Executive Summary

On 10 June 2026, BleepingComputer reported that Oracle PeopleSoft servers are allegedly being targeted in ongoing data theft attacks by the ShinyHunters extortion gang, which claims to have stolen data from over 100 organizations. PeopleSoft is an enterprise business software suite used by large organizations to manage HR, payroll, finance, supply chain, procurement, and student administration.

Key Takeaways

- Scale & Attribution: The attacks target both cloud and on-premises Oracle PeopleSoft instances, with ShinyHunters confirming they are behind the attacks and claiming to have stolen data from 300 instances across more than 100 organizations.

- Attack Method: ShinyHunters says they are using a “gadget chain” of old and zero-day vulnerabilities, though they note the attack does not work on all systems and believe exploitation success may depend on how an instance is configured.

- Primary Targets: Most of the organizations impacted are in the education sector, with many having been previously extorted by the threat actor.

- Known Victim: ShinyHunters confirmed Nottingham University as a victim, with its data already published on their leak site. The University released a statement acknowledging a cybersecurity incident.

-

Attack Mechanics: Exposed servers revealed a shell script designed to drop a ransom note on breached PeopleSoft servers. The script parses /etc/hosts to identify PeopleSoft-related systems, attempts SSH connections using common admin accounts such as psoft, oracle, and linuxadm, falls back to SSH key-based authentication if passwords fail, and then drops the ransom note into PeopleSoft web and application server directories.

Indicators of Compromise (IoCs)

IP Addresses (obfuscated):

- 142.11.200[.]186

- 142.11.200[.]187

- 142.11.200[.]188

- 142.11.200[.]189

- 142.11.200[.]190

- 108.174.202[.]99

- 176.120.22[.]24

Several of these IPs use a TLS certificate with the common name azurenetfiles[.]net, a domain previously linked to the ShinyHunters extortion gang.

File Path / Network Artifact:

A ransom note file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT is dropped on internal PeopleSoft servers upon successful breach.

Mitigation Options

Organizations running Oracle PeopleSoft are advised to analyze logs for any connections from the above IP addresses. If these IoCs are found, immediately begin incident response, investigate whether the PeopleSoft instance was compromised, and consider temporarily removing affected servers from internet access until the environment can be secured and reviewed.

Executive Summary

On 19 June 2026, the threat group Icarus claimed to have compromised and exfiltrated data from customers of Klue, specifically the Salesforce integration of the market intelligence platform. Salesforce has since disabled Klue integrations.

Compromised Data Scope

The impacted data may consist of business names, products trialed/used, subscription details (units, pricing), business contact info (full names, work emails, job title, phone number, and business addresses), marketing/sales communications, and opportunity notes (free-form fields where teammates capture and track thoughts and next steps).

Key Takeaways

- With matching data points, there is high confidence that the Icarus actor is responsible for the Klue compromise and this supply chain attack.

- Security vendors including Recorded Future, Tanium, and Jamf have released statements on impact to their data. More statements are expected as others verify which data may have been touched or taken by the attackers.

- The Icarus actor states on their website that they have been active since April 28, 2026, and currently list two previous victims.

Attack Timeline

- 11 June: The Klue compromise began when anomalous behavior took place in a system connecting various integrations. Attackers pushed a code update capable of collecting OAuth tokens Klue customers use to connect Klue to their own systems.

- 12 June: Klue became aware of the anomalous behavior and noted unusual network connections to IP addresses the threat actor was using to remotely connect to the Klue backend servers and execute commands.

- 13 June: Klue staff disabled the remote access and removed the token-theft code from their servers, and issued a general alert to customers, which did not indicate which customers were impacted.

- 16 June: Emails began to appear in the inboxes of some targeted companies’ staff with the subject line “top secret email” and a warning: “Your data has been downloaded…You have 48 hours to communicate with us.”

- 19 June: Icarus listed Klue as one of their casualties on their leak site.

TTPs (MITRE ATT&CK)

- T1195 – Supply Chain Compromise: The threat actor leveraged a long-disused but still active credential originally created by Klue for a third-party integration prototype, then pivoted into Klue’s infrastructure to steal OAuth tokens and query customers’ CRM tools directly.

