Latest / Daily DefSec Brief / Cisco email gateway exploited, PAN-OS zero-day, Zimbra send-as flaw | Cyber Security News Oct 15
Transcript
- Jerry: Developers lean on their package manager to fetch the right code. Most package managers just take whatever the server hands them. This is the daily DefSec brief for Thursday, October 15th, 2026. If you do only one thing today, push the content scanner updates to every Cisco secure email gateway. 1. Attackers are already exploiting a flaw that gives them route on Cisco secure email gateways by sending an email. A crafted attachment is enough if file reputation is turned on. since September 14th inside what Cisco calls a hardening release. Push the content scanner update today. Then run Cisco's compromise check on every gateway. By the way, this is the second exploited flaw in that gateway in a month. There seems to be a broad trend of vulnerability fixes released without mentioning the vulnerabilities fixed, by the way. Two, a PanOS Zero Day is being used to run code as root on Palo Alto firewalls and panorama. An attacker needs a valid login to use it. any firewall that was hit had already lost a management login to somebody. Palo Alto calls the exploitation very limited And the patch is the only fix. Most of the patches shipped yesterday. Install them and keep the management interface on your admin network only. Three. An update on the Ahsay CBS backup console that attackers have been breaking into since October seventh. That's the console that a lot of MSPs run. Ahsay now says its first patch left the two flaws they're using open. There's a hotfix now, and Huntress has checked that it blocks the way in. Apply the hotfix and reboot. By the way, the hotfix sits behind the partner portal login, and that's one more login than the attackers needed. Four, attackers are planting web shells on Nextcloud servers through the built-in Collabora app. Whenever the App's document servers down, like right after a restart, anyone on the internet can run commands on the next cloud server with one request. Disabling the app leaves it exploitable, so update it or remove it. The fix has been out since September 11th. 5. There's a public proof of concept for a Linux kernel flaw that gives a local user route through the vhost device. That's the part that speeds up networking for VMs and containers. It covers nearly a decade of kernels. In one virtual machine setup, a guest can write into the host's own VM process. The fix has been out in stable kernels since August. Update and reboot your Linux hosts. The reboot is the part that tends to get skipped. Six. proof of concept code is built for a Zimbra flaw that lets any logged in user send mail. As any other user. It passes SPF, DKIM, and DMARC, and lanes in the impersonated user's sent folder. A second flaw lets a user read anyone else's mailbox and calendar through Exchange web service where that's turned on. Those are two of the first five Rapid Seven has written up out of more than eighty it reported. The fixes have been out since May and July. Upgrade Zimbra. Seven, exploit coded is public for a curl flaw, the project's first high severity bug since twenty twenty-three. A server receiving an upload over HTTP/2 Can crash the client while uploading to it. With enough knowledge of the client's build, it can run code on it. Update curl and watch for libcurl updates from your vendors. 8. A poisoned repository could use Claude Code Desktop's preview pane to read your SSH keys and cloud credentials. Ask Claude to review a large HTML file and the file's own script ran with access to your files. Anthropic fix it in August before this week's disclosure. The long lived secrets on a laptop are what made it worth doing. Get those off of developer machines. 9. No attacks came of it. But a researcher at XBOW using a public AI model built a working Chrome exploit in six days. That was after months of groundwork. Google's fixed all three bugs it chained. The compute cost about forty thousand dollars. The bounty paid about two hundred and fifty thousand dollars. Not a bad week. Make sure Chrome relaunches within days of an update, not at a month end. 10. Trail of Bits tested 25 package managers against a fake compromised repository that slipped code into packages. Two of them, Go and VCPKG, caught it out of the box. Nine more caught it only with a lock file checked in. That's NPM, cargo, and friends. Five more needed extra setup. Nine let it straight through, Maven and Composer among them. Commit your lock files And have CI install from them in frozen mode. And Perl's CPAN minus has fetched packages over plain HTTP for years because switching would be a breaking change. But so would the malware. Once more, push the Cisco content scanner updates. Thanks for watching. Sources are in the show notes. If it helped, like, subscribe, and pass the show to a friend who'd use it. I'm Jerry Bell and the Daily Def Sec Brief will be back again tomorrow.