Latest / Daily DefSec Brief / Cyber Security News for August 18 2026 - Daily DefSec Brief
Transcript
- Jerry: Three separate stories on today's board are about attackers letting an AI do the work, and one of them ran nearly an entire ransomware intrusion, So the AI seems to be living up to the hype on the offense side. Thirteen items today, and the machines have opinions now. This is the Daily DefSec Brief. I'm Jerry Bell, the day's security news in five minutes for Tuesday, August eighteenth, twenty twenty six. Thirteen items on the board today. One CISA confirmed ransomwangs are now exploiting a link following privilege escalation in the Windows task host that hands a local user system. The patch has been out since November of last year and somehow we're all freaked out about AI superhackers. two Ray, the distributed compute framework, exposes its job submission endpoints with no authentication and attackers are reaching them through DNS rebinding straight from the browser. three. A GitLab GraphQL flaw lets an unauthenticated attacker modify or delete public projects with a CSRF bug riding alongside it. Patches are out, GitLab.com is already sorted. Four. There's a working proof of concept called certi ghost where a standard domain account can coerce an enterprise CA into issuing itself a valid authentication certificate. Review your CA enrollment permissions and template settings and go hunt for cert issuance that shouldn't have happened. 5. A two-stage chain against Unisoc modem firmware delivers a payload. then places a Volt video call the victim answers to reach the Android kernel. There's no vendor fix and it's worth figuring out if your devices are affected. Six, a ransomware affiliate used Anthropics Cloud Code to breach exposed VPNs, steal LDAP passwords, backdoor those VPNs, and exfiltrate SQL databases across six organizations. Prioritize VPN appliance patching and MFA and hunt for LDAP credentials access and config changes that you didn't make. Seven Zscalers tracking C2 Looper. A new Rust backdoor delivered through a multi-stage clickfix chain that uses GitHub for command and control. Hunt for those clickfix lures and GitHub-based C2 traffic and block those published indicators. eight. Iranian state linked operators have evolved the Cavern framework to use DNS A record responses to switch between direct HTTPS and a rotating Google Apps Script relay. Inspect DNS responses that steer traffic and any Google Apps script relay activity And block the indicators included in the write-up. Nine, Storm O five one has moved past encrypting endpoints to hijacking whole Azure tenants, neutralizing resource locks, immutability policies, and backups before they extort. Alert on changes to any of those and treat those config changes as your early intervention signal. ten. Across three unrelated actors, AI is being used to write malicious code, harvest credentials, and pick out the valuable business data during an intrusion. So assume post compromise triage is much faster now. Titan detection on internal recon and mass file access rather than leaning on just dwell time. Eleven. Microsoft has removed WMIC, a long abused living off the land binary from Windows eleven, twenty-four H two and twenty-five H two. Finally a little bit of good news. Twelve. Rapid7 found an exposed web directory holding a full crypto fraud pipeline. Phishing panels, fake wallets, and telegram XFIL all built with AI assistance. When one model resisted, the operator wrote a custom jailbreak prompt and when that failed, just swapped AI providers. Fold the recover fake wallet and phishing indicators into your blacklist and awareness training. 13. Windows Server 2022 reaches end of mainstream support on October thirteenth. Nothing urgent breaks. Security updates keep coming at no cost through 2031. But if you start the migration now, it might be done before the security updates stop. But probably not. That's the board for today. All the sources are linked in the show notes if you want to dig into any of these. If the show is useful to you, a like and subscribe help and pass it along to someone who gets something out of it. Thanks for watching and I'll be back again tomorrow.