Latest / Daily DefSec Brief / Cyber Security News for August 20 2026 - Daily DefSec Brief
Transcript
- Jerry: Threat actors using AI scripted exploits against internet exposed Siemens PLCs. And if you've been wondering if NetScalers were safe to use again, stay tuned. This is the Daily Def Stack Brief. I'm Jerry Bell with a day's security news in five minutes for Thursday, August 20th, 2026. Fifteen items on the board today. One, threat actors are scanning for exposed Siemens S seven PLCs and using AI generated exploit scripts disguised as monitoring software for initial access, credential theft, and denial of service across energy, water, and manufacturing. Maybe someday someone can explain why people thought it was a good idea to expose PLCs to the internet. Two, there's a critical authentication bypass in Citrix Netscaler using an alternate path against gateway or AAA virtual server configs. An exploitation is expected with a public proof of concept already out. An update is out, so you know what to do. Three, a Chinese speaking actor is running a cross platform kit against IIS and Linux web servers using a vulnerable driver to knock out EDR and a kernel root kit for persistence. Patch the known CVEs, watch for unsigned driver loads, and hunt for in memory web shells. Four. The RDKB Broadband Gateway Web UI has five flaws including a broken JWT auth and possible code execution. It's still theoretical, so restrict the web UI to the LAN and check with your device vendor for a fixed build. Five. The Toxic Panda Banking Trojan hit version two, adding a pin harvesting workflow and an overlay theft now targeting three hundred and forty nine institutions up from just sixteen in version one. Six. A new Android family called Manic combines spyware and banking fraud, captures taps through transparent keypad overlays, and when it can't reach its server, it relays stolen data through other infected phones nearby. 7. A fake Google Gemini installer dropped the Vidar InfoStealer, and attackers hosted it on Google's collab so it would look legitimate. 8. A campaign of malicious Firefox add-ons posing as wallets and themes tricked users into handing over their recovery phrases and private keys, then exfiltrates through Cloudflare workers. Nine. A network of forty-one fake download sites shows a genuine URL when you hover over the link and then serves a bundled installer when you click. So the lesson for your users is that a hover previewed proves nothing, and the official vendor domains are the only safe path. ten. Huntress saw password spraying jump one hundred and fifty five times over, including a campaign against Azure CLI with over eighty one million attempts in two weeks. That yielded seventy-eight account compromises highlighting the importance of properly configured MFA. Enforce MFA on every admin and CLI path in Block Legacy Auth. Eleven. There's a USB stack overflow in Cisco Room OS that runs code as root, but it needs physical access to a USB port. There's no workaround, so apply the update and lock down physical access to the conference room gear in the meantime. 12. Cisco Broadworks has an XXE flaw where the XML parser resolves external entities by default, letting an unauthenticated attacker read sensitive files. Apply the Cisco update because there's no workaround. 13. A network driver on GeekCom's legacy support page shipped with the Azure X backdoor running with admin rights to log keystrokes and beacon out. If you pulled that driver, run a full scan and consider a clean reinstall. Geecom has since removed the file, fourteen. An actor posing as a coin desk marketing VP pitched DEF CON attendees a fake conference, then sent a Google Doc that prompts you to authorize a custom appscript. Treat post-conference outreach with suspicion and treat any doc asking for App Script authorization as a red flag. 15. A rogue ransomware affiliate calling itself RansomBusters is contacting victims before attacks go public, claiming it can recover their stolen data for a fee. Treat any predisclosure recovery pitch as part of the extortion until proven otherwise. That's the board for today. All the sources are in the show notes. If this was useful, a like and subscribe helps and pass it on to someone who'd want it. We're back again tomorrow.