Skip to content
Sign in
Artwork for Daily DefSec Brief
TechnologyNewsTech News

Daily DefSec Brief

Jerry Bell

A daily podcast covering the important cyber security news that IT and security teams need to know.

Play
Open in
  • 76 episodes
  • daily
  • Avg 4 min
  • English

Episodes 76

NewestOldestLongest
All20Unplayed20In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • October 1 · 3 min

    Cyber Security News for October 1 2026 - Daily DefSec Brief

    1. Cisco SD-WAN Manager zero-day gives admin — CVE-2026-76504 — Fixed: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1 — federal due 2026-10-03 — Do: Patch SD-WAN Manager, then check its logs — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU 2. Zammad zero-days used in an AI-agent breach — CVE-2026-102489, CVE-2026-102490 — Do: Upgrade Zammad to version 7 and check logs — https://csirt.divd.nl/cases/DIVD-2026-00015/ 3. MikroTik web interface flaw gives root — CVE-2026-84411 — Fixed: 7.24 — Do: Upgrade RouterOS and close WebFig to the internet — https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06 4. TeamViewer session permissions can be bypassed — CVE-2026-92370, CVE-2026-19743, CVE-2026-92368 (+ 2 more) — Fixed: 15.82, 15.64.8, 14.7.48855, 13.2.36230 (Windows) — Do: Update TeamViewer everywhere it is installed — https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/ 5. WatchGuard fixes 15 Fireware OS flaws — CVE-2026-86131, CVE-2026-81433, CVE-2026-86101 (+ 2 more) — Fixed: 2026.3.2, 2026.2.3, 12.12.3, 12.5.21; AP 3.4.8 — Do: Upgrade Firebox and WatchGuard access points — https://psirt.watchguard.com/CVE-2026-86131 6. Star Blizzard's archive-and-disk-image phish — Do: Hunt for the three fake maintenance tasks — https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/ 7. Google: exploit growth is fast n-days — Do: Order the patch queue by exploitation evidence — https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era/ 8. SSMS Copilot made a database owner sysadmin — CVE-2026-65669 — Fixed: 22.8.2 — Do: Update SQL Server Management Studio — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65669

    • Transcript
  • September 30 · 3 min

    Cyber Security News for September 30 2026 - Daily DefSec Brief

    1. A password reset led to Kubernetes credentials — Do: Alert on sign-in methods added after resets — https://www.microsoft.com/en-us/security/blog/2026/09/29/beyond-source-code-a-path-to-the-keys-to-the-kingdom/ 2. A package name runs commands in AWS AgentCore — CVE-2026-12530, CVE-2026-16796 — Fixed: 1.18.1 — Do: Upgrade the Bedrock AgentCore Python SDK — https://aws.amazon.com/security/security-bulletins/2026-065-aws/ 3. An Octopus project edit runs code on the server — CVE-2026-101169 — Fixed: 2026.1.11781 · 2026.2.13441 · 2026.3.15829 — Do: Upgrade self-hosted Octopus Server — https://advisories.octopus.com/post/2026/sa2026-10/ 4. OpenSSL DTLS leaks heap memory to a peer — CVE-2026-84782 — Fixed: 4.0.3 · 3.6.5 · 3.5.9 · 3.4.8 · 3.0.23 — Do: Update OpenSSL wherever DTLS is in use — https://openssl-library.org/news/vulnerabilities/ 5. Stolen passwords opened France's tax portals — Do: Require MFA on every staff and partner portal — https://thehackernews.com/2026/09/french-tax-data-theft-using-stolen.html 6. Windows gets built-in Linux containers — Do: Set the WSL containers policy in Intune — https://blogs.windows.com/windowsdeveloper/2026/09/29/wsl-containers-now-generally-available/ 7. Coding agents post private screenshots publicly — Do: Stop coding agents from creating public repos — https://www.glow.io/blogs/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies

    • Transcript
  • September 29 · 4 min

    Cyber Security News for September 29 2026 - Daily DefSec Brief

    1. Exploited Apple flaw fixed for older releases — CVE-2026-86950 — Fixed: 26.7.1 · 15.8.1 — Do: Update iPhones and Macs still on older releases — https://support.apple.com/en-us/149229 2. Featured Chrome ad blocker is spyware — Do: Remove Poper Blocker and allowlist Chrome extensions — https://www.darkreading.com/application-security/chrome-store-poper-blocker-spyware-downloaded-millions 3. A webpage can run code through OpenCode — Fixed: 1.18.22 — Do: Upgrade OpenCode on every developer machine — https://github.com/anomalyco/opencode/security/advisories/GHSA-632h-h47v-g4x4 4. 16,326 Supabase databases readable by anyone — Do: Turn on row-level security for every Supabase table — https://www.upguard.com/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps 5. MCP Python SDK leaks OAuth secrets — Fixed: 1.30.0 or 2.2.0 — Do: Upgrade the MCP Python SDK, rotate client secrets — https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-qx49-fqc8-xw99 6. NeedyMantis keeps access after the break-in — Do: Hunt NeedyMantis sideloading, block its domain — https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/ 7. Authlib accepts JWS with no signatures — CVE-2026-96760 — Do: Reject empty-signature JWS before Authlib sees it — https://kb.cert.org/vuls/id/762428 8. Old branded QR codes can be taken over — Do: Delete DNS records pointing at abandoned QR services — https://cyberinsider.com/hackers-can-hijack-qr-code-domains-to-redirect-users-to-phishing-sites/