- T1528 – Steal Application Access Token: The attackers pushed a code update capable of collecting OAuth tokens Klue’s customers use to connect Klue to their own systems.

- T1078 – Valid Accounts: Huntress understands the threat actor leveraged a long-disused but still active credential to conduct the initial compromise.

- T1530 – Data from Cloud Storage: Some of the affected companies report that data associated with Salesforce and Gong were successfully exfiltrated. Huntress’ integration with Klue involved Salesforce and Gong data.

- T1657 – Financial Threats / Extortion: The actor advised Klue to contact them for “a swift resolution,” and separately advised affected companies to contact them via Session to protect their data.

- T1071 – Application Layer Protocol: Most malicious requests to Salesforce targeted /services/data/v59.0/query/ with a User-Agent of 5238 or blank, with some Python-based User-Agent strings used in nearly 900 queries.

Indicators of Compromise (IOCs)

Klue’s notification includes a non-exhaustive list of IP addresses from which the threat actor accessed sensitive information. The IPs belong to ISPs based in the Netherlands, France, and Ukraine:

- 138[.]226[.]246[.]94

- 212[.]86[.]125[.]24

- 213[.]111[.]148[.]90

- 94[.]154[.]32[.]160

Note: the 138[.]226[.]246[.]94 address is connected to spam campaigns from March 2026.

Extortion emails originated from domains belonging to subsidiaries of “Global Retail Brands,” an Australian retailer. Huntress believes the adversary leveraged their mail server as compromised infrastructure:

- house[.]com[.]au

- robinskitchen[.]com[.]au

- baccarat[.]com[.]au

The threat actor has historically provided samples of exfiltrated data on the dead-drop site gofile[.]io

Mitigation Options

- Review logs for known IOCs: Review the IOCs provided by Klue and cross-reference log data from Salesforce, Klue, and other potentially affected OAuth applications configured through Klue.

- Request missing logs from vendors: Some services may not have API/access logs readily available. Contact vendors to request missing logs, clarifying they are part of an active security investigation. Response times will vary depending on vendor SLAs.

- Revoke sessions for affected services: As this scenario was predicated on harvested credentials, revoking service integrations may be insufficient for remediation. Consider revoking all active sessions for known-affected services to invalidate any potentially compromised sessions.

- Review email inboxes and spam folders: The threat actor’s emails may have been delivered to Spam folders. Inboxes should be reviewed for communications related to the IOC domains or similar phrasing. If identified, retain them for forensic purposes.

- Engage cyber insurance provider: If cyber defenders find evidence of improper data exfiltration, engage cyber insurance provider to assist with investigation, remediation, and after-action items. These may vary significantly based on the scope of impact.

- Audit dormant credentials: The threat actor leveraged a long-disused but still active credential that was originally created by Klue for a third-party integration prototype they later abandoned. Audit and deactivate all dormant OAuth and third-party integration credentials.

Executive Summary

On 20 April 2026 Wiz Research uncovered a critical vulnerability (CVE-2026-3854) in GitHub’s internal git infrastructure affecting both GitHub.com and GitHub Enterprise Server. By exploiting an injection flaw in GitHub’s internal protocol, any authenticated user could execute arbitrary commands on GitHub’s backend servers with a single git push command – using nothing but a standard git client.

Affected Systems

GitHub Enterprise Server versions up to and including 3.19.1 are vulnerable. Fixed versions are: 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, and 3.19.3. GitHub[.]com has been fully mitigated.

Technical Details

Root Cause: X-Stat Header Injection

The critical link between internal pipeline components is the X-Stat header, which carries security-critical fields as semicolon-delimited key=value pairs. Internal services parse this header by splitting on ; and populating a map using last-write-wins semantics: if a key appears twice, the later value silently overrides the earlier one.

The flaw: babeld copies git push option values directly into the X-Stat header without sanitizing semicolons. Since ; is the field delimiter, any semicolon in a push option value breaks out of its designated field and creates new, attacker-controlled fields.

RCE Exploitation Chain

The attack chains three injections together:

- Sandbox bypass – Inject a non-production rails_env value to switch from the sandboxed production path to the unsandboxed execution path.

