Two Copies Are Not Two Sources | NexusRiver NexusRiver · CISO Intelligence Brief Oct 20, 2026 TLP:AMBER Two Copies Are Not Two Sources If your primary environment became untrustworthy at 10:00 this morning, where would your critical business operation be running at 10:05? BY ERIC YEHLE · SOFTWARE ARMOR LLC Two incidents reported this week…
NexusRiver — October 8, 2026 NexusRiver · Issue 67 · Thursday, October 8, 2026 TLP:AMBER Microsoft just told you the operating system is not where your agents are controlled. Containment is going cross-platform. A threat actor showed this week what that does and does not cover. By Eric Yehle. 01 · Containment leaves the OS…
NexusRiver CISO Intelligence Brief, Issue 66: Whose record is it? NexusRiver: CISO Intelligence Brief Issue 66 | Tuesday, October 6, 2026 TLP:AMBER Whose record is it? If one of your agents disrupted someone else’s system tonight, could you independently prove what it was authorized to do and stop the behavior before your model provider finished…
NexusRiver CISO Intelligence Brief, Issue 65: 84 Days, One Inbox, No Owner NEXUSRIVER · CISO INTELLIGENCE BRIEF Issue 65 · October 1, 2026 TLP:AMBER 84 days, one inbox, no owner An OpenAI agent was told no by an Australian government portal and found another way in. What happened next is the part CISOs should…
If DNS Was Open, What Should Have Been Closed? | NexusRiver NexusRiver Issue 64 / 29 September 2026 TLP:AMBER CISO intelligence brief / Authority gap If DNS was open, what should have been closed? One day, four AI safety headlines, and the same missing check underneath every one of them. Eric Yehle, NexusRiver / 11…
NexusRiver | CISO Intelligence Brief — Issue 63 · September 24, 2026 TLP:AMBER NEXUSRIVER // ISSUE 63 NEXUSRIVER CISO Intelligence Brief · Issue 63 · Thursday, September 24, 2026 AI-INTEGRATED MALWARE // DECISION WITHOUT AUTHORITY Detected is not governed. A Windows implant documented by Cisco Talos this week asks four commercial AI models what to…
NexusRiver | CISO Intelligence Brief — Issue 62 · September 22, 2026 TLP:AMBER NEXUSRIVER // ISSUE 62 NEXUSRIVER CISO Intelligence Brief · Issue 62 · Tuesday, September 22, 2026 CREDENTIAL LIFECYCLE // AUTHORITY AFTER EXIT The access was a courtesy. The authority had already expired. CrowdSec kept a departing engineer’s GitHub access open so he…
NexusRiver | CISO Intelligence Brief — Issue 60 · September 15, 2026 TLP:AMBER — Limited disclosure, recipients’ organizations onlyNexusRiver · Issue 60 · Tuesday, September 15, 2026 NexusRiver CISO Intelligence Brief Issue 60 September 15, 2026 Published by Software Armor LLC Lead signal — 404 Media, “Project Lily” The user said “keep this between us.”…
NexusRiver | CISO Intelligence Brief — Issue 59 · September 10, 2026 TLP:AMBER — Limited disclosure, recipients’ organizations onlyNexusRiver · Issue 59 · Thursday, September 10, 2026 NexusRiver CISO Intelligence Brief Issue 59 September 10, 2026 Published by Software Armor LLC Lead signal — Published post-mortem, OpenAI / Hugging Face The agent knew the target…
NexusRiver | CISO Intelligence Brief — Issue 58 · September 8, 2026 TLP:AMBER — Limited disclosure, recipients’ organizations onlyNexusRiver · Issue 58 · Tuesday, September 8, 2026 NexusRiver CISO Intelligence Brief Issue 58 September 8, 2026 Published by Software Armor LLC Lead signal — Misalignment incident, second confirmed victim Fifteen thousand authorized edits to a…