Cyber Security News for September 25 2026 - Daily DefSec Brief
1. One affiliate, four ransomware brands, one toolkit — Do: Hunt for remote access tools you didn't deploy — https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/
2. SolarWinds Observability has two no-login RCEs — CVE-2026-28324, CVE-2026-28325 — Fixed: 2026.2.3 — Do: Upgrade SolarWinds Observability Self-Hosted — https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28324
3. Carbonato botnet hijacks exposed Docker APIs — Do: Take the Docker API off the network —…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.