Latest / Daily DefSec Brief / NetScaler root takeover, Siemens app in ClickFix, Plex hijacks | Cyber Security News Oct 20
Transcript
- Jerry: When a login fails, it's natural to assume you've fat-fingered the password. A fake download site is counting on that. This is the daily DefSec brief for Tuesday, October 20th, 2026. 1. An update on the Netscaler flaw that attackers use to crash appliances earlier this month. Rapid 7 found that the crash is one step in a root takeover. Attackers put a command in the login username. Then crash the box. When it reboots, the crash handler runs that command as root. From there, they tried to copy their implant to the HA partner as well as mapped active directory and vCenter. They also stole the configuration and its private keys. If your Netscaler was exposed, check both nodes of the pair. Rotate the keys and the password stored on them too. This makes four Netscaler stories since late September. Number two, Attackers running clickfix lures now bring their own copy of a Siemens program to run their malware. The program is Siemens Software Center. The copy they bring, the current version at the time, loads whatever DLL sits in its folder. The program carries a real Siemens signature. Any system that runs the lure is exposed, whether or not it normally runs Siemens Software. Alert on Siemens Software Center running from a user's AppData folder. Three, Canada's Cybersecurity Center, citing public reports, says attackers are exploiting a Redis flaw in the Restore command. Any client allowed to run restore can send data that corrupts memory and may run code on the server. The first fix left the second way through the same command. Block restore in your Redis access rules for every user that doesn't need it, and limit access to authorized endpoints only, not the entire internet. Turns out Restore will restore just about anything, including someone else's code. 4. This one is for all my eyepatch wearing hook-handed InfoSec friends. Attackers started exploiting Plex Media Server a day after a researcher published an exploit chain called Plex to Shell. They're installing crypto miners and residential proxy software. Many Plex servers sit on home connections. The researcher who caught the attacks noted what that's worth to attackers. A home address to try corporate VPN and email logins from. Update Plex, the fix has been out since August. Five, For 11 hours last week, Rank Math Pro downloads from the vendor's own website, included a WordPress backdoor. The backdoor rebuilds itself whenever someone visits the site. Installing the clean version leaves behind any admins and files it planted. If a site installed and activated that copy, restore a backup before October 15th and change every password it holds. That's two WordPress backdoors and two shows. WordPress itself has been going through a lot lately, but the riskiest aspect remains the plugin ecosystem. Six, Attackers got into an old open code system and exposed the AI provider keys some customers stored in its team console. Users reported charges of up to $1,700 overnight. Google suspended some of their projects for abuse. If you stored keys there, rotate them. Don't rely on your credit card company to be your IDS. Seven, an update on a story we covered last week. Earlier this month, a crew called Ghost Action used hijacked maintainer accounts to publish a credential stealing workflow into GitHub repositories. GitHub started blocking that workflow on October 9th. The crew has also phished at least one maintainer with a fake GitHub login alert. That alert's sign-in page quietly approves an access token for the attacker. In ninety four repositories, they also planted a VS Code task that runs a stealer when the folder is opened. Turn off automatic tasks in VS Code. With automatic tasks on, opening the folder is all it takes. Side note, this is a good awareness training topic for your developers. Eight, No attacks yet, but exploit details are public for an Archibus flaw that skips the login and runs code. Archibus manages buildings, assets, and room booking. In 2023, Eptura said 40% of the Fortune 500 used it. Its database holds passwords and secrets. Upgrade Archibus lest someone steal your conference room booking. Nine, an MSP admin mistyped a Bing search for the Watchguard VPN client. The result they clicked on was a fake WatchGuard site. It asked for the VPN server username and password. It rejected the first try. after the second try, it sent the real signed client from WatchGuard's own servers. Anyone who finishes both tries hands over a working login and their security tools see a clean installer. Give your staff a bookmark link to the real download. Sometimes it pays to fat finger your password the first time around. Thanks for watching. You'll find sources in the show notes. If the show helps, like it, subscribe, and share it with a friend who'd use it. We'll be back again tomorrow.