    • Transcript
  • September 28 · 4 min

    Cyber Security News for September 28 2026 - Daily DefSec Brief

    1. NetScaler zero-days exploited before the patch — CVE-2026-88771, CVE-2026-88772 — Fixed: 14.1-73.37, 13.1-64.23, 13.1-37.279 (FIPS and NDcPP) — federal due 2026-09-30 — Do: Patch NetScaler, then hunt for compromise — https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html 2. One encoded letter gets past PeopleSoft WAF rules — CVE-2026-35273 — Do: Patch PeopleSoft, don't rely on the WAF — https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/ 3. SharePoint "spoofing" flaw is now exploited — CVE-2026-65660 — Fixed: 16.0.10417.20198 (2019), 16.0.19725.20522 (SE), 16.0.5565.1001 (2016) — federal due 2026-09-28 — Do: Install August's SharePoint update on every farm — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660 4. RouterOS SSH skips the login after a rekey — CVE-2026-67279 — Fixed: 6.49.21, 7.23.4, 7.24.2 — federal due 2026-09-28 — Do: Upgrade RouterOS and fence off SSH — https://www.cve.org/CVERecord?id=CVE-2026-67279 5. WordPress core file-load flaw now exploited — CVE-2026-87902 — Fixed: 7.1.2 (backports down to 4.7.37) — federal due 2026-09-28 — Do: Make sure WordPress updates reach every site — https://wordpress.org/news/2026/09/wordpress-7-1-2-release/ 6. Leaked service principal deletes Azure resources — Do: Rotate any service principal secret ever posted — https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/ 7. Public lead form hijacked Salesforce Agentforce — Do: Limit agents that read public web forms — https://labs.zenity.io/post/salesbleed-0-click-data-exfiltration-on-agentforce 8. New RAT takes commands over Tailscale's tailcat — Do: Alert on unsanctioned VPN software on endpoints — https://www.malwarebytes.com/blog/threat-intel/2026/09/kothamine-malware-uses-tailscales-tailcat-to-evade-network-detection 9. Disabled malicious GitHub Actions came back online — Do: Pin GitHub Actions to commit hashes — https://socket.dev/blog/mini-shai-hulud-actions

    • Transcript
  • September 25 · 4 min

    Cyber Security News for September 25 2026 - Daily DefSec Brief

    1. One affiliate, four ransomware brands, one toolkit — Do: Hunt for remote access tools you didn't deploy — https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/ 2. SolarWinds Observability has two no-login RCEs — CVE-2026-28324, CVE-2026-28325 — Fixed: 2026.2.3 — Do: Upgrade SolarWinds Observability Self-Hosted — https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28324 3. Carbonato botnet hijacks exposed Docker APIs — Do: Take the Docker API off the network — https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/ 4. Docs domain third-party.com now serves ClickFix — Do: Search your repositories for third-party.com — https://thehackernews.com/2026/09/placeholder-third-partycom-referenced.html 5. MacSync hides commands in iCloud calendar events — Do: Hunt Macs for new LaunchAgents and Git hooks — https://securelist.com/macsync-new-version/121383/ 6. ViewSonic ViewBoards give up screen and control — CVE-2026-82987, CVE-2026-82988, CVE-2026-82989 — Do: Put ViewBoards on their own network segment — https://kb.cert.org/vuls/id/234131 7. AI agents went around government portal controls — Do: Lock down your pre-production web servers — https://www.infosecurity-magazine.com/news/openai-hacks-australian-medicare/ 8. Fake payroll apps install hidden ScreenConnect — Do: Block ScreenConnect servers that aren't yours — https://www.helpnetsecurity.com/2026/09/25/fake-payroll-desktop-apps-screenconnect/

    • Transcript
  • September 24 · 4 min

    Cyber Security News for September 24 2026 - Daily DefSec Brief

    1. Roundcube pre-login SQL injection now exploited — CVE-2026-48842 — Fixed: 1.6.16 or 1.7.1 — Do: Upgrade Roundcube webmail — https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1 2. TeamCity RCE now used in ransomware campaigns — CVE-2026-63077 — Fixed: 2025.11.7 or 2026.1.3 — Do: Patch TeamCity and check it for intruders — https://www.rapid7.com/blog/post/etr-cve-2026-63077-critical-unauthenticated-remote-code-execution-in-jetbrains-teamcity/ 3. Spraying hit only forgotten M365 service accounts — Do: Lock down forgotten Microsoft 365 service accounts — https://www.proofpoint.com/us/blog/threat-insight/Spraying-in-the-Andes-TeamFiltration-Returns 4. Public Ubuntu container escape, no kernel fix yet — CVE-2026-80521 — Do: Keep untrusted containers off Ubuntu hosts — https://ubuntu.com/security/CVE-2026-80521 5. Windows app host hands Microsoft tokens to attackers — Do: Turn off app sideloading where it isn't needed — https://www.huntress.com/blog/stealing-oauth-tokens-through-microsofts-front-door 6. Malicious providers on HashiCorp's Terraform registry — Do: Check Terraform lock files for the typosquat — https://www.aikido.dev/blog/graphalgo-terraform-go-modules 7. Any cPanel account can get root via CalDAV — CVE-2026-87899, CVE-2026-87900, CVE-2026-68490 — Fixed: 11.134.0.57, 11.136.0.41, 11.138.0.8; WP Toolkit 6.11.3 — Do: Update cPanel and WP Toolkit — https://support.cpanel.net/hc/en-us/articles/43591715125271-Security-CVE-2026-87899-Vulnerability-in-cPanel-s-CalDAV-CardDAV-September-22-2026 8. Foxit PDF Reader update fixes updater SYSTEM flaw — CVE-2026-91813 — Fixed: Reader 2026.2.1; Editor 2026.2.1, 14.0.8 or 13.2.7 — Do: Push the Foxit PDF update — https://www.foxit.com/support/security-bulletins.html 9. Hundreds of leaked GitHub App keys still work — Do: Audit your GitHub Apps and rotate their keys — https://blog.gitguardian.com/github-app-private-keys-leaked/ 10. New injection technique slips past four EDRs — Do: Ask your EDR vendor about parameter poisoning — https://flashpoint.io/blog/process-parameter-poisoning-edr-evasion-technique/ 11. A GitLab email address can commit code as you — Do: Reset your GitLab incoming email token — https://www.aikido.dev/blog/gitlab-email-push-to-main

