ISC Stormcast For Friday, October 2nd, 2026 https://isc.sans.edu/podcastdetail/10120, (Fri, Oct 2nd)

CERT-EU's September threat review highlights stolen AI-service access and hijacked cloud workloads. Its roundup cites Google's reporting on LLM-jacking and Microsoft's account of passkey-themed phishing against Microsoft 365 users. It also covers spyware targeting civil society and alleged unauthorized AI-agent activity. The monthly report separates law-enforcement, espionage, cybercrime and AI developments across Europe and globally, drawing on attributed public reporting.

EFF reports that Ecuador ordered security researcher and free-software developer Ola Bini’s deportation and imposed a ten-year reentry ban. The advocacy group says officials relied on a secret security report that his defense could not inspect, and that his lawyers sought habeas corpus protection. EFF says Bini was held at Quito’s airport awaiting departure for Sweden and urges authorities to explain the accusations.

GitHub now lets repository teams discuss vulnerability reports inside security advisories using comments restricted to users who currently have write access. Reporters and invited collaborators lacking that permission cannot read them or receive notifications; losing write access also removes visibility. Comment visibility cannot be changed after posting. GitHub says the feature covers public repositories with private vulnerability reporting enabled across its Free, Pro, Team and Enterprise Cloud plans.

GitHub has introduced a public preview of REST endpoints for reading, adding and editing repository advisory comments on public repositories. Access requires advisory visibility and appropriate repository security advisory permissions or token scopes; non-collaborators cannot read internal comments, and confidential comments are excluded. Comment deletion remains unsupported. Repository advisory responses now report non-confidential comment counts, letting integrations check for discussion before retrieving it.

EFF reports that a federal judge temporarily blocked enforcement of Utah’s VPN-related location requirements in SB 73. The organization argues that websites cannot reliably determine every VPN user’s physical location and that the requirements would expand invasive age checks beyond Utah. The ruling is a preliminary injunction, rather than a final decision; the lawsuit does not challenge the separate restriction on sharing VPN instructions.

EFF is using its Opt Out October campaign to encourage people to reconsider default reliance on major technology companies. Its resource hub points to alternative software, social platforms and operating systems, alongside controls for how services use personal data in AI training. The campaign frames switching tools as one route to greater control over data; these are EFF’s advocacy recommendations, not an independent evaluation of every alternative.