- Hook directory redirect – Inject custom_hooks_dir to control the base directory where the binary looks up hook scripts.

- Path traversal to arbitrary execution – Inject repo_pre_receive_hooks with a crafted hook entry whose script field contains a path traversal sequence, resolving to an arbitrary binary on the filesystem.

Impact Scope

- On GitHub[.]com, this vulnerability allowed remote code execution on shared storage nodes, with millions of public and private repositories belonging to other users and organizations accessible on the affected nodes.

- On GitHub Enterprise Server, the same vulnerability grants full server compromise, including access to all hosted repositories and internal secrets.

Defensive Actions

For GitHub Enterprise Server administrators:

- GitHub released patches for all supported GHES versions. Customers should upgrade immediately; at the time of disclosure, 88% of instances remain vulnerable.

Fixed versions to target:

- 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, and 3.19.3.

For GitHub[.]com users:

- GitHub has already mitigated this issue. No action is required.

For security and engineering teams broadly:

- The presence of non-production code paths in production binaries, lack of path traversal validation on hook scripts, and the use of delimiter-based protocols without input sanitization are patterns that appear across many codebases. Teams building multi-service architectures should audit how user-controlled input flows through internal protocols, notably where security-critical configuration is derived from shared data formats.

Executive Summary

In June 2026, D3 lab researchers reported on a new banking trojan. NFCShare is an Android banking trojan initially distributed as a malicious Android Package file (APK) through a phishing flow impersonating Deutsche Bank. The malware presents a fake card-verification interface, prompts the victim to place a payment card near the phone, collects the card PIN, and exfiltrates NFC-derived payment-card data to a WebSocket endpoint.

Since 14 May 2026, a newer wave of NFCShare APKs has been observed impersonating Italian and European banking brands, originating from a phishing website (areaclienti-intesa[.]com) mimicking Intesa Sanpaolo. The evolution is in campaign operations and analysis resistance: the actor is rotating brands, rebuilding APKs frequently, using URL shorteners, hosting payloads in a public GitHub repository disguised as a school project, and shipping APKs with malformed ZIP paths that can break automated extractors.

Key Takeaways

- The core NFC and exfiltration logic remains largely unchanged. The relevant evolution is operational and anti-analysis oriented: more frequent APK rebuilds, brand rotation, a new C2 endpoint, a 10-DEX layout, and malformed ZIP paths designed to break naive APK extractors.

- The GitHub repository used for hosting is named “app-scuola” (roughly “school app”), with a decoy README. As of 5 June 2026, the repository contains 57 commits starting 10 April 2026, with the vast majority using the commit message “Aggiornato tutto” (“Updated everything”).

- Victims may also receive an SMS or phone call from a fake bank operator who guides them through the process, including enabling Android installation from unknown sources in order to sideload the APK.

- The most important technical evolution is the packaging: newer APKs contain malformed ZIP entries such as paths rooted under /AndroidManifest.xml/, /classes.dex/, and /resources.arsc/. Simple extraction tools may try to write those entries as absolute paths, causing extraction failures.

- For defenders, the most resilient detection opportunities are not the APK filename or the C2 endpoint, but the internal NFCShare code markers, the WebView/NFC behavior combination, and the malformed APK structure introduced in the newer builds.

Indicators of Compromise (IOCs)

Network IOCs

File Hashes (SHA-256)

Application IOCs

TTPs (MITRE ATT&CK)

The malware retains key internal markers: the nfc.share.itnamteis namespace, CardInfoitmanteis model, MqttChannel enum, and NFC reader code using android[.]nfc[.]tech[.]IsoDep to send an EMV PPSE select APDU and parse returned payment card data.

Mitigation Options

D3 Labs included the following potential mitigations:

For End Users / Banks

- Block sideloading: Enforce policies preventing installation from unknown sources on corporate and BYOD devices.

- User awareness: Train customers to recognize that legitimate banks never request app updates via SMS links or phone calls.

- Warn users that attackers may use a social engineering layer via SMS or fake bank operator phone calls to guide victims through enabling unknown-source APK installation.