    • Transcript
  • September 23 · 5 min

    Cyber Security News for September 23 2026 - Daily DefSec Brief

    1. F5 BIG-IP APM zero-day exploited for code execution https://my.f5.com/manage/s/article/K000162605 2. Check Point management servers exploited since July https://support.checkpoint.com/results/sk/sk1000171 3. Device-code phishing kit registered its own devices ra — https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/ 4. Arista VeloCloud orchestrator zero-day exploited https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183 5. Check Point VPN certificate flaw now exploited https://support.checkpoint.com/results/sk/sk1000117 6. Public tool freezes Defender's updates — Do: Alert on stale Defender signatures — https://thehackernews.com/2026/09/researcher-drops-bigdiskbuster-zero-day.html 7. Rogue Entra MFA provider keeps stealing passwords — Do: Alert on new external MFA methods — https://www.varonis.com/blog/trustsink 8. Public exploit for Veeam Agent's SYSTEM escalation — CVE-2026-32996 — Fixed: 13.0.2.29 — Do: Update Veeam Agent on Windows endpoints — https://www.veeam.com/kb4852 9. WordPress core flaw loads PHP with no login — CVE-2026-87902 — Fixed: 7.1.2 (backports down to 4.7.37) — Do: Check WordPress auto-updates really installed — https://wordpress.org/news/2026/09/wordpress-7-1-2-release/ 10. ManageEngine logon-screen client gives SYSTEM — CVE-2026-74849 — Fixed: 7001 — Do: Upgrade ADSelfService Plus to the fixed build — https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-74849.html 11. SharePoint "spoofing" flaw is code execution — CVE-2026-65660 — Fixed: 16.0.10417.20198 (2019), 16.0.19725.20522 (SE), 16.0.5565.1001 (2016) — Do: Confirm August's SharePoint update is installed — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660 12. Next.js preview images can run server code — CVE-2026-94545 — Fixed: 16.3.6 — Do: Upgrade Next.js apps that generate preview images — https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j 13. Bifrost AI gateway runs commands without a login — CVE-2026-90898 — Fixed: 2.1.0 — Do: Upgrade Bifrost and rotate its provider keys — https://research.jfrog.com/vulnerabilities/bifrost-is-vulnerable-to-unauthenticated-remote-code-execution-via-mcp-stdio-client-registration-cve-2026-90898/ 14. Malware has four AI models vote on its moves — Do: Alert on unexpected AI API calls from endpoints — https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/

    • Transcript
  • September 22 · 4 min

    Cyber Security News for September 22 2026 - Daily DefSec Brief

    1. A thousand switches gave up the network map — CVE-2026-7273 — Fixed: 2.90(ABTQ.2)C0 on the 48HPv2 — each model has its own 2.90 build ending .2)C0 — federal due 2026-09-24 — Do: Upgrade the GS1900s and change their passwords — https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026 2. One admin click plants PHP on WordPress — CVE-2026-93485 — Fixed: 7.1.1 — Do: Automate WordPress updates, alert on failures — https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/ 3. Signed driver kills 145 security tools — Do: Block NvFsFilter and alert when EDR goes quiet — https://www.bleepingcomputer.com/news/security/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer/ 4. A bad npm release with valid provenance — Do: Stop treating npm provenance as a code check — https://www.cloudsek.com/blog/ghappier-malware-loader-npm-supply-chain-attack 5. Ransomware run entirely through Group Policy — Do: Alert on new GPOs and review domain admin — https://securelist.com/tr/payload-ransomware-via-group-policy/121335/ 6. Windows COM fix left the hole open — CVE-2026-66804, CVE-2026-50343 — Do: Patch Windows and hunt dangling COM registrations — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66804 7. Backdoor exfiltrates each document as you save it — Do: Hunt the fake scheduled tasks on your endpoints — https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html 8. SAML keeps producing authentication bypasses — Do: Take new SSO integrations to OIDC — https://blog.trailofbits.com/2026/09/21/saml-a-fractal-of-bad-design/ 9. AWS quarantines leaked keys in ten seconds — Do: Alert when AWS quarantines one of your keys — https://unit42.paloaltonetworks.com/detecting-exposed-aws-iam-credentials/ 10. 225 AI-found CVEs, one of them exploited — CVE-2026-26980 — Fixed: 6.19.1 — Do: Upgrade Ghost and rotate its API keys — https://github.com/advisories/GHSA-w52v-v783-gw97 11. ShinyHunters seized Clop's leak site — Do: Revisit a ransom you paid Clop — https://therecord.media/shinyhunters-clop-cyberattack-website

    • Transcript
  • September 21 · 5 min

    Cyber Security News for September 21 2026 - Daily DefSec Brief

    1. Orkes Conductor RCE exploited for a month — CVE-2026-58138 (fixed in 3.30.2) — Do: Patch Conductor, put its API behind login — https://research.empiricalsecurity.com/research/september-2026-cve-of-the-month 2. Three Linux kernel flaws are now exploited — CVE-2025-39682, CVE-2025-39964, CVE-2026-53266 (KEV, federal due 21 Sep) — Do: Update the kernel on every Linux host — https://www.cisa.gov/known-exploited-vulnerabilities-catalog 3. npm malware slips past the new install-script block — indexed-btree, ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window — Do: Search lockfiles for the ten btree packages — https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/ 4. A former employee's access leaked CrowdSec code — Do: Revoke leavers' GitHub access on their last day — https://thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html 5. Hardcoded key hands over SolarWinds ARM — CVE-2026-28326 (fixed in 2026.2.1) — Do: Upgrade SolarWinds Access Rights Manager — https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28326 6. HEIC upload bugs reach GitHub Enterprise and Slack — CVE-2026-19118, libheif 1.23.2+, GitHub Enterprise Server 3.17.20, 3.18.14, 3.19.11, 3.20.7, 3.21.5 — Do: Update libheif, or turn off HEIC decoding — https://heif-heist.com/ 7. A Terraform lock file pulls malware on terraform init — Do: Check lock-file registries before terraform init — https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/ 8. Cisco's September firewall fixes include a 9.9 — CVE-2026-20329, CVE-2026-20154, CVE-2026-20249, CVE-2026-20250 — Do: Upgrade ASA, FTD and FMC software — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN 9. Public root exploits land for four Linux kernel flaws — CVE-2026-74469, CVE-2026-81000, CVE-2026-68121, CVE-2026-80844 — Do: Turn off unprivileged user namespaces and SCTP — https://heyitsas.im/posts/lpe-quartet/ 10. Gemini hacked three real firms in a test — Do: Scan public repos for committed credentials — https://www.securityweek.com/google-confirms-gemini-ai-breached-three-firms/

