Good morning!

A ransomware recovery CEO is charged with wire fraud over secretly paying the ransoms he claimed to beat as Boeing faces extortion claims at a unit it sold last year. One is an indictment; the other is only claims.

Here are the 7 things you don't want to miss:

1. 🔒 Cisco's October advisories cover switches, controllers and licensing

Cisco's PSIRT published its scheduled batch on Wednesday, October 7, led by an unauthenticated remote code execution flaw in NX-API (CVE-2026-76471, rated 9.8), further 9.8 flaws in Nexus MPLS OAM and NGOAM, and Smart License On-Prem items rated 10.0. Fixed software is listed for each; Cisco offers no workaround. The date was promised; the list of CVEs never was. (Cisco)

2. 🤝 Practice the Thing You Just Read About

Every item above is something you will eventually have to do, not just read about. Threat Road's Cyber Security Labs give you an isolated VM, a guided exercise, and a target that only exists for you to break — Linux fundamentals through hands-on exploitation, in your browser, on your own schedule. No shared infrastructure, no waiting for a lab window, no permission slip. (Threat Road)

3. ⚖️ DOJ charges a ransomware recovery CEO over secret ransom payments

Zohar Pinhasi, the Florida operator of MonsterCloud, was arraigned in the Eastern District of New York on Wednesday on wire fraud charges. The indictment alleges he told clients he could decrypt without paying, then paid attackers anyway — charging more than $19 million while paying out more than $8 million in ransoms. (Department of Justice)

4. 🎯 A $10M reward for an accused MSS operative

The State Department's Rewards for Justice program says it will pay up to $10 million for information on Zhang Yu, a Firetech director it alleges works for China's Ministry of State Security and took part in the 2021 Exchange intrusions. Officials say co-defendant Xu Zewei was extradited in April 2026; Zhang is still at large. (Rewards for Justice)

5. 🤖 PoeLLM's poem-directed miners have compromised 3,400 exposed servers

Lumen's Black Lotus Labs says in research published October 7 that PoeLLM has compromised more than 3,400 internet-facing deployments, among them LiteLLM, Ollama, Gotenberg and Gitea instances, and that it steers its command servers from poems published on GitHub, peaking above 800 hosts a day. Hiding command servers in a published poem is a choice. (Lumen)

6. 💰 Who was extorting the Boeing spin-off Jeppesen ForeFlight?

In the ShinyHunters case, KrebsOnSecurity reports, citing two sources familiar with the investigation, that the group was extorting Boeing over claims tied to Jeppesen ForeFlight while a suspect was in custody. Boeing said it is aware of the claims and actively reviewing them with Jeppesen, which said the claims have had no impact on its operations or products. Boeing sold the unit last year. (KrebsOnSecurity)

7. 🔓 The Atlassian file-read flaw is now being exploited

Two days after Atlassian's October 5 advisory said it had found no evidence of exploitation, BleepingComputer reports that Previdian watched attackers hit CVE-2026-21589 on its honeypots within hours of a detailed public write-up from watchTowr. The unauthenticated file-read flaw affects eight Data Center products; Atlassian's advisory has the fixes. The "no exploitation" line aged in about forty-eight hours. (BleepingComputer)

Bonus. Threat Road Tip Of The Day

Take ten minutes on your own estate today: which services answer on the public internet, who owns each one, and how long they have been sitting there. Servers do not decommission themselves.

Disclosure: Topic #2 in this newsletter is a promotion for Threat Road's Cyber Security Labs. Nothing else in this issue is sponsored.