KPMG · Québec Cyber Team

Cyber Newsletter

Edition 24 — Week of October 10 to 16, 2026

Welcome to edition 24 of the KPMG Cyber Team in Québec. Prepared by FX, Kifing, Enguerrand, Bill, and our friendly robot colleagues. It covers what we consider the most relevant security news of the week, with a strong AI flavour. Like it? Tell us or send it to a friend. Don't like it? Send it to an enemy.

Foreword

🔌 You buy a hardware wallet for exactly one reason: the key never leaves the box. This week we learned the box can arrive with a passenger. Devices sold through an authorised reseller in Malaysia, and others bought off the shelf in Germany, carried an added circuit able to send the recovery phrase out over a mobile network. Roughly 102 million dollars left some 315 accounts. The chilling detail is not the amount but the bill of materials: a flexible circuit cut to fit the device's own parts, a custom antenna already on its second revision, coating matched to the colour of the plastic, and markings scraped off. Someone, in other words, budgeted for mass production. The software has nothing to answer for. It did precisely what it was asked, inside a box that was no longer the box you thought you had bought.

🧊 Meanwhile, in France, industrial control security left the power plant and moved into the frozen foods aisle. Attackers took over internet-exposed refrigeration controllers and turned the temperature up, reaching 50 degrees in some units. The result: spoiled stock across roughly 150 stores and, according to the reporting, a few fires. The password on this gear, per the Canadian coverage of the story, was set to change every day, and took the value of that day's date. France's security agency has confirmed that controllers from several manufacturers are compromised. We talk a great deal about critical infrastructure resilience, and it turns out part of that resilience rests on a freezer nobody ever put in an inventory.

🔍 Third story, and it is the uncomfortable one for anyone who signs off on a compliance report. A research shop watched an actor chain three previously unknown flaws in remote access gateways: authentication bypass, code execution, privilege escalation. The access obtained is root, unauthenticated, on fully patched appliances. Then comes the part that changes how you work: the attackers wiped log entries and restored the components they had modified in memory, so the vendor's own integrity checker found nothing left to report. The researchers' line deserves a spot on the team wall. A box can pass the integrity check and still be owned.

All that, plus frontier models hitting eight objectives out of eight in an industrial lab, 1,411 Microsoft patches in a single day, and an encrypted messenger confirming its exit from Canada. Enjoy the read.

The Ransomware Negotiator Arrested, and a Peer Accused of Paying Quietly

Ed Dubrovsky, founder of a ransomware negotiation firm and a well-connected cyber executive in Canada, has been arrested in the United States. KrebsOnSecurity reports the arrest is connected to the ShinyHunters group. Canadian coverage dwells on the shock across the industry: Dubrovsky is a respected negotiator who even wrote a book on the subject. At this stage these are accusations only, and what exactly he is charged with remains unclear. In the same week, the owner of MonsterCloud was accused of billing more than 19 million dollars for recovery work while quietly paying ransoms to obtain decryption keys.

Both cases land on the same layer of the ecosystem, the intermediaries standing between victim and criminal, and it is the least scrutinised layer in the whole incident response chain. A negotiator sees the pressure, the budget, the timeline, and the victim's appetite, and nobody asks that negotiator to prove the independence of their position. For anyone who maintains a response plan, the practical question is not whether your provider is honest but what the contract says: who decides to pay, who speaks to the insurance broker, who keeps the record of exchanges with the attacker, and above all how you replace a participant mid-crisis if an indictment lands on them. We covered the other end of this story last week with the arrest of the alleged ShinyHunters leader in Amman (see [[Newsletter 23 EN|edition 23]]); the new angle is that the investigation is now working its way up to the people who were selling the way out.

🔗 FBI Arrests Founder of Ransomware Negotiation Firm — Brian Krebs (via Canadian Cyber in Context)
🔗 Shock and surprise after FBI arrests Canadian cybersecurity expert in ShinyHunters hacking case — CBC News (via Canadian Cyber in Context)
🔗 MonsterCloud Owner Accused of Billing Over 19M While Secretly Paying Ransoms — The Hacker News (via Canadian Cyber in Context)

Intermarché Refrigeration Controllers Pushed to 50 Degrees Across 150 Stores

Attackers compromised internet-exposed refrigeration controllers at French supermarkets and raised temperatures, reaching 50 degrees Celsius in some units. Intermarché says roughly 150 stores were affected, with spoiled stock and, according to the reporting, fires. France's CERT-FR published alert CERTFR-2026-ALE-012 and confirms that controllers from several major manufacturers are compromised. One detail surfaced by the Canadian coverage: the password on this equipment was set to change every day, and took the value of that day's date.