    • Transcript
  • September 18 · 3 min

    Cyber Security News for September 18 2026 - Daily DefSec Brief

    1. Cisco ISE zero-day exploited for full control — CVE-2026-76460 — Do: Upgrade ISE, grep access.log on every node — https://cyberscoop.com/cisco-ise-zero-day-cve-2026-76460/ 2. Stolen key rewrote vendor scripts at the edge — Do: Check 14 September traffic, hunt long-lived API keys — https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/ 3. Acronis backup flaw confirmed exploited — CVE-2026-87886 — Do: Upgrade the Acronis plugin to 1.9.3 HF3 — https://www.bleepingcomputer.com/news/security/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin/ 4. A long username gets root on Check Point — CVE-2026-91843 — Do: LivePatch Check Point, tighten Trusted Clients — https://thehackernews.com/2026/09/critical-check-point-management-server.html 5. Fake video calls target Rust crate owners — Do: Never install or paste during an unexpected call — https://simonwillison.net/2026/Sep/17/targeted-attacks-on-rustaceans/ 6. Docker sandbox escapes onto the macOS host — CVE-2026-77179 — Do: Upgrade Docker Sandboxes to 0.42.0 — https://thehackernews.com/2026/09/critical-docker-sandboxes-flaw-lets.html 7. Malicious zone runs code on your resolver — CVE-2026-81642 — Do: Upgrade Unbound to 1.26.1 — https://thehackernews.com/2026/09/critical-unbound-dnssec-validator-flaw.html 8. One DoH request crashes BIND's named — CVE-2026-77692 — Do: Upgrade BIND to 9.21.26 or 9.20.29 — https://www.securityweek.com/isc-patches-14-vulnerabilities-in-bind-9-security-update/ 9. Android malware enables its own debug shell — Do: Alert on Developer Options being enabled — https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control/ 10. First AI-agent breach reported to a regulator — Do: Check your breach template covers agent-run attacks — https://www.darkreading.com/cyberattacks-data-breaches/ai-agent-breaches-spanish-organization-personal-data 11. One in eight MCP config slots holds a secret — Do: Search repos for MCP config files, rotate keys — https://www.helpnetsecurity.com/2026/09/18/hush-security-mcp-credential-exposure-report/

    • Transcript
  • September 16 · 4 min

    Cyber Security News for September 16 2026 - Daily DefSec Brief

    1. WSO2 API gateway takes a forged admin token — CVE-2026-5430 — Do: Apply the WSO2 update level, rotate gateway secrets — https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/ 2. Pixel modem zero-day used in targeted attacks — CVE-2026-58704 — Do: Push Pixel to the 2026-09-05 patch level — https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices/ 3. Malware forges Chrome's extension integrity hashes — Do: Allowlist extensions, alert on developer mode — https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html 4. Logitech Options+ gives a normal user SYSTEM — CVE-2026-12518 — Do: Upgrade Logi Options+ fleet-wide — https://blog.amberwolf.com/blog/2026/september/a-peripheral-path-to-system---exploiting-logi-options+-for-system-shells/ 5. GlobalProtect privesc needs a PAN-OS upgrade too — CVE-2026-0307 — Do: Upgrade the app and PAN-OS together — https://security.paloaltonetworks.com/CVE-2026-0307 6. Parallels Desktop gives a local Mac user root — CVE-2026-90894 — Do: Upgrade Parallels Desktop to 27.0.0 — https://jfrog.com/blog/parallels-desktop-turns-appliance-install-into-root-shell/ 7. Oracle's September update covers 672 flaws — Do: Patch E-Business Suite first — https://www.tenable.com/blog/oracle-september-2026-critical-security-patch-update-addresses-672-cves 8. Four of 800 hit their recovery target — Do: Run one full restore end to end — https://www.infosecurity-magazine.com/news/four-of-800-clients-hit-ransomware/ 9. Gambling sites doubling as C2 infrastructure — Do: Re-examine gambling-domain hits in proxy logs — https://www.theregister.com/security/2026/09/15/low-quality-casino-sites-conceal-highly-dangerous-threat-actors/5296652 10. Fraudulent hires get credentials before detection — Do: Verify identity when credentials are issued — https://www.infosecurity-magazine.com/news/fraudulent-hires-credentials/ 11. Most Mythic C2 servers keep the default cert — Do: Alert on O=Mythic certificates and port 7443 — https://censys.com/blog/mythic-c2/

    • Transcript
  • September 15 · 4 min

    Cyber Security News for September 15 2026 - Daily DefSec Brief

    1. Cisco email gateway zero-day exploited for root — CVE-2026-76461, CVSS 9.8 — Do: Upgrade AsyncOS 16.5.0-780, grep mail_logs — https://www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root/ 2. Vite dev servers scanned for cloud credentials — CVE-2026-39364, CVSS 7.5 — Do: Upgrade Vite to 7.3.2 or 8.0.5 — https://www.bleepingcomputer.com/news/security/hackers-target-exposed-vite-dev-servers-to-steal-aws-azure-secrets/ 3. AI agents ran a credential campaign in six hours — Do: Shorten cloud key lifetimes and alert on scanning — https://thehackernews.com/2026/09/autonomous-ai-agents-compromise.html 4. LiteSpeed flaw takes a hosting account to root — no CVE assigned — Do: /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7 — https://thehackernews.com/2026/09/litespeed-enterprise-flaw-could-let-one.html 5. Apple patches 261 flaws across every OS — Do: Update Mac security tools before macOS 27 — https://isc.sans.edu/diary/rss/33336 6. Homebrew 7.0.0 closes a sudo path in casks — Do: Install Homebrew 7.0.0 on developer Macs — https://www.helpnetsecurity.com/2026/09/15/homebrew-7-0-0-security-open-source/ 7. MeshCentral used as the backdoor at a broadband ISP — CVE-2024-21762 in the toolkit — Do: Hunt for RMM agents you never deployed — https://thehackernews.com/2026/09/3bb-attacker-used-meshcentral-backdoor.html 8. AWS TEAM grants access it was not asked for — CVE-2026-86830, CVSS 7.2 — Do: Upgrade TEAM to 1.5.1, forks included — https://aws.amazon.com/security/security-bulletins/rss/2026-112-aws/ 9. An unpatched VPN cost Japan 246,000 records — Do: Alert on bulk file reads by service accounts — https://securityaffairs.com/199090/security/non-zero-day-vpn-flaw-left-japan-government-shared-network-platform-exposed-246000-records-at-risk.html 10. Office update breaks copy and paste in Excel — Do: Warn the help desk about KB5002914 — https://www.bleepingcomputer.com/news/microsoft/microsoft-september-kb5002914-security-update-breaks-excel-copy-and-paste/ 11. WordPress scans plugin updates before shipping — Do: Leave WordPress plugin auto-updates on — https://thehackernews.com/2026/09/wordpress-adds-automated-plugin-reviews.html 12. A $159 board defeats confidential computing — no CVE will be assigned — Do: Recheck what you claim confidential computing proves — https://thehackernews.com/2026/09/new-ddrop-attack-breaks-intel-tdx-and.html

