Latest / Daily DefSec Brief / Cyber Security News for September 14 2026 - Daily DefSec Brief
Transcript
- Jerry: If your GitLab server is self-managed, it got a patch on Thursday. By Friday, someone was working through the internet looking for the ones that hadn't applied it yet. This is the daily DevStack brief for Monday, September 14th, 2026. One, anyone who can reach a self-managed GitLab server can read any file on the disk in a single request to the commits API with no account at all. It's being scanned for right now, and the fix is out. So patch today, then search your logs for post requests to the commit endpoint with a file path parameter. Rotate whatever secrets were in the files held there. Two, ConnectWise has shipped a patch for a screen connect flaw that lets files be transferred and run through an active remote session with nobody confirming anything. It's been exploited since the twentieth of August with no fix until now. Cloud instances were patched automatically. On premise has to be upgraded by hand, and I make that today's job rather than this week's. you can't update, turn off the transfer files permission. I do wonder if all the initial access brokers that use Screen Connect keep their installs up to date too. 3. On self-hosted Artifactory, an unauthenticated request pulls back an internal anonymous user token, even with anonymous access turned off. Second flaw trades that token up for an administrator one because the server only checks who signed it, never what it's allowed to do. Attackers went from first request to To new admin account in under five minutes and left a rust backdoor. Patch, then audit your admin accounts. Four. Metasploit's latest release adds 16 modules and five target flaws CISA already lists as exploited. Cisco's Firewall Manager, SonicWall's SMA 1000, Team City, Paper Cut, and Langflow. Four of those five have been on the show in the past six weeks. If you deferred any of them, the skill required just dropped to typing a module name. And as a reminder, the lazy agentic AI hacker kids just got some new powers. Five, a plus customer with nothing but FTP access can win a race during a subscription restore. Point a Simlick somewhere else and end up owning the files anywhere on the server. Restores run with elevated privileges, so that lands as root. It's Linux only, the fix is out. So go apply it. And by the way, plus instances are typically by design multi-tenant. Six. Anyone who can reach a Dell object scale system can run code on it without logging in because it trusts data it shouldn't. And in an object store, that's the data, the config, and somewhere to hide. Nobody is exploiting it yet. Upgrade and check who can reach the management interface. Seven, Microsoft 365's direct send lets a printer email your staff with no account at all. Attackers connect straight to the tenants exchange online endpoints, and nearly 30,000 phishing emails came through that way over July and August. Looking like HR or accounting. work out which printers need it, then set reject direct send to true. Eight. Twenty-nine organizations picked up a remote access Trojan over two days in July because somebody searched for the Claude desktop app, clicked a sponsored ad, and landed on Claude.ai itself. Certificate and all. The page was an artifact an attacker had published using Claude rather than the Claude download page. The Fake Page predictably forwarded them to a fake download. Filter and share artifact links on AI vendors domains is user content. Nine, Revolute got a request for customer information from an unauthorized account on a real government agency's email domain. The checks passed, so it was fulfilled. Passports, verification, selfies, I bands, full transaction histories, everything. Remember that a passing SPF check tells you about the domain and nothing about the authority. Call the agency back on a number you looked up yourself. 10. One actor ran a pipeline across 10 EC2 workers, downloading 1.8 million Android apps and scanning them for hard-coded secrets. By the way, that pipeline and a matching one for GitHub tokens drove most of this actor's confirmed breaches. If you ship a mobile app, scan your own builds and rotate whatever turns up. eleven. Florida's driver database was breached using one police officer's credentials conveniently stored on that officer's personal device. Go find every partner and contractor with standing log on to your systems and send them a vendor management spreadsheet or something. 12. A crafted repository can send the powers registry in AWS's Kiro IDE at someone else's endpoint, and your workspace data goes with it. Kiro shows you the edit and asks, but it writes the file first. So opening that panel before you answer sends the data anyway. Upgrade and rotate the credentials in any project you opened on an older build. thirteen. If you've turned Copilot loose on your Microsoft three hundred sixty five tenant, you're in the three quarters of users who have, but you're probably also in the half that skipped the permissions review. It surfaces content using the permissions already there, so go review them. Fourteen. Across two and a half million phishing simulations, the people who clicked most were tech and IT staff at thirty percent. Put your own departments in the test and report per team instead of one company number. My intuition is that this has as much to do about who the adversaries are targeting as anything. fifteen in May RubyGems suspended new signups because somebody flooded it with malicious packages. Researchers published on Friday that the somebody was a swarm of OpenAI agents, of course, using the registry's own build system to get code execution on RubyDocs servers. It took four months for anyone to work that out. If you mirror RubyGems, check what you pulled on the second week of May. If you do only one thing today, upgrade self managed GitLab. Thanks for watching. Sources are in the show notes. Like, subscribe and share the show with a friend. Back again tomorrow.