When we talk OT security we picture power plants and assembly lines, almost never the frozen foods aisle, even though it is the same connected gear with no screen and no assigned administrator, with immediate physical damage at the end of it. Cost is the interesting part of this story, and nobody has put a number on it yet: lost goods, cleanup, bringing the cold chain back, insurance, across roughly 150 sites. For practitioners, this week's exercise is an inventory rather than a detection project. Which building, refrigeration, ventilation, or physical access devices answer on a public address, who holds their credentials, and who handles their updates. The question is awkward because the answer rarely lives in the IT inventory: this gear arrives with an equipment vendor's maintenance contract, not with the fleet.

🔗 Cyberattack defrosts French supermarket freezers, spoiling food at hundreds of stores — CBC News (via Canadian Cyber in Context)
🔗 CERTFR-2026-ALE-012: compromise of refrigeration controllers — CERT-FR

T4 Forms and Social Insurance Numbers Exposed at Canadian Mennonite University

Canadian Mennonite University suffered a cyberattack. After consulting experts through its insurance provider, it determined that T4 and T2202 tax forms issued by the university had been accessed, exposing names, mailing addresses, and social insurance numbers. In a separate case, Windsor-based Williams Food Equipment warned its customers of a security breach that led to a phishing fraud, stemming from a third-party software partner compromised the previous month.

The social insurance number is the Canadian data point whose exposure cannot be undone: you change a password, you replace a credit card, you do not reissue a SIN, and a T4 slip also carries income and employer, which is the complete file for a credible impersonation. The two cases read well together because they call for different responses. For the university, the work is about retention: a tax slip has a regulatory lifespan rather than an eternal one, and nobody owns the network share where last year's export is sleeping. For the Windsor company, the point of failure is the software partner, and the only useful question in a vendor review is who holds your data, not who invoices you. Québec organisations under Law 25 would do well to handle both angles in the same exercise, since the notification obligation does not distinguish a direct breach from a subcontractor's.

🔗 Cyber hack at Canadian Mennonite University — CBC News (via Canadian Cyber in Context)
🔗 Williams Food Equipment warns customers of security breach — CTV News (via Canadian Cyber in Context)

Hardware Implants in Ledger Wallets, 102 Million Siphoned Off

Hardware implants have been found in Ledger Nano X wallets sold by CryptoBilis, an authorised reseller based in Malaysia. According to Bitquery, they allowed attackers to siphon off roughly 102 million dollars in crypto from some 315 accounts. Implants were also found in devices bought at a MediaMarkt store in Germany, as well as in Flex and Stax models, pointing to a supply chain compromise wider than unauthorised sellers alone. Hacker Joe Grand had reported implants to Ledger as early as March, and Mark Karpelès documented more sophisticated versions in September and October, including a flexible circuit and a custom antenna marked AC-A2016-NANO-V1.1. Ledger for its part confirms that added components could transmit recovery information over a mobile network, that the hardware was tampered with before reaching customers, and that the software is intact.

Kim Zetter's technical description is the part to keep, because it describes a supplier rather than a tinkerer: "A flex PCB keyed to the Ledger's own parts, a custom antenna already at its second revision, colour-matched coating and scraped markings all point to planning, a real budget, and a goal of mass production." An antenna on its second revision implies an iteration cycle, which implies a team and a schedule. For practitioners the lesson has nothing to do with crypto and everything to do with the distribution channel, which is a complete blind spot in third-party risk programmes. We audit the software publisher, the hardware manufacturer, sometimes the assembler, almost never the distributor, the authorised reseller, and the retailer who physically handle the device before it arrives. The realistic countermeasure for a company is procedural: buy sensitive equipment directly from the manufacturer, check seal integrity on receipt, and for anything that holds secrets, generate the secret after delivery rather than trusting a factory state.

🔗 Who is planting backdoors in Ledger crypto wallets? — Kim Zetter (via ZERO DAY)
🔗 Ledger says spy chip inside CryptoBilis devices transmitted wallet keys over mobile network — CoinDesk (via The Cybersecurity Pulse)

Trezor Trims Its Reseller List While Denying Any Compromise

Joe Grand found implants in two Trezor wallets: a Model T bought through Facebook Marketplace in Canada in 2025, and a Trezor One obtained from a TikTok shop in August 2026. In both, the microcontroller had been swapped for a component that generates predetermined recovery phrases; roughly 50 dollars was stolen from the Trezor One's owner. On October 13, Trezor announced it was trimming its list of authorised resellers as a "precaution", while maintaining there is "not a shred of evidence" that its devices were compromised. Grand disputes that reading and points out the models involved remain supported until 2031 for software and 2036 for security.

Trezor's problem is not the implant, it is the gap between the public denial and the technical correspondence the researcher published: when private exchanges from August and September contradict the official statement, the credibility of every future company communication is on the line. Trimming the reseller list is a sensible measure, and it says the opposite of the press statement, since you do not restrict a channel you are certain let nothing through. For teams who manage vendor incidents, the case is a textbook example of what to avoid: denying in absolute terms rather than bounding a scope, and letting a third party publish the timeline on your behalf. A defensible wording does exist, and it consists of describing what was verified, on what sample, and what remains unknown.

