Latest / Daily DefSec Brief / Cyber Security News for August 7 2026 - Daily DefSec Brief
Transcript
- Jerry: If you run Sogo Webmail, someone can attack you with a calendar invite right now and there's a fresh CPU trick that quietly strolls past the default Spectre V2 fix on Linux. This is the daily DefSec brief. I'm Jerry Bell, the day's security news in five minutes for Friday, August seventh, twenty twenty six. Sixteen items on the board today, so let's go. One, there's a cross-site scripting bug in Sogo Webmail where a calendar invites description field renders an SVG payload without sanitization, so opening the invite runs a script in your session and it's being used in the wild. Get that updated and hunt for malformed ICS invites and embedded SVG. Two, a local unprivileged program can repoison a branch protector right after the kernel's Spectre V2 mitigation runs, leaking kernel memory including the shadow password file, And there's a public proof of concept. Apply the kernel update as it ships for your distro and prioritize your shared and multi-tenant hosts first. Three, a widespread adversary in the middle campaign is stealing Microsoft 365 session tokens through residential proxies and then refreshing those sessions every eight hours or so To dig through finance and payroll emails. Enforce phishing resistant MFA and hunt for sign-ins from residential proxy IPs and those recurring session refreshes. four. A group tract as UNC 6671 calls staff pretending to be the IT help desk, walks them through a fake sign-in page, And grabs a live auth token to act as the employee in three hundred sixty five or Okta. And they're going after hedge funds and financial firms right now. Verify helped us colors out of band and watch for token reuse and new device registrations. 5. Malware running an assigned in Windows session can quietly use the victim's Windows Hello for Business Key to authenticate to Entra ID and pull a primary refresh token with no admin, no PIN, biometric prompt. Treat any user session code execution as identity compromise. In Titan, who can add auth methods to your tenant? Six. Cisco patched 15 flaws in Catalyst SD WAN and iOS XE, three of them at 9.9. The SD-WAN ones apply regardless of your config, so don't assume you're safe. Apply the updates now. seven. Microsoft Fixed three max variety flaws in Azure SQL database, Planetary Computer Pro, and Teams. All network exploitable, and Apple also ships some updates too. Patch those promptly and prioritize the three ten out of tens. Chrome 151 fixed forty-one flaws, including several critical use after free in WebGL, SKIA, and Views. It's encouraging to see the number of vulnerabilities going back down. nine, a shadow MMU flaw in KVM called Zapscape lets an attacker with kernel privileges inside a nested guest run code on the host as root. And there's a public proof of concept. Patch to a fixed kernel, and if you don't need nested virtualization for untrusted guests, don't expose it. 10. A new attack class called NATJack abuses NAT Connection State to hijack active TCP sessions, spoof DNS, and exhaust NAT tables with two implementation bugs getting CVEs. Patch those two, but there's no single effects for the class, So separate untrusted workloads from trusted systems sharing net. eleven. A weak random number generator in CryptoJS produced predictable wallet recovery phrases and attackers have regenerated seeds to drain at least five point seven million dollars. Update the affected wallet apps and treat any recovery phrase made by a vulnerable version as compromised, And move the funds to a fresh wallet. Twelve. In the set instances that serve public and private tables from the same database, a user with access to any public table could run SQL injection to read private ones. Upgrade to the latest release and as a stopgap, disable the execute SQL permission in that database. thirteen. scan last week found more than forty four hundred Rockwell water system controllers exposed online and attackers changed IPs and set passwords on reachable devices without exploiting a vulnerability at all. Get those PLCs off the public internet, put them behind a VPN in segmentation and audit for unexpected IP or password changes. Fourteen, Portswigger's AI assisted research tool turned up new HDB desync techniques. And a zero day and Apache traffic server. Check the Apache advisory for the fixed version And review your front end and proxy configs for request smuggling exposure. fifteen, during an offline evaluation, Moonshot AI's open weight Kimi K3 model found a leak in the sandbox network config and reached the open internet instead of staying isolated. Don't trust the model to respect the sandbox. enforce default deny egress at the network layer and verify containment out of band. I think we're going to see a lot more of this as more companies start performing such tests. sixteen flaws in clawed code in Gemini CLI meant a GitHub issue from an unprivileged account could reach CI secrets, with the Gemini bug running before the sandbox even started. Update Gemini CLI and run Gemini CLI to the latest versions, apply the Cloud Cofix, and review any coding agent CI that lets untrusted issues trigger runs. That's the board for today. All the sources and CVEs are in the show notes. If the show's useful, please give us a like and subscribe and share with friends. Thanks for watching, and I'll be back on Monday reporting from the beach.