Latest / Daily DefSec Brief / Guessed FortiGate passwords, coding agent hijack, Brotli beyond Node | Cyber Security News Oct 26
Transcript
- Jerry: Every company has software on its laptops that everyone forgot about. some of it still asks a stranger's website what to install next. This is the daily DefSec brief for Monday, October 26, 2026. Last week was a rough one with PHP to shell, node to shell, and a certificate authority with a signing key that was literally the number four. If you spent the weekend patching, I hope you got some sleep. If you only do one thing today, Take your firewall and VPN admin logins off the internet. 1. Attackers are getting into Fortigate firewalls by guessing the admin password. The attackers tried passwords like admin and Fortigate on firewalls with their admin logins open to the internet. Then downloaded each firewall's config and decrypted the secrets stored inside. Forta OS encrypts those secrets with a built-in default key unless you set your own. So the configs gave up the active directory accounts the firewalls log in with. take your Fortinet admin logins off the internet. If a config may have left, change every directory account stored in it. Apparently Fortigate is still a popular password for a FortIgate. Number two, a text file in a developer's downloads folder told an AI coding agent to install malware. And the agent tried. It was caught on a real customer's machine before the package ran. The file was called agents.md. In the researchers tests, OpenAI's codex Followed the planted file more than nine times in ten. A planted claw.md got clawed code to leak its login token about half the time. Start coding agents in a project folder, never in downloads. The downloads folder has never been a good place to take advice from. Three, an update on a flaw from last week. And exploit code is public, but no attacks are reported. Node.js fixed the code execution bug and how it unpacked brotli compressed data. It turns out the bug is in Google's brotli decoder itself. Software in Python, .NET, PHP, and Ruby has the same decoder, and fixes are landing for all of them. The public exploits reportedly run code only on deliberately weakened builds. Fix and patch every copy of the Bratley decoder, starting with your Python packages and container images. Four. No attacks yet, but HPE has fixed 33 critical flaws in Aruba OS. That's the software behind its wireless controllers, gateways, and access points. Eight are rated 10 out of 10, and some need nothing but network access. Upgrade Aruba OS and keep its management interfaces and UDP port 8211 off untrusted networks. 5. Exploit code is public for a flaw in Pillow, the Python imaging library under many upload forms and thumbnail tools. Pillow hands an EPS image's file name straight into Go script, which can read it as instructions. An attacker who controls that name and one more file can run commands on the server. Upgrade Pillow in every Python project and stop building stored file names from what users upload. For once the picture is harmless and its file name isn't. Six, an update on last week's PHP to shell flaws, and unverified exploit code is out for a third one. PHP shipped emergency fixes for the first two critical flaws on october twenty first. Two days later, PHP disclosed a third flaw in session upload progress that those fixes leave open. It only works when an app switches its session format while running, and PHP calls that unlikely. Keep session upload progress turned off in your PHP settings until the next release. Seven, no fix yet, but a researcher showed one hacked device on a tailscale network can get root on other servers it's allowed to SSH into. It works where Tailscale SSH allows forwarding because Tailscale's own service does the forwarding as root. Instead of a key or a password, Tailscale SSH trusts the device. Narrow your Tailscale SSH rules to named users and servers and turn off forwarding where you can. Eight. Windows Server 2016 gets its last security update on January twelfth. Paid extended updates exist for Standard and Data Center through Azure Arc. Inventory your Windows Server 2016 machines this week. Start with the ones in the closet that runs something important. Nine, no attacks are reported on this one yet. An updater from a forgotten copy of the pirated movie app Popcorn Time was still running on millions of computers. From web addresses its owner had let expired, it would download and run unsigned programs. iSecurity registered 15 of those addresses and used the updater to switch itself off. They saw machines on corporate, government, and military networks. Someone else registered one of the remaining addresses on October 19th And public records don't say who. So far it points nowhere. Search endpoints for Popcorn Times Updater and DNS logs for its update domains. Remove it wherever it turns up. To be fair to the app, it was very diligent about updates. Once more, take your firewall and VPN admin logins off the internet. Thanks for watching, the sources are in the show notes. If the show helps, like and subscribe, and share the show with a friend who use it. We'll be back again tomorrow.