For Security Teams / Analysts

- Detection via code markers: Focus detection on internal NFCShare code markers (package name, namespace, MqttChannel enum), the WebView/NFC behavior combination, and malformed APK ZIP structure rather than filename or C2 endpoint alone.

- APK analysis tooling: Use the open-source tool apkInspector for APK parsing and artifact extraction, which is useful for identifying NFCShare family markers and DEX layout differences even in malformed samples.

- GitHub monitoring: Monitor for public repositories hosting bank-themed APK files with suspicious commit patterns.

- Treat failed APK extraction as a potential indicator rather than a benign signal, in this campaign, extraction failures are themselves useful indicators of the newer NFCShare packaging.

For Mobile Security / MDM

- Block NFC reader permissions for sideloaded or unverified applications.

- Implement behavioral detection for apps combining WebView UI with android[.]nfc[.]tech[.]IsoDep usage and WebSocket outbound connections.

- Block known malicious domains at the DNS/proxy layer.

Executive Summary

The retail and hospitality sectors operate on high-velocity human interaction, making their front lines a major target for sophisticated social engineering attacks.

Historically, organizations have relied on annual compliance videos and predictable phishing simulations to train frontline workers. While they were initially valuable, this type of traditional training no longer matches how attacks arrive or their increasing diversity and scale. The 2026 Verizon Data Breach Investigations Report reveals that ~62% of security breaches continue to involve the human element.

Countering automated, AI-driven campaigns takes more than traditional security compliance training programs. It takes human risk management (HRM): an approach that reduces human risk by changing how employees recognize and respond to an attack in real time, not once a year.

Key Takeaways

- Primary Threat Vector: Threat actors are shifting away from traditional malware delivery or infrastructure exploitation. They are increasingly engaging frontline employees directly, through conversation.

- Attack Methodology: Threat groups like Scattered Spider use open-source reconnaissance on sites like LinkedIn to map out organization charts. They then deploy AI voice cloning to pose as locked-out employees and talk help desk staff into resetting a password and enrolling multi-factor authentication (MFA) on a device they control.

- Sector-Specific Vulnerabilities: Frontline turnover is high enough that an annual training cycle can miss a seasonal or part-time worker’s entire tenure. A workforce rewarded for being fast and accommodating is exactly the opening a social engineer looks for.

- Cross-Channel Blind Spots: Frontline and floor staff work over SMS, radios, mobile apps, and collaboration tools, not just email. A security program built for the inbox alone cannot see the channels where these attacks actually land.

- Velocity of Compromise: Attackers optimize relentlessly and pivot the moment a channel hardens. Once a lure lands, compromise takes under a minute: Verizon’s 2024 DBIR measured a median of 21 seconds to click a phishing link and another 28 seconds to enter credentials. As email defenses caught up, attackers moved to the phone, where CrowdStrike’s 2025 Global Threat Report tracked a 442% surge in vishing.

Threat Actor Playbook: Conversational Social Engineering

Recent incidents show that modern adversaries do not need complex code or zero-day exploits to get past the perimeter. They target the person instead.

Threat groups like Scattered Spider are using generative AI to run multi-channel, conversational campaigns, following a repeatable loop built to get around technical controls, not break through them:

- Open-source reconnaissance: Attackers scrape professional networks to map the org chart, identifying the IT help desk staff and executives to target or impersonate.

- Vishing: Using AI voice cloning, they place high-pressure calls to the help desk, posing as locked-out employees.

- MFA and password reset abuse: They manufacture urgency to get help desk agents to reset the password and enroll MFA on a device they control, turning a support call into a direct foothold.

Sector-Specific Vulnerabilities and Operational Realities

Defending a consumer-facing brand means managing conditions that line up almost exactly with how attackers operate. Cybercriminals exploit three that are characteristic of retail and hospitality:

1. High workforce turnover

The frontline workforce turns over quickly, with much of it on seasonal and part-time contracts. Static, annual training cycles break down in this environment. By the time a seasonal or part-time employee is scheduled for their security awareness block, their contract may already be nearing its end.

