Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 13 2026
Transcript
- Jerry: Progress isn't telling sharefile customers to patch a server today. It's telling them to shut it off. Happy Monday, friends. This is the Daily DefSec Brief. I'm Jerry Bell. Your few minutes on what defenders need to know for today, July 13th, 2026. Three stories and then a few quick ones. First up, the big one. If you run a self-managed sharefile storage zone controller, Progress wants that server powered down now, not patched, off. So here's what happened. Progress disabled share file account access through storage zone controllers and it's asking customers to manually shut down servers hosting them. The reason they're giving is a credible external security threat that they're still investigating, which is about as much as they've said publicly. This affects anyone running the self-managed storage controller, whether your storage is on-prem or with a third party. So the action here is simple, even if it's unpleasant, Manually shut down the server hosting your storage zone controller following progress' instructions then watch for an advisory with patch guidance before you bring anything back online. A vendor telling you to turn it off rather than patch is not something you see every day. Alright, moving on. Zimbra has a critical flaw in its classic web client and the patch is already out. This is a stored cross-site scripting bug in the classic UI, and the part that makes it worth your attention is that it's zero click. a specially crafted email can run an attacker's code just by being opened. no link to click, no attachment to launch. From there they can get at mailbox data, session data, or account settings. Now to be fair ⁓ about where this stands, Zimbra withheld the technical detail, and there's no report of anyone using it the wild. This is a patch before someone figures that out type situation. Apply Zimbra's patch now, and if you genuinely can't patch right away, restrict or disable access to the classic web client. Until you do. Next up is a research note from the SANS Internet Storm Center, and it's a good early warning read. A handler pulled 14 days of logs off an ordinary low-traffic web host, and mixed in with the usual noise, the WordPress probes, the.emv scans, the git config scans, they found something new, A distinct pattern of scan, systematically hunting for model context, protocol servers, and AI assistant credential files. So this is recon, not compromised. Nobody's been broken into here that we know of. What it tells you is that attackers have already added MCP servers to their target list, right alongside the stuff that they've been scanning for years. If you stood up an MCP server, it's now part of your attack surface, whether you plan for that or not. So here's the practical response. Audit for MCP endpoints and AI credential files that are exposed to the internet. Don't put MCP interfaces directly on the public internet. and add those MCP paths to your log and WAF watch list right next to the dot ⁓ env and git patterns that you're already watching. it's cheap to do now, and this is about as clear a heads up as you're gonna get. Before we wrap, a few quick ones. Attackers use a stolen publishing credential to push malicious versions of the JScramble MPM package with a pre-installed script that quietly dropped native malware on Linux, Mac, and Windows. So check your lock files and update. Researchers found a leftover misconfigured server exposing the toolkits of three separate evil gen X campaigns against Microsoft 365. And because the two MFA bypassing techniques needed different defenses, it's worth reviewing LexFoe's indicators rather than assuming one fix covers both. There's a critical auth bypass in Mini Orange's WordPress OAuth single sign-in plugin that lets unauthenticated attackers hijack accounts through the password recovery flow. So update the plugin per patch stacks advisory. And the latest Red Hook Android malware now abuses wireless debugging to get shell access without a tethered computer. So restrict wireless ADB on your managed Android devices and watch for unexpected pairing requests. that's the brief. Thanks for watching. the sources for everything are in the show notes. If this was useful, like and subscribe and pass it along to a friend who'd put it to use. I'm Jerry Bell and I'll see you tomorrow.