Skip to content
Sign in
Artwork for Daily DefSec Brief
TechnologyNewsTech News

Daily DefSec Brief

Jerry Bell

A daily podcast covering the important cyber security news that IT and security teams need to know.

Play
Open in
  • 81 episodes
  • daily
  • Avg 4 min
  • English

Episodes 81

NewestOldestLongest
All20Unplayed20In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • Yesterday · 3 min

    SSHole attacks on Alpine, SonicWall MFA bypass, AI agent breaches WorkOS | Cyber Security News Nov 9

    Attackers are trying the SSHole long-password bypass against OpenSSH on Alpine, and a SonicWall SSL VPN flaw skips SAML MFA. Also: an AI agent going from a GitHub secret to Azure Key Vault in five minutes, a hijacked release bot that published to npm, Claude Code's settings file leaking secrets, and an AI pentest agent that got into WorkOS. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: How do you keep development credentials out of production at your shop? Reply in the comments or at feedback@defensivesecurity.org. 1. SSHole long-password attacks hit OpenSSH on Alpine - CVE-2026-123158 - Fixed: 10.6p2; Alpine 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11 - Do: Update OpenSSH on Alpine and restart sshd - https://www.openssh.com/txt/release-10.6p2 2. SonicWall SSL VPN flaw skips SAML MFA - CVE-2026-19868 - Fixed: Gen7 7.3.4-7013; Gen8 8.2.3-8015 - federal due 2026-11-20 - Do: Upgrade SonicOS on your SonicWall firewalls - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014 3. Update: AI agent mined GitHub, hit Key Vault - Do: Rotate every secret ever in a public repository - https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/ 4. Hijacked release bot backdoored bee-js on npm - Do: Treat GitHub release rights as publish rights - https://safedep.io/blog/ethersphere-bee-js-npm-compromise 5. Claude Code settings file leaks secrets to GitHub - Do: Rotate secrets in Claude Code settings files - https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html 6. DNS typos let outsiders send mail as agencies - Do: Check DNS records for typos and expired domains - https://www.sh.consulting/blog/government-dangling-dns-records 7. An AI pentest agent got into WorkOS - Do: Take internal tools off the open internet - https://workos.com/security/bulletins/update-for-october-30th-2026-data-security-incident

    • Transcript
  • Thursday · 4 min

    APT29-linked phone exploits, Zyxel patch bypass, White House proxy | Cyber Security News Nov 5

    Hackers tied to APT29 are serving exploits for already-patched flaws to out-of-date phones, the Zyxel looting exploit beats June's patch, and the White House network was a rentable proxy. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: What got your team to enforce a minimum phone OS version? Reply in the comments or at feedback@defensivesecurity.org. 1. APT29 hits out-of-date phones from hacked websites - CVE-2024-27834, CVE-2025-14174, CVE-2025-27038 (+ 5 more) - federal due 2026-11-18 - Do: Require current iOS and Android versions on phones - https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain 2. Update: Zyxel exploit beats the June patch - CVE-2026-107441, CVE-2026-7273 - Fixed: 2.90(xxxx.3)C0 - Do: Patch Zyxel GS1900 switches and change passwords - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026 3. DreamHost breach exposed FTP logins for two months - Do: Check DreamHost-hosted sites for changed files - https://www.dreamhost.com/news/announcements/october-security-incident/ 4. APT flaw lets a tampered download run as root - CVE-2026-109518 - Fixed: 2.6.2, 3.0.4, 3.3.3ubuntu0.1, 3.2.1ubuntu0.1, 2.8.4ubuntu0.1, 2.4.15ubuntu0.1, 2.2.5 - Do: Update APT on Debian and Ubuntu servers - https://lists.debian.org/debian-security-announce/2026/msg00526.html 5. Xen flaws let one guest VM take the host - CVE-2026-102703, CVE-2026-102704 - Fixed: xen-4.17.7-4.2.xcpng8.3 - Do: Patch and reboot Xen and XenServer hosts - https://support.citrix.com/external/article/CTX697256 6. Web traffic ZIP files can hijack Snort 3 - CVE-2026-20043 - Fixed: FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2; Snort 3.12.4.0 - Do: Upgrade Cisco Secure Firewall Threat Defense - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe 7. Foglight for Databases fixes three critical flaws - CVE-2026-92188, CVE-2026-92189, CVE-2026-92190 - Fixed: 8.3 - Do: Upgrade Quest Foglight for Databases - http://www.zerodayinitiative.com/advisories/ZDI-26-854/ 8. SonicWall won't patch end-of-life GMS flaws - CVE-2026-109593, CVE-2026-109594 - Do: Replace SonicWall GMS with Network Security Manager - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019 9. DigiCert migration left internal system exposed - Do: Re-check what's reachable after every migration - https://bugzilla.mozilla.org/show_bug.cgi?id=2084460 10. White House network was a residential proxy exit - Do: Hunt for proxyware on company machines - https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/

    • Transcript
  • Wednesday · 5 min

    Stolen Entra app secrets, cPGuard update hijack, Binance fake interview | Cyber Security News Nov 4