2. Weaponization of customer service empathy

Frontline personnel, guest service agents, and business process outsourcing (BPO) representatives are rewarded for keeping customers happy. Social engineers play directly on that instinct.

By manufacturing a high-stress scenario, an angry high-value customer or a critical business delay, they pressure workers into breaking the verification protocols meant to catch exactly this.

3. Cross-channel blind spots

Unlike traditional corporate staff, floor managers and guest-facing employees rarely work from a desktop. Operations rely heavily on SMS, mobile apps, radios, and collaboration platforms. Standard email-only security controls cannot see these secondary channels, leaving blind spots where these attacks actually land.

Voice has become one of the loudest of those blind spots, with attackers increasingly using AI-cloned voices to call help desks and employees directly.

Transitioning to Human Risk Management

Mitigating these risks means shifting from passive, email-centric testing to human risk management. In practice, that changes a few things:

- Testing beyond the inbox: Resilience assessments extend past email to SMS, voice calls, and collaboration channels, the places frontline work actually happens.

- Threat-informed simulations: Generic templates give way to scenarios built from the campaigns actually targeting your sector, not last year’s lures.

- Point-of-failure coaching: Instead of an annual video, a worker who slips gets immediate feedback on the exact lure that fooled them, while it is still fresh.

Recommendations for Security Leaders

Building a more resilient human layer is a data-driven effort: track behavioral risk, model it, and act on it before it becomes an incident. Three moves matter most:

1. Test the help desk across every channel, and harden it

Put your help desk and contact center through realistic pressure, including AI voice calls paired with a follow-up text or email, and see whether agents hold the identity-verification line. Then close the gap the attack needs: require out-of-band or step-up verification before any password or MFA reset, so no single urgent call can hand over an account.

2. Coach at the moment of failure

For a high-turnover workforce, brief, contextual training beats the annual block. When someone slips on a simulation, immediate feedback, right then, helps them recognize the exact pressure used on them, without pulling them off the floor.

3. Score risk by role, and feed it real intelligence

A flat spreadsheet of risk ratings misses where the exposure actually sits. Combine behavioral signals, role and access, and live intelligence on the campaigns aimed at your sector to find the highest-exposure groups, then put your sharpest coaching and monitoring there first: the finance teams that move money, the help desk agents that hold the keys. This is where seeing the whole campaign matters.

The full social engineering attack chain begins with reconnaissance and impersonation long before a call reaches your help desk, and the work we do at Doppel is built on breaking that chain upstream of the inbox, rather than reacting one message at a time.

Executive Summary

On 9 June 2026, Group-IB Threat Intelligence reported a malicious shell script uploaded to VirusTotal assessed as a new modular macOS stealer likely distributed via ClickFix phishing pages, relying on compromised WordPress domains and Telegram infrastructure, with a strong European victim focus.

According to Group-IB, a ClickLock Stealer operation has already targeted at least 100 victims across 33 countries, with more than 50% from Europe, and has been active for approximately two months since May 2026.

Notably, the malware does not require elevated privileges or exploits for successful execution.

Key Takeaways

- ClickLock Stealer targets data from 8 browsers, 31 crypto wallet browser extensions, 7 password manager extensions, 8 desktop wallet applications, extracts blockchain addresses across 6 chains, macOS Keychain, shell history, and FTP credentials.

- Upon execution of a ClickFix command, the malicious script shows a terminal-based loading animation mimicking a Cloudflare progress bar with browser verification flow, while the malware orchestrates modules that search the system for browser credentials, password manager data, crypto wallet extensions, desktop wallet files, and employs a GSocket backdoor.

- The victim is forced to follow the attack flow and enter a password, because otherwise the malware “locks” the system by killing all visible processes except the Terminal, giving the malware its name, ClickLock Stealer.

- After modules complete their objectives, they forge timestamps, remove their persistence mechanisms, and self-delete, with the exception of the GSocket backdoor, which remains permanently installed. The attacker ends up with the macOS login password, Chrome’s encryption key, a full archive of stolen data, and a persistent backdoor.

- Based on the code structure and other observed artifacts, the malware is assessed to still be under development.

