An authenticated user with access to those logs could then retrieve the credentials in plaintext, potentially gaining unauthorized access to private source-code repositories.
The issue originates in the SDK's git_utils.py component, which handles Git operations during machine learning workflows. Imagine a development team using SageMaker to train a proprietary AI model with code pulled from a private Git repository. If the repository URL contains embedded credentials and a cloning operation fails, the resulting error output could expose those credentials in CloudWatch. Depending on the permissions attached to the exposed token, an attacker who can read the logs might be able to access proprietary model code, training scripts or other sensitive development assets. The vulnerability is particularly relevant because machine learning environments often connect multiple repositories, data sources and cloud services.
AWS has released patches for both major SDK versions:
- SageMaker Python SDK V2: Upgrade to 2.257.3 or later.
- SageMaker Python SDK V3: Upgrade to 3.10.0 or later.
Organizations unable to upgrade immediately should avoid embedding credentials directly in Git repository URLs and restrict access to CloudWatch Logs containing SageMaker output. Security teams should review logs from failed Git clone operations, identify any credentials that may have been exposed and rotate them. AWS also recommends ensuring that custom forks or derivative versions of the SDK incorporate the security fixes.
Why it matters: AI development environments increasingly bring together sensitive data, proprietary code, cloud infrastructure and powerful automation. That makes seemingly routine development activity, including error logging, a potential source of credential exposure. Organizations should treat AI and machine learning infrastructure as part of their core security program, with the same attention to secrets management, access control, software patching and monitoring applied to production applications. A failed development task should never become an opportunity for someone else to obtain the credentials protecting your intellectual property.
3. Cisco Warns of Actively Exploited Email Security Flaw That Could Give Hackers Root Access
Cisco has released an emergency security update for a critical vulnerability in its Secure Email Gateway software that attackers are already exploiting in the wild. The flaw, tracked as CVE-2026-76519, carries a CVSS severity score of 9.8 out of 10 and affects the Advanced Malware Protection (AMP) functionality used to inspect potentially malicious email attachments. According to Cisco's October 14 advisory, an unauthenticated attacker could exploit the vulnerability remotely by sending a specially crafted email attachment to an affected gateway. Successful exploitation could allow the attacker to write arbitrary files to the underlying operating system and execute commands with root privileges, potentially gaining complete control of the appliance.
The vulnerability stems from improper handling of email attachments when the file reputation service is enabled. This creates a particularly troubling scenario because email security gateways sit directly in the path of incoming corporate communications. Organizations rely on these systems to identify malicious attachments, block phishing attempts and prevent dangerous content from reaching employees. If attackers gain control of the gateway itself, they could potentially interfere with those protections, manipulate email traffic or use the compromised appliance as a foothold for additional attacks. Cisco has also warned that an attacker with root-level access could remove evidence of malicious activity, making detection and incident response more difficult.
The urgency surrounding this vulnerability is reflected in the federal government's response. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog on October 14, requiring affected federal civilian agencies to remediate the issue by October 17. Cisco has released fixed versions of its AsyncOS software and is urging customers to update immediately. Organizations running version 15.5 should upgrade to 15.5.5-014 or later, while those running version 16.5 should upgrade to 16.5.0-780 or later. Customers on version 16.0 should migrate to a fixed release. Cisco has not identified a workaround that eliminates the vulnerability, making patching the primary remediation step.
For organizations using Cisco Secure Email Gateway, the immediate priority should be to identify affected appliances, apply the appropriate updates and investigate for evidence of compromise. Security teams should review appliance logs, validate configurations, restrict administrative access and monitor for suspicious behavior using security tools outside the gateway itself. Because the vulnerability is already being exploited, organizations should not assume that applying the patch automatically resolves a prior compromise. The broader lesson is one that security leaders cannot afford to overlook: the systems responsible for defending an organization can become some of its most valuable targets. Email gateways, firewalls and other security appliances require the same disciplined patching, access controls and continuous monitoring as the critical infrastructure they protect.
Thanks for reading!
About us: Echelon is a full-service cybersecurity consultancy that offers wholistic cybersecurity program building through vCISO or more specific solutions like penetration testing, red teaming, security engineering, cybersecurity compliance, and much more! Learn more about Echelon here: https://echeloncyber.com/about