    Thirteen stories for defenders. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: What got your team to give network appliances a named patch owner? Reply in the comments or at feedback@defensivesecurity.org. 1. Stolen Entra app secrets hit MSPs and customers - https://www.todyl.com/blog/stolen-app-credentials-real-access-an-actor-is-signing-into-entra-id-and-azure-devops-as-your-workloads 2. cPGuard's update channel pushed a backdoor - https://opsshield.com/notice/cpguard-update-channel-compromise.html 3. Update: open Node-RED editors are being exploited - CVE-2026-58115 - https://cert-portal.siemens.com/productcert/html/ssa-834709.html 4. WS_FTP fixes a 10.0 admin-credential leak - CVE-2026-84295, CVE-2026-90868 - https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-1116 5. Barracuda fixes a flaw chain that reaches root - CVE-2026-116606, CVE-2026-111560 - https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection 6. Update: Linux TCP flaw fixed, Ubuntu still open - CVE-2026-98432 - https://access.redhat.com/security/vulnerabilities/RHSB-2026-016 7. Zyxel GS1900 switches get a command-execution fix - CVE-2026-107441, CVE-2026-76955 - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026 8. Chrome 157 ships 213 security fixes - CVE-2026-121156 - http://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html 9. Android's November patch fixes a no-tap code flaw - CVE-2026-58868 - https://source.android.com/docs/security/bulletin/2026/2026-11-01 10. Forged antd-img-crop commit planted a stealer - https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer 11. Network appliance flaws stay unpatched over a year - https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/ 12. Defense firm pays $13M over cyber claims - https://www.justice.gov/opa/pr/defense-and-aerospace-contractors-ilc-dover-and-ilc-astrospace-agree-pay-13m-resolve 13. Fake job interview opened Binance's wallets - https://www.binance.com/en/blog/community/3229153443759566763

    • Transcript
  • November 3 · 3 min

    Synology NAS ransomware, stolen keys running up $100K AI bills | Cyber Security News Nov 3

    Ransomware is encrypting outdated Synology NAS boxes, attackers are running up six-figure AI bills with stolen cloud keys, and Trigger.dev customers need to rotate their secrets. Plus a Langflow login bypass, coding agents installing abandoned MCP servers, and a second wave of supermarket freezer attacks across Europe. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: Who in your shop finds out first when a cloud bill jumps overnight? Reply in the comments or at feedback@defensivesecurity.org. 1. Ransomware hits outdated Synology NAS boxes - CVE-2024-10441, CVE-2026-13639, CVE-2026-13684 - Fixed: 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12 - Do: Update Synology DSM and close its admin page - https://www.synology.com/en-global/security/advisory/Synology_SA_24_20 2. Stolen cloud keys run up $100K-a-day AI bills - Do: Alert when someone switches on cloud AI services - https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/ 3. Trigger.dev customers' secrets exposed - Do: Rotate every secret you keep in Trigger.dev - https://trigger.dev/blog/security-incident-nov-2026 4. Langflow fixes critical login bypass and RCE - CVE-2026-93680, CVE-2026-110186 - Fixed: 1.13.0 - Do: Upgrade Langflow and turn off auto-login - https://www.ibm.com/support/pages/node/7294467 5. Coding agents install unmaintained MCP servers - Do: Keep an approved list of MCP servers - https://www.glow.io/blogs/mcphantom-ai-coding-agents-are-installing-vulnerable-deprecated-mcp-servers-from-training-data 6. Update: freezer attacks hit six more countries - Do: Take vendor-managed controllers off the internet - https://censys.com/blog/european-refrigerator-controller-redux-a-new-wave-of-refrigeration-attacks/

    • Transcript
  • November 2 · 4 min

    Claude Code extension backdoor on Cursor, Drupal Commerce exploited | Cyber Security News Nov 2

    Every version and fix here was checked against the vendor's advisory or the researcher's write-up before it aired. Today's question: Who approves your developers' editor extensions? Reply in the comments or at feedback@defensivesecurity.org. 1. Exploited Drupal Commerce flaw skips authorization - CVE-2026-118539 - https://www.drupal.org/sa-contrib-2026-254 2. Tampered Claude Code extension hit Cursor users - https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/ 3. Update: Ivanti VPN needs a second patch - CVE-2026-111357, CVE-2026-118527 - https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 4. Fake help desk call led to AD CS takeover - https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/ 5. Northflank breach: rotate every stored secret - https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/ 6. TeamViewer host can run code on the viewer - CVE-2026-111585, CVE-2026-92372, CVE-2026-92374 - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/ 7. Swapped vendor script drained Polymarket users - https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html 8. Attackers run AI pentest frameworks in intrusions - https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks/ 9. LXD flaw lets a public certificate log you in - CVE-2026-112816 - https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557 10. One text message crashes Android phone service - CVE-2026-58882 - https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/ 11. Email to Request Tracker can hijack the reader - CVE-2026-105454, CVE-2026-105455, CVE-2026-105456 - https://cert.pl/en/posts/2026/10/CVE-2026-105454/ 12. n0n ransomware got in on stolen credentials - https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754 13. GCHQ can't account for thousands of drives - https://therecord.media/gchq-cannot-account-for-thousands-of-data-devices

    • Transcript
  • October 30 · 4 min

    GitLab RCE now exploited, Linux kernel remote root | Cyber Security News Oct 30

    A GitLab flaw that runs code on the server is now being exploited, a Linux kernel TCP flaw gives remote root while Ubuntu and RHEL wait on a fix, and the browsers built into five AI coding tools could run code or read a developer's files. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: What's the strangest password you've ever found while cleaning up an environment? Reply in the comments or at feedback@defensivesecurity.org. 1. Update: GitLab 10.0 flaw now exploited - CVE-2026-97229 - Fixed: 19.4.2, 19.3.5 or 19.2.8; Ruby 3.3.13, 3.4.12 or 4.0.9 - federal due 2026-11-01 - Do: Upgrade self-managed GitLab and close open sign-up - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ 2. Linux TCP flaw gives remote root, no Ubuntu fix - CVE-2026-98432 - Do: Install the fixed Linux kernel as it ships - https://ubuntu.com/security/CVE-2026-98432 3. Update: WordPress update flaw under attack - Fixed: 7.1.4 (backports to 4.7.39) - Do: Update WordPress core and block wp-content/upgrade - https://wordpress.org/news/2026/10/wordpress-7-1-4/ 4. AI coding tools' built-in browsers leak files - Do: Keep long-lived secrets off developer laptops - https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical 5. Malware bills its AI to your OpenAI key - Do: Alert on AI API calls from unexpected hosts - https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/ 6. Report: personal AI agent got admin on DoD network - Do: Give AI agents their own scoped accounts - https://cybersecuritynews.com/accenture-contractor-allegedly-gave-claude-access/ 7. Fake AI crawlers hunt for .env files and keys - Do: Block web requests for .env and key files - https://www.cequence.ai/blog/ai-agent-impersonation 8. MLflow fixes six flaws, one needs no login - CVE-2026-118628, CVE-2026-118627, CVE-2026-118626 (+ 3 more) - Fixed: 3.17.0 - Do: Upgrade MLflow and turn on its login - https://www.zerodayinitiative.com/advisories/ZDI-26-844/ 9. Chrome update fixes 21 flaws, one critical - CVE-2026-76024 - Fixed: 156.0.8078.79/.80 - Do: Push the Chrome update and force the restart - https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html 10. Admin password insulted hackers, then let one in - Do: Keep admin accounts off legacy servers - https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649

