Latest / Daily DefSec Brief / Cyber Security News for August 3 2026 - Daily DefSec Brief
Transcript
- Jerry: If you run an MSP or a remote access appliance, today's board is aimed right at you. En Central's second incomplete fix and SonicWall's SMA are both being exploited right now. This is the Daily DefSec Brief. I am Jerry Bell, the day's security news in five minutes for Monday, august third, twenty twenty six. Fifteen items on the board today. One, there is an unauthenticated auth bypass in Enables and Central Console that gives attackers full God mode admin, And they're using it to pivot to managed endpoints over take control and cloud flare tunnels. this is the second fix since the first one was incomplete. So update now and hunt for unexpected Cloudflare tunnels registered as services on your endpoints. Two. SonicWall's SMA 1000 chain two flaws combined for unauthenticated tunnel access and route is now the main entry point for Inc. ransomware, with exploitation traced back to June twenty second before the July patches. Apply the July 14th patches immediately. Assume many harvested credentials are stolen and hunt for dropped files and persistence. three. Microsoft now attributes that hotel captive Wi-Fi portal campaign to a Russian state actor overlapping with APT twenty eight, using modified router DNS to run adversary in the middle interception of Microsoft 365 enforce phishing resistant MFA, treat public Wi-Fi as hostile, and hunt for unexpected DNS changes on your edge gateways. four. Thermofisher patched a flaw where unsigned output files from forensic human ID software could be altered near undetectably before analysis. install the July 31st updates and for the three end of life products that get no fix, lean on lab controls and chain of custody around file handling or better yet, update. Five, three high severity flaws in hugging face diffusers dubbed facehugger let a crafted model repo run arbitrary code on any machine that loads it, bypassing the trust remote code safeguard. Update diffusers per the advisory and treat model repos as untrusted code in your build pipelines. Six, Unit forty two published a passkey attack class where malware on a compromised endpoint abuses onboarding and recovery workflows to authenticate without the user and extract synced private keys. The takeaways to treat endpoint compromise as a pass key compromise, so prioritize endpoint hardening and review your device trust and recovery flows. Seven, XCSet version 40 hides in poisoned Xcode projects, spreads a supply chain compromise, and abuses the Chrome DevTools protocol to steal cookies and run commands from short-lived in memory files. Vet Xcode projects before you build and hunt for unexpected Chrome remote debugging activity on dev machines. Eight, a paid search result and fake clawed install guide tricked Mac OS users into pasting terminal commands that install MacSync, which does credential theft, remote access, screen capture, and wallet phishing. include copy paste to terminal social engineering in your training and hunt for suspicious terminal execution on Macs. Nine, an unknown Chinese actor is running over a hundred web properties, mostly fake AWS sign-in pages, hosting a leaked full chain exploit kit to deploy Ghostblade on iOS. Keep iOS fully patched, turn on lockdown mode for high risk users, and block the reported fake AWS infrastructure. ten. A flawed random number generator in cold card firmware let attackers Reconstruct private keys and sweep about eighty eight million dollars in Bitcoin with the first wave hitting roughly thirty hours before disclosure. anyone with an affected cold card should generate a new seed on patched firmware and move funds to a freshly derived address. eleven. CrowdStrix's AI agent driven behavior now generates more than twice the malicious looking noise of human triggered incidents and they're triaging around fourteen million detection leads a day. Tune your detections to separate sanctioned AI activity from abuse and inventory where agents run with credentials. Twelve, bring your own vulnerable drivers, now common ransomware tradecraft for disabling security tools, deploy Microsoft's vulnerable driver blocklist and hunt for known bad signed drivers loading before a payload. Thirteen, the UK's police national legal database confirmed names, organizations, and work emails of officers, staff, and government partners were published. On the dark web. There's no evidence of passwords being taken, but name people should be expecting convincing spearfishing. So brief affected staff and Titan inbound email verification. 14. Brinks Home confirmed a breach after Shiny Hunters claimed nearly 5 million records tied to its Salesforce environment, consistent with the ongoing Salesforce extortion wave. Review your Salesforce connected app authorizations and OAuth tokens. Enforce MFA and audit for anomalous data exports. Fifteen, OpenAI banned a coordinated account network. likely out of Cambodia that use this models to build fake personas and translate messages for investment, romance, and impersonation scams. Factor AI affluent multilingual social engineering into your fraud awareness training and impersonation defenses. That's the board for today. Thank you for watching. All the sources are linked in the show notes. So head there if you want to dig into any of these. If the show's useful, a like and subscribe helps and pass it on to someone who you think would get use out of it. Back again tomorrow.