🔗 Trezor wallets also compromised with implants — Kim Zetter (via ZERO DAY)

SlugFest, FakeGit, and Stolen Credentials: Three Ways to Trust the Wrong Repo

Three stories this week target the same infrastructure. SlugFest is a weakness in npm Trusted Publishing that lets an attacker publish malicious package versions without ever touching the maintainer's account: the root cause is configurations that trust GitHub repo names instead of immutable repo IDs, so an attacker who claims a renamed or transferred name inherits its publishing trust. GitHub now expires unvalidated configurations, but older trust relationships remain exposed. Apiiro separately counted 17,610 repositories tied to the FakeGit campaign, more than 13,000 of which were re-pointed within 34 hours to SmartLoader, which drops the StealC infostealer; the attackers mostly reuse existing repositories rather than creating new ones, precisely because that is what makes them look trustworthy. Meta finally disclosed that attackers used compromised employee credentials to reach GitHub repositories holding source code and personal data on roughly 1,500 individuals.

All three rest on the same implicit assumption, that a repository is an identity: yet a repo name can be claimed, a repo history can be repurposed, and a developer account can be stolen, while the build chain treats all three as proof of origin. The npm countermeasure is specific and verifiable within the hour: review your Trusted Publishing configurations and make sure they carry a repository ID rather than a text path. For FakeGit, the useful reflex has little to do with seasoned developers and everything to do with workstations that download a ZIP archive from a legitimate-looking project, which files the problem under execution control rather than code review. As for Meta, the case is a reminder that a single set of developer credentials opens both intellectual property and personal data, and that GitHub was not breached: the developer's identity was.

🔗 SlugFest: npm Trusted Publishing flaw — Help Net Security (via The Cybersecurity Pulse)
🔗 Never Deleted, Only Re-Pointed: Inside the 17,600-Repo FakeGit Fleet — Apiiro Research (via The Cybersecurity Pulse)
🔗 Meta says hackers took code, personal data of 1,500 in GitHub breach — SecurityWeek (via The Cybersecurity Pulse)

Three Chained Zero-Days in Ivanti Connect Secure, and One More Citrix Alert

Volexity watched the actor it tracks as UTA0576 chain three previously unknown flaws in Ivanti Connect Secure, an authentication bypass, a remote code execution, and a privilege escalation, to obtain unauthenticated root access on fully patched appliances. The attacker then went after credentials, Active Directory, LAPS, and BitLocker recovery data. The most troubling part is the cleanup: log entries were wiped and modified components restored in memory, leaving nothing persistent for Ivanti's integrity checker to find. Fixes for the authentication bypass and the code execution shipped on October 13; the privilege escalation fix was still pending when the researchers published, along with indicators and forensic guidance.

Volexity's line is the only conclusion worth keeping from this week's perimeter news: "Translation: a box can pass the integrity check and still be owned." The consequence is methodological and expensive. An integrity check is a persistence check, and an attacker who lives in memory leaves nothing to compare against: the verification looks at disk, the intruder lives in RAM. Teams running remote access concentrators should therefore treat a green result as an absence of evidence rather than evidence of absence, and build a memory capture into the procedure before any reboot, since the reboot destroys the one thing that would have helped. A second reminder on the same perimeter this week: the Canadian Centre for Cyber Security issued a second update to its AL26-024 alert on critical Citrix NetScaler ADC and Gateway vulnerabilities, CVE-2026-88771 and CVE-2026-88772, a saga we have now tracked for two editions (see [[Newsletter 23 EN|edition 23]]).

🔗 A series of unauthenticated events: chained exploitation of Ivanti Connect Secure zero-days — Volexity (via The Cybersecurity Pulse)
🔗 AL26-024: critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway, update 2 — Canadian Centre for Cyber Security (via Canadian Cyber in Context)

October Patch Tuesday: 1,411 Flaws, Including an Exploited Mark of the Web Bypass

Microsoft fixed 1,411 vulnerabilities in its October Patch Tuesday, including 70 rated critical and three zero-days. The one that matters is CVE-2026-96951, actively exploited, which bypasses Windows Shell's Mark of the Web protections, meaning the warnings that appear on files downloaded from the internet. The other two zero-days had been publicly disclosed without being reported as exploited.

Mark of the Web is one of the few security controls an end user actually sees, understands, and applies personally, and an exploited bypass removes it from the picture without anyone noticing: the suspicious attachment now opens without asking a question. The raw count of 1,411 fixes has become the least useful figure in the bulletin, because no team works through them in order. The hierarchy to apply fits in two lines: exploited flaws on the workstation first, since that is where the email lands, then components exposed on the perimeter. For organisations that built their awareness training around the downloaded-file warning, the internal message to prepare is unpleasant but necessary, because part of the training in force describes a guardrail that was already failing in production when the patch shipped.

