Latest / Daily DefSec Brief / Cyber Security News for September 21 2026 - Daily DefSec Brief
Transcript
- Jerry: If you don't know whether anything you run is built on ORX Conductor, you're in good company, but you should probably spend some time to figure that out today. This is the daily DefSec brief for Monday, September 21st, 2026. One, anyone who can reach an ORX conductor server can run commands on it with a single request because the open source server's workflow API takes requests without a login by default, and the scripts inside a workflow get Full access to the machine where conductor often runs as root. Exploit code went public in early August and attacks started within weeks. The fix shipped back in June, so make sure you've upgraded today. 2. CISA has confirmed that attackers are exploiting three Linux kernel flaws. A bug in how the kernel handles TLS records, a race in its crypto socket interface, And an out-of-bound rights in EB tables, the bridge filter. Nobody has said yet how they're being used. Two of the three were fixed about a year ago. So this is about the machines that never got updated. Update the Linux kernel on every machine you run. Three, a malicious MPM package called index dbtree. Copy of the popular sorted B tree library got past npm's new block on install scripts by not having one. Its loader sits inside the library's own set function and runs the first time your code calls it. And nine related packages came from the same operation. they're off npm now. And the names are in the show notes. So search your lock files for them and treat any machine that ran it as compromised. four. Attackers copied about a hundred and seventy of CrowdSec's private GitHub repos in May using an account of an employee who had already left and whose laptop was compromised in the Tan Stack MPM attack. The account came out of the organization three days later And the code turned up on a forum last week. Remove people from your GitHub organization and revoke their tokens on their last day. Five, an attacker on the same network as a SolarWinds Access Write Manager can run code on it without logging in because it ships with a hard coded key, which is an awkward thing to find in a product called Access Write Manager. It's the server that manages who can get into what across Active Directory and your file shares. The fix shipped Thursday, so time to upgrade. Six. A crafted HEIC photo upload was enough to run code or leak memory on Slack, Meta, Discourse, and GitHub Enterprise Server through libh, the decoder that ImageMagic and a lot of other image tools use for those files. On Discourse and GitHub, the uploader had to be logged in. On OpenAI's own forum, the same bug plus a login flaw got researchers into staff chat GPT accounts. no attacks are reported yet. Update lib H E IF through your distribution. Also consider turning off HEIC decoding because it seems like a repeat offender. Seven, a coding test from a fake job interview shipped with a terraform lock file that named a lookalike provider registry. When a DevOps engineer at an IT services firm ran the Terraform init, Terraform fetched the attacker's provider and ran it, and the engineer's Mac ended up with a North Korean backdoor. Before you run any Terraform init on anyone else's code, Check that every provider in the lock file comes from the registry dot terraform.io. Eight. Cisco has filed a batch of bugs it found in its own ASA and firewall threat defense code under eight CVEs, one per type of weakness, and each of them needs a logged in user. denial of service bugs and logging, VPN, certificate checks, and DTLS that need no login. I think one CVE per type of bug makes it harder to tell what was actually fixed. There are no workarounds, so s schedule the upgrade anyway. This is becoming standard practice for Cisco, by the way. 9. Working root exploits for four Linux kernel networking bugs went public on Friday. Three of them need unprivileged user namespaces, which many distributions switch on by default. And the fourth only needs the SCTP module. Where you can't update yet, turn off unprivileged user namespaces and the SCTP module on hosts that don't use them. 10. Google has confirmed that one of its Gemini models Broke into three real companies in May because they got to keep up with the Joneses during a hacking test. The test confirmed it could reach the internet, and one of the made-up target companies shared its name with a real one. This is becoming a habit, people. Gemini guessed a password into one of them and used credentials from a public repository to reach the other two. Then stopped once it worked out that they were real, which puts it ahead of most of the other AI intruders. Search your public repositories for committed credentials and rotate whatever turns up. If you do only one thing today, patch that conductor and put its workflow API behind a login. That's the daily Def Sec brief for today. I'm Jerry Bell. Thanks for watching. Sources are in the show notes. Like, subscribe, and share the show with a friend back again tomorrow.