    • Transcript
  • September 14 · 6 min

    Cyber Security News for September 14 2026 - Daily DefSec Brief

    1. GitLab path traversal at CVSS 10, now exploited — CVE-2026-85706 — Do: Upgrade GitLab, then grep for file.path — https://watchtowr.com/resources/rapid-reaction-gitlab-critical-path-traversal-vulnerability-cve-2026-85706/ 2. ScreenConnect file-transfer flaw now has a patch — CVE-2026-84869 — Do: Upgrade ScreenConnect to 26.6.5 — https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin 3. Artifactory chain mints admins, drops a backdoor — CVE-2026-42018, CVE-2026-42016 — Do: Patch Artifactory, audit admin accounts — https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 4. Metasploit weaponizes five KEV flaws at once — CVE-2026-20079, CVE-2026-83549, CVE-2026-63077, CVE-2026-82078, CVE-2026-19295 — Do: Patch the five KEV flaws now weaponized — https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen 5. Plesk restore race gives a customer root — CVE-2026-68488 — Do: Upgrade Plesk to 18.0.80.7 — https://support.plesk.com/hc/en-us/articles/43248932867351-Vulnerability-in-Plesk-s-Backup-Manager-symlink-race-during-restore-allows-root-privilege-escalation 6. Dell ObjectScale unauth RCE at CVSS 10 — CVE-2026-70416 — Do: Upgrade ObjectScale to 4.4.0.0 — https://securityonline.info/dell-objectscale-vulnerabilities-cve-2026-70416/ 7. Direct Send phishing lands as internal mail — Do: Set RejectDirectSend to true in M365 — https://www.infosecurity-magazine.com/news/hackers-us-business-hours-m365/ 8. Malware hosted on AI vendors' own domains — Do: Filter AI share links as user content — https://www.huntress.com/blog/ai-attack-surface 9. Fake agency request passed every email check — Do: Verify agency data requests out of band — https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/ 10. 1.8 million APKs mined for hardcoded secrets — Do: Scan your shipped mobile apps for secrets — https://www.bleepingcomputer.com/news/security/hackers-abused-claude-to-extract-secrets-from-18m-android-apps/ 11. Stolen police login opened a state DMV database — Do: Inventory external accounts into your systems — https://therecord.media/florida-shiny-hunters-motor-vehicle 12. Kiro wrote the edit before you approved it — CVE-2026-89332 — Do: Upgrade Kiro to 0.8.135, rotate creds — https://aws.amazon.com/security/security-bulletins/rss/2026-111-aws/ 13. 76% deployed Copilot, 43% reviewed permissions — Do: Review M365 oversharing before Copilot — https://www.infosecurity-magazine.com/news/organizations-skip-permissions-ai/ 14. IT staff clicked more than any other team — Do: Include IT in phishing simulations — https://www.securityweek.com/phishing-research-challenges-conventional-security-awareness-testing/ 15. OpenAI agent swarm ran the RubyGems attack — Do: Rotate RubyGems API keys from May — https://www.infosecurity-magazine.com/news/openai-agent-swarm-hacks-rubygems/

    • Transcript
  • September 11 · 5 min

    Cyber Security News for September 11 2026 - Daily DefSec Brief

    1. Two MikroTik flaws exploited, deadline Sunday — CVE-2026-86060, CVE-2026-67277 — Do: Patch RouterOS, close SSH and btest — https://www.cisa.gov/known-exploited-vulnerabilities-catalog 2. WatchGuard Firebox now in ransomware — CVE-2025-14733 — Do: Upgrade Fireware to 12.5.15 or later — https://www.scworld.com/news/cisa-watchguard-firebox-bug-exploited-in-ransomware-campaigns · NVD — https://nvd.nist.gov/vuln/detail/CVE-2025-14733 3. Two 9.8s in Check Point VPN certs — CVE-2026-85102, CVE-2026-85103 — Do: Apply Check Point's 9 September VPN fixes — https://thehackernews.com/2026/09/check-point-discloses-two-98-rated-vpn.html 4. AWS SSM agent leaks instance credentials — CVE-2026-89049 — Do: Upgrade SSM Agent to 3.3.4851.0 — https://aws.amazon.com/security/security-bulletins/rss/2026-107-aws/ 5. Backup driver writes below the OS — CVE-2026-12780 — Do: Block amwrtdrv.sys, confirm Secure Boot on — https://kb.cert.org/vuls/id/687587 · NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-12780 6. AI closed the detection-evasion loop — Do: Weight behavioural detection over signatures — https://www.securityweek.com/anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion/ 7. BYOD calls end at the Graph API — Do: Alert on new MFA device registrations — https://www.darkreading.com/threat-intelligence/voice-callers-exploit-byod-microsoft-365-corporate-data 8. IDScan confirms the licence breach — Do: Ask vendors how long they keep the scan — https://www.bleepingcomputer.com/news/security/idscan-confirms-breach-tied-to-153-million-stolen-drivers-licenses/ 9. Sogou input method drops a backdoor — CVE-2026-51990 — Do: Confirm Sogou is on an April 2026 build — https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html 10. Work profiles hide a banking trojan — Do: Test your app's checks inside a work profile — https://thehackernews.com/2026/09/gigabud-creates-android-work-profiles.html 11. Android ransomware plus spyware — Do: Block sideloading, alert on Accessibility grants — https://www.infosecurity-magazine.com/news/mantaxotax-android-malware/ 12. MCP tool descriptions act as instructions — Do: Review and pin your MCP tool descriptions — https://www.scworld.com/resource/when-english-becomes-exploit-code-the-hidden-risk-inside-mcp-servers 13. Root on the node forges workload identity — Do: Shorten SPIFFE credential lifetimes — https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ 14. Passkeys move between managers — Do: Revisit passkeys now migration works — https://www.helpnetsecurity.com/2026/09/10/google-android-password-manager-transfer/ 15. Invoice fraud with an AI paper trail — Do: Call back on every payment-detail change — https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/

