Latest / Daily DefSec Brief / Cyber Security News for September 18 2026 - Daily DefSec Brief
Transcript
- Jerry: We have a second exploited Cisco Zero day this week, and this one is a 10 out of 10. At least it's Friday, so you can push that patch right before you leave for the weekend. This is the daily DevStack brief for Friday, September 18th, 2026. One, anyone who can reach a Cisco ISE appliance can send a crafted API request and come back with administrative access because that endpoint doesn't require authentication. It was being exploited before Cisco disclosed it. Upgrade to the patch for your train. Read the access.log on every node for names you don't recognize. If you find one, Cisco's advice is to re-image that node. Two, somebody stole a Cloudflare API key that Brevo had hard-coded into its own source, then used it to rewrite content at the CDN edge for five and a half hours on the 14th. That put clickfix paste prompts in Brevo's sites and into the scripts customers embedded on theirs. Four, anyone who can reach a checkpoint management server can run code on it as root by sending a login request with a very long username. The login handler overflows its stack before anyone authenticates. That box holds your firewall policy, by the way. Patch through Live Patch if automatic updates are off, and limit trusted clients to only the hosts that need smart console access. Five, somebody is setting up video calls with Rust maintainers about a job or contract and talking them into installing a missing audio codec or running something off their clipboard. It worked on the ArrayRef crate last month. If you can push a package release, treat an unexpected call that ends in an install or a paste as an attack. Six, code running inside a Docker sandbox on a Mac can swap a parent directory for a simlink and walk out with a shared project folder, Rewriting anything the host account can touch. Upgrade to 0.42.0 out since the seventeenth. seven. An attacker who controls a DNS zone and gets your resolver to look it up and crash it and possibly run code on it because Unbound's DNS Sec validator overflows the heap while it digests DNS keys. Every release before 1.26.1 is affected. Upgrade to that, which shipped the same day and closes eight more flaws including a heap corruption in CNAME synthesis that Anthropic reported. Eight, an unauthenticated attacker can drop Bind's name D process by sending one DNS over HTTPS request with a cryptographically invalid SIG Zero record and then closing the connection early. It is one out of seven remote denial service flaws in the same release. Upgrade to the latest. That is both major open source resolvers affected in one week. Nine, an Android family called Rat Hat abuses accessibility permissions to switch on developer options and wireless debugging, which opens up all manner of badness. Block sideloading on managed devices and alert when developer options comes on. A managed phone should never do that by itself. 10. Spain's data protection agency has taken its first breach notification for an attack run by an AI agent. It got in on loose credentials and hunted the application for flaws by itself, which will let its operator change personal data and reach the invoices. Make sure your incident response planes are ready for this sort of thing. eleven. Across about eighty two thousand MCP server configuration files in public GitHub repositories, twelve percent of the credential sluts held a real secret rather than a reference to one. Search your repositories for the config file names your coding agents use and rotate whatever comes back. If you do only one thing today, upgrade ISC to the patch for your train and grep access.log on every node for usernames you don't recognize. That's the daily DefSec brief for today. I'm Jerry Bell. Thanks for watching. Sources are in the show notes. Like, subscribe and share with a friend back on Monday.