Latest / Daily DefSec Brief / Cyber Security News for August 31 2026 - Daily DefSec Brief
Transcript
- Jerry: Papercut Zero Day turned out to be two flaws chained together, and together they hand an unauthenticated attacker remote code execution inside the print server. The first emergency patch went out on Friday, and the second one went out later the same day. This is the Daily DefSec brief. I'm Jerry Bell with a day security news in five minutes for Monday, August 31st, 2026. 18 items on the board today. 1. Papercut NG and MF have two flaws that chain to let an unauthenticated attacker rewrite the server's trusted configuration and run arbitrary Java inside the application. It's being actively exploited. apply the second emergency patch, which shipped on Friday and now covers version 24. And hunt for the published indicators. Two. Rails has an arbitrary file read that leaks application secrets and reaches remote code execution. And VolneCheck says attackers are using it actively. The fix has been out since late July, so if your app uses libvips for active storage and takes uploads from strangers, patch and run the forensics tooling Rails published. 3. Attackers planted a self-spreading credential stealer in OpenAI React Query Coden. An MPM package with 150,000 weekly downloads. Rotate MPM tokens on any machines that installed it and install with scripts off. four. Signia is tracking a China League group called FireEnt moving across VMware hypervisors into Cisco iOS XR routers and TACX servers, harvesting credentials and suppressing the logs. The first clue was a tunnel interface with no commit behind it, so compare active tunnels against your running config. Five. A path traversal in AWS's system manager agent's download content plugin lets a user write files anywhere on the box as root. Upgrade the Amazon SSM agent everywhere it runs, including on-prem. Six. Microsoft is tracking a clickfix variant terminal fix where a fake Cloudflare captcha talks users into pasting a PowerShell command into Windows terminal, ending an active directory recon in a reverse tunnel. Alert on terminal running pasted encoded commands and tell people no verification check needs a terminal. Seven. Unit 42 watches operators use external Teams accounts to pose as the help desk and talk people into running remote management tools. One variant escalated into an NTLM relay against the domain controller. Restrict Teams Federation to approve domains and enforce SMB signings. Eight. Commodity info stealers like Vidar, Luma, and Redline are copying live login cookies off of infected machines and using the sessions without touching a password or an MFA prompt. Treat any info stealer hit as a session compromise and reissue tokens for every SaaS application on that machine. nine. Socket found nineteen Chrome and Edge extensions serving malware. Pushed as an automatic update once the install base was big enough. Inventory what your users have and move to a policy allow list. Fourteen the operator wrote and five they bought from people who built them. ten. ESET found Russian operators writing comments into a VBS downloader designed to trip an AI assistance safety filters. So AI assisted analysis stops before it reaches the payload. When a tool refuses a sample, send it to a human or a sandbox and alert on the refusal. Eleven. Census found a loader serving PowerShell over port 80 that pulls down a file every basic check reads as an MP4 with six and a half megabytes of encrypted net support client inside. Alert on PowerShell fetching media over HTTP and flag net support clients you didn't deploy. Twelve. A two month campaign hid obfuscated JavaScript and SVG files dressed as voicemail attachments, pushing more than twenty six thousand messages past gateways into more than five thousand organizations. block inbound SVG attachments. It ran in waves and mostly took weekends off. thirteen. Kaspersky found a Valorat backdoor shipping as signed adware, a category users routinely add to their own exclusion lists so features don't get blocked. Audit your AV and EDR exclusions for AdWord entries somebody added by hand. fourteen, Metasploit's latest release adds 16 modules including an arbitrary file read in Forge Joe and exploits for tenable, flow wise, checkpoint and lang flow. fifteen, a flaw in Composer lets a malicious PHP packets change permissions on files outside its own install directory, which on a shared host reaches SSH keys. Update Composer per the advisory and assume any key the composer user can reach is exposed. 16. The UK's NCSC says a range of actors are targeting operational technology globally, and the exposure comes from misconfigurations, legacy connections, and unmanaged assets. Scan your OT ranges from outside and reconcile what answers against your inventory. Seventeen, CISA published what it learned red teaming two partners, naming Operational Silos, Technology Sprawl, and Cloud Blind Spots is what let its team take domain privileges at one of them. The lessons here are worth a read if you're responsible for security operations. eighteen a Defender update is making the Windows Security app report that antivirus is turned off on machines where it is running fine across every supported Windows version. Check real protection state from your EDR console and brief the help desk before users learn to dismiss that one. that's Monday for you. Sources are in the show notes. If you want to read further, if the show is useful, like it, subscribe, and send it to someone who'd use it. Thanks for watching, and I'll be back again tomorrow.