    • Transcript
  • October 29 · 4 min

    PHP2Shell hits Palo Alto firewalls, Cisco ASA VPN zero-day | Cyber Security News Oct 29

    Attackers are using PHP2Shell against Palo Alto firewall management pages, an exploited flaw crashes Cisco ASA and FTD VPNs, and Talos found an SD-WAN implant that steals network keys. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: What finally got your certificate renewals automated? Reply in the comments or at feedback@defensivesecurity.org. 1. Update: PHP2Shell hits Palo Alto management pages - CVE-2026-109618, CVE-2026-109619, CVE-2026-46300 - federal due 2026-10-31 - Do: Take PAN-OS management off the internet - https://security.paloaltonetworks.com/CVE-2026-109618 2. Exploited flaw crashes Cisco ASA and FTD VPNs - CVE-2026-76418 - Do: Patch Cisco ASA and FTD VPN firewalls - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 3. Attackers try a new Oracle EBS flaw - CVE-2026-101767 - Do: Apply Oracle's October patch to E-Business Suite - https://www.oracle.com/security-alerts/cpuoct2026.html 4. SD-WAN implant steals the network's keys - CVE-2026-20127 - Do: Hunt SD-WAN controllers for KeyDrift - https://blog.talosintelligence.com/uat-11473-keydrift/ 5. Exploited ESX flaw hides admin actions from logs - CVE-2026-41709 - Fixed: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 - federal due 2026-11-11 - Do: Apply VMware's July ESX updates - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 6. WatchGuard fixes seven critical Firebox flaws - CVE-2026-93857, CVE-2026-93865, CVE-2026-93866 (+ 4 more) - Fixed: Fireware 2026.4, 12.12.4, 12.5.22 (T15/T35) - Do: Update WatchGuard Fireware - https://psirt.watchguard.com/CVE-2026-93857/ 7. Firefox 159 fixes 167 security flaws - Fixed: Firefox 159; ESR 153.6, 115.44; Thunderbird 159, 153.6 - Do: Push the Firefox update - https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/ 8. Entra drops SMS and voice MFA in February - Do: Move Entra users off SMS and voice codes - https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement 9. WordPress 7.1.4 fixes an update-time RCE - Fixed: 7.1.4 (backports to 4.7.39) - Do: Update WordPress core - https://wordpress.org/news/2026/10/wordpress-7-1-4/ 10. Seven unpatched Ultralytics code-execution flaws - CVE-2026-118613, CVE-2026-118614, CVE-2026-118615 (+ 4 more) - Do: Load Ultralytics files only from sources you control - http://www.zerodayinitiative.com/advisories/ZDI-26-818/ 11. Few teams automate nearly all TLS renewals - Do: Automate your TLS certificate renewals - https://www.helpnetsecurity.com/2026/10/29/tls-certificate-automation-report/

    • Transcript
  • October 28 · 6 min

    HTTP2Shell flaw exploited, stolen GitHub tokens, Magento PolyShell | Cyber Security News Oct 28

    Attackers are exploiting the Brotli flaw behind HTTP2Shell and Magento's PolyShell, and stolen GitHub tokens are dumping private repo secrets. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: How do you find the services that quietly bundle a library like Brotli? Reply in the comments or at feedback@defensivesecurity.org. 1. Update: Brotli flaw now listed as exploited - CVE-2026-111497 - Do: Patch every service that decompresses Brotli - https://nodejs.org/en/blog/vulnerability/october-2026-security-releases 2. Stolen GitHub tokens dump private repo secrets - Do: Search GitHub for ci-sync branches - https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles 3. Magento PolyShell flaw now listed as exploited - CVE-2026-48356 - Do: Patch Magento and audit its admin accounts - https://helpx.adobe.com/security/products/magento/apsb26-73.html 4. Apple fixes 304 flaws, backports exploited fix - CVE-2026-86950, CVE-2026-86990 - Do: Require supported OS versions on mobile devices - https://support.apple.com/en-us/149225 5. Skimmer hid in a store platform's analytics script - CVE-2026-8467 - Do: List every script your checkout page loads - https://github.com/plausible/analytics/releases/tag/v3.2.1 6. Camera management software led to malware on PCs - Do: Find camera management software on your PCs - https://www.huntress.com/blog/camera-management-software-compromise-malware 7. Veeam fixes critical flaw in Backup & Replication - CVE-2026-108142, CVE-2026-106076, CVE-2026-106078 - Do: Upgrade Veeam B&R and Backup for Microsoft 365 - https://www.veeam.com/kb4948 8. Chrome update fixes 52 flaws, four critical - CVE-2026-118306, CVE-2026-118331, CVE-2026-118344 (+ 1 more) - Do: Push the Chrome update and force the restart - http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html 9. Update: Tailscale fixes the Tailworm SSH flaws - Do: Upgrade Tailscale on servers that run Tailscale SSH - https://tailscale.com/security-bulletins 10. UEFI network boot flaw runs code before the OS - CVE-2026-97631 - Do: Turn off network boot where it's unused - https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m 11. Desktop host breach: customers told to unplug PCs - Do: Turn off drive sharing on hosted desktop sessions - https://www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/ 12. Attack agent built to run on victims' AI models - Do: Require authentication on every AI model endpoint - https://www.security.com/threat-intelligence/ai-llmjacking-skynet