    • Transcript
  • September 10 · 5 min

    Cyber Security News for September 10 2026 - Daily DefSec Brief

    1. Cisco firewall manager exploited to root — CVE-2026-20079 (CVSS 10.0), CVE-2026-20316 — Do: Apply the Cisco Secure FMC hotfixes now — Cisco Talos — https://blog.talosintelligence.com/fmc-ongoing-exploitation/ 2. NetScaler auth bypass now actively exploited — CVE-2026-19490 (CVSS 9.3, NVD v4.0) — Do: Upgrade NetScaler to 14.1-73.32 or 13.1-63.21 — Rapid7 — https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway/ 3. Four spy crews, one shared exploit kit — CVE-2026-85046, CVE-2026-85880 — Do: Confirm Chrome 153 and September Windows landed — The Record — https://therecord.media/china-hackers-chrome-browser-zero-day-multiple-groups 4. FortiOS packet flaw added to CISA KEV — CVE-2025-25249 (CVSS 8.1) — Do: Upgrade FortiOS off the affected branches — CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog 5. Passkey social engineering ends in cloud takeover — Do: Alert on new auth methods added to accounts — Microsoft Security — https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/ 6. Shai-Hulud back past npm's scan — feishu-docx-mcp, bmc-i18n-extract-cli, blueai-cli, bmc-translate-utils — Do: Rotate npm tokens, install with --ignore-scripts — Aikido Security — https://www.aikido.dev/blog/shai-hulud-npm-resurfaces 7. Phishing page assembled inside the browser — Do: Alert on OAuth redirects leaving Microsoft — Help Net Security — https://www.helpnetsecurity.com/2026/09/10/browser-based-phishing-blob-urls-microsoft-oauth/ 8. Stealer logs yield replayable AI tokens — Do: Rotate AI provider keys after any stealer hit — https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html 9. Fortinet portal leaks a token-forging secret — CVE-2026-84390 (CVSS 9.6), CVE-2026-84388 (CVSS 9.1) — Do: Patch FortiPAM and the browser extension together — SecurityWeek — https://www.securityweek.com/fortinet-patches-critical-vulnerabilities-in-fortimonitoronsight-chrome-extension/ 10. Android patches 180 flaws in one month — Do: Push the September Android patch level — https://www.securityweek.com/androids-september-2026-updates-patch-180-vulnerabilities/ 11. AI workflows run on the wrong identity — Do: Run AI workflows as the requester — https://www.darkreading.com/threat-intelligence/identity-based-ai-attack-security-enterprise-data 12. Agent could turn off its own sandbox — CVE-2026-82533 (CVSS 9.6) — Do: Update DeepSeek Harness to 0.1.2-alpha.1 — https://thehackernews.com/2026/09/deepseek-harness-flaw-let-ai-agents.html 13. Scanning and brute force on Proxmox — Do: Take Proxmox port 8006 off the internet —https://isc.sans.edu/diary/rss/33324 14. Vendor credentials opened an EHR API — Do: List vendors holding API credentials to you — The Record — https://therecord.media/electronic-health-record-company-says-customer-data-stolen-in-breach 15. Machine identities overtake phishing — Do: Inventory and expire non-human identities — https://www.infosecurity-magazine.com/news/nhis-number-one-corporate-entry/ 16. Contractor's admin account outlived him — Do: Match every admin account to a current person — The Register — https://www.theregister.com/security/2026/09/10/dental-contractor-set-up-secret-account-with-access-to-4000-patient-records-then-left-the-company/5295361 17. EU gives you 24 hours to report from Friday — Do: Name who files your EU 24-hour report — Dark Reading — https://www.darkreading.com/cybersecurity-operations/eu-cyber-resilience-act-reporting-requirements 18. Phishing from the vendor's own address — Do: List who can send mail as your domain — BleepingComputer — https://www.bleepingcomputer.com/news/security/trezor-warns-users-of-email-provider-breach-phishing-attacks/

    • Transcript
  • September 9 · 5 min

    Cyber Security News for September 9 2026 - Daily DefSec Brief

    1. Record 974-CVE Patch Tuesday, two zero-days live — CVE-2026-81963, CVE-2026-85880 (CVSS 7.8) — Do: Install September Windows updates now — SecurityWeek — https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/ 2. Chrome 153 patches its seventh zero-day of 2026 — CVE-2026-87491 — Do: Push Chrome 153.0.8010.36, force restart — SecurityWeek — https://www.securityweek.com/chrome-153-patches-seventh-zero-day-of-2026/ 3. F5 BIG-IP rootkit hides its web shell in memory — CVE-2025-53521 (CVSS 9.8) — Do: Patch BIG-IP APM, then hunt memory — The Hacker News — https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html 4. Defender patch bypassed again, no fix yet — CVE-2026-69414 (the bypassed fix) — Do: No fix — watch SYSTEM-level file reads — Security Affairs — https://securityaffairs.com/198726/security/chaotic-eclipse-released-shieldcrash-a-poc-for-microsoft-defender-zero-day.html 5. SAP kernel flaw scores 10.0, no auth needed — CVE-2026-44756 (CVSS 10.0) — Do: Apply September SAP security notes — SecurityWeek — https://www.securityweek.com/sap-patches-critical-extended-passport-processing-vulnerability/ 6. Phishing chain hides inside Google's own redirects — Do: Hunt unauthorised ScreenConnect installs — Dark Reading — https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign 7. Ivanti patches ten flaws, two unauth RCE at 9.8 — CVE-2026-12744, CVE-2026-12745, CVE-2026-18851, CVE-2026-83527 — Do: Patch EPMM to 12.10.0.0 or 12.9.0.2 — Ivanti — https://www.ivanti.com/blog/september-2026-security-update 8. ClearFake runs its loader straight off WebDAV — Do: Block outbound WebDAV at the proxy — Cisco Talos — https://blog.talosintelligence.com/clearfake-webdav-infection-chain/ 9. New N-central chain creates its own admin account — CVE-2026-86206, CVE-2026-86207 — Do: Apply N-central 2026.3 Hotfix 3 — Rapid7 — https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed 10. FreeIPA lets an anonymous client become admin — CVE-2026-76578, CVE-2026-13097, CVE-2026-76560, CVE-2026-79678 — Do: Update FreeIPA to 4.13.4 — The Hacker News — https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html 11. Extortion crews now steal the model itself — Do: Inventory model weights as crown jewels — The Register — https://www.theregister.com/research/2026/09/08/extortion-crews-have-their-eyes-on-high-value-ai-data-google-warns/5294640 12. VMware Workstation and Fusion guest escapes — CVE-2026-59346, CVE-2026-59347 — Do: Update VMware Workstation and Fusion — SC World — https://www.scworld.com/brief/broadcom-patches-critical-vmware-workstation-and-fusion-vm-escape-vulnerabilities 13. Planted prompt sent ChatGPT's Gmail data elsewhere — Do: Cut ChatGPT connector scopes back — Check Point Research — https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/ 14. Android RAT worms through open ADB ports — Do: Disable ADB over TCP on managed Android — Infosecurity Magazine — https://www.infosecurity-magazine.com/news/thost9-android-rat-packed-loader/ 15. UEFI shell in flash defeats Secure Boot — CVE-2026-20293, VU#718077 — Do: Set BIOS passwords, patch UCS firmware — Cisco PSIRT — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW 16. Military kills ad IDs — Do: Disable advertising IDs via MDM — Bitdefender — https://www.bitdefender.com/en-us/blog/hotforsecurity/us-military-turned-off-ad-tracking-phones 17. BleachBit's shredder skipped parts of the file — Do: Update BleachBit, wipe free space — Help Net Security — https://www.helpnetsecurity.com/2026/09/09/bleachbit-6-0-4-released/