🔗 Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days — BleepingComputer (via The Cybersecurity Pulse)
🔗 TCP 149: Hackers x Fridges on Fire — Andrew Richards

An Unauthenticated RCE in Self-Managed GitLab Through a CI Config File

Rapid7 disclosed CVE-2026-97229, a critical unauthenticated remote code execution affecting self-managed GitLab CE and EE, triggered through a malicious CI/CD configuration file. The attacker has to get a crafted configuration into a project's pipeline; from there they obtain code execution inside the GitLab application process, along with whatever credentials and data the server can reach. Fixes are available, and GitLab.com and GitLab Dedicated customers are unaffected.

The GitLab server is the most profitable target in a software company, because it holds the code, the deployment tokens, and the build-chain secrets, which is everything needed to quietly replay access elsewhere after losing this one. The exploitation condition deserves an honest look: a configuration must reach a pipeline, which is trivial in any repository that accepts external contributions, or in any organisation where a merge request triggers a pipeline before review. That is precisely the default in many installations. This week's control to verify is therefore not only the version, but the pipeline trigger policy on untrusted branches, and the value of the tokens those runs can read.

🔗 CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab — Rapid7 (via The Cybersecurity Pulse)

Counterfeit TLS Certificates Obtained for Google and Other Large Services

Attackers obtained counterfeit TLS certificates for Google and for other large services, according to Ars Technica. The detail is still thin, and observers agree on one point: this is a serious attack, and it could enable other, more sophisticated ones.

A counterfeit certificate for a major service attacks the layer every other layer depends on, since it is the certificate authority that turns a domain name into a verified identity, and all transport security rests on that translation. The concrete exposure is machine-in-the-middle interception, but the most actionable part for security teams is elsewhere: the monitoring mechanisms exist and are barely used. Certificate transparency lets you subscribe to issuance events for your own domains, and it surfaces a certificate you never requested within hours. For an organisation running exposed services, that monitoring is free, takes an afternoon to wire up, and is missing from most detection programmes we see. It is also the same family of problem as the npm story above: trust hangs off a name, and the name gets borrowed.

🔗 Hackers obtain counterfeit TLS certificates for Google and other large services — Ars Technica (via Canadian Cyber in Context)

Eight Scenarios out of Eight for Frontier Models in an OT Lab

Booz Allen Hamilton ran frontier AI models through eight scenarios in a controlled OT lab, and the models hit all eight objectives. One moved a robotic arm within minutes. Another went from network compromise to industrial control actions in just over 16 minutes. Humans had to approve exploitation and physical actions, so this is not an autonomous real-world attack but a preview of how fast one could move.

The 16 minutes is the only figure to keep, because it compares directly against a number every team already knows: its detection time and its escalation time towards industrial automation, which run in hours in most OT environments, and in days when the alert has to cross two organisations. The experimental setup invites the usual caveats, and they are in the text: controlled lab, scenarios designed to be achievable, human validation at every sensitive step. None of that changes the planning consequence. If the window between the first foothold in the office network and the first command towards a controller is measured in minutes, then the controls that still hold are not detection controls but separation controls: a break in the flow between IT and OT, allow lists on command protocols, and physical interlocks no software can override. The topic meets this edition's refrigeration controller story from the other end of the market.

🔗 Frontier SI reaches OT systems — Booz Allen Hamilton (via The Cybersecurity Pulse)

A Full Chrome Exploit Chain in Six Days, and a Free Scanner for Open Source

XBOW built a full Chrome exploit chain in six days with four experienced researchers assisted by AI agents, and walked away with a 250,000 dollar Google bounty. The bugs are patched. The agents analysed source code, tested hypotheses, built proofs of concept, and drafted exploits; the humans set the strategy, split the chain into independent pieces, and changed course when Google flagged one bug as already known. XBOW puts its compute costs at roughly 40,000 dollars, not counting researcher time or development. In the same movement, Anthropic launched a free opt-in service that periodically scans open-source projects for vulnerabilities and sends reports to maintainers, with no human review of the findings beforehand.

XBOW's thesis is more interesting than its headline, and it cuts against the prevailing narrative: "The headline isn't 'AI writes Chrome exploits now.' It's that four people who know Chrome's internals cold used AI to ship a full chain in under a week." The expertise is the multiplier, the agent is the accelerator. For teams who hire, that settles a budget question: tooling does not replace deep knowledge of a target, it makes that knowledge far more productive. Anthropic's service illustrates the other side of the same movement, and it reproduces the problem we described last week when Google closed part of its bounty programme under a flood of automated reports (see [[Newsletter 23 EN|edition 23]]): no human researcher validates the findings before they go out, and the volunteer maintainer absorbs the triage. Free triage, not free answers.

