Cyber Security News for September 24 2026 - Daily DefSec Brief

Daily DefSec Brief · Sep 24, 2026 · 4m · transcript

1. Roundcube pre-login SQL injection now exploited — CVE-2026-48842 — Fixed: 1.6.16 or 1.7.1 — Do: Upgrade Roundcube webmail — https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1

2. TeamCity RCE now used in ransomware campaigns — CVE-2026-63077 — Fixed: 2025.11.7 or 2026.1.3 — Do: Patch TeamCity and check it for intruders — https://www.rapid7.com/blog/post/etr-cve-2026-63077-critical-unauthenticated-remote-code-execution-in-jetbrains-teamcity/

3. Spraying hit only forgotten M365 service accounts — Do: Lock down forgotten Microsoft 365 service accounts —…