    • Transcript
  • October 26 · 5 min

    Guessed FortiGate passwords, coding agent hijack, Brotli beyond Node | Cyber Security News Oct 26

    An access broker guessed its way into FortiGate firewalls and decrypted their configs for the domain accounts inside, a planted AGENTS.md file in a Downloads folder told a coding agent to install malware, and the Brotli flaw Node.js patched last week turns out to live in Google's decoder. Plus 33 critical ArubaOS fixes, a third PHP flaw with no patch yet, and a forgotten Popcorn Time updater. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: Where does your team let coding agents start, and who decided? Reply in the comments or at feedback@defensivesecurity.org. 1. Guessed FortiGate logins gave up domain accounts - CVE-2025-64446, CVE-2026-0257, CVE-2019-6693 - Fixed: FortiWeb 7.0.12, 7.2.12, 7.4.10, 7.6.5 or 8.0.2 - Do: Take Fortinet admin logins off the internet - https://fortiguard.fortinet.com/psirt/FG-IR-25-910 2. AGENTS.md in Downloads steered a coding agent - Do: Keep coding agents out of the Downloads folder - https://forever.security/blog/hijacking-ai-agents-via-downloads-folder 3. Update: the Brotli flaw reaches far past Node.js - CVE-2026-111497 - Fixed: Brotli 1.0.10, 1.1.1 or 1.2.1 - Do: Patch every copy of the Brotli decoder - https://research.jfrog.com/post/brotli2shell-beyond-node2shell-and-http2shell/ 4. ArubaOS fixes 33 critical flaws - CVE-2026-79844, CVE-2026-79845, CVE-2026-79846 (+ 2 more) - Fixed: 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24 - Do: Upgrade ArubaOS and restrict management access - https://cyber.gc.ca/en/alerts-advisories/hpe-security-advisory-av26-1079 5. Pillow runs commands through an image's filename - CVE-2026-112900, CVE-2026-112393, CVE-2026-112403 - Fixed: 13.0.0 - Do: Upgrade Pillow in every Python project - https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh 6. Update: a third PHP flaw, with no patch yet - CVE-2026-115560 - Do: Keep PHP's session upload progress turned off - https://www.php.net/archive/2026.php#2026-10-23-1 7. Tailscale SSH lets one device reach root elsewhere - Do: Narrow your Tailscale SSH access rules - https://tailworm.com/ 8. Windows Server 2016 updates end in January - Do: Inventory your Windows Server 2016 machines - https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016 9. Researchers switched off a Popcorn Time updater - CVE-2026-30612 - Do: Find and remove Time4Popcorn from company machines - https://labs.eye.security/operation-ixim-preventing-a-botnet-of-millions-of-popcorn-time-users/

    • Transcript
  • October 23 · 4 min

    VeloCloud zero-day exploited, Railway secrets breach, M365 token replay | Cyber Security News Oct 23

    Attackers are exploiting a third VeloCloud Orchestrator zero-day, stolen Microsoft 365 tokens were replayed against 79 organizations from one hosting range, and Railway is telling every customer to rotate their secrets. Plus eMudhra's root leaving Chrome on October 27, and a firewall whose admin password was "password". Every version number in this episode was checked against the vendor's own advisory before it aired. Today's question: How does your team keep audit findings from turning into a pay negotiation? Reply in the comments or at feedback@defensivesecurity.org. 1. Third exploited VeloCloud Orchestrator zero-day - CVE-2026-114625 - Fixed: 5.2.3.18, 6.1.3.10 or 6.4.2.12 - Do: Patch and restrict VeloCloud Orchestrator - https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 2. Stolen M365 tokens replayed from one hosting range - Do: Search your sign-in logs for that IP range - https://www.huntress.com/blog/token-replay-spray 3. Railway breach: rotate every secret stored there - Do: Rotate every secret you keep in Railway - https://blog.railway.com/p/security-disclosure-wednesday-october-21st 4. Update: Chrome drops eMudhra's root on Oct 27 - CVE-2026-91403 - Do: Replace eMudhra certificates and update Java - https://www.oracle.com/security-alerts/alert-cve-2026-91403.html 5. Update: LiteLLM's stolen tokens came from its logs - Do: Stop logging response bodies on your AI gateway - https://docs.litellm.ai/blog/security-incident-oct-21-2026 6. NoMachine web service open to remote code - CVE-2026-114549 - Fixed: 10.1.7, 9.9.6 or 8.27.1 - Do: Upgrade NoMachine and keep its web port internal - https://www.zerodayinitiative.com/advisories/ZDI-26-786/ 7. Splunk fixes 9.9 flaws in Enterprise and SOAR - CVE-2026-76299, CVE-2026-76302, CVE-2026-76531 (+ 1 more) - Fixed: 9.4.16, 10.0.11, 10.2.8 or 10.4.4; SOAR 8.7.0 - Do: Upgrade Splunk Enterprise and SOAR - https://advisory.splunk.com/advisories/SVD-2026-1008 8. Roundcube fixes 20 flaws in 1.6.20 and 1.7.5 - Fixed: 1.6.20 or 1.7.5 - Do: Upgrade Roundcube - https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 9. Linux KSMBD flaws public before a kernel fix - Do: Turn off KSMBD wherever it isn't needed - https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html 10. Firewall admin password was "password" - Do: Replace type 7 passwords on your Cisco gear - https://www.theregister.com/security/2026/10/22/it-department-and-auditors-at-major-pharmacy-chain-got-into-a-rip-roaring-fight-about-using-password-on-cisco-firewall/5304592

    • Transcript
  • October 22 · 4 min

    PHP2Shell exploited, LiteLLM poisoned, Fortinet fixes with no CVEs | Cyber Security News Oct 22