    • Transcript
  • September 8 · 5 min

    Cyber Security News for September 8 2026 - Daily DefSec Brief

    1. A maximum-severity Magento zero-day was exploited for three days before Adobe shipped a fix — CVE-2026-75650 — Do: Apply the APSB26-146 composer patch, then hunt — Adobe — https://helpx.adobe.com/security/products/magento/apsb26-146.html 2. MikroTik routers taken over through an SSH key check that ignores half the key — CVE-2026-67276, CVE-2026-67277 — Do: Update RouterOS, then audit SSH users and keys — CERT Polska — https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ 3. N-able's fourth N-central hotfix in five weeks, and its own notices disagree on exploitation — CVE-2026-86218 — Do: Install N-central Hotfix 4, build 2026.3.1.14 — N-able — https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/ 4. A phishing service beat MFA at 258 organisations and took 5,000 Microsoft 365 logins — Do: Move admins to phishing-resistant sign-in — BleepingComputer — https://www.bleepingcomputer.com/news/security/bigbear-microsoft-365-phishing-service-bypassed-mfa-at-258-organizations/ 5. ConnectWise has no patch for a ScreenConnect file-transfer flaw, and rogue clients are spreading malware — Do: Deselect TransferFiles on every ScreenConnect role — ConnectWise — https://www.connectwise.com/company/trust/advisories 6. Attackers are phoning executives, posing as the help desk, and walking off with the session — Do: Give the help desk a caller-verification step — The Hacker News — https://thehackernews.com/2026/09/microsoft-365-attackers-use-help-desk.html 7. One researcher dropped zero-days for Avast, CrowdStrike and Nvidia inside a week — Do: Disable Falcon's Office macro removal for now — SecurityWeek — https://www.securityweek.com/nightmare-eclipse-drops-crowdstrike-nvidia-avast-zero-day-exploits/ 8. A working exploit chain for Telerik is now public, two months after the patch — CVE-2019-18935, CVE-2026-13181 — Do: Upgrade Telerik UI to 2026.2.708 or later — The Hacker News — https://thehackernews.com/2026/09/telerik-ui-padding-oracle-bug-chained.html 9. A fake bookmarks extension turns Chrome and Edge into a command channel — Do: Hunt for extensions loaded outside the Web Store — The Hacker News — https://thehackernews.com/2026/09/peep-turns-chrome-and-edge-into-post.html 10. Nine years of passenger records sat in an Elasticsearch cluster anyone could reach — Do: Find search clusters answering from the internet — BleepingComputer — https://www.bleepingcomputer.com/news/security/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak/ 11. Berlin refused a €2m ransom and Rhysida published nearly six terabytes — Do: Write down who refuses a ransom — Infosecurity Magazine — https://www.infosecurity-magazine.com/news/rhysida-berlin-data-extortion/ 12. An unpatched Metabase handed over a million students' details — Do: Patch and gate your self-hosted BI tools — Help Net Security — https://www.helpnetsecurity.com/2026/09/08/mathspace-data-breach-metabase-vulnerability/ 13. The NCSC says most staff are already using AI you have not approved — Do: Publish an approved AI tool people will use — NCSC — https://www.ncsc.gov.uk/blog-post/shadow-ai 14. Ransomware negotiation has turned into a business process with its own staff — Do: Work out your own ransom number first — Help Net Security — https://www.helpnetsecurity.com/2026/09/08/ransomware-negotiation-tactics-video/ 15. A North Korean backdoor is compiled into the victim's own load balancer — Do: Verify HAProxy and daemons against their packages — Security Affairs — https://securityaffairs.com/198656/apt/north-korea-linked-hackers-hide-a-backdoor-inside-haproxy.html 16. The SEO agency poisoning your search results has been at it since 2015 — — The Hacker News — https://thehackernews.com/2026/09/bengalseo-poisons-bing-search-results.html

    • Transcript
  • September 4 · 5 min

    Cyber Security News for September 4 2026 - Daily DefSec Brief

    1. Chrome patches a V8 zero-day that attackers are already using — CVE-2026-85046 — The Hacker News — https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html 2. Coder's package registry served Terraform modules that steal credentials (malicious modules served 07:35–21:45 UTC, Mon 31 Aug, advisory GHSA-vx42-ghc9-gw65) — BleepingComputer — https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised-to-push-malicious-modules/ 3. HPE patches unauthenticated code execution in ArubaOS-CX switches (fixed in 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, 10.10.1181) — CVE-2026-73749 — BleepingComputer — https://www.bleepingcomputer.com/news/security/hpe-patches-critical-arubaos-cx-remote-code-execution-flaw/ 4. Casdoor lets one tenant's admin act on every other tenant, with no patch available (3.115.0 and earlier) — CVE-2026-15630 — CERT/CC — https://kb.cert.org/vuls/id/889462 5. Cisco ships seven IOS XR flaws as one hardening release (no fixed release, upgrade to a release with SMUs, then apply them) — CVE-2026-20274, CVE-2026-20279 — Cisco PSIRT — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM 6. Phishing hides lure words from email filters with invisible Unicode (strip U+E0000–U+E007F before applying signatures) — Microsoft Security — https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/ 7. AWS patches command injection in the CodeCatalyst blueprints framework (@amazon-codecatalyst/blueprints.blueprint before 0.3.156) — CVE-2026-85012 — AWS Security Bulletin — https://aws.amazon.com/security/security-bulletins/rss/2026-095-aws/ 8. A China-linked espionage crew is running its intrusions through AI agents — Security Affairs — https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html 9. BraZetsu packages a compromised Windows host into something an access broker can sell — The Hacker News — https://thehackernews.com/2026/09/brazetsu-malware-turns-compromised.html 10. Toy Ghouls runs its new backdoor's command channel over HiveMQ and Element — Securelist — https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/ 11. Fourteen fake macOS installers deliver the OtterCookie remote access trojan — Jamf Threat Labs — https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/ 12. A phishing kit produced 700 new pages in the month after its servers were seized — Infosecurity Magazine — https://www.infosecurity-magazine.com/news/outsider-phishing-kit-survives/ 13. The 153 million driver's licence scans have a suspected source — Security Affairs — https://securityaffairs.com/198388/security/dark-web-service-nexus-sells-153m-drivers-licenses.html 14. Thomson Reuters breach exposed sealed court records across eleven states — The Hacker News — https://thehackernews.com/2026/09/thomson-reuters-court-software-breach.html 15. A fake acquisition, a forged NDA, and instructions not to tell your colleagues — Dark Reading — https://www.darkreading.com/cyberattacks-data-breaches/large-enterprises-fake-merger-acquisition-scams 16. An AI found 23,000 vulnerabilities and nobody has looked at 21,000 of them — Help Net Security — https://www.helpnetsecurity.com/2026/09/04/echo-claude-mythos-vulnerability-findings/

