Latest / Daily DefSec Brief / Cyber Security News for August 4 2026 - Daily DefSec Brief
Transcript
- Jerry: Adobe and Cisco are both dropping unauthenticated remote code execution today, and a whole wave of AI agent abuse stories just moved from theory into real intrusions. This is the Daily Def Stack Brief. I'm Jerry Bell, the day's security news in about five minutes for Tuesday, August 4th, 2026. Fourteen items on the board today. One, Adobe Campaign Classic has a batch of critical flaws, including three unauthenticated remote bugs sitting in a perfect CVSS 10 that lead to arbitrary code execution. it's still theoretical for now, but this is an Adobe priority one so upgrade to build 9399 as soon as you can. Two, Cisco Secure Firewall Management Center has an auth bypass where crafted HTTP request lets an unauthenticated attacker run scripts as root. That's amazing, by the way. Apply Cisco's hotfixes, and if that management interface isn't exposed to the internet, your attack surface is a lot smaller. 3. Checkpoints security management server has a similar problem. An unauthenticated attacker on a network can bypass management authentication and run arbitrary commands, which is a full takeover, and that is also awesome. Apply the fixes and prioritize this if you're still running an end-of-support release. four. Apache NiFi has four flaws in its web API and parameter controls that allow authorization bypass, config changes, and in some deployments code execution. The fixes to upgrade to version 2.11.0. Five, there's a critical cPanel in WHM Flaw where an authenticated user with database access can run arbitrary SQL as the database admin, which can lead to root in some configs. Apply cPanels update and treat it as urgent on shared hosting infrastructure where a lot of accounts sit on one server. Six, a researcher published a set of techniques against the Light LLM AI gateway that lets an attacker intercept traffic, steal backend provider keys, and inject tool calls. There's a public proof of concept and the EPSS is up near the top, so patch to the fixed version lockdown gateway access and rotate those provider keys. Seven, researchers found a prompt injection in Google's 80K Python agent where a low privileged public agent can be tricked into invoking A high privilege maintainer agent exposing secrets and enabling pull request tampering. So one AI agent turns another one against the code base. If you use ADK Python, enforce a hard privilege boundary between agents and treat any issue or PR text as untrusted input. Eight. There's a Russian loader as a service called Double Cup that uses clickfix lures to hide payloads in steganographic PNGs. in the browser cache, then decrypts a loader and a new rat in memory using the victim's own IP address as the key. Block those paste to run click fix lures and hunt for odd browser cache PNG execution. Nine, Unit 42 published three attacks they're calling pass to key against Google's Chrome Password Manager. Malware already on a Windows host can grab off sessions, plant its own verification key, or extract the secret that protects your synced pass keys. The takeaway is that all this starts with malware on the box, so keeping endpoints clean is still the whole game. ten. 18 malicious MPM packages are typosquatting a private Alibaba scope package to drop a cross platform rat, and this one's active in the wild. Audit your dependencies for the flag names and block unscoped lookalikes for your internal scope packages. eleven. There's a lure factory called Troydens cloning trusted GitHub projects like AI coding assistance and and comfy UI and hiding a two stage smart loader chain that drops an info stealer. Verify project providence before you run a download and think hard about developer local admin rates. 12. Zscaler documented a new Windows backdoor called Bindcloak. Deployed after access that steals user and process tokens to run malware at higher privileges. It arrives through an ISO based execution chain, so hunt for a suspicious ISO born Execution and token manipulation behavior. And by the way, you should already be doing that. 13. Scammers are mailing physical letters that look like they're from the IRS, urging crypto holders to scan a QR code and enroll in a fake compliance portal that spoofs IRS.gov. Tell your staff that IRS runs no such portal and never solicits with a QR code. It's phishing that comes by mail. We should expect more of this in different contexts. fourteen CrowdStrike's threat hunting report says device code phishing is up fifteenfold and phishing doubled in the first half of the year, both aimed at getting around email controls and MFA. Restrict the OAuth device code flow where you don't need it, alert on device code authentications and brief your help desk on phishing pretexts. That's the board for today. Thank you for watching. All the sources and C V E's in the show notes below. If the show is useful to you, give it a like, subscribe, and send out to someone on your team who'd want it. We're back again tomorrow.