Latest / Daily DefSec Brief / Cyber Security News for August 17 2026 - Daily DefSec Brief
Transcript
- Jerry: If you run Macs, today's list opens with a screen sharing bug that attackers are using to get root and drop Monero miners. This is the Daily Death Stack Brief. I'm Jerry Bell, the day security news in five minutes for Monday, August 17th, 2026. Twelve items on the board today. 1. There's an authentication bypass in Mac OS screen sharing that lets a network attacker connect over VNC with no valid credentials and then gain route and it's being exploited in the wild to install miners. Patch now and if you can't, turn screen sharing off and make sure port 5900 isn't reachable from the internet. Two, a chained attack on Microsoft SCCM lets an attacker run code on the primary site server, which means the whole managed Windows fleet, and there's a public proof of concept. Check the vendor advisory and restrict and monitor access to that site server. three, RoundCube shipped eleven fixes for its webmail, including a remote code execution flaw plus SSRF, injection, and stored XSS. Update to one dot six dot eighteen or one dot seven dot three. four. Wireshock fixed twenty eight vulnerabilities, the kind of partial crashes that hit you when you're opening a hostile capture. Update it, especially on Analyst Workstations, since opening a hostile capture is the job. Five, a threat actor is selling millions of records apparently pulled from Azure and Entra tenants using leaked credentials, including a 1.7 million record McDonald's dump. And the buyer list of victims reads like a Fortune 500 roster. Rotate exposed credentials, enforce MFA and Entra, and hunt for anomalous directory export activity. 6. A LinkedIn recruiter lure leads to assigned click once technical assessment That installs malware to steal private keys and browser data aimed at crypto and web 3 teams. Treat those assessment apps as hostile, block, click once where you can, and warn your crypto-facing staff about the pattern. 7. An APT 36 linked backdoor called PatchCord is being delivered through a fake Afghan telecom VPN installer and a Go variant uses Google Sheets for command and control. Verify installer providence for your VPN and management tooling and hunt for outbound Google Sheets traffic where it doesn't belong. eight. Flashpoint recorded seven point four million infosteeler infections in the first half of the year, up twenty-seven percent harvesting one point seven billion credentials. Assume the harvested creds are already in circulation enforce MFA and watch SteelerLog Marketplaces for your domains. Nine. Attackers are buying expired domains to inherit their old trust and reputation for malware and command and control, and one actor spent over seven million dollars on ten thousand of them. Don't trust domain age or reputation on its own and watch for recently re-registered domains carrying old backlinks. ten. A self represented litigant hit a prompt inside a July court filing telling any AI that read it to rule in his favor, and a Connecticut judge sanctioned him for it. the defensive version is the same as always. Don't let an LLM act on a document's contents as instructions in strip and sandbox untrusted text before it goes near the model. eleven. Klopp is claiming data theft from GE and Phillips as part of a mass exploitation wave, and Phillips has confirmed a contained breach. the batch points at CVE twenty twenty six twelve five sixty nine, so work out whether you run the software behind it, patch it, and hunt for bulk data exfiltration on your internet facing servers. twelve Microsoft has delayed an exchange update and won't give a new date due to too many AI generated bug reports coming in. Until it lands. Keep an eye on your exchange and track Microsoft's advisory for any revised release dates. That's the board for today. All the sources are linked in the show notes if you want to go deeper. If the show is useful to you, please like it, subscribe, and pass it along to someone who gets something out of it. Thanks for watching, and I'll see you again tomorrow.