Latest / Daily DefSec Brief / Cyber Security News for September 9 2026 - Daily DefSec Brief
Transcript
- Jerry: Many times does the same Defender flaw get to come back before we stop calling it fixed. This is the third bypass since June, and there's still no patch. This is the daily DevSec brief for Wednesday, September 9th, 2026. One, both of the Windows flaws Microsoft says are being exploited, take a local account up the system, one through the Windows update stack and one through advanced local procedure calls. They come in as Part of a record batch of nearly a thousand fixes. Two, Google fixed over 200 bugs in Chrome, one of them an out-of-bounds right in the JavaScript engine that somebody's already exploiting. That's the seventh Chrome Zero Day this year, and the second one in five days. Push the Chrome update today and force the restart. Three, an implant on F5 Big IP APM appliances. Hook Apache and injects a web shell into a copy of the page held in memory so the file on disk stays exactly as F5 shipped it. Comparing those files against known good copies comes back clean and that's the check most people would run. Patch the appliance and then hunt in memory rather than on disk. four. Researchers published a working bypass for the Defender flaw Microsoft fixed last week, and it still gives arbitrary file read as system on fully updated Windows. There's no patch for it. Keep Defender's engine and definitions on automatic and watch for system level file reads you can't account for. Five, an unauthenticated attacker can run commands on SAP systems, read its database credentials and password hashes, and change SAP binaries all through the tracing code in the kernel, and Onapsis counts over ten thousand internet facing SAP systems that could potentially be exposed. Apply the September security notes. Outside facing systems should be first. 6. Affishing campaign routes as victims through Google's own services. A meet redirect, then a search, then a double-click tracking link. So the mail filter sees Google all the way down. Reset credentials for anyone who reaches the final page and hunt for screen connect installs you didn't put there. Vonti patched 10 flaws across neurons for ITSM: Endpoint Manager, Mobile, and Sentry. Two of them give an unauthenticated attacker remote code execution on the ITSM server, and the Sentry one hands over admin access with no login at all. By the way, the cloud ITSM tenants were fixed last month, so this one is a self managed problem. Eight. So this one starts with a fake Google CAPTCHA and ends with a DLL running straight off a web dev share, which means nothing malicious is ever written to the disk. Block outbound web dev at the proxy and alert on any DLL executing from a web dev path. Nine, two new end central flaws chained together so a remote attacker with no credentials can create a system administrator account for themselves. And for an MSP, that is the management plane. Apply the hotfix endable shipped, then look for any undocumented administrators. Ten. In free IPA, a client that has never logged in can create a Kerberos identity of its own choosing and end up in the administrators group. Red Hat has reproduced that on a default install, There is a fix out. eleven. Extortion crews have started stealing AI models, the weights and prompts and the model scripts and the secrets sitting next to them. So put those artifacts in your crown jewel inventory and alert on bulk egress from wherever they live. 12. So there are two VMware bugs that let code inside a guest run on the host. One in the virtual network adapter and one in the host guest file system. You need local admin inside the virtual machine first. There are no workarounds, so update workstation and fusion. thirteen. One instruction planted in a chat GPT conversation made it read the user's connected Gmail and hand the contents to a different account, with nothing about it showing in the reply. OpenAI is close that particular channel, but treat a shared AI conversation as a untrusted input. fourteen an Android Trojan hides its payload in the app package, then scans for debug ports left open and installs itself on whatever answers. Turn off ADB over TCP on your managed Android fleet. Fifteen, where the UEFI shell ships inside Flash, an administrator who can change the boot order can start it and use its memory write commands to turn off the checks secure boot relies on. Cisco has firmware updates out for UCS and set a BIOS password while you're in there. 16. The Army, Air Force, Navy, and Special Operations Commands have all turned off the advertising ID on government phones over concerns that commercially bought location data was being used to target American forces. That is the same ID sitting on your corporate fleet, and the MDM can switch it off. So maybe you should do that too. Seventeen. Bleach bit shipped a fix because its secure delete on Windows was skipping the clusters of fragmented file gets scattered across. So parts of the things you shred may be still on the disk, and you can't reshred the original because you shredded it. So you need to wipe the free space instead. If you do only one thing today, install the September Windows updates because both of those flaws are already being used. Thanks for watching, sources are in the show notes. Like, subscribe, and share with the show with a friend. Back here tomorrow.