Latest / Daily DefSec Brief / Cyber Security News for September 15 2026 - Daily DefSec Brief
Transcript
- Jerry: Twelve items today. If you only do one thing before your first meeting, upgrade your Cisco email gateways and grep the mail logs. Two of the other 11 have no fix at all. This is the daily DefSec brief for Tuesday, September 15, 2026. 1. Anyone who can send mail to a Cisco secure email gateway can run commands on it as root, and Cisco says it's being exploited actively in attacks. The fix ship with Monday's advisory and Cisco published the hunt with it. Grip your logs for a copy statement that pipes into a program. Shadow Server counts more than four hundred of these appliances on the internet. Run that hunt even after you patch because root meant they could tidy up behind themselves. Two, if your developers have a Vite dev server reachable from the internet, an attacker can append a query parameter to a web request and walk off with the files Vite is supposed to refuse. three, Google's threat intelligence group watched a crew handing a coding chatbot a prompt and a set of instructions, and the agent built and ran a mass credential harvesting campaign in under six hours. They ran the scanning pipeline, fixed their own errors, and rotated infrastructure mid-campaign, shorten the lifetime on your cloud keys, and alert on outbound scanning from your own workloads. Rotation windows measured in days were made for attackers who had to sleep, and that's not where we're at anymore. 4. A hosting customer on a shared server running light speed enterprise can become root on the whole machine Straight through KFS and whatever else was keeping tenants apart. Update it by hand because auto update may lag and Lightspeed's download pages still listing the old build. There's no CVE and no description of how it works. By the way, the advisory covers only the enterprise build. Nobody has said anything about open lightspeed. Five. Apple's annual release patched more than two hundred and sixty flaws across every operating system it ships, none of them listed as exploited. Before you push macOS 27 to a fleet, update your endpoint tooling first. Little snitch, Objective C's and BlockBlock need new builds, and some iPhones show the update is twenty six dot seven when twenty-seven is apparently what it installs. Six. Homebrew shipped seven dot zero dot zero with eight advisories closed. And the one that matters is a cask whose unsigned removal metadata could run commands with sudo. Seven of the eight landed in the 6.0 releases, so an auto-updating machine has them already. The eighth only arrived in seven dot so developer max need the upgrade. Seven, an attacker ran one of Thailand's largest broadband providers through Mesh Central, the free remote management tool, under a device group named after the company. They sprayed credentials across more than 50 internal machines, and hunt.io found the whole thing by looking at the attacker's own server sitting open on the internet. Because of course it was. Hunt for RMM agents that you don't recognize and rotate the credentials on anything you find. Eight, Amazon's temporary elevated access management, the open source sample that grants just in time admin on IIM Identity Center, can give an authenticated user access to accounts they shouldn't be able to access. Upgrade it and patch any fork you made because there's no workaround. Nine, Japan's digital agency lost close to a quarter of a million rows of personal data through a VPN flaw that had a patch. What caught it was the maintenance account suddenly reading files in bulk. Make sure that alert exists on your own service accounts. They went public with the news seventy eight days after they spotted it. ten. September's Office Security Update can make copy and paste autofill and formula dragging fail in Excel. With no beep and no error, the source stays selected and nothing lands. There's no fix yet, and we don't want users trying to uninstall or bypass security checks in Excel. Eleven WordPress now scans every plugin released before it reaches your sites. Nothing to install, so leave auto updates on. The review has already caught a backdoor committed to a plugin with twenty thousand installs. This is good news by the way. 12. Get a few minutes of physical access to a server and a hundred and fifty nine dollar board between the processor and its memory silently drops writes so the chip keeps reading stale encrypted data. That breaks Intel TDX, Intel Scalable SGX, and AMD SCV SNP. There's no patch coming. Intel bonus sign a C V E and AMD says. Physical access is outside its threat model. If your program relies on the cloud operator being unable to read that memory, You probably need to rethink your expectations. If you do only one thing today, upgrade your Cisco email gateways and grep the mail logs for that copy statement. Thanks for watching. Sources are in the show notes. Like, subscribe and share with the show with a friend. Back again tomorrow.