Latest / Daily DefSec Brief / Cyber Security News for September 16 2026 - Daily DefSec Brief
Transcript
- Jerry: If you run WSO2's API Gateway, today's the day to get that five-month-old patch off the risk register and onto the system. Happy hump day. This is the daily DevSec brief for Wednesday, September 16th, 2026. 1. Anyone who can reach a WSO2 API gateway Can sign a token with an algorithm the product doesn't support and the gateway validates it and hands back administrator. Watchtower caught forged admin tokens arriving at its honeypots over the weekend, and the fix has been on WSO2's website since the first week of May. Apply the update level for your version, then rotate every consumer key and secret on the gateway. Two, somebody on an adjacent network with basic privileges on a pixel phone can escalate through a logic error in the cellular modem with no user interaction and Google says there are indications it's under limited targeted exploitation. That means somebody near the handset rather than somebody who fished it. Push the September update to your Pixel Fleet through MDM and confirm it landed. The same release closes over a hundred other flaws, including a dozen of them that have remote code execution. Three. A Brazilian banking Trojan installs its own browser extension by writing it straight into Chrome's secure preferences file, switching on developer mode and forging the integrity hashes. It skips the web store and steals credentials and live session tokens. Elastics Sinkhole counted about 1500 infected machines. Block sideloaded extensions with an allow list policy rather than a block list and alert when developer mode is switched on. Four. A standard Windows user can get system through Logitech Options Plus. The updater service trusts a process the user controls, then loads an installer from a user-supplied path without checking the certificate. No admin rights, nothing to click, upgrade it fleet-wide, the fix shipped back in mid-August. Five, a local user on a machine running the global protect app can escalate the system on Windows a route on Mac and Linux. Palo Alto says the fix needs PanOS or Prisma access upgraded. Alongside the client, in patching only one of the two leaves the exposure open. Prisma access tenants get it at the next maintenance window unless they ask. Six rounding out the privilege escalation bugs An unprivileged account on a Mac running Parallels Desktop can get root because the root helper listens to a world writable socket and builds this unpack command by splitting a string. a quote in a path becomes a program that tar runs as root. Upgrade to Parallels twenty seven out since the first of September. Seven. Oracle's September patch update covers nearly 700 flaws across 17 product families, more than 100 of them critical with eBusiness Suite taking the biggest share. Start there and with anything internet facing and book the window now. These land monthly. Eight. An incident response firm looked at more than eight hundred organizations. and found only four that came close to their own ransomware recovery target. Almost none had an identity recovery plan written down, which is awkward because compromised identities are usually how the ransomware was delivered in the first place. Run one full restore end to end, if you're able. Nine, the low grade Chinese language gambling sites in your proxy logs. InfoBlox tracks about one point seven million of them, can be command and control for espionage and malware distribution. If those domains turn up, stop filing them under acceptable use and check whether the connections are regular and repeating rather than browsing. 10. Candidates using a false identity get through pre-hire screening and start the job in about four out of ten cases. And the average one is just under six days of unmonitored network access before anyone notices. Verify identity at the point credentials are issued, not only during screening. 11. Census scanned the internet for Mythic, the post-exploitation framework, and found 131 servers running it. 115 were still presenting the TLS certificate that the installer ships with. Alert on that certificate. And on port 7443 with a self-signed cert. Some of those hosts are authorized RUD teams who are apparently not awesome at their jobs. If you do only one thing today, apply that WSO2 update for your version. The fix has been out since the first week of May. That's the daily Death Sect brief for today. I'm Jerry Bell. Thanks for watching. Sources are in the show notes. Like, subscribe, share the show with a friend, and back again tomorrow.