Latest / Daily DefSec Brief / Cyber Security News for September 11 2026 - Daily DefSec Brief
Transcript
- Jerry: If you run Microtic at the edge, two vulnerabilities are now confirmed exploited as of yesterday. One of them is a username that starts with the wrong character. This is the daily DevSec brief for Friday, September 11th, 2026. 1. CISA put two microtic router OS flaws on the exploited list, an argument handling bug in the SSH login path that lets an attacker rewrite the trusted policy mask, and the B test service accepting a connection before the session has authenticated. That second one is the pair we covered on Tuesday. Now confirmed exploited rather than just observed. Patch today and you should probably put your firewall behind a firewall. Two. The Watch Guard Firebox Flaw that went on the exploited list in December is now at a ransomware campaign. CISA just confirmed it on Wednesday. Be sure you apply the fireware update. And remember, it's a patch, not wine. It doesn't need to age. Three, checkpoint ship fixes for two VPN certificate flaws in its gateways. Both 9.8, both unauthenticated code execution. One skips certificate trust validation, the other overflows the decoding certificate. Apply the fixes or not, you might get nine months. Four, AWS patched a flaw in the systems manager agent where a session manager's port forwarding checked the destination address as text. Write a link local address another way and you bypass the denying list, reach the metadata service, and leave with the instance's IAM credentials, which then work from anywhere. Even outside the instance. Upgrade the agent and until then restrict who can start a remote host port forwarding session. The denialist was just checking spelling, not addresses. Five, a kernel driver shipping in the AOMEI backupper. lets any local user write straight to the physical disk with secure boot off that becomes code at UEFI level before the operating system loads. Underneath HVCI, EDR, and Defender. And possibly reaches bitlocker keys. There's no fix yet. Block that driver and confirm secure boot is on. Six. Anthropic disrupted a Russian operation that used Claude to watch whether its malware was being detected. And when a tool got flagged, agents rebuilt and redeployed it until it wasn't. The days of signature based detection are long gone, by the way. Seven, access brokers are calling employees on their personal phones, posing as the IT help desk, and saying a passkey or an MFA method has to be updated or they'll lose access to the network. The link goes to a convincing Microsoft sign-in page, and an adversary in the middle kit or device code flow takes the session. Then they register their own MFA device to keep the account. What's new here is calling people's personal cell phones. Eight. ID scan has confirmed the breach behind those more than 153 million driver's license scans and dates at around the first of September. It's time to rotate your name, appearance, And address. Nine, a Chinese link group exploited a flaw in the SOGU input method, one of the most common ways to type Chinese on Windows, to drop a backdoor from a crafted link. Tencent fixed it in April. By the way, input method editors are rarely inventoried. if your staff type Chinese on Windows, check the build. ten. The Gigabud Banking Trojan creates an Android work profile and hides a tampered banking app inside it. Out of sight of the checks the real app runs. Group IB counted nearly fifteen hundred infected devices in Indonesia and about a million dollars gone. If you ship an Android app that scans the device, test what it sees from inside a work profile. eleven another android family with Man taxotax encrypts files and steals messages and credentials at once and takes its command and control address from a GitHub repository so the operators can move without new code. It arrives siloaded, so it blocks side loading in your MDM and alert on anything granted accessibility. 12. In work published back in July and written up this week, Island looked at 33,000 MCP server builds and found manipulation signals in about 3% of them, and the potential for it in about half of them. A tool's description lands in the model's context. It gets read as guidance, not documentation. Review the descriptions on every MCP server you've got connected the way you would review code. thirteen. Unit 42 showed that root on a Kubernetes node lets you impersonate the other workloads there and harvest their machine identities because the design assumes the node is trustworthy. It's a proof of concept, treat node compromise as identity compromise for anything on it and keep those credential lifetimes short. fourteen. Something that helps for once. Android now moves passwords and passkeys straight between password managers with no unencrypted export file. Passkeys couldn't be transferred at all before. If lock in was your argument against passkeys at work, now it's gone. fifteen. Over three days in August, Microsoft counted more than a million emails impersonating companies' own CEOs and finance chiefs, asking accounts payable to move about fifty thousand dollars by ACH. What gave them away wasn't the writing, it was the markup. The templates came packed with tidy HTML comments and uniform section labeling the way generated code looks. Require a callback on any payment detail change to a number that you already had and hand your mail team that indicator to look for. If you only do one thing today, patch that microtic router OS. Both flaws are being exploited actively. Thanks for watching. Sources are in the show notes. Like, subscribe and share with a friend. Back here again on Monday.