Latest / Daily DefSec Brief / The Microsoft login page that phishing training can't save you from
Transcript
- Jerry: Two of today's stories are attackers abusing login flows that are completely legitimate. Microsoft's device code sign in and OpenAI's org invites to walk right in without ever needing a password. This is the daily DefSec Brief. I'm Jerry Bell, and this is your few minutes on what defenders need to know for today, July 6, 2026. Four stories in a quick round at the end. Our first story is one that you're probably already exposed to, and it's not a bug. It's an abuse of a legitimate feature. Attackers are phishing Microsoft's device code login flow. The device authorization grant was built for signing into TVs, printers, and things without a real keyboard. You get a short code, you type it into Microsoft's real login page, and it authorizes a session. What attackers do here is socially engineer someone into generating and entering that code, and then they capture the token for themselves. The reason this one worries me is that all the anti-phishing training we've done for years leans on checking the URL. And the URL here is genuinely Microsoft's. The site is real. Kaspersky Secure list and realistically most other security companies have documented that this is being used in real-world campaigns right now. So here's what you need to do. If you don't actually have input constrained devices that need this flow, restrict or block it with conditional access policies. Go hunt your sign-in logs for the device code grant type And teach people that enter this code on Microsoft's site is itself a red flag when they didn't start the request. All right, moving on. The next one is a plain denial of service bug in PHP, And it's an easy one to trigger. When PHP's HTTP stream rapper fails to set up TLS, and an expired certificate or a mismatched hostname is enough to cause that, the stream object gets torn down, but a cleanup routine is still run against it. That's a null pointer operation and it crashes PHP FPM and it takes all its work processes down with it. It's tracked as CVE 2026-12184. There's a second memory corruption bug patched in the same release too. The good news is that there's no published exploit in the wild yet. The researchers described it as easily reproducible, but not weaponized. So this is a next maintenance window type job, not a fire drill. Patch to 8.3.32, 8.4.21, or 8.5.6. If you've got internet facing PHP FPM, someone can knock it over with a band handshake, so don't sit on it for too long. Next up is a pair of mod security bugs, and these are the kind I don't love because they let bad input slip past the rules you think are catching it. there are two flaws. One is a pointer size miscalculation and transformer that only misfires on 32-bit i386 systems and it truncates input before inspection. The other is the more serious of the two. It's in the multi-part form data parser and a crafted request can bypass inspection entirely. It's rated high. Both are through libmod security 3.0.15 and there are no in-the-wild reports yet. This came out of research. So upgrade to 3.0.16. If you happen to be running mod security on 32-bit infrastructure, treat this one as urgent because the truncation bug is specific to I-386. And if you genuinely can't patch right away, go back through your recent WAF logs and look for gaps. The last main story comes from Cybersecurity News. And it's the other legitimate login abuse I mentioned up top. This time it's OpenAI's Oregon byte system. Attackers create a fake OpenAI organization named after a real company and then send out invites. The invite is real. It comes from OpenAI's genuine notification address. passes the authentication checks and when someone clicks they get owner level access with no further verification. The clever part and the part that concerns me is that they're not after immediate credential grab. They want long-term visibility into whatever the victim later treats as their normal open AI workspace. The prompts, the API activity, all of it. This has been demonstrated through the researcher's own proof of concept organization. The action here is mostly awareness and hygiene. Train staff to check that an openAI org invite's domain actually matches yours before they join anything. Audit your current OpenAI org memberships for tenants you don't recognize, and where you can restrict who's even allowed to accept an external invite. Before we wrap, a few quick ones. Claim AV patch seven scanner bugs, some of them going back two decades. So update to one dot five dot three or one dot four dot five LTS. Cisco patched an arbitrary file rebug in Catalyst Center, and the fixed release is in the PCRT advisory. Opera fixed a zero click Opera GX bug that let malicious sites silently install browser and reconstruct a victim's Gmail address. So update to the latest build. And there's a new North Korean linked macOS malware called Gaslight that steals browser and keychain data and even embeds fake system messages to fool AI scanners. Apple's X Protect already covers it, but treat any unsolicited recruiter a job test downloads as hostile. That's the brief for today. Thanks for watching. The sources are all in the show notes. If this was useful, like and subscribe and pass it along to someone who you think would get some use out of it. I'm Jerry Bell and I'll see you tomorrow.