Latest / Daily DefSec Brief / VeloCloud zero-day exploited, Railway secrets breach, M365 token replay | Cyber Security News Oct 23
Transcript
- Jerry: Finding the firewall's admin password was the easy part of this audit. The meeting afterward ran over an hour. This is the daily DefSec brief for Friday, October 23rd, 2026. 1. Attackers are already exploiting a flaw in Arista's on-prem VeloCloud Orchestrator. Any logged in user can make themselves a super user. Even the lowest read-only role is enough. From there, an attacker may gain access to every SD-WAN edge the orchestrator manages. It's the third exploited Orchestrator Zero Day since July. Attackers could use the first two before signing in. The fixes shipped yesterday, patch it, and keep its web interface on your admin network. If anything from this week's show changed how you work, tell me at feedback at defensive security dot org. Number two Huntress saw attackers replace stolen Microsoft 365 sign-in tokens against 79 customer organizations, mostly from one block of hosting addresses. The tokens were stolen after the victims had passed MFA. Whoever holds one is already signed in. The attacker also registered its own devices and its own MFA methods in the tenant. A pass or reset leaves both of those in place. Search your sign in logs and your SIEM back to July for that address range. 3. Railway hosts apps for developers, and it says an intruder may have decrypted some customers' stored passwords. It's asking every customer to rotate every key and password they keep there. Railway calls it part of a series of attacks on platform companies. It thinks the real target is AI inference providers. Separately, the hosting provider Zeabur says Its own intruder this month was mainly after AI service keys. Rotate every secret you keep in railway. four an update on a story we covered yesterday and there are no attacks yet. A certificate authority called eMudra generated signing keys so weak that one of them was the number four. Chrome stops trusting eMudra's route on Tuesday. That breaks about 30,000 legitimate certificates, nearly all from a certificate service for universities. Oracle also shipped an emergency Java update that blocks the week certificates. Replace any certificate that chains to eMudra and update Java. Five and update on yesterday's LiteLLM story. Attackers hijacked Lite LLM's release pipeline and shipped a version with a credential stealer. LiteLLM now says it believes the attacker got in with GitHub tokens sitting in his own gateway's logs. it says it has seen Claude Code put a developer's GitHub token into a response passing through the gateway. A gateway that logs responses can end up keeping a copy. if your AI gateway logs response bodies, turn that off. Six, no attacks yet, but anyone who can reach no machines web service can run code on the machine. Web Access is on by default in its enterprise server products, NoMachine says. The fix has been out since September 14th. Upgrade NoMachine and keep its web port off the internet. 7. No attacks yet, but Splunk fixed four critical flaws in Splunk Enterprise and SOAR. At least three need only a low-privileged login. Splunk holds your logs and your detections. It's Splunk's second critical release in Two weeks. Upgrade Splunk, Enterprise, and Sore. Eight. No attacks yet, but RoundCube fixed 20 security flaws in its webmail. They include ways to slip commands into its connection to the mail server. Twenty fixes and no CVEs. Your scanner will be the last to know. Upgrade RoundCube. 9. No attacks yet, but details of two Linux kernel flaws went public before the kernel shipped a fix. They're in KSMBD, the kernel's built-in SMB server. Trend Micro rates both as remote code execution. For anyone who can reach the server on port 445, one of them works. Red Hat doesn't ship KSMBD, Debian and Ubuntu leave it switched off until someone installs its tools. Turn off KSMBD wherever it isn't needed. ten. A penetration tester auditing a large US pharmacy chain checked the admin password on its internet facing Cisco firewall. It was the word password. He read it straight out of the config because Cisco's type seven storage is reversible. Arguing that it shouldn't be a medium, the IT team spent over an hour. It turned out the audit department had set the IT team's bonuses and any high finding cancelled them. Search your Cisco configs for type seven passwords and replace them with hashed secrets. Also, don't create incentives for people to hide or downplay vulnerabilities. A medium rating, by the way, would have left the password exactly as strong as it was. Thanks for watching and have a great weekend. The sources are in the show notes. Like and subscribe if the show helps and share it with a friend who'd use it. Have a good weekend and we'll be back again on Monday.