Latest / Daily DefSec Brief / Cyber Security News for August 14 2026 - Daily DefSec Brief
Transcript
- Jerry: Two zero days are getting exploited within hours of disclosure. A net scalar pre-auth RCE and a backdoor now ships with a signed kernel root kit. And to round out the day, the White House hands private firms a license to hack back, so now you get to worry about that too. We made it to another Friday for my friends. This is the Daily Def Sec Brief. I'm Jerry Bell, the day security news in five minutes for Friday, august fourteenth, twenty twenty six. Fifteen items on the board today. One, there's an unauthenticated SQL injection in GeoServer that escalates to remote code execution under Post GIS or Oracle data sources, and it's being exploited within hours of disclosure with no patch yet. Pull management and query access off the public internet. Watch the vendor advisory for a fix and hunt for anomalous SQL against JSON array fields. 2. Researchers have detailed a pre-authentication RCE in Citrix Netscaler ADC and Gateway, which is the SSL VPN edge box that keeps ending up as somebody's initial access. There's a public proof of concept, so patch to the fixed version the moment Citrix ships it. Keep an eye out for this flipping to active exploitation and treat any exposed net scaler as a priority for review. Three, that vCenter Syslog RCE we covered is now a global campaign from a single actor with compromises confirmed at 361 IPs across 47 countries, deploying reverse SSH for persistence. Apply the emergency update, but patching alone won't evict someone already inside. So hunt for reverse SSH persistence and unexpected outbound connections. Four. Honeymite's cool client backdoor now installs a signed kernel mode driver as a Windows service and talks to it over IOCTL to hide itself. Hunt for unexpected signed driver services and IOCTL activity from user mode processes, review your driver allow listing and block the published indicators. Five, the critical Adobe Commerce authorization flaw we covered yesterday is now under active exploitation per SANSEC. Letting attackers switch a customer session over to another customer's account. Apply the August Patch Tuesday fix now if you haven't and check for session switching abuse. six. A Rust-based Mac OS InfoStealer called Amnesia Stealer is spreading through counterfeit GitHub download pages that talk users into pasting a terminal command. Then it adds a stage for interactive browsing control. Keep reminding people about click fix attacks, keep macOS current and hunt for the shell script fetching pattern jamf documented. Seven, a malware family called HackerAI hides its commands and stolen data inside GitHub GIS to blend in with traffic most networks allow. Baseline and monitor your GIST API traffic from your endpoints and block the indicators a cron has published. Eight. A new Windows installer called Eternum stores its instructions in Polygon smart contracts. So there's no single server to seize and it arrives through a fake Dbeaver install among other routes. Alert on endpoint traffic to public blockchain RPC endpoints, watch for evasion checks and block the unit 42 indicators. 9. there's a local attack that rewrites writeable SBD data on some consumer memory modules to fake extra RAM and the resulting aliases bypass VBS and disables defenders. So you can in fact download more RAM and it turns off your antivirus while it's at it. Apply the april twenty twenty six mitigation and where VBS integrity matters prefer modules with SBD write protection. ten. Attackers are harvesting developer AI API keys from phishing stealers and public repos, then reselling that capacity through proxy services. And one campaign ran up nearly a million dollars in charges before anyone noticed. Rotate and scope your AI keys, scan repos, and build systems for exposed secrets and alert on sudden spend spikes. Eleven. A new Mirai variant called Evil Boot has been exploiting unpatched bugs and routers from Alcatel, D Link, Netgear, Tenda, and others for at least a month. I'm glad Fortinet is finding these things and hopefully they can turn some of that energy to fixing the never ending stream of major issues with their own products. twelve. Commercial crypto services are selling repackaged malware that promises to slip past Defender, EDR, and Smart Screen on every delivery. So don't lean on a single detection layer, add behavioral detection, and network hunting for post-execution activity. 13. A criminal AI service called Masaya GPT is being sold on bridge forms, claiming to write ransomware, fishing kits, stealers and root kits on demand with no guardrails. Expect more volume and variety of generated malware and lean on behavior based detection since the output changes per request. 14. Microsoft has shipped a fix for the legacy high flaw in the Windows user profile service that a researcher had a proof of concept for within hours of the July Patch Tuesday. Though the exploit needs additional credentials, you should apply the August 2026 update. There's a bunch of other fixes in there anyway. 15. a presidential memo directs DHS to stand up a program letting vetted private companies run offensive operations against transnational criminal groups with a sixty day timeline. Nothing to patch but between the tacit acceptance of AI companies running around hacking other companies and now this and it might be time to think about that career change to alpaca farming. That's the board for today. All the sources are in the show notes below. If the show's useful to you, give it a like and subscribe and pass it on to someone on your team who'd get something out of it. Thanks for watching and we'll be back again on Monday. Have a great weekend.