Latest / Daily DefSec Brief / Cyber Security News for September 24 2026 - Daily DefSec Brief
Transcript
- Jerry: If there's a round cube webmail server in your estate that hasn't been updated since spring, go find it today before somebody else does. This is the daily Def Sec Brief for Thursday, september twenty fourth, twenty twenty six. One, anyone who can reach a RoundCube webmail server with his Vert UserQuery plugin turned on can tamper with its database before logging in and that's now being exploited. It's tracked as CVE 2026-48842. The fix has been out since May. Two, ransomer crews are now using the Team City flaw that lets anyone run code on the build server without logging in, according to CISA. The fix has been out since late July, so patch it, and if you're set unpatched and reachable through August, check it for intruders before you trust another build from it. Three, somebody sprayed passwords at more than 5,000 Microsoft 365 accounts across 28 tenants and got into seven. And all seven were service accounts with no MFA and a password that had never been changed. They were set up to run something and then left alone. Go find the Microsoft 365 accounts that exist to run a process rather than a person and then lock them down. 4. Code running inside a container on either of the two newest Ubuntu LTS releases can get root on the host itself using system calls that Docker and Kubernetes allow by default. And the exploit is public. The kernel fix landed upstream on august sixth and Ubuntu hasn't shipped it yet. So until it does keep untrusted containers off those hosts, actually you should consider whether you should run untrusted containers at all. Five, an attacker who already has code running on a Windows machine can use a sign Microsoft app host to open the genuine Microsoft sign in page and let the user finish MFA and take the access and refresh tokens it hands back. There's no fake page and no lookalike domain to spot. It only works where app side loading is allowed, so turn that off wherever it isn't needed. Six. Operators linked to North Korea's fake job campaign got two malicious Terraform providers onto HashiCorp's own registry, and one of them, the cruise wenker slash docker, is a letter off from the popular cruise worker provider. Check your Terraform lock files for both names on the slide. Seven, anyone with a cPanel hosting account can run code as root through its calendar and contact service. So on a shared server, any customer can take the whole box. Update cPanel and WP Toolkit. By the way, this is the fourth route from a hosting account to root on these servers since early August. Eight. Foxit September update fixes a batch of bugs where opening a crafted PDF runs code. Plus one in its updater that gives a local user system. Push the Foxit update through whatever deploys your software. Nine of the GitHub app private keys Git Guardian found leaked in public code, nearly 500 still work because those keys never expire and forty four of them can administer an entire organization. Go through the apps installed in your organization and rotate the keys on the ones you built. One key that still works belongs to a test framework that hasn't been maintained in three years. ten. Researchers have found a way to inject code into a new Windows process by hiding it in the startup parameters Windows copies into that process, which skips the memory write calls EDR watches, and it ran with no alerts against four leading EDR products. It needs code already running on the machine though. Ask your EDR vendor whether it catches process parameter poisoning. Eleven. GitLab gives every user a private address for filing issues by email, and anyone who learns it can email it in a patch that lands on main as a commit from you. And also starts CI jobs as you. The token in that address never expires. It comes in every project you can open and GitLab doesn't check who sent the mail. Reset your incoming email token and look for anywhere somebody helpfully posted that address in a README file. GitLab's position, by the way, is that it's a token like any other, which it is, except that most people might not think of an email address as a personal access token. If you only do one thing today, find the forgotten service accounts in Microsoft three hundred sixty five and lock them down. Thanks for watching. Sources are in the show notes. Like, subscribe, and share the show with a friend. Back again tomorrow.