🔗 XBOW built a Chrome full chain exploit — XBOW (via The Cybersecurity Pulse)
🔗 Launching an opt-in vulnerability-finding service for open-source software — Anthropic (via Canadian Cyber in Context)

Ottawa Puts Frontier AI to Work on Malware Reverse Engineering

The Canadian Centre for Cyber Security published a document explaining how it uses frontier AI to accelerate malware reverse engineering. It is guidance rather than a product announcement, and it describes a government agency's operational use on a technical analysis task. In the same week, the Government of Canada issued a security policy implementation notice covering cyber security readiness in the frontier artificial intelligence era.

This is, as far as we know, the first documented account of a national CERT folding frontier AI into its own analysis operations, and it arrives alongside a policy direction, which means practice and rule are advancing in step for once. The practical interest for DFIR teams is direct. Reverse engineering is one of the few tasks where the cost of a model error stays contained, since the hypothesis it produces can be checked by execution or by disassembly, which makes it a good adoption ground ahead of decision-making tasks. For regulated organisations and for vendors who sell to the federal government, the policy notice carries a different weight: it sets expectations that will reappear as contractual requirements, and it reads better now than at tender time.

🔗 How the Canadian Centre for Cyber Security uses frontier AI to accelerate malware reverse engineering — Canadian Centre for Cyber Security (via Canadian Cyber in Context)
🔗 Canadian Cyber News Rewire 40 — Canadian Cyber in Context

A Personal Agent Protocol Backed by Meta, Sierra, Stripe, and Walmart

Sierra, the company founded by former Salesforce co-CEO Bret Taylor, announced the Personal Agent Protocol, also called Poppy, with Meta on October 6. The protocol standardises identity, authentication, permissions, and action between a person's agent and a business: the user states what their agent may do, while the enterprise controls what it exposes through the web, through APIs, or through its own agent. The stated goal is to get past screen-scraping and the agent that pretends to be a human. Meta, Stripe, Shopify, Walmart, and Genesys are among the parties involved, and the design partner list also includes OpenAI, Target, Bank of America, and United Airlines.

Knowing who is human, who is an agent, and what each is allowed to do is the most pressing infrastructure problem of the year, and an agent identity protocol adopted by these players becomes an authorisation layer to audit the way a SAML federation is audited today. The comparison with HTTP and OAuth is being made widely and it is premature, because both standards won over years of competing implementations. What is already usable is the internal question: when an agent acts on a customer's behalf on your portal, what will you log, what record of consent will you keep, and how will you tell a mandated action from an impersonated one. The essay retained further down this edition shows the current draft leaves that last point to the agent's good faith.

🔗 Poppy: the Personal Agent Protocol — Sierra
🔗 Personal Agent Protocol specification — Personal Agent Protocol
🔗 What's Hot in AI/Infra/VC 519 — What's Hot in AI/Infra/VC

MoonPay Brings 200 MCP Servers Under Control, and Tenable Wants to Inspect Yours

MoonPay, which moves money for more than 30 million people, found its employees connecting AI agents to internal systems over MCP, out of reach of controls placed at the browser level. After a 30-day proof of concept, Speakeasy's platform now governs more than 200 MCP servers and more than 60,000 agent sessions, with every agentic action authenticated, auditable, and compliant. Tenable for its part added AI Inspector to its offering, a service that evaluates agents, skills, and MCP servers for security risk before deployment, through a mix of automated analysis, AI-assisted inspection, and human review.

The useful figure is not 60,000 sessions, it is 200 MCP servers at a company with roughly 30 million customers: the order of magnitude says agentic shadow AI is not counted in isolated experiments but in hundreds of integration points, built by people who were doing their jobs properly. Both announcements come from vendors, one of them as partner content, and the numbers should be read with that reservation. The lesson still holds, because the mechanism is verifiable at home within a day: an MCP server is declared in a local configuration file, appears in no application inventory, passes through no web gateway, and carries the rights of whoever launched it. The realistic control point is therefore not the browser but the workstation and the token: who issued the credentials the agent is using, and for how long.

🔗 AI Control Plane — Speakeasy (partner content, via Return on Security)
🔗 Tenable AI Inspector — Tenable (via The Cybersecurity Pulse)

Workday Buys C1.ai and Moves the HR Record Closer to Access Control

Workday signed a definitive agreement to acquire C1.ai, an identity governance platform covering both employees and AI agents. Terms were not disclosed and the deal is expected to close by January 31, 2027. Workday did roughly 9.5 billion dollars in revenue last fiscal year and counts more than 11,500 customers, including more than 65 per cent of the Fortune 500. It already owns the source of truth for who works where.

