Latest / Daily DefSec Brief / Cyber Security News for July 30 2026 - Daily DefSec Brief
Transcript
- Jerry: Hard coded password just put Cisco's secure firewall management center in the Kev catalog. and that's before we get to three critical VMR flaws in a couple of pre-auth RCEs. It's a patch heavy day. This is the daily DevSec brief. I'm Jerry Bell, the day's security news in five minutes for Thursday, July 30th, 2026. Sixteen items on the board today. One, there's a hard-coded password in Cisco's secure firewall management center that lets an unauthenticated remote attacker log in with a low privileged account and reach sensitive data. And it's being exploited in the wild. Apply Cisco's hotfixes now per the advisory. Two, same product, separate advisory. There's an authentication bypass in FMC software that lets a network attacker gain unauthorized access, and there's a public proof of concept out for it. Apply the hotfixes and upgrade to the fixed release listed in the advisory. Three, Brockom shipped fixes for three critical VMR flaws. A vCenter auth bypass, a vCenter directory traversal RCE, and an ESXi out of bounds write that lets an attacker escape a VM to the host. Apply the updates now. Four. An active storage flaw in Ruby on Rails, which is what Team City is built on, lets unauthenticated attackers read arbitrary server files through crafted image uploads. And that can expose secrets that lead to code execution. Upgrade to the patched Rails release for your branch, and apps using LibVIPs for image processing are at the highest risk. Five. Hunters tracked a credential stuffing spree that compromised 92 accounts across 30 organizations in 41 hours, hitting internet facing SonicWall VPN and firewall accounts. Enforced MFA, rotate credentials, and hunt for anomalous VPN logins. There's no SonicWall advisory yet, so keep an eye out for that. 6. ESAT found at least 11 defective but signed shims, one of them dating back to 2013, that lets even a novice attacker bypass secure boot through UEFI. Apply the DBX verification updates as they roll out and audit for known bad shims. Seven. Chrome one fifty one patches three hundred and seventy flaws, seven of them critical, including four use after free bugs. Update to Chrome one fifty one and confirm your managed fleet pulls the new build. Eight, there's a JIT bug in Firefox that gives arbitrary code execution just from visiting a malicious page. No interaction is needed and it was used to compromise the Tor browser. Update the Firefox 151 to 0.3 or later and the Tor browser to the latest release. Public exploit material is already out. nine. No.js patched eleven flaws, including two high severity HTTP two memory issues. lets crafted HTTP2 traffic bypass the max session memory limit. Upgrade to the patched release for your branch. 10. GitLab fixed 13 flaws that can leak data, manipulate CI CD pipelines, and crash servers, including a workhore's info disclosure bug reachable at developer access. Upgrade self-managed GitLab immediately. GitLab.com is already patched. 11. Sophos is tracking a group that impersonates IT support over Microsoft Teams, talks employees into granting remote access in about two minutes, then deploys the Chaos ransomware. Restrict external teams messaging, control your remote access tools, and train staff to verify support callers out of band. 12. Oct detailed a crime platform called WorkPanel that bundles target research, caller management, phishing site cloning, and stolen credentials to speed help desk impersonation into full enterprise takeover. Harden your help desk identity verification, enforce phishing resistant MFA, And watch for cloned login pages. thirteen. Amazon linked the September 2025 Debug and Chalk NPM hijack and the March Axios compromise to North Korea's Sapphire Sleet. Debug and Chalk carried more than two billion weekly downloads between them. Pin your dependencies and install cooldowns, which are quickly becoming the default. Fourteen, someone built a prompt injection worm for copilot in Word. Hidden instructions in a source document get executed by copilot and copied into the output so each new document becomes a fresh carrier. Treat externally sourced documents as untrusted in copilot workflows and strip hidden text before AI processing. Fifteen, a Linux crypto mining campaign gets through a trusted third party connection, escalates the roop, and then abuses PAM to hop between low privileged accounts and hide Monero mining. Monitor PAM configuration changes, audit your third party access paths and hunt for XM rig indicators. 16. There's a critical flaw in Roughlow, the AI orchestration tool formerly known as Claude Flow, where an unauthenticated MCP bridge exposed 233 tools, including shell access. Attackers can run commands and corrupt the agent's memory so the bad behavior sticks around even after you patch. Upgrade to 3.16.3 or later restrict the MCP bridge and inspect persistent agent memory for tampering. That's the board for today. Thanks for watching. All the sources are linked in the show notes below. If the show is useful to you, a like and subscribe will help and pass it along to someone on your team who can use it. Back again tomorrow.