Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 14 2026
Transcript
- Jerry: CISA just put an 18-year-old Cisco bug on the exploited list. And if you run federal, the clock on it is in two days. This is the daily DefSec Brief. I'm Jerry Bell. Your few minutes on what defenders need to know for today, July 14th, 2026. up, CISA formally added a Cisco iOS cross-site forgery request flaw to the known exploited vulnerabilities catalog. This bug lets an attacker run arbitrary commands by sending a crafted request to the device's web interface, and it affects iOS 12.4 devices ⁓ that interface reachable. Now here's why I'm bringing it up. This CVE is from 2008. It's active in the wild and it's cited alongside another older Cisco bug in Monday's joint advisory about the Russian FSB Center 16 targeting routers. So this isn't exactly novel, but people are still getting hit with it. Federal agencies patch or mitigate by July 16th. Everyone else get that web management interface off the internet. Restrict it to trusted management networks only. And follow the binding operational 26-04 guidance if you can't patch. Yet another example of why internet facing management interfaces shouldn't be exposed to the internet. Also. Unlike diamonds, Cisco's aren't forever. Maybe replace them occasionally. Next up, a piece of research from Microsoft. They tracked campaigns from mid 2025 to mid 2026 abusing OAuth trust relationships against Salesforce and other SaaS platforms. There's no CVE here because there's nothing to patch. This abuses legitimate trust. The way it works is three access paths. They vish someone into approving a malicious OAuth consent request, or they compromise a trusted integration like SalesLoft or GainSite, or they abuse a misconfigured guest access. Once they're in through any of those, they inherit real user or app privileges and can query your CRM data without tripping the normal sign in monitoring. That's the part that concerns me because if you're watching for bad logins, this doesn't look like a bad login. It looks like a trusted app doing trusted app things. So the takeaway is to go audit and revoke OAuth grants that are unused or too broad. Review your guest access configuration and start watching for CRM queries coming from integrations rather than direct logins. Microsoft said it worked with Salesforce on new detection and governance tooling for this. ⁓ So that's worth a look too. Alright, moving on to SAP. If you run SAP, this is your top patch this Tuesday. SAP's July patch day fixed a memory corruption bug in the Netweaver application server ABAP kernel. An attacker can use it to alter how a program runs, pull sensitive data, or just crash your services. It's tracked as CVE 2026-44747 and it's a 9.9. It hits multiple SAP kernel versions running Netweaver Application Server ABAP. The good news is, if you can call it that, is that this one's theoretical right now. There are no in the wild reports yet per SAP and cybersecurity news. So pull the July notes from the SAP support portal and prioritize the systems affected by this one first. There are a few other notes in the same batch, so check which ones are apply to your kernel version while you're in there. story comes from Cybersecurity News and it's about ServiceNow. There's an unauthenticated code execution bug in a platform a lot of you run, and that combination makes it a same-day check. It's a sandbox escape in ServiceNow's AI platform that lets an attacker bypass platform restrictions and run code with no authentication required. It affects both hosted and self-hosted deployments. It's tracked to CVE 2026-6875. Like the SAP bug. This one's theoretical for now. No confirmed active exploitation yet. Per service now's disclosure. But the lack of an authentication requirement is what moves this up on the list for me. So confirm the fixes applied on your hosted instances and push the update on self-hosted deployments now. I wouldn't wait on this one. Before we wrap a few quick ones, Google and Microsoft pulled Modheader browser extension, which had 1.6 million installs after researchers found a dormant browser history collector built into the signed version. So if your users have it, remove it and check for signs the collector activated. CISA's own postmortem showed a contractor left AWS GovCloud admin keys and plain text credentials in a public GitHub repo for almost six months, which is a good reminder to audit your public repos for exposed secrets on a recurring schedule, not just once. Researchers found 148 NPM packages disguised as school Wi-Fi bypass tools that turned visiting browsers into a DDoS botnet for about two weeks in May. So consider blocking untrusted browser plugins. And there's a new phishing as a service kit called Forge 365 running device code phishing and session theft against Microsoft 365 for about $400 a month. so watch for anomalous device code sign inflows and block its known redirect infrastructure. That's the brief. Thanks for watching. The sources are all in the show notes. If this was useful, like and subscribe and pass it along to a friend who'd use it. I'm Jerry Bell and I'll see you again tomorrow.