Latest / Daily DefSec Brief / Cyber Security News for September 4 2026 - Daily DefSec Brief
Transcript
- Jerry: Coders package registry spent about fourteen hours on Monday answering developers from servers that weren't coders. Dropbox, Palantir, and the US government all pull from that registry. This is the daily DevStack brief for Friday, September 4th, 2026. One, Google patched a bug in Chrome's JavaScript engine that lets a web page run inside a browser sandbox and an exploit for it is already out in the wild. That's the sixth Chrome Zero Day this year. The update is out, so push it through policy and force the browser to restart instead of waiting for people to close their tabs. Two, somebody got into the infrastructure behind Coder's package registry and added their own IP addresses to the pool it answers from. So for about 14 hours on Monday, developers pulling workspace templates got back Terraform modules that stole their secrets and API keys. Rotate everything a coder's workspace could reach. Coders Advisory has an SQL that finds cache modules from that window. Three, there's a buffer overflow in a daemon on HPE's Aruba OS CX switches that lets an unauthenticated attacker send crafted packets and run code with elevated privileges on the switch. There's a fix for every branch, but the 1010 branches end of support and gets only limited remediation. four. In the Castor Identity Platform, an admin who runs one organization can create and delete users and permissions in anybody else's because the authorization check and the action behind it disagrees about the target. There is no patch, cut those admin accounts to least privilege, require MFA and alert on cross organizational admin calls, and most of all, good luck. Five, Cisco review to iOS XR internally and Found so many bugs that bundled them by weakness class and gave each class one CVE, two of those classes being critical. Every release is affected, and it sounds like there are maybe many rounds of patches forthcoming. Six, attackers are splitting money words like funding with an invisible Unicode character, so your mail filter parses the word that isn't there while the recipient reads it normally. Microsoft went from about 21,000 hits a day to over 1.3 million hits per day. Strip those characters out before your phishing signatures run it, not after. 7. AWS patched a command injection in its code catalyst Blueprints framework. When it rebuilds a project, it reads the project's own ownership file and passes one field straight to a shell, unchecked. The fixes out and the package is blueprint.blueprint under the Amazon. Code catalyst scope on NPM. Eight. A China-linked crew left five directories exposed to the internet, and researchers used them to map the whole operation. An orchestration host handing reconnaissance exploitation and collection to separate AI agents. The agents work old flaws, so close your shell shock era exposures and Java deserialization endpoints. 9. A Python framework called Brezetsu packages compromised Windows hosts into something an access broker can sell. And Group IB found samples that no engine on VirusTotal detected. So don't close a commodity malware ticket at cleanup, rotate credentials, and hunt for remote access first. 10. Kaspersky is tracking a group running two versions of a new backdoor, one talking to a hive MQ message broker and the other To the element messenger, so its command channel looks like ordinary messaging. Targets of Russian organizations so far. Alert on outbound MQTT and element traffic from servers with no reason for it. 11. JAMP found 14 fake Mac installers wearing the names of real apps. The unarchiver, sketch bartender, sight sucker pro. They deliver a JavaScript implant called Ottercookie that takes browser credentials and watches the clipboard. And they arrive through fake recruiting conversations. Block installs from outside your managed software channel. 12. A coordinated operation sees the outsider phishing kit's admin servers, storefront, and thousands of domains. Group IB counted more than 700 new phishing pages from it in the month that followed. Keep its indicators in your blacklist and recheck any detection built around infrastructure that's now gone. 13. The dark web service selling 153 million driver's license scans has a suspected source. And identity verification companies whose customers include Hertz, Target, and FedEx. Ask your own verification vendor which document images they kept and for how long. fourteen Thompson Reuters says files were taken from its C track court records platform in March. It found out june thirteenth and disclosed this week. If a vendor holds your records, ask them about that gap. fifteen. Phantom Deal sends a WhatsApp message from what looks like a senior executive, attaches a branded NDA for a secret acquisition, and asks for a big advanced payment. The NDA says not to discuss it with colleagues. One target called the executive back, the voice was wrong, and nothing moved. 16. Anthropic pointed a model at 280 open source projects and got 23,000 candidate vulnerabilities. nineteen hundred of them went out for review, ninety seven fixes landed upstream, and the other twenty one thousand haven't been looked at by anyone. Nothing to patch it but budget triage time. That's the daily Def Suck Brief. I'm Jerry Bell. Thanks for watching. Sources are in the show notes. If this saves you time, like it, subscribe, and pass it to someone who'd use it. Have a good weekend and I'll see you on Tuesday.