The underlying movement is the merging of HR and identity: whoever owns the employee record wants to own access, and the technical promise is that provisioning and deprovisioning fire on a role change rather than on a ticket. The flip side hits the identity governance market immediately, since one of the strongest independent players in the category now belongs to an HR platform, and competitors were already calling C1 customers the week of the announcement. For affected CISOs, the three questions to put on the table at renewal are the ones every acquisition raises: the roadmap, the price at term, and the priority given to deployments that do not run on Workday. There is a fourth, specific to this deal: how far the acquirer's agent registry becomes the authority on non-human identities, which have no employee record at all.

🔗 Workday to Acquire C1.ai — C1.ai (via The Cybersecurity Pulse)
🔗 TCP 149: Hackers x Fridges on Fire — Andrew Richards

87.7 Million Raised in One Week, and the Stitch It Together Era

Week of October 12: 7 companies from 4 countries raised 87.7 million dollars across 6 distinct categories, with an average deal size of 12.5 million and a median of 4.5 million, and 89 per cent of disclosed funding going to product companies. Six companies from three countries were acquired. The notable deals are Hadrian in the Netherlands, 40 million in Series B for breach and attack simulation, Rein Security in Israel, 25 million in Series A for runtime application security monitoring, Netsec in France, 10 million, Fleuret AI in France, 4.5 million pre-seed for autonomous penetration testing, and Hilt in the United States, 4.2 million seed for kernel-level exfiltration prevention.

The thesis Mike Privette draws from his own tally is the most useful part of his issue, and it settles an architecture debate: "The new way forward is to buy, build, and stitch. That's what I call the Stitch It Together era." You do not replace your EDR with something homegrown, and he says so bluntly, never roll your own CrowdStrike. But the era of "just buy it" is over too, because AI finally makes the plumbing between paid products and open-source pieces affordable, the kind only the largest teams at the largest tech companies used to be able to build. The objection sits in the same text: what gets assembled has to be maintained, and AI-written connective tissue is production code nobody put in the budget. The rest of the tally confirms where the money goes, since two of the five notable deals fund automated offence, the category we already saw sweeping the board last week (see [[Newsletter 23 EN|edition 23]]).

🔗 Security, Funded 265 — Mike Privette
🔗 Hadrian raises 40M — Hadrian (via Return on Security)
🔗 Rein Security raises 25 million — Rein Security (via Return on Security)

IonQ, CrowdStrike, and Absolute: Consolidation Advances in Small Pieces

Three deals this week tell the same story of recomposition. IonQ, the quantum computing company, is acquiring Elisity, a specialist in identity-based network microsegmentation, in an all-stock transaction worth up to 1.3 billion dollars, including up to 150 million in contingent consideration. Calcalist separately reports that CrowdStrike is in advanced talks to acquire Israeli startup Orion Security, which does AI-powered data loss prevention, for roughly 500 million, with no official announcement so far. The same publication reports that XM Cyber is laying off around 250 people in Israel after CrowdStrike picked up its technology, in a deal put at roughly 600 million and confirmed by neither company. More quietly, Absolute Software acquired FirmGuard, a firmware and embedded security specialist.

The detail buyers should notice is not the price tag but the structure of the XM Cyber deal: you acquire the technology without the company, which leaves customers with a product whose development team has just been cut and whose support is changing hands. This arrangement is spreading, because it buys a capability without carrying an organisation, and it offers none of the implicit guarantees of a conventional acquisition. For a renewal in progress, the question to put to the account team is factual: was the company acquired, or only its technology, and who holds the support contract at the end of the quarter. A quantum computing manufacturer buying Elisity follows a different logic, that of assembling a security portfolio around a post-quantum promise, and it is best read as a signal on microsegmentation valuations.

🔗 IonQ to acquire Elisity — IonQ (via The Cybersecurity Pulse)
🔗 CrowdStrike in talks to acquire Orion Security — Calcalist (via The Cybersecurity Pulse)
🔗 XM Cyber cuts about 250 jobs after CrowdStrike technology deal — Calcalist (via The Cybersecurity Pulse)

Signal and Psiphon Threaten to Leave Canada if Bill C-22 Passes

Signal has said the minister's changes to the lawful access bill will not persuade it to stay in Canada, as Bill C-22 heads for Senate consideration. Toronto-based censorship circumvention service Psiphon, used by some twenty million people, has taken the same position, alongside NordVPN and Windscribe. The Globe and Mail separately argues an editorial case on the substance, holding that the Carney government is seeking an easy route for law enforcement that will do more harm than good.

The concrete risk for Canadian organisations is not losing a consumer messaging app, it is sudden dependence on tools that may stop being offered here: a security team that built its crisis channels or its source protection on a provider announcing its exit has a continuity problem, not a political one. The useful exercise happens before passage. It means listing the communication and circumvention services your sensitive functions depend on, identifying which ones have publicly conditioned their presence on the final text, and lining up an alternative that does not assume an emergency migration. For professional firms, media outlets, and organisations that run anonymous reporting channels, this is the part of the file with a deadline.

