Latest / Daily DefSec Brief / Cyber Security News for September 29 2026 - Daily DefSec Brief
Transcript
- Jerry: How much do you trust the featured Chrome extension? Well, two million people trusted it quite a lot, and today would be a good day to check whether any of them work for you. This is the daily DefSec brief for Tuesday, September 29th, 2026. One, push yesterday's Apple update to every phone still on iOS twenty six and earlier. A crafted file can run on an iPhone through a bug in Apple's core graphics, and Apple says it may have been used in extremely sophisticated attacks against specific targeted people. Two, researchers at Bay Area Labs say PokerBlocker, a Chrome ad blocker with two million users, sends people's browsing history, screenshots, and AI chatbot conversations back to its operator. It carries the Chrome Web Store's featured and established publisher badges, and Google was told in May, block it across your managed browsers and move to an extension allow list. By the way, this is the seventh round of bad browser extensions on the show since mid-August. Three, open code, the AI coding agent, can run a small web server on a developer's own machine, and that server has no password by default. The malicious website can make a developer's browser send that server a request to upgrade open code, naming a package the attacker controls instead of a version number. Open code hands that name to npm, npm installs the package and the attacker's code runs on the developer's machine. It only affects copies installed through npm, p npm, or bun. And only while that web server is running. It's been fixed since Thursday so upgrade open code on every developer machine. Four. Upguard looked at about three hundred thousand sites built on Supa base and found more than sixteen thousand databases With tables anyone on the internet could read, over half of them holding personal data and some holding passwords and login tokens. Tables made in Supa Base's dashboard get row level security by default, but tables created through the API, which is how coding agents create them, don't. Turn on row level security for every Superbase table, including the ones an agent made. Five, a malicious MCP server could point an app built on the official MCP Python SDK, the PyPy package just called MCP, At a login service, the attacker runs and the app would send its OAuth client secret authorization code and PKCE key, which trade for a real access token. The fix ship September seventh filed under behavior changes rather than security, so anyone scanning release notes for the word security missed it. Upgrade the SDK and rotate the client secret for any app that's connected to a server you don't control. Six, Microsoft has published details of Needy Mantis, malware that attackers install after they've already broken into a network so they can stay in. It's been used at least since last October against telecoms, universities, and government contractors. The attackers copy an ordinary program like Poedit, Vim, or Type VNC onto a machine and put their own malicious DLL in the same folder. When the program starts, it loads the attacker's DLL instead of the real one, so the malware runs inside a legitimate program. Look for those programs running from folders where they were never installed in and Block the command and control domain on the slide. Seven, authlib, the Python library will accept a signed JSON message with no signatures on it at all and call it verified. And there's no fix yet because the current release still has that bug. Ordinary GWT decoding isn't affected. So if your code verifies JWS in its JSON form, reject an empty signature list before Authlib ever sees it. Eight, if your marketing team ever pointed a branded subdomain at QR Tiger and then stopped using that service, another QR Tiger customer can claim the subdomain and every code you already printed on packaging and signs sends people to them instead. QR Tiger only checks that DNS records point at the servers and five months after the researchers reported it. That's still all it checks. Delete the DNS records pointing at QR services and really any service that you've stopped using. If you do only one thing today, make sure your Apple products are all up to date. Thanks for watching. Sources are in the show notes. Like, subscribe, and share the show with a friend. I'm Jerry Bell, and the Daily Def Sack Brief will be back again tomorrow.