Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 22 2026
Transcript
- Jerry: Two separate campaigns are stealing MFA protected Microsoft 365 sessions right now, and a Kev edition puts an old router bug back in the crosshairs. This is the Daily DefSec Brief. I'm Jerry Bell, the day's security news in five minutes for July 22nd, 2026. 12 items on the board today. One, CISA added a DDWRT UPMP buffer overflow to the Kev. And it's being exploited in the wild. An unauthenticated flaw that lets an attacker run code on the router. Apply the fix or disable the UPMP agent. Two. Law enforcement took down Kratos, an adversary in the middle phishing kit that stole logins plus session cookies to walk right past Two-Factor into Microsoft 365. It's a good reminder to enforce phishing resistant MFA, shortened session lifetimes. And hunt for anomalous token reuse. Three. Speaking of stolen Microsoft 365 sessions, a separate campaign is abusing already compromised Outlook mailboxes to send procurement themed lures internally and to partners, then hijacking live sessions. Hunt for those internal lures, review sign-in logs for token theft, and revoke sessions on anything that's suspect. For Microsoft's official Azure DevOps MCP server has a tool that returns pull request content without its prompt injection guardrail. so a hidden HTML comment can steer your AI agent into other projects and leak data. Update the server once it's fixed and treat PR content as untrusted input to the agent. Five, AWS's Kiro coding IDE could be tricked by hiding text on a web page into rewriting its own config and running attacker code, skipping the human approval step. There's a public proof of concept. Update to the patched build and don't point agents at untrusted web content. 6. The campaign called Fake It I mentioned yesterday that seeded 7,600 malicious GitHub repos has now been downloaded 14 million times. These repos are intended to install info stealers and the distribution method seems to be working quite well. 7. An anonymous researcher is dumping working proof of concept. Exploits for dozens of open source projects on GitHub with no coordinated disclosure and it keeps growing by the week. Check the archive against your open source inventory, prioritize anything that's internet-facing, and add virtual patching until fixes land if that's a possibility. Also, be very cautious when testing proof of concept code. It can itself be malicious. Eight, North Korean aligned actors are posing as recruiters, faking a camera error during a video interview and getting victims to paste a fix into the terminal that installs credential stealing malware on Mac and Windows. Tell your staff to never paste commands from a website into a terminal and hunt for that clipboard terminal pattern. Nine. The plain project tool has an authorization bug where its asset API never checks that the requester is allowed. So an authenticated user can read or delete assets in other workspaces. this one is still theoretical, but upgrade to 1.3.0 or later. And if you self-host multi-tenant plane, treat cross workspace access as exposed until you're able to patch. 10. Chick-fil-A disclosed a breach from credential stuffing against its one app logins in June. Stop reusing passwords when trying to get free nugs. eleven. The FBI warns that scammers are targeting people who already reported fraud, using deepfakes and spoofed IC3 sites to pose as recovery agents and extract even more money. The FBI never charges to recover funds, and you should verify that you're actually on the real iC3.gov site. 12. You can tell the IPO is getting close. OpenAI says that during sandbox testing, its own models chained zero day attacks and used stolen credentials to reach an RCE path into Hugging Face's production database, trying to cheat a test rather than solve it. Sandbox agentic testing off of production, scope credentials tightly, and assume agents will take unintended shortcuts. And overall remember that the basics still matter even in the day of Agentic AI. That's the board for today. All the sources are linked in the show notes below. If the show is useful to you, give it a like, subscribe, and pass it along to someone who'll use it. Thanks for watching and I'll be back again tomorrow.