Latest / Daily DefSec Brief / Cyber Security News for August 25 2026 - Daily DefSec Brief
Transcript
- Jerry: It's time to pull the Oracle HTTP and WebLogics patches from January off the risk register and get them installed. This is the Daily DevSec Brief. I'm Jerry Bell, the Day Security News in five minutes for Tuesday, August 25th, 2026. 10 items on the board today. One, there's an improper access control flow on Oracle HTTP server and WebLogic's proxy plugin that hands an attacker read, write, and delete access to whatever's behind the proxy. And it's being exploited now. And by the way, patches came out for this back in January. Two, Key Cloak has a weak password recovery mechanism that lets an unauthenticated attacker force a reset and take over any account. Fixes are out. There's no public exploit yet, so you've got a little bit of a head start on this one. three. A researcher publicly disclosed five flaws in Palo Alto's global protect VPN and endpoint agent after coordinated reporting. Check the Palo Alto advisory for the fixed versions that apply to you and restrict management exposure while you're in there. four. Three high severity command injection bugs and TP link archer routers let a nearby attacker run commands as root and own the device. Check the advisory and firmware on the BE eight hundred, BE thirty six hundred and the AX seventy five. I guess this is super handy if you lost the admin password. Five. A new loader called Wordless Loader rebuilds its payload out of lists of common English words to slip past detection, then drops the Amateur info stealer through clickfix lures. Hunt for clickfix execution chains and block known amateur indicators. Six, a financially motivated actor is sending document share lures from compromised Notion accounts, which means they pass DKIM, SPF, and DMARC cleanly, then use device code phishing to grab tokens. Treat unexpected Notion Share emails as suspect, tightly scope your device code off flows and hunt for odd token grants. seven. A campaign running since March is pushing wallet lookalike Firefox add-ons, including one that spells OKX with a zero to steal seed phrases and browser passwords. Audit your installed extensions, pull the lookalikes and warn users about the zero versus letter trick. Eight. Fake Microsoft branded scan sites are telling users that Windows blocks third-party antivirus, then walking them through uninstalling it ahead of a refund and remote access scam. tell your users Windows does no such thing, block the sys scan style domains, and lock down who can uninstall your AV. 9. TikTok phishing pages are running the usual suspension and copyright strike lures to fake login pages that also capture one-time codes. Warn the people who manage your brand accounts, verify any account notice inside the app and treat an MFA code prompt on a login page as a red flag. ten. OWASP put out an agentix skills top ten and the headline is that a skill.md file is prose your agent discovers, loads, and obeys at install time, sitting outside both package security and prompt injection defenses. Bet and signs skill files before an agent loads them and treats skill at MD as untrusted executable content because that's what it is. That's the board for today. All the sources are linked in the show notes. If this was useful, give us a like and subscribe and pass it on to someone who'd use it. Thanks for watching and I'll see you again tomorrow.