MITRE ATT&CK TTPs

- Initial Access (T1204.004 – Malicious Copy and Paste): The kill chain starts once the user pastes the command into Terminal. The orchestrator script (script[.]sh) disables keyboard interrupts, shows a fake Cloudflare animation, and downloads four components: a credential stealer (zsh[.]txt), a Keychain stealer (chrome[.]txt), a crypto-focused stealer (finderv2.jpg) from compromised WordPress infrastructure, and a GSocket-based backdoor installer (goyim).

- Credential Theft (T1056.002 – GUI Input Capture): A fake macOS password dialog is built with osascript. If the user complies, the password is validated and sent to Telegram immediately.

- Persistence (T1543.001 – Launch Agent): Both plist[.]css and chrome[.]js create LaunchAgent .plist files in ~/Library/LaunchAgents/. Any plist with RunAtLoad set to true automatically executes on user login, meaning even if the user reboots, the modules activate on the next login.

- Keychain Extraction (T1555.001): The extracted key is the AES encryption key used by Chromium-based browsers to encrypt locally stored cookies, passwords, and autofill data. Possession of this key allows offline decryption of Chrome Login Data and Cookies SQLite databases.

- Backdoor Installation (T1543.001): On macOS, the GSocket binary is disguised as iCloud within ~/Library/Application Support/iCloudsync, with the process masquerading as SystemUIServerl. The script leverages GSocket’s built-in persistence via crontab injection, shell RC file infection, and LaunchAgent creation.

- Exfiltration (T1567.002): The stolen key file and system profile are exfiltrated to an attacker-controlled Telegram bot via the sendDocument API method. Telegram serves as a lightweight C2 channel requiring no attacker-controlled infrastructure while providing encrypted transport unlikely to be blocked by network filters.

Indicators of Compromise (IOCs)

File Hashes (SHA1)

Network Indicators (Obfuscated)

- panalobet[.]ph – hosts chromer.txt, zsh.txt, finderv2.jpg, deng.php

- store.grafsynergy[.]com – hosts goyim backdoor installer

- cottonbox[.]co[.]il – hosts additional payload (hbd)

File System Artifacts

- ~/Library/LaunchAgents/com[.]authirity[.]plist

- ~/Library/LaunchAgents/com[.]chromer[.]plist

- $HOME/[.]cacheb/ (hidden staging directory)

Mitigation Options

- Monitor for osascript processes spawning password dialogs with custom icons, particularly when the icon is sourced from /tmp/ or other unusual locations.

- Alert on rapid, repeated pkill or killall activity targeting system processes (Finder, Dock, SystemUIServer, NotificationCenter) at sub-second intervals, as this behavior is unique to forced-interaction malware.

- Detect bulk access to browser profile directories followed by outbound connections to api[.]telegram[.]org or archive creation. Consider blocking or alerting on curl piped directly to bash, especially when source URLs use misleading file extensions (.jpg, .txt, .css).

- Deploy endpoint detection tools capable of behavioral analysis rather than relying solely on signature-based detection. This sample had zero VirusTotal detections at discovery, meaning static analysis tools provided no protection.

- Implement TCC (Transparency, Consent, and Control) monitoring to detect unexpected Full Disk Access grants, particularly to Terminal[.]app or shell interpreters.

Executive Summary

Manchester Airports Group has disclosed on 27 August 2026 that an unauthorized third party accessed customer data belonging to approximately 8.7 million people across three of England’s busiest airports: Manchester, London Stansted, and East Midlands. The incident involved data related to parking lot, lounge and fast-track bookings and in-airport Wi-Fi sign-ups, and the hackers obtained email addresses, phone numbers, vehicle registration numbers and postcodes. The attack was initiated during the peak summer travel season, with millions of families flying back into the UK before the school year begins, but the attack did not disrupt airport operations or flights. MAG says it quickly contained the incident, brought in external cybersecurity experts and notified the relevant authorities, and no group has claimed responsibility, and investigators have not publicly linked the attack to any specific actor.

Key Takeaways

- The system did not store bank or payment details, and according to MAG, most of the 8.7 million affected customers only lost their email addresses, while the impact varies depending on which services they used.