🔗 Messaging service Signal says minister's changes to lawful access bill will not persuade it to stay in Canada — The Globe and Mail (via Canadian Cyber in Context)
🔗 Canada's Bill C-22 could drive out a tool 20 million people use to beat censorship — TechRadar (via Canadian Cyber in Context)

National Defence Doubles Its New Contracts With American Tech Giants

The Department of National Defence has doubled the number of new contracts awarded to American technology giants, according to an investigation by The Maple. The publication expects the trend to continue, and faults the Carney government for taking no concrete steps on Canadian cyber security.

The gap between the digital sovereignty speech and the awards column is the most usable data point of the week for anyone advising a Canadian organisation, because it shows where the dependency actually sits rather than where we would like it to sit. The practitioner reading comes in two parts. First the technical dependency: a defence capability operated on a foreign platform inherits the legal conditions of that platform's home country, and the question arises in exactly the same terms for a Québec company storing its security logs outside Canada. Then the industrial dependency: a procurement market that builds no local capability produces no credible Canadian supplier for the following decade. These are two separate problems, and only the first one can be solved with a contract clause.

🔗 National Defence has doubled new contracts with U.S. tech giants — The Maple (via Canadian Cyber in Context)

Sanctions on Iran and Seven Domains Seized From a Beijing Firm

Canada has imposed new sanctions against Iran and Iranian actors over that country's repression activities in the digital space, published in the Canada Gazette on October 7, 2026 under reference SOR/2026-195. In the United States, the Department of Justice and the FBI seized seven domains tied to hacking tools attributed to Integrity Technology Group, a Beijing-based security company linked to Chinese state-sponsored operations, tools used for scanning, spear-phishing, and attacks on critical infrastructure. This is not the first action against the firm: in 2024 the FBI dismantled a botnet tied to it spanning more than 200,000 compromised devices.

The question The Cybersecurity Pulse asks is the right one, and it remains open: "So the real question: are takedowns actually degrading capability, or just forcing them to buy new domains?" The people, the tradecraft, and the funding survive an infrastructure seizure, and the rebuild time is counted in weeks. For detection teams the consequence is practical: an indicator list published at takedown time has a short shelf life, and is worth most for retrospective hunting through retained logs. On the Canadian side, the sanctions regulation has a more immediate effect than it appears, since it bears on counterparty screening and on compliance for clients exposed to Iran, a control that lives with legal and finance rather than security, and that rarely updates at the pace of the Gazette.

🔗 Canada Gazette, Part II, SOR/2026-195 — Government of Canada (via Canadian Cyber in Context)
🔗 Justice Department and FBI Seize Vulnerability Scanning and Spear-Phishing Tools Operated by Chinese State-Sponsored Hackers — DOJ and FBI (via The Cybersecurity Pulse)

The SIEM Problem Has Become an Architecture Problem

Uche Obiora argues that the SIEM market is no longer converging on a single replacement architecture but separating into five models, depending on where the primary control point sits: an integrated security platform, an observability environment, a security data pipeline, the underlying data platform, or a federated access layer. His framework, which he calls Modern SIEM Architecture Models, reorganises the market around four areas: the data path, detection execution, investigation context, and agent workflow. Two figures he cites set the scene: Splunk reports that 46 per cent of teams spend more time maintaining their tools than defending their organisation, and SANS found that 42 per cent of SOCs send data into a SIEM with no defined strategy for managing or retrieving it.

The thesis comes down to one sentence that shifts the buying criterion: "The strongest SIEM architectures will be the ones that give analysts and AI fast, trustworthy access to the evidence they need while preserving control over cost, data ownership, response authority, and portability." In other words, the renewal question is no longer which product ingests best, but where the four control points sit, and which of them you are willing to give up. The objection is plain and worth holding onto: the MSAM framework and the Trusted SOC model are the author's own constructions, with no third-party deployments validating them, and classifying vendors by control layer sometimes tidies up the reality of a product that occupies several. What stands up is the tender testing grid he proposes, particularly measuring search response time across months of your own data, which is the one test a sales demo cannot fake.

🔗 The SIEM problem has become an architecture problem — Uche Obiora (via Software Analyst Cyber Research)

A Standing Permission the Store Cannot Verify

Karl McGuinness takes the personal agent protocol announced this week and pushes it to its breaking point with a trivial case. A customer wants to exchange a jacket for its insulated version, which is back-ordered, provided the exchange costs no more than 75 dollars extra, and will be away when the quote arrives. The protocol handles the situation: the agent confirms on a standing permission, and passes the store a label indicating the approval came from that permission. The store sees only the label. It cannot check the 75 dollar limit, and an agent whose model had been manipulated by injected content would send exactly the same confirmation for a 90 dollar quote. The author proposes an extension he calls a Mission, where the customer approves the task and its limits once on the store's own page, and the store keeps that record and checks every confirmation against it: 73 dollars goes through while the customer is away, 90 dollars does not.

