Latest / Daily DefSec Brief / BeyondTrust zero-day exploited, Atlassian flaw under attack | Cyber Security News Oct 16
Transcript
- Jerry: Passwords left in old code repositories keep getting found. Today by something new. Happy Friday, my friends. This is the daily DefSec brief for October 16th, 2026. If you only do one thing today, patch Beyond Trust Remote Support and review it for compromise. One, a suspected Chinese espionage crew has been exploiting a zero-day in Beyond Trust remote support since late August. Anyone who can reach the appliance can write files to it. Google says the crew got root, went after the appliance's password vault, and used the appliance to open sessions on computers it manages. That box holds every credential it hands out. Beyond Trust patched its cloud customers last week. Self-hosted appliances need the patch applied. Patch it today. Google says to treat any internet facing one as compromised until it's been reviewed. By the way, if anything from this week's show changed what you did, tell me at feedback at defensive security.org. Thank you. Number two, an update. attackers are now exploiting the Atlassian Data Center flaw we covered last week. Anyone who can reach the server can read files from the web root of Jira, Confluence, Bitbucket, and five more. CISA added it. To the exploited list yesterday. Patch at Lassian Data Center or take it off the internet until you can. Three, no attacks yet, but three critical office flaws in Outlook and Word can run code from the preview pane. Microsoft published them on Thursday along with 27 more Office flaws. The fixes shipped in Tuesday's update. Make sure that update actually installed, especially where Office updates lag behind Windows. Think of it as Tuesday's patch with Thursday's paperwork. 4. The Aoki InfoStealer now takes developers' tokens for AI coding assistants like Claude, Codex, and Cursor. It takes AWS keys too. With those, an attacker works as the developer in their own repositories, cloud accounts, and build pipelines. Keep