Latest / Daily DefSec Brief / Cyber Security News for October 8 2026 - Daily DefSec Brief
Transcript
- Jerry: Somewhere on GitHub there's a poem. A few thousand hex servers read it to find out where to call home, and most of them run AI tools. This is the daily DefSec brief for Thursday, October eighth, twenty twenty six. One, Japan's national cert said some of a wave of data thefts at organizations came through systems that were never meant to face outsiders. Attackers unpacked public mobile apps to find the admin APIs behind them. Some used API keys stolen in other breaches, Others got in through a known flaw in their reporting tool metabase. If your app can call an API, so can an attacker. Find the internal APIs your apps expose and make sure each one checks permissions on the server side. Two, some phishing emails now carry a second hidden message. It's written for the AI that summarizes your inbox. The hidden text tells the assistant to present the email as urgent or to add a to do about changing a vendor's bank details. Skip the fish and your assistant will bring it right back to you. Put every change to payment details on a phone callback or whatever the summary says. Three, SonicWall's SMA 1000 remote access appliances have a new maximum severity flaw and it's reachable before anyone logs in. An attacker could make the appliance send requests to its own internal functions. There's no sign of exploitation yet. If you applied September's fix for the two exploited SMA 1000 flaws, you still need this one. The hotfix ship. Tuesday, so get it installed. And just remember there's a reason it's called a remote access appliance. Four. Anyone holding Veeam's backup viewer role can run code on a version 12 backup server. That's a lot of authority for a job title with viewer in it. Backup servers are a favorite ransom or target. Version 13 isn't affected. Install the update that shipped Tuesday and check who holds that role. 5. Cisco Nexus 3000 and 9000 switches can run an attacker's code as root with no login when one of three features is turned on. Two of them, NXAPI and MPLS diagnostics, are off by default. A switch running an attacker's code sees everything that passes through it. Check which of those features your switches run and upgrade those switches to. Six. Splunk Enterprise search head clusters have an API that lets everyone in. Anyone who can reach it can run commands on the host. The system that records every login never asked for one. Older releases aren't impacted by this one. Splunk's same-day hardening release fixes a flaw rated just as severe, so go upgrade all the Splunk things. Seven, Rounding out today's patch list, Cisco's October Meraki firmware fixes serious flaws across MX appliances, switches, and access points. Cisco found them internally. The worst can be reached by anyone on the same network without a login. Logins are apparently overrated for network gear. Schedule the upgrades in the dashboard. A few switch and access point fixes arrive later this month, and one campus gateway fix waits until mid-November. Eight. Attackers got into a third party platform that ASOS uses to manage his customers. They used it to send an extortion note to the retailers' app users. The note was addressed to ASOS's data protection officer and it landed on shoppers' phones. It claimed the attackers had ASOS's Snowflake data. That claim is unverified and Snowflake says his platform was not breached, which by the way is a normal thing for Snowflake. Whoever holds that login can talk to every customer as you In the one channel that they trust. Lock down your messaging platform logins. Nine, a botnet called Poe LLM has taken over more than 3,400 exposed servers since April. It gets in through internet facing Lite LLM and OLAMA servers, plus Gotenberg and Gitea. Then it mines cryptocurrency and scans for the next victim. To find its command server, It reads four words from a poem on GitHub and turns them into an IP address. The operator has revised the poem eleven times. Get those AI servers off the open internet or at least limit them to addresses you trust. And by the way, their poetry apparently gets more views than I do. Thanks for watching. The sources are in the show notes. Like, subscribe, and share the show with a friend. We're back again tomorrow.