Latest / Daily DefSec Brief / Cyber Security News for August 26 2026 - Daily DefSec Brief
Transcript
- Jerry: Gidea is being exploited today, and if that's where you do your thing, it's time to update. This is the daily DefSec Brief. I'm Jerry Bell with today's security news in five minutes for Wednesday, August 26, 2026. 14 items on the board today. One, there's a code injection flaw in self-hosted Gidea where a user with repo write access can plant a git hook through the diff patch API and run shell commands. In default installs, let anyone register to reach it. It's being exploited now, so patch it today, disable self-registration, and hunt for unexpected git hooks. Two, SonicWall's NetExtender Linux client has a critical path traversal bug that lets an attacker write files as root. And there's a public proof of concept. Updates are out. 3. Chrome 152 ships 327 security fixes, 10 of them critical, and 299 were found internally with AI. Update the Chrome 152 and confirm your managed fleets are actually rolling. 4. NVIDIA's Nemo Claw exposes the local OLAMA API to browser attack. So a malicious web page can poison your local model's chat template and persistently corrupt any agents using it. Updates are out for Mac OS and Linux. On Windows and WSL, there is no fix. 5. Siemens Semantic IoT 2050 Advanced has an unauthenticated remote code execution flaw in its node-red interface that runs code with maximum privileges. Update the firmware per semen's advisory and restrict access to that interface because we've seen what happens when you don't. Six, a commercial phishing kit called Mirage2FA abuses legitimate Microsoft 365 flows to steal passwords and session cookies, hijacking authenticated sessions across SSO connected services. it's active now against about 4,500 organizations. Make sure you're enforcing phishing resistant MFA, shorten session lifetimes, and hunt for anomalous cookie reuse and OAuth grants. Seven. Two dozen MPM packages carry fake Cloudflare capture pages, and installing them doesn't infect you. Attackers are just using the registry and mirrors like UNPKG is free hosting for phishing redirects. You get to be both the victim and the problem with this one. Eight. Iran linked operators are running a backdoor called Dindor through the trusted Deno runtime so it blends into legitimate developer tooling. Seen as a later stage payload against US software targets. Watch for unexpected dental execution and encoded script launches on your developer and server hosts. 9. A backdoor called Sleepwalker poses as dpapi.dll, sideloads into the ESET management agent, and sits completely inert with no outbound traffic until a crafted packet wakes it up. Your connection watching tooling probably won't catch it, so hunt for a rogue dpapi.dll sitting next to the agent executable. 10. Researchers found 28,000 publicly reachable.get directories leaking API keys, bank details, and employee files. Block web access to.git, scan your own external footprint and rotate any keys that were reachable, and also probably tell your web team to not do that anymore. eleven a phishing operation across forty six countries uses signed legitimate RMM software to hand attackers direct control while blending into normal IT activity. Alert on any RMM installs you didn't deploy and keep an allow list of the remote access tools you actually approve of. 12. The Merimo Notebook app has a code injection flaw that runs an attacker's MCP command as a local subprocess the moment you open a crafted notebook in edit mode. Update to the latest and don't open untrusted notebooks in edit mode. This one's EPSS is sitting at the top of the scale, so don't sleep on it. 13. AWS StransAgen has a flaw in its Python REPL tool where prompt input can bypass the human consent gate and run arbitrary python on the agent's host. That is amazing. Upgrade strands agents tools to the latest. 14. Scammers are posing as employers on Indeed and telling candidates to siload an interview app that's actually Android spyware. Block siloaded APKs through your MDM and tell your staff plainly that no real interview requires installing an app from a link and perhaps don't treat your employees like crap so they don't want to leave. That's the board for today. All the sources are in the show notes. If the show is useful to you, like it, subscribe, and pass it on to someone who gets some mileage out of it. Thanks for watching, and I'll be back again tomorrow.