    Attackers are now exploiting PHP2Shell, a poisoned LiteLLM release carried a stealer for AI and cloud keys, and Fortinet shipped critical fixes while holding the CVEs until November 10. Every version number and every fix in this episode was checked against the vendor's own advisory or the researchers' report before it aired. Today's question: How do you check that your security alerts still reach a person? Reply in the comments or at feedback@defensivesecurity.org. 1. Update: PHP2Shell is now being exploited - CVE-2026-109618, CVE-2026-109619 - Do: Patch PHP on every internet-facing server - https://www.php.net/archive/2026.php 2. LiteLLM 1.107.0 shipped a credential stealer - Do: Rebuild affected LiteLLM hosts and rotate their keys - https://research.jfrog.com/post/litellm-hijacked-again/ 3. Fortinet ships critical fixes with no CVEs yet - Do: Patch FortiGates and restrict admin access - https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products 4. GitLab fixes a 10.0 flaw reaching back to 2014 - CVE-2026-110264, CVE-2026-15723, CVE-2026-112212 - Do: Upgrade self-managed GitLab again - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/ 5. A BlackLotus copy beats Secure Boot on patched PCs - CVE-2022-21894 - Do: Start rolling out Microsoft's Secure Boot revocation - https://securelist.com/uefi-bootkit-blackx/121539/ 6. Node.js fixes RCE and TLS hostname bypasses - CVE-2026-111497, CVE-2026-105483, CVE-2026-106069 (+ 1 more) - Do: Upgrade Node.js and rebuild images that bundle it - https://nodejs.org/en/blog/vulnerability/october-2026-security-releases 7. Clustered Cisco Expressway open to root commands - CVE-2026-76466 - Do: Upgrade clustered Cisco Expressway servers - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t 8. BIND fixes four flaws, and 9.18 gets no fix - CVE-2026-94300, CVE-2026-19630, CVE-2026-96888 (+ 1 more) - Do: Patch BIND, and move servers off 9.18 - https://cyber.gc.ca/en/alerts-advisories/isc-bind-security-advisory-av26-1072 9. Chrome now warns when you copy a ClickFix command - Do: Turn on Enhanced Protection in Chrome by policy - https://www.bleepingcomputer.com/news/google/google-chrome-adds-gemini-powered-scam-detection-warns-users-of-clickfix-attacks/ 10. OpenAI agents switched off misalignment alerts - Do: Keep agents' keys away from alerting config - https://www.bleepingcomputer.com/news/security/openai-agents-disabled-safety-monitoring-one-lied-about-it/

    • Transcript
  • October 21 · 4 min

    PHP critical fixes after a leak, eMudhra CA keys, SafePay ransomware | Cyber Security News Oct 21

    PHP ships fixes today for two critical flaws whose details leaked ahead of disclosure, and a certificate authority's signing keys turned out to be guessable, one of them the number four. Also: a joint advisory on SafePay ransomware, a hijacked account that swapped OVHcloud's CLI downloads for a stealer, and a test account with the password Password1. Fixes were checked against the vendor's advisory or release notes where one exists, and against the researchers' report where not. Today's question: How does your team find accounts that should have been deleted? Reply in the comments or at feedback@defensivesecurity.org. 1. PHP fixes two leaked critical flaws today - CVE-2026-109618, CVE-2026-109619 - Do: Find every copy of PHP you run - https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities 2. eMudhra CA keys were trivially guessable - CVE-2026-111943 - Do: Update the CA bundles outside your browsers - https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ 3. SafePay: 600 victims via passwords, old flaws - CVE-2020-3259, CVE-2023-20269, CVE-2023-27532 (+ 2 more) - Do: Require MFA on every VPN login - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a 4. OVHcloud CLI releases carried a secret stealer - Fixed: 0.16.0 - Do: Turn on release immutability for your GitHub repositories - https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/ 5. Zeabur shuts down after second breach - Do: Rotate every secret you stored on Zeabur - https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/ 6. OpenCode silently patched a code-execution flaw - Fixed: 1.18.33 - Do: Upgrade OpenCode on Windows developer machines - https://github.com/anomalyco/opencode/releases/tag/v1.18.33 7. Chrome 156 fixes 353 security flaws - CVE-2026-113341, CVE-2026-113279, CVE-2026-113072 (+ 3 more) - Fixed: 156.0.8078.47/.48 - Do: Push the Chrome update and force the restart - http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html 8. Oracle's quarterly update fixes 1,209 flaws - Do: Patch Oracle Fusion Middleware and E-Business Suite first - https://www.oracle.com/security-alerts/cpuoct2026.html 9. A 2012 Password1 test account let ransomware in - Do: Disable accounts that haven't signed in for a year - https://www.theregister.com/cyber-crime/2026/10/20/password1-and-a-forgotten-test-account-land-welsh-outfits-in-hot-water/5304139

    • Transcript
  • October 20 · 4 min

    NetScaler root takeover, Siemens app in ClickFix, Plex hijacks | Cyber Security News Oct 20

    The NetScaler flaw that crashed appliances is a step in a root takeover whose implant tries to copy itself to the HA partner. ClickFix crews bring a signed Siemens program to run their malware, Plex servers are being hijacked a day after an exploit went public, and a fake WatchGuard download site collects VPN logins. Every version number and every fix in this episode was checked against the vendor's advisory, release notes or the CVE record before it aired. Today's question: Where does your team tell people to get the VPN client? Reply in the comments or at feedback@defensivesecurity.org. 1. Update: NetScaler crash bug drives root takeover - CVE-2026-88771, CVE-2026-88779 - Do: Check both NetScaler HA nodes, rotate keys - https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779 2. ClickFix runs malware through signed Siemens app - CVE-2026-110936 - Fixed: V4.0.9.8 - Do: Alert on Siemens Software Center in AppData - https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/ 3. Redis RESTORE flaw reported exploited - CVE-2026-25243 - Fixed: 8.6.5, 7.2.15 or 6.2.23 - Do: Block the RESTORE command in Redis ACLs - https://cyber.gc.ca/en/alerts-advisories/redis-security-advisory-av26-423 4. Plex2Shell exploited a day after the write-up - CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 (+ 1 more) - Fixed: 1.43.3.10861 - Do: Update Plex Media Server - https://www.cve.org/CVERecord?id=CVE-2026-96652 5. Rank Math PRO downloads shipped a backdoor - CVE-2026-111862 - Fixed: 3.0.124 - Do: Restore affected Rank Math sites from backup - https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html 6. OpenCode Console exposed stored AI provider keys - Do: Rotate any AI keys stored in OpenCode Console - https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/ 7. Update: GhostAction moves to phishing maintainers - Do: Turn off automatic tasks in VS Code - https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html 8. Archibus login bypass leads to code execution - CVE-2026-107186, CVE-2026-107187, CVE-2026-107188 - Fixed: 2025.02 - Do: Upgrade Eptura Archibus - https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed 9. Fake WatchGuard site steals VPN logins - Do: Give staff a bookmarked VPN client download link - https://www.huntress.com/blog/fake-watchguard-vpn-credential-phishing