    • Transcript
  • September 3 · 4 min

    Cyber Security News for September 3 2026 - Daily DefSec Brief

    1. Kestra workflow engine lets anyone run commands with no credentials at all — CVE-2026-49869 — CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog 2. GitSpawn lets a repository's own config run commands through your AI coding agent — CVE-2026-19592, CVE-2026-55607, CVE-2026-71963, CVE-2026-72718 — Manifold Security — https://www.manifold.security/blog/ai-coding-agents-git-hijack 3. Cisco Nexus 9000 switches take unauthenticated code execution as root — CVE-2026-20212 — Cisco PSIRT — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-f2SiMFxl 4. LiteLLM accepts any bearer token as a valid MCP session — CVE-2026-59822 — BerriAI advisory — https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q 5. BadHost defeats authentication anywhere Starlette rebuilds the URL — CVE-2026-48710 — CCB Belgium — https://ccb.belgium.be/advisories/warning-vulnerability-starlette-framework-and-related-frameworks-fastapi-exposes 6. Exploit published for a Cleo Harmony authentication bypass — CVE-2026-84115 — SecurityWeek — https://www.securityweek.com/exploit-published-for-fresh-cleo-harmony-vulnerability/ 7. Dropbox accounts opened through a flaw in Lenovo's email verification — BleepingComputer — https://www.bleepingcomputer.com/news/security/dropbox-accounts-breached-through-lenovo-email-verification-flaw/ 8. Fake IT support on Teams now ends in a Node.js implant and hands-on-keyboard access — Microsoft Security — https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/ 9. The Gentlemen ransomware turns off EDR and backups before encrypting — Cyber Security News — https://cybersecuritynews.com/the-gentlemen-ransomware/ 10. Researcher publishes a CrowdStrike Falcon privilege-escalation exploit — Security Affairs — https://securityaffairs.com/198342/hacking/chaotic-eclipse-releases-crowdstrike-falcon-zeroday-falconflank.html 11. Windows starts switching memory integrity on by itself in October — Help Net Security — https://www.helpnetsecurity.com/2026/09/03/windows-memory-integrity-update/ 12. One AI model completed a full cyber kill chain on its own in Booz Allen's tests — The Register — https://www.theregister.com/security/2026/09/02/claude-mythos-only-model-to-complete-full-cyber-kill-chain-experts-say/5294071 13. Attackers are self-hosting a chat interface on the infrastructure they compromise — Unit 42 — https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ 14. Chrome ships 26 fixes including two critical use-after-free bugs — CVE-2026-84352, CVE-2026-84353 — SecurityWeek — https://www.securityweek.com/chrome-and-firefox-updates-patch-dozens-of-vulnerabilities/ 15. Teams and Outlook fail to launch on ARM Windows after the August updates — BleepingComputer — https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-outlook-fail-to-launch-on-arm-based-windows-pcs/ 16. A hundred and fifty-three million driver's licence scans are for sale — Ars Technica — https://arstechnica.com/security/2026/09/my-drivers-license-is-one-of-153-million-for-sale-on-a-new-dark-website/

    • Transcript
  • September 2 · 5 min

    Cyber Security News for September 2 2026 - Daily DefSec Brief

    1. SonicWall SMA1000 zero-days chained for pre-auth remote code execution — CVE-2026-83548, CVE-2026-83549 — SecurityWeek — https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/ 2. JFrog Artifactory authentication bypass exploited four days after the patch — CVE-2026-82329 — SC World — https://www.scworld.com/news/jfrog-artifactory-flaw-exploited-days-after-patch-release 3. Langflow remote code execution used to harvest OpenAI and AWS keys — CVE-2026-0768 — BleepingComputer — https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/ 4. Twenty-two thousand Exchange servers still unpatched against a mailbox takeover flaw — CVE-2026-62911 — BleepingComputer — https://www.bleepingcomputer.com/news/security/nearly-22-000-microsoft-exchange-servers-vulnerable-to-hijack-attacks/ 5. AI agents ran a full ransomware intrusion in under ten hours — Unit 42 — https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/ 6. FBI warns of consent phishing that takes an account without a password — CyberScoop — https://cyberscoop.com/fbi-alert-oauth-consent-phishing-campaign/ 7. Sangoma Switchvox SQL injection is being exploited seven weeks after the fix — CVE-2026-9586 — The Hacker News — https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html 8. GeoNetwork chain gives unauthenticated code execution on government geoportals — CVE-2026-63219 — The Hacker News — https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html 9. Counterfeit software download sites are installing malware that turns Defender off — Microsoft Security — https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/ 10. Phishing crew abuses a real endpoint-management platform to install ScreenConnect — BleepingComputer — https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/ 11. Airport breach traced to admin keys sitting in the websites' own JavaScript — Infosecurity Magazine — https://www.infosecurity-magazine.com/news/fulcrumsec-manchester-airport/ 12. Stolen API key burned 600,000 dollars of model credits before anyone noticed — The Register — https://www.theregister.com/security/2026/09/01/attacker_stole_a_metr_api_key_used_600k_worth_of_credits_and_no_one_noticed_for_weeks/5293730 13. Hugging Face Transformers writes remote code to disk before asking permission — CVE-2026-80047 — CERT/CC — https://kb.cert.org/vuls/id/456290 14. SageMaker SDK leaves its signing key in cleartext where any account role can read it — CVE-2026-83551 — AWS Security Bulletin — https://aws.amazon.com/security/security-bulletins/rss/2026-093-aws/ 15. Thirteen poisoned Composer packages on Packagist attack visitors of the sites that install them — CVE-2025-31277, CVE-2025-43398, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529 — The Hacker News — https://thehackernews.com/2026/09/13-malicious-packagist-packages-target.html 16. Attackers are installing Apache modules that quietly proxy visitors to phishing pages — Check Point Research — https://research.checkpoint.com/2026/gaming-the-system-how-a-chinese-speaking-actor-turned-brazilian-government-sites-into-an-seo-weapon/

    • Transcript
Showing 21–40 of 76 episodes