Latest / Daily DefSec Brief / Cyber Security News for September 8 2026 - Daily DefSec Brief
Transcript
- Jerry: What do you do when your vendor's public advisory says a flaw isn't being exploited? And the email they sent you says it is. A lot of MSPs spent the weekend working that one out. This is the daily Def Site brief for Tuesday, September 8th, 2026. One, if your Magento store sent anybody a payment failure email over the weekend, look twice because that's what sets this off. Attackers inject PHP into the template system, the store mails the reminder, and the code runs with nobody logged in. Adobe's Fix landed last night and it is a composer patch rather than a release. So nothing shows up as a vendor update. Exploitation started on Friday. 2. Microtic router OS checks an SSH key by its type and its modulus. And it never looks at the exponent. So if you know the public half of an authorized key, you can present one with the exponent sent to one, forge the signature, and log in as that user. Update and then audit your SSH users because attackers are adding their own so the patch doesn't lock them out. 3. Animal has shipped its fourth end central hotfix in five weeks. And this one is for a 10 out of 10 that lets an unauthenticated attacker run code on the server managing all of your endpoints. The public advisory says there is no evidence of exploitation. The notice they emailed the customers calls it a zero day scene in the wild. I'll believe the email and install the hotfix number for today. 4. A phishing service called Big Bear got past multi-factor authentication at 258 organizations and collected more than 5,000 Microsoft 365 logins. It sits between the user and the Microsoft's real sign-in page, so the victim completes MFA properly and the operator keeps the cookie that proves it. Move your admins and executives to pass keys. 5. ConnectWise has disclosed a file transfer flaw on Screen Connect that has no CV and no patch and says both are coming this week. The mitigation works though. Go into administration security roles and turn off the transfer files permission. Separately, Huntress is finding rogue screen connect clients that infect every machine which connects to them. Six. So attackers are calling executives, saying they're from IT and sending them to a login page with their own company's name on it. They relay the password and MFA prompt live, then replay the session from a residential proxy so the login looks ordinary. Give your help desk a verification check that a phone call can't satisfy. Seven, the researcher who dropped that CrowdStrike exploit last week has now added Avasta and Nvidia. So that is three vendors in a week, none of them coordinated. CrowdStrike's own advice is to turn off Falcon's Office macro removal feature until there's a fix. The other two don't have one yet. 8. There is now a working public exploit chain for the Telerec UI for ASP.NET Ajax that turns a padding Oracle bug into a remote code execution with no login. Progress patched it back on the 8th of July, so the fix is two months old and the exploit is now the new part. It only works against non-default configurations though. Nine. A toolkit called Peep installs itself into Chrome and Edge by forging Chromium's own integrity values, which skips the web store and the permissions prompt completely. then runs commands on the host through the native messaging, hunt for extensions that didn't come from the store and native messaging manifests that nobody remembers installing. ten. two hundred and twenty million passenger records, passports, flight details, nine years of them were sitting in a search cluster reachable from the internet. By the way, the lesson here isn't about airlines. Go and find the clusters that your own team stood up for reporting and check which of them are accessible from the outside. eleven. Berlin refused to pay Resita 2 million euros, and the group published what it claims is nearly six terabytes of state administration files. Berlin made the right call, and it still hurt, which is the part worth planning for. Decide who says no and what happens in the hours afterward. 12. Mathspace lost data on more than a million students, parents, and staff through an unpatched metabase. Business intelligence tools sit on top of everything and almost never make it onto the patch list. thirteen. The NCSC says seventy-one percent of UK employees have used AI tools their employer never approved. Banding it only moves the traffic somewhere you can't see it. So publish something good enough that people actually use it. fourteen. Ransomware crews research your revenue and your insurance before naming a number. And Intel's four hundred seventy one says the demand usually lands between one and five percent of annual revenue. Work out your own figure first. fifteen a North Korean backdoor is compiled into the victim's own HA proxy and it erases its command and control traffic from HA proxy's own connection counters. So the load balancer's statistics show nothing at all. Check your daemons against their packages. sixteen the people poisoning Bing search results to serve malware run an SEO agency. There are two Indian IT firms working out of Rajasthan since twenty fifteen. Your mail filter never sees any of it because it arrives through a search. So if you only do one thing today, patch Magento, and remember it's a composer patch, not a release. And this was the Daily DevSec Brief. I'm Jerry Bell. Thanks for watching. Sources are in the show notes. Like it, subscribe, and share the show with a friend.