    • Transcript
  • October 19 · 5 min

    ConnectWise app breach hits M365 tenants, FortiGate memory implant | Cyber Security News Oct 19

    Attackers used ConnectWise's app credentials to enter Microsoft 365 tenants. Also: a FortiGate implant, stolen UpdraftCentral keys, NTLMv1 blocks, AOMEI's update servers, and fixes. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: How do you review vendor apps in your tenant? Reply in the comments or at feedback@defensivesecurity.org. 1. ConnectWise app credentials used on M365 tenants - Do: Disable ConnectWise app identities and audit their roles - https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access 2. FortiManager break-in leads to memory-only implant - CVE-2025-61624 - Fixed: FortiOS 7.6.5 or 7.4.10 - federal due 2026-10-19 - Do: Patch FortiOS and rotate FortiManager-held credentials - https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ 3. Stolen UpdraftCentral keys backdoor WordPress - Do: Delete UpdraftCentral keys from your WordPress sites - https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/ 4. AOMEI update servers tampered with for minutes - Do: Hunt AOMEI machines for the RadminComponentRuntime task - https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering/ 5. Update: KVM escape PwnEscape gets a kernel fix - CVE-2026-99999 - Do: Patch the kernel on KVM hosts - https://access.redhat.com/security/cve/cve-2026-99999 6. Max-severity Magento flaw bypasses September's fix - CVE-2026-103849 - Do: Apply Adobe's October Magento patch now - https://www.adobe.com/trust/security/products/commerce/apsb26-153.html 7. MOVEit Transfer fixes 12 high-severity flaws - CVE-2026-89067 - Fixed: 2025.1.6 or 2026.0.4 - Do: Upgrade MOVEit Transfer - https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-1058 8. Firefox 158 fixes 77 flaws, 30 high - Fixed: Firefox 158, ESR 153.5 or 115.43 - Do: Push the Firefox and Thunderbird updates - https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/ 9. Airflow SSH accepts any server key by default - CVE-2026-94134, CVE-2026-94135 - Fixed: 7.0.0 - Do: Upgrade Airflow's SSH and SFTP providers - https://www.ox.security/blog/by-default-insecure-apache-airflow-disables-ssh-host-key-verification/ 10. Official OpenAI skill used an unowned domain - Do: Search your code for render-internal.com - https://www.air.security/blog-posts/render-openai 11. Windows now blocks NTLMv1 sign-on by default - Do: Find NTLMv1 dependencies before setting Audit mode back - https://support.microsoft.com/help/5066470

    • Transcript
  • October 16 · 4 min

    BeyondTrust zero-day exploited, Atlassian flaw under attack | Cyber Security News Oct 16

    Attackers are using a BeyondTrust Remote Support zero-day and the Atlassian Data Center file-read flaw. Also: Office Preview Pane flaws, AI coding tokens stolen, Drupal, Next.js and NGINX fixes, hijacked NAS boxes, spyware in ads, and AI agents on leaked credentials. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: Where do your developers' AI tool tokens live, and how long do they last? Reply in the comments or at feedback@defensivesecurity.org. 1. BeyondTrust Remote Support zero-day exploited - CVE-2026-102764 - Do: Patch BeyondTrust Remote Support and review it for compromise - https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/ 2. Update: Atlassian file-read flaw now exploited - CVE-2026-21589 - Fixed: see Atlassian's table (Confluence 9.2.26 / 10.2.19, Jira 9.12.40 / 10.3.26 / 11.3.12, Bitbucket 9.4.26 / 10.2.8 / 10.5.1) - federal due 2026-10-18 - Do: Patch Atlassian Data Center or take it offline - https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html 3. Critical Office flaws hit via the Preview Pane - CVE-2026-108448, CVE-2026-108439, CVE-2026-108440 - Fixed: LTSC 2024 16.0.17932.21056, LTSC 2021 16.0.14334.20974, Mac 16.114.26101123 - Do: Make sure Tuesday's Office update actually installed - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108448 4. Aoki stealer takes AI coding assistant tokens - Do: Keep long-lived tokens off developer laptops - https://www.infosecurity-magazine.com/news/aoki-infostealer-ai-coding/ 5. Drupal critical flaw; 28% on end-of-life branches - CVE-2026-108097 - Fixed: 11.4.10, 11.3.19 or 10.6.19 - Do: Update Drupal core, or uninstall Field UI - https://www.drupal.org/sa-core-2026-014 6. Hacked edge devices resold as residential proxies - CVE-2024-3272, CVE-2024-3273, CVE-2021-44228 (+ 1 more) - Do: Take NAS boxes and recorders off the internet - https://www.greynoise.io/blog/proxyjacking-edge-devices-residential-proxies 7. Next.js out-of-band fix for two critical RCEs - CVE-2026-96889 - Fixed: 16.4.1 or 15.5.28 - Do: Upgrade Next.js - https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw 8. Online ads delivered zero-click spyware - Do: Block ads on managed phones and browsers - https://therecord.media/spyware-citizen-lab-advertising 9. NGINX fixes five flaws, one from 2005 - CVE-2026-15176, CVE-2026-93479, CVE-2026-95101 (+ 2 more) - Fixed: 1.30.6 or 1.31.7 - Do: Upgrade NGINX - https://nginx.org/en/security_advisories.html 10. Test AI agents got in on leaked credentials - Do: Find and rotate credentials sitting in your code - https://thehackernews.com/2026/10/cert-in-warns-ai-agents-accessed.html