The weakness he isolates is named in the draft itself, which is what makes the demonstration hard to dismiss: "Section 8 of the extension says approved_by 'works on trust', so a store that will not take the agent's word sets user_approval_required and makes the User approve every revision, which defeats the purpose of letting the agent act while the User is away." This is the classic delegated authorisation dilemma, where the resource holder must choose between taking the proxy's word and interrupting the principal for every step. The objection comes from the author, who writes it out plainly: neither the protocol nor his own drafts have adopted the proposal, and implementing it would depend on stores and platforms, so the gap stays open in practice. For architects preparing for agents to arrive on their portals, the transferable lesson is protocol-independent: the proof of what the user approved has to live with whoever executes the action, not with whoever requests it.

🔗 Poppy's standing permissions work on trust — Karl McGuinness (via Control Plane)

Cache Is the New Egress

Jamin Ball moves attention away from model providers' headline price lists and onto the one line agents actually consume, the cache read rate, meaning what a provider charges to re-read input tokens it already processed on an earlier call. In an agent loop, the system prompt, the tool definitions, and the history make up the majority of input tokens and do not need resending every turn. His analogy is the early cloud era, when everyone watched compute and storage prices before realising data egress was the real lock-in. On a 40-turn session with a good cache hit rate, he shows a gap that inverts the intuition: staying on one model costs roughly 4.90 dollars, while alternating with a model five times cheaper on list price pushes the bill to 18 dollars.

The conclusion is directly operational for anyone running an inference budget: "Routing to the cheaper model ends up costing ~4x than not routing and hitting the cache." Per-call routing, which is the commercial promise of an entire tool category, becomes counterproductive the moment a cache is in play, because the cache is keyed to one provider and one model, and every mid-session switch pays full list price on the whole context. Routing keeps its value at the session level, not the request level. The objection is the fragility of the material: price lists change quickly and cache hit rates vary widely between workloads, which could move the conclusions within a quarter. What remains is the structural lesson, which is about dependency more than cost: if agents run longer and longer, accumulated cache becomes an exit cost, and a provider negotiation now happens on that line.

🔗 Clouded Judgement 10.9.26 - Cache Is the New Egress — Jamin Ball (via Clouded Judgement)

From 1898 Telegraph Cables to Drones Over Data Centres

Richard Stiennon places physical strikes against communication infrastructure in a long lineage. In May 1898, US Navy crews cut two submarine telegraph cables under fire off Cienfuegos, Cuba, and destroyed the cable house. At the outbreak of the First World War, the British cable ship Alert severed Germany's international telegraph links, forcing its communications onto routes London could intercept. In March 2022, a Russian strike damaged the control room of the Kyiv TV tower. In spring 2026, Iranian drone strikes hit two AWS facilities in the UAE and physically damaged a site in Bahrain. Then, between October 8 and 11, drones struck Yandex data centres in Sasovo, Kaluga, and Vladimir, shutting two sites down entirely, disabling several modules at the third, and disrupting cloud, transport, banking, and media services across Russia.

The consequence the author draws is the one that speaks directly to continuity planning: a hyperscale data centre is now a plausible military target, which moves the simultaneous physical destruction of several sites into the category of scenarios you write down rather than improbable hypotheses. Most recovery plans assume the loss of one availability zone to an outage, not the coordinated loss of three facilities to a strike. The objection comes from the author himself, candidly: his data on the drop in Russian bot traffic comes from an indicator that probably includes Yandex's own crawler, and his thesis of a cascading effect favourable to Ukraine remains speculative. The lineage, though, holds up perfectly. Cutting the adversary's communications is a 128-year-old habit, and the only novelty is that the target now carries an entire country's civilian services.

🔗 Kinetic Escalation in Cyberwar — Richard Stiennon (via The Security Industry)
🔗 Ukrainian drone strikes on Yandex datacenters knock cloud and payments offline — The Register (via Canadian Cyber in Context)

🎯 Haven't taken the quiz yet? Five questions on this edition, two minutes, one leaderboard: right here · leaderboard

Your Feedback?

Topics to explore further, sources to add, format feedback — all welcome. We adjust continuously.

Next edition: week of October 19.

Internal newsletter — KPMG Cyber Team Québec

Edition 24 | Week of October 10, 2026

Sources consolidated this week:

The Cybersecurity Pulse · Canadian Cyber in Context · Krebs on Security · ZERO DAY · Return on Security · Software Analyst Cyber Research · Control Plane · Clouded Judgement · The Security Industry · What's Hot in AI/Infra/VC