Latest / Daily DefSec Brief / Cyber Security News for October 7 2026 - Daily DefSec Brief
Transcript
- Jerry: Your dependency scanner can only warn you about malicious packages that somebody has already reported. Today's last story is about one that went unreported for more than a year. This is the daily DefSec brief for Wednesday, October 7th, 2026. One, the FBI and Secret Service say the Fortibleed campaign is still running. Some victims can be locked out of their own Fortinet firewalls. Attackers login with leaked or reused credentials, add their own admin accounts, and sometimes delete the originals. Reporting indicates access brokers pass that access to ransomware crews, including INC Lynx and payload. A patch doesn't fix a stolen login or other persistence mechanisms, so wipe, re-image, and reset every Fortinet admin and VPN password if your 40s were impacted. 2. Attackers are using poisoned entries In Ninja Forms and WPC product bundles to create hidden WordPress admin accounts. So far in small numbers, anyone can send the poison entry and the script runs the moment an administrator opens it. Ninja Forms is on more than half a million sites. Apparently, the riskiest part of running a contact form is reading what people send you. Update both plugins and hunt for admin accounts the Users screen doesn't show. 3. Attackers broke into the country code registries for Ghana, Sierra Leone, and American Samoa. They changed DNS for selected domains there. That let them pass the certificate authorities checks and get real certificates for several Google domains and other large brands. Whoever controls the registry can pass as the owner. Chrome blocks the known bad certificates, but Google can't promise it found them all. This is a good reminder to monitor the certificate transparency logs for every domain you own. Four, Chrome has a new release that fixes about 250 security flaws four of them critical. That's less of a patch note and more of a rating assignment. release this size usually gives attackers a lot to work with once the details go up. Push the Chrome update and force the relaunch. Five, the FBI says a contractor failed to apply a security patch on a platform managed by a third party. That led to the security breach Shiny Hunters claimed. The FBI has removed the contractor. Ask every contractor that runs a platform for you how it's patched and verify the answer yourself. Six, OpenSSH has a new release that turns off a compression feature. That feature lets an attacker who controls one channel in a connection recover secrets from another channel. It also rejects risky characters and command line usernames. The maintainers say releases will come more often for now because attackers are likely to find the same bugs that AI assisted researchers do. Upgrade open SSH and plan for a shorter patch cycle. Think of it as a subscription you didn't sign up for. Seven, Outlook will block MSIX attachments by default starting early to mid-November. That covers new outlook and outlook on the web in Exchange Online. Attackers abused Windows App Installer links and Microsoft turned those off by default in December of 2023. Now it's blocking the packages themselves. Find out who actually receives these files, question whether it's really necessary, and then allow them only for those mailboxes. 8. A campaign called Mal Fex Had three MPM packages still installable on October 1st. They are function flag, function color, and CDNIMG fetch. Function flag has been malicious since July of 2025 and picked up more than 37,000 downloads. The campaign delivers a remote access Trojan or an information stealer. Search your lock files for those three names. No advisory flagged function flag, so a scanner that waits for one stayed quiet for over a year and strictly speaking, it was right. If you do only one thing today, reset your Fortinet admin and VPN passwords and require MFA if not already set up. Thanks for watching. The sources are in the show notes. if the show helps, like, subscribe and share the show with a friend who'd use it. We're back again tomorrow.