Latest / Daily DefSec Brief / HTTP2Shell flaw exploited, stolen GitHub tokens, Magento PolyShell | Cyber Security News Oct 28
Transcript
- Jerry: AI budgets are hard enough to justify. Somebody has a plan to make you pay for theirs. This is the daily DefSec Brief for Wednesday, october twenty eighth, twenty twenty six. If you do only one thing today, patch every service that decompresses Bratley. One, An update on a story we covered on Monday. Google's Brotly decoder has a flaw that can corrupt memory when it unpacks data from the internet. Cisa now lists it as exploited. No indicators have been published. Runtimes from Node.js to.NET bundle the decoder. The fix went into Bratly's own code in February and was released last week. Patch every service that decompresses brotli, including copies and container images. Two, attackers are using stolen GitHub tokens to pull secrets out of private repositories. They push a workflow to a new branch named CISync, and that workflow prints the repository secrets into its build log. GitHub holds these runs for approval on public repos. Private repos and GitHub enterprise servers run them anyway. Search your GitHub organizations for CISync branches, and if you find one, rotate every secret that repository could read. 3. CISA now lists a Magento flaw called Polychell as exploited. It lets an attacker upload a file that runs as code on Adobe Commerce and Magento stores. In March, One group used it to plant a hidden JavaScript loader on 471 stores in an hour. That loader is now on more than 900 stores and it hides itself from security scanners. Adobe Spix has been out since July. Patch Magento and audit its admin accounts. Four. Apple's October updates fixed just over three hundred flaws, and Apple says one of them was already exploited in a targeted attack. That one is a core graphics flaw Apple fixed for newer iPhones a month ago. This release brings the same fix to iPhones still running iOS eighteen. If you still allow iOS eighteen on your phones, push this update. Better yet, require your mobile devices to run supported operating systems. Five, attackers turn the analytics script on a Brazilian store platform into a card skimmer. It ran on every merchant's checkout page. It sent card numbers and CVEs to the attackers. Sansex suspects the way in was the platform's own Plausible Analytics server, still missing a fix from May. Analytics is supposed to count visitors, this one counted their cards. If you self-host Plausible, it needs that May update. List every script your checkout page loads. Six. In September and October, through a camera management program, attackers got onto business PCs. Huntress believes the program itself was compromised. It couldn't find logs showing how. Camera software tends to get installed once by whoever set up the cameras, then it's forgotten. Find the camera management software on your PCs and give it an owner. Seven. No attacks reported yet, but Veeam fixed a critical flaw in backup and replication 13. Veeam says anyone who can reach one of its servers can bypass authorization there under a condition it hasn't spelled out. Veeam also fixed a flaw in backup for Microsoft 365 that crosses between tenants. Ransomware Crews used Veeam flaw within weeks of its fix in September 2024. Upgrade both and keep the backup server off the internet and out of your main Active Directory domain. Eight. No attacks yet, but Chrome has a new update with fifty two security fixes for them critical. Google credits AI tools from Anthropic and OpenAI on 10 of this update's 52 fixes. Push the Chrome update and forced the restart. 9. Another update on a story from Monday. A researcher showed that one hacked device on a Tailscale network could get root on other servers through Tailscale SSH. Tailscale shipped a fix for its built-in SSH server today, two days after it published its security bulletins. If you run your own headscale server, upgrade the nodes too because headscale can't switch off forwarding. Upgrade Tailscale on any server that runs Tailscale SSH. 10. No attacks yet, but one crafted packet can hang the machine while it boots from the network. An attacker who knows the machine's firmware can run code instead. The flaw is in reference code that most UEFI firmware is built on in a public code change in September, months before the planned January disclosure, It's fix appeared. turn off network boot where it's unused. eleven. Japan's GMO internet told customers of its hosted Windows desktops to back up their own PCs and unplug them after a breach. Attackers have put malicious programs on some customer servers and threatened ransomware. GMO hasn't said how they got in or how far they reached. A remote desktop session can open your local drives to the machine on the other end. Turn off drive sharing on remote desktop sessions to machines you don't run. Twelve. Symantec reported last week that its honeypot caught an attacker's instructions for a new AI agent. In what its authors call Skynet mode, the agent runs up to a hundred thousand steps unattended. The victim's model does the thinking and the victim pays for every step. Symantec has no evidence it has broken into anyone yet. Require authentication on every AI model endpoint and alert on unusual spend. Finally, an AI project with a clear return on investment. Just not for you. Once more, patch Bratley wherever it lives. Thanks for watching. Sources are in the show notes. Like, subscribe and share the show with a friend who'd use it. I'm Jerry Bell and I'll be back again tomorrow.