Latest / Daily DefSec Brief / Cyber Security News for August 10 2026 - Daily DefSec Brief
Transcript
- Jerry: cappy Monday. There's a critical progress loadmaster command injection flawed that is now under active exploitation and eleven more stories this morning. This is the Daily Death Sec Brief. I'm Jerry Bell, the day's security news in five minutes for Monday, August 10th, 2026. one attackers poisoned a remote promotional feed that BD themes WordPress plugins pull from. Pushing account takeover, web shells, and backdoors without ever touching the official WordPress.org source. Deactivate the effective plugins now, check your admin accounts for files and web shells, and watch for the team's updates. two. A pair of malicious Solidarity Pro extensions ran a full stealer grabbing browser profiles, Crypto wallet source control tokens, API tokens, and SSH keys. Remove them, rotate anything that could have been touched, and audit developer machines for the beginning. Three, Atlassian fixed a one-click prompt injection bug in Rovo called Rovo Blast that pre-filled Rovo chat with attacker instructions and exfiltrated data from Jira, confluence, and connected services with no user approval. Confirm the server side fixes live on your tenant and audit rovo activity for unexpected data access. For Kimsuki is running a campaign called Operation Git Power using local LLMs for polished lures in GitHub for command and control to drop async ret behind a decoy PDF. Block an alert on LNK files that launch PowerShell and hunt for GitHub-based C2 traffic. Five. Another campaign chains VBS and PowerShell to stage a hidden payload for remote control and data theft rotating across several DuckDNS hosts. Alert on VBS spawning PowerShell and monitor DuckDNS lookups coming from your endpoints. 6. Ransomware crew spent a month going after mid-level IT managers, not executives, because a manager's account opens the door to contracts, payments, and records, and their title makes fraudulent requests look credible. Extend phishing resistant MFA and Titan monitoring to managers and IT staff and watch privileged accounts for unusual data collection. 7. GitHub's Dependabot malware alerts now cover eight package ecosystems, adding PyPy, Maven, RubyGems, NuGet, Go, Crates.io, and Composer alongside MPM. Turn the alerts on to get Typosquat, Dependency Confusion, and Takeover coverage across all of them. eight. Elastic found a clawed code session on a dev machine that spawned reverse shells, sent login details to temporary public addresses, and created launch agent entries that survive a restart. Monitor your code agent processes for shells and tunneling tools. This could have been legitimate automation or abuse, so go verify that rather than assume. Nine. Speaking of Claude Code, starting August fourteenth, Anthropic makes AI driven auto mode, the default for new sessions on Pro, Macs, and Teams. They say human review caught just 13.6% of dangerous commands versus 89% for auto mode. But admins should decide whether to keep a human in the loop before that default flips and judge the classifier against your own risk tolerance. ten. CirtaPL reports a second purely destructive attack on Poland's energy sector with Russia-linked sandworm pivoting through a private APN to reach ICS networks. OT operators should audit private APN and cellular pivot paths into ICS and segment safety monitoring systems from external comms. 11. Python's PyCal library now implements NIST's post quantum primitives. ML-CHEM for key establishment and ML dash DSA for signatures. It's one pip install away. No emergency here, but start planning crypto agility now so a future migration isn't a scramble. twelve in the one I opened with. There's an unauthenticated command injection flaw in progress loadmaster appliances and it's being exploited in the wild and CISA has added it to the Kev list with more than a hundred thousand deployments out there patched to the fixed release per progress's advisory now And if you can't, restrict management and API access to trusted IPs and review your appliance logs for anomalous command activity. That's the board for today. Thanks for watching. All the sources are linked in the show notes below. If the show's useful, please like and subscribe and pass it on to someone who'd get something out of it. Back again tomorrow.