    • Transcript
  • October 15 · 5 min

    Cisco email gateway exploited, PAN-OS zero-day, Zimbra send-as flaw | Cyber Security News Oct 15

    Attackers are getting root on Cisco Secure Email Gateways with a crafted attachment, and the fix is a month old. Also: a PAN-OS zero-day, Ahsay's failed patch, Nextcloud, Zimbra, curl, Claude Code Desktop, and which package managers check their downloads. Every version number and every fix in this episode was checked against the vendor, the CVE record or the researcher who found it before it aired. Today's question: Have you ever turned on a package manager's integrity checks on purpose, and what made you do it? Reply in the comments or at feedback@defensivesecurity.org. 1. Cisco email gateway exploited through attachments - CVE-2026-76519 - Fixed: Content Scanner Tools 25.3.0.5525; AsyncOS 15.5.5-014 or 16.5.0-780 - federal due 2026-10-17 - Do: Update the Cisco email gateway's content scanner - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp 2. PAN-OS management interface zero-day exploited - CVE-2026-0322 - Fixed: 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12 - federal due 2026-10-17 - Do: Patch PAN-OS and lock down management access - https://security.paloaltonetworks.com/CVE-2026-0322 3. Update: AhsayCBS hotfix out, first patch failed - CVE-2026-105134, CVE-2026-105133 - Fixed: 10.3.4.45 (v10); 9.15.2.70 (v7 to v9) - federal due 2026-10-17 - Do: Apply the AhsayCBS hotfix and reboot - https://www.huntress.com/blog/ahsaycbs-flaws-exploit 4. Nextcloud's built-in Collabora app exploited - CVE-2026-110447 - Fixed: 26.4.303 - Do: Update or remove Nextcloud's built-in Collabora app - https://cveawg.mitre.org/api/cve/CVE-2026-110447 5. Linux vhost flaw: local root, and a VM escape - CVE-2026-74580 - Fixed: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 - Do: Update and reboot your Linux hosts - https://cloud.tencent.com/announce/detail/2483 6. Zimbra: any user can send mail as the CEO - CVE-2026-73571, CVE-2026-10631, CVE-2026-50055 (+ 2 more) - Fixed: 10.1.17 (CVE-2026-73571); 10.1.20 (CVE-2026-10631, CVE-2026-50055) - Do: Upgrade Zimbra - https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1 7. curl fixes its first High flaw since 2023 - CVE-2026-92392 - Fixed: 8.23.0 - Do: Update curl - https://curl.se/docs/CVE-2026-92392.html 8. Claude Code Desktop's preview pane read SSH keys - Fixed: 1.30096.1 - Do: Get long-lived secrets off developer laptops - https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data 9. AI built a Chrome exploit in six days - CVE-2026-85045 - Fixed: 152.0.7977.82 - Do: Force Chrome relaunches after updates - https://xbow.com/blog/xbow-built-a-chrome-full-chain-exploit 10. Of 25 package managers, two check every download - Do: Commit lockfiles and install from them in CI - https://blog.trailofbits.com/2026/10/14/package-managers-have-an-integrity-problem/

    • Transcript
  • October 14 · 4 min

    Ivanti VPN zero-days, exploited Windows flaw, Docker Hub token mix-up | Cyber Security News Oct 14

    Attackers chained Ivanti Connect Secure zero-days to take over VPNs without a login, one of them fully patched, and Microsoft's record October updates fix a Windows flaw that skips the warning on downloaded files. Also: Fortinet, Chrome, Copilot in Visual Studio, SAP, npm trusted publishing, Ghostscript, and a Docker Hub flaw that handed old tokens to new owners. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: Which remote-access path into your network would you least like to explain to an auditor? Reply in the comments or at feedback@defensivesecurity.org. 1. Ivanti VPN zero-days give root before login - CVE-2026-104935 - Fixed: 22.8R2.5, or 25.1.3.0 or later - federal due 2026-10-16 - Do: Upgrade Ivanti and rotate its directory account - https://www.cve.org/CVERecord?id=CVE-2026-104935 2. Exploited Windows flaw leads record Patch Tuesday - CVE-2026-96951, CVE-2026-70571, CVE-2026-70229 - federal due 2026-10-16 - Do: Push October's Windows updates - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951 3. FortiSandbox and FortiSIEM fix pre-login flaws - CVE-2026-107656, CVE-2026-106173 - Fixed: FortiSandbox 5.0.7 or 4.4.10; FortiSIEM 7.5.1 - Do: Upgrade FortiSandbox and FortiSIEM - https://fortiguard.fortinet.com/psirt/FG-IR-26-185 4. Chrome update fixes seven critical flaws - CVE-2026-110152, CVE-2026-110149, CVE-2026-110136 - Fixed: 155.0.8059.79/.80; Extended Stable 152.0.7977.167 - Do: Update Chrome and force the restart - http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html 5. Copilot in Visual Studio could run commands - CVE-2026-103572 - Fixed: 17.14.42 or 18.10.4 - Do: Update Visual Studio and SSMS - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572 6. SAP fixes four critical flaws in October - CVE-2026-89111, CVE-2026-89110 - Fixed: sap-cloud-sdk 0.45.2 - Do: Apply SAP's October security notes - https://www.cve.org/CVERecord?id=CVE-2026-89111 7. Vendor-run gateway let an attacker into a bank - Do: Require MFA on vendor-managed remote access - https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/ 8. npm trusted publishing trusted repository names - Do: Review your npm packages' trusted publisher settings - https://github.blog/changelog/2026-10-02-unvalidated-npm-trusted-publishing-configurations-now-expire 9. Ghostscript flaw reachable through uploaded PDFs - CVE-2026-39919 - Fixed: 10.08.0 - Do: Update Ghostscript on servers that process uploads - https://www.cve.org/CVERecord?id=CVE-2026-39919 10. Docker Hub handed old tokens to new owners - CVE-2026-105445 - Do: Revoke Docker Hub tokens you don't recognize - https://docker.com/blog/docker-hub-security-advisory-cve-2026-105445

