Latest / Daily DefSec Brief / Cyber Security News for October 5 2026 - Daily DefSec Brief
Transcript
- Jerry: Time is money, they say. For one security product, time was also the password. This is the daily Def Sec brief from Monday, October fifth, twenty twenty six. One, attackers are crashing netscaler appliances with crafted SAML login traffic. It works on appliances that have last week's emergency patch. It's also what was rebooting them. Only a netscaler set up as a SAML service provider Or an identity provider is exposed. Kevin Beaumont says one of his patched test appliances ended up running downloaded malware. So treat a crashing Netscaler as possibly compromised, not just unstable. Citrix shipped another fixed build over the weekend, so if you use SAML update Netscaler again, by my count, that's at least five Netscaler stories on the show in seven weeks. If patching these is still a hands on job at your shop, it shouldn't be. Two, a Horizon 3 researcher using Anthropic's Mythos model found a way to forge an admin login on Rejetto HFS, a small file web server. The fix has been out since July. Attackers started using it a day after the exploit write up. Upgrade HFS or take it off the internet if you didn't know it was there. Three, malware set inside a pair of VS Code color themes linked to the Glassworm campaign. Two related themes had more than 8,000 installs between them. They stayed on Microsoft's own marketplace until Socket reported them. A VS Code theme can carry code, and that code runs with everything the developer can reach. Allow list the extensions your developers may install. 4. A researcher said he broke out of a KVM virtual machine and got root on the host underneath it. Vercel CEO confirmed the KVM Zero Day and Vercel awarded its $50,000 maximum. Cloud providers run strangers workloads side by side on KVM. If this works as claimed, it breaks the wall between those workloads. There's no write up. No version list and no published fix yet. If you run KVM hosts with untrusted guests, watch your Linux vendor for the fix, be ready to reboot hosts quickly. If you're running in the cloud, the action is to rub your lucky rabbit's foot because that's about all you can do. Five. Microsoft reissued September's Exchange Server security update to fix a flaw that lets any signed in user read other people's mailboxes. If you installed the first September update, you still need this one. Exchange Online is already covered, so this is for on-premise servers only. Install the September V2 update. Six, Dell's container storage modules connect Kubernetes to Dell storage. Anyone who can reach them can get the admin credentials for Every array with no login. Dell says there's no workaround, so upgrade the modules. Flaws in the part called authorization, which is a bold name for something that never asks who you are. 7. GitLab's AI Gateways, the link between GitLab and your AI models. If you host it yourself, a user with duo agent access can, under certain circumstances, run commands on it. GitLab.com customers don't need to do anything. If the gateway is yours, upgrade it. 8. Last week's Debian kernel updates. Fixed more than 1300 CVEs at once. Nearly all of them were assigned this year. It came three weeks after Microsoft's record patch Tuesday, which fixed nearly a thousand. I think this is the AI bug finding wave reaching open source. Linux patching is gonna need the some of the same muscle that Windows patching has. Update your Debian 13 kernels and reboot. Nine, Fortra's BoKS Can set your Active Directory service account passwords. It generates them from the clock. If you can guess roughly when a password changed, you have a short list to try. Any ordinary domain account can request a ticket for that service and test the guesses offline. If you use BoKS for this, patch it and restart. Then rotate those passwords because the patch doesn't change the ones BoKS already made. So cracking them really just is a matter of time. If you do only one thing today, if you run Netscaler with Samuel, update it again, thanks for watching. Sources are in the show notes. Like, subscribe and share the show with a friend. I'm Jerry Bell and I'll see you again tomorrow.