Latest / Daily DefSec Brief / Cyber Security News for July 29 2026 - Daily DefSec Brief
Transcript
- Jerry: Someone knocked operational technology controls offline at more than 30 Minnesota water systems, and separately a 20-year-old flaw is leaking password hashes off of 24,000 exposed servers. This is the Daily Def Sec brief. I'm Jerry Bell, the day's security news for Wednesday, July twenty-ninth, twenty twenty-six. Fifteen items on the board today. One, attackers hit OT controls at more than 30 community water systems in Minnesota, shutting down automated control and in at least one city knocking a treatment plant offline. Isolate OT from IT and the internet, verify your manual fallback for control functions, and hunt for unauthorized remote access on your SCADA and HMI hosts. 2. A 20-year-old flaw in the IPMI 2.0 handshake returns password-derived hashes before you even log in. And a researcher found evidence of exploitation across roughly 24,650 internet-exposed BMCs. Pull those management interfaces off the public internet. Onto a management VLAN, replace the default and weak passwords, and restrict access to trusted admin hosts. Three, there's a critical Gidea bug where a user with ordinary repository write access can turn attacker controlled patch content into a live git hook and run shell commands as a service account. Upgrade to 1.27.1 now and if you can't, disable open registration and review who has repo write access. Four, a crafted DHCP V6 request overflows a stack buffer in OpenWRT's ODHCPD, which runs as root, and there's a public Python proof of concept. Install 24.10.8 or 25.12.5 through the firmware selector and restrict DHCP V6 reachability when you can't patch right away. Five, a malicious version of the advanced responsive video embedder WordPress plugin runs before authentication, hands unauthenticated attackers full admin, and phones details back to a situation. Check your version, roll back to 10.8.7, look for PHP fn dash update dash check.php, and rotate admin credentials if you find them. Six. Two compromised JoyFill MPM packages carry an import time implant that resolves its code through blockchain transactions and drops a rat when Node loads the package. Purge those beta versions, pin to known good releases, and treat that multi-blockchain resolver pattern as an indicator in your pipeline builds. 7. Speaking of poison packages, another set of malicious NPM packages imitates private Alibaba package names and pulls in a cross-platform rat at install time. Scope block your internal package names, verify dependency sources, and watch your registry for typos squatted private names. eight. ATT's Aeris BGW210 700 gateway on firmware 2.7.7 and earlier. Let's an unauthenticated LAN user. Read, config, and change settings, and there's a public proof of concept. Confirm your firmware is newer than 2.7.7 and for stragglers, force an update or replace the unit. Nine. Microtic router OS has no meaningful rate limiting or lockout on its API authentication, so attackers can just hammer away guessing passwords. Restrict the API to trusted IPs or disable it if you're not using it and enforce strong, unique admin passwords. 10. Siemens DeZigo CC ships a stack overflow in bundled OpenSSL that allows denial of service and potentially remote code execution. Update V9 to 9.0.1 and for V7 and V8, apply Siemens recommended countermeasures until a fix ships. 11. A Mirai derived Linux botnet called Tengu spreads over Telnet, and when you kill its main process, It trips the hardware watchdog to force a reboot, so its other persistence mechanisms bring it back. Disable telnet and enforce strong credentials. And on cleanup, disable watchdog trigger reboots so a process kill actually sticks. And perhaps don't try to clean up hacked systems. 12. An attacker seized DNS control of the Q pilot drone software domain and obtained valid TLS certs for every subdomain. So redirected traffic shows a clean HTTPS lock when landing on attacker infrastructure. Treat recent downloads from that domain as suspect and lock down your own registrar and DNS with registry lock and MFA. 13. Apple's July release fixes 187 flaws across iOS, Mac OS, and Safari, including remote code execution, sandbox bypass, and privilege escalation. Push the current updates across your fleet and prioritize the older Mac OS branches still in use. 14. Source code for the Flying Eagle Android Rat is spreading in criminal telegram channels with control panels mapped to 170 servers and it captures payment passwords, keystrokes, screen, and camera through fake app prompts. Block the identified infrastructure fingerprints and reinforce siloading restrictions and MDM controls on your managed Android devices. fifteen. CESA, the ACSC, and FBI released joint guidance on isolating vital OT, Which is timely given the Minnesota water story up top. Use the checklist to map your OT to IT dependencies and pre-stage isolation points in manual runbooks before you need them. That's the board for today. Thank you for watching. All the sources are linked in the show notes below. And if the show's useful to you, a like, a subscribe, and a share with someone who'd use it all help. Back again tomorrow.