    • Transcript
  • October 13 · 4 min

    Cyber Security News for October 13 2026 - Daily DefSec Brief

    1. GitLab fixes a 10.0 pre-login code execution flaw — CVE-2026-97229 — Fixed: 19.4.2, 19.3.5 or 19.2.8 — Do: Upgrade self-managed GitLab — https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ 2. Windows 11 23H2 Enterprise updates end in November — Do: Find and upgrade Windows 11 23H2 machines — https://learn.microsoft.com/en-us/windows/release-health/windows-message-center 3. Attackers warmed freezers at French supermarkets — Do: Take vendor-managed equipment off the open internet — https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/ 4. Free AI credits came with a rerouted coding agent — Do: Check where your coding agents send their traffic — https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages 5. Cheap Android phones ship as proxy exit nodes — Do: Keep unmanaged phones off the internal network — https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware 6. Agent frameworks ran a tool call the model refused — Do: Put the permission check in the tool — https://arxiv.org/html/2610.13651v1 7. VMware's MFA for ESX comes in a paid add-on — Do: Keep SSH off on your ESX hosts — https://www.theregister.com/virtualization/2026/10/13/vmware-is-pushing-so-many-patches-it-thinks-users-need-new-tools-to-manage-the-flood-1/5302172

    • Transcript
  • October 12 · 5 min

    Cyber Security News for October 12 2026 - Daily DefSec Brief

    1. GlobalProtect bypass still feeds ransomware — CVE-2026-0257 — Fixed: 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6, or the matching hotfix — Do: Patch GlobalProtect and review VPN sessions — https://security.paloaltonetworks.com/CVE-2026-0257 2. Fake "security audit" workflow steals CI secrets — Do: Search your repos for unexpected workflow files — https://socket.dev/blog/ghostaction-cloud-credentials 3. Public root exploit for AnyDesk on Linux — Fixed: 8.0.3 — Do: Update AnyDesk on Linux hosts — https://github.com/v12-security/pocs/tree/main/anydesk 4. One prompt exposed every AgentCore agent — Do: Scope down every AgentCore execution role — https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model 5. Old Windows loses Windows Update in 2027 — Do: Find unsupported and stuck Windows machines — https://learn.microsoft.com/en-us/windows/release-health/windows-message-center 6. AWS PowerShell tools logged console passwords — CVE-2026-107783 — Fixed: 5.0.306 — Do: Upgrade AWS Tools for PowerShell — https://aws.amazon.com/security/security-bulletins/rss/2026-132-aws/ 7. Exposed Nvidia GPU exporters leak telemetry — CVE-2026-47483 — Fixed: DCGM 4.5.3 — Do: Take the DCGM Exporter off the internet — https://github.com/NVIDIA/product-security/blob/main/2026/5857/5857.md 8. Two letters slip lookalike domains past Chrome — Do: Watch for lookalikes of your domains — https://www.theregister.com/security/2026/10/10/two-characters-open-up-a-world-of-typosquatting-opportunities-in-chromium-browsers/5302383 9. Update: Denmark's CPR breach ran on "123456" — Do: Ban common passwords on partner accounts — https://databreaches.net/2026/10/10/123456-password-used-in-massive-danish-cpr-data-breach/

    • Transcript
  • October 9 · 5 min

    Cyber Security News for October 9 2026 - Daily DefSec Brief

    1. AhsayCBS backup consoles exploited, no patch — CVE-2026-105134, CVE-2026-105133 — Do: Take the AhsayCBS console off the internet — https://www.huntress.com/blog/ahsaycbs-flaws-exploit 2. China-linked crew stays in through a VPN client — CVE-2014-6278, CVE-2015-3306, CVE-2015-5477 (+ 5 more) — federal due 2026-10-11 — Do: Alert on VPN software you didn't deploy — https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a 3. NetScaler's new SAML flaw hits last week's build — CVE-2026-107406 — Fixed: 14.1-73.46 or 13.1-64.29 — Do: Update every NetScaler running SAML — https://support.citrix.com/external/article/CTX697191/ 4. Ollama model pulls can plant root code — CVE-2026-103663 — Fixed: 0.35.0 — Do: Upgrade Ollama and check what it will load — https://cert.pl/en/posts/2026/10/CVE-2026-103663/ 5. Cisco License On-Prem resets any password — CVE-2026-20328, CVE-2026-76454 — Fixed: 10-202608 — Do: Upgrade Cisco License On-Prem — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE 6. Ransomware shut a cloud and its consoles — Do: Test a restore without your provider's console — https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/ 7. Vault deny rules miss differently cased names — CVE-2026-89322, CVE-2026-105818 — Fixed: 2.1.2, 1.21.12, 1.20.17 or 1.19.23 — Do: Lowercase your Vault policies, then upgrade — https://cyber.gc.ca/en/alerts-advisories/hashicorp-security-advisory-av26-1019 8. 17,610 fake GitHub repos re-aimed at malware — Do: Use app control on developer workstations — https://www.bleepingcomputer.com/news/security/fakegit-malware-campaign-returns-with-17-610-malicious-github-repos/ 9. Let's Encrypt moves to 64-day certificates — Do: Test your renewals against Let's Encrypt staging — https://letsencrypt.org/2026/10/07/64-day-certs 10. Spirit wants to sell staff Teams chats to Google — Do: Set a retention limit on Teams chats — https://therecord.media/lawmakers-warn-of-google-spirit-ai-training-deal

    • Transcript
Showing 1–20 of 81 episodes