- The combination of an email address, a phone number, and the knowledge that someone recently made a parking or lounge booking gives a convincing starting point for a targeted phishing message. Attackers don’t need payment data if they can impersonate the airport convincingly enough to obtain it themselves.

- As a precaution, MAG temporarily suspended its Manage My Booking service, but all existing reservations remain valid.

Jeff Lewis Announces Two More Years of ‘Jeff Lewis Live’ on Radio Andy

“I’m happy to announce another two years of ‘Jeff Lewis Live’ on Radio Andy,” Jeff said on today’s show.

On today’s episode of Radio Andy’s Jeff Lewis Live, Jeff revealed that he and SiriusXM have agreed to terms on another two years of their partnership.

“Yesterday at 2:50pm Pacific Daylight Time, we came to terms. I’m happy to announce another two years of Jeff Lewis Live on Radio Andy here at SiriusXM,” Jeff said.

“As you know, my contract ended today [October 16]. We did successfully come to a compromise, although we both are a little bit bruised,” he added.

Listen to the full episode on the SiriusXM app, and hear a clip from the episode above.

Jeff Lewis Live on SiriusXM

Hear Jeff Lewis Live weekdays on Radio Andy (Ch. 101) on satellite radios and the SiriusXM app.

It’s Jeff Lewis just the way fans want him: live and uncensored. Jeff and his band of “Chumps” take on everything from the news of the day to the world of reality TV and everything in between.

Listen Live: No. 2 Notre Dame Fighting Irish vs. No. 8 BYU Cougars College Football Game

Choose the Notre Dame or BYU broadcast to follow the matchup live on SiriusXM.

The No. 2 Notre Dame Fighting Irish and No. 8 BYU Cougars meet Saturday, October 16 as the undefeated teams face off at LaVell Edwards Stadium in Provo, Utah — and you can listen to every snap live on SiriusXM.

Notre Dame vs. BYU College Football Game

How to Listen to the Live Radio Broadcast

Listen to Notre Dame vs. BYU live on SiriusXM in your car and on the SiriusXM app. Choose the Notre Dame or BYU broadcast to follow the action live.

Date: Saturday, October 16, 2026

Time: 12pm ET

Location: Memorial Stadium in Bloomington, Indiana

Notre Dame broadcast: Ch. 82 (car and app)

BYU broadcast: Ch. 166 (car) and Ch. 992 (app)

College Football on SiriusXM

Throughout the 2026 college football season, SiriusXM listeners can hear live play-by-play of games featuring teams from the ACC, Big Ten, Big 12, SEC, and other conferences, plus Notre Dame, Army, Navy, HBCU football, and more.

Visit SiriusXM’s college football page to see the latest schedule and find upcoming games.

Listen Live: No. 6 Alabama Crimson Tide vs. No. 14 Tennessee Volunteers College Football Game

Choose the Alabama or Tennessee broadcast to follow the matchup live on SiriusXM.

The No. 6 Alabama Crimson Tide and No. 14 Tennessee Volunteers meet Saturday, October 17 for the latest edition of the Third Saturday in October rivalry at Neyland Stadium in Knoxville, Tennessee — and you can listen to every snap live on SiriusXM.

Alabama vs. Tennessee College Football Game

How to Listen to the Live Radio Broadcast

Listen to Alabama vs. Tennessee live on SiriusXM in your car and on the SiriusXM app. Choose the Alabama, Tennessee, or national broadcast to follow the action live.

Date: Saturday, October 17, 2026

Time: 3:30pm ET

Location: Neyland Stadium in Knoxville, Tennessee

Alabama broadcast: Ch. 230 (car) and Ch. 954 (app)

Tennessee broadcast: Ch. 229 (car) and Ch. 953 (app)

National broadcast: Ch. 81 (car and app)

College Football on SiriusXM

Throughout the 2026 college football season, SiriusXM listeners can hear live play-by-play of games featuring teams from the ACC, Big Ten, Big 12, SEC, and other conferences, plus Notre Dame, Army, Navy, HBCU football, and more.

Visit SiriusXM’s college football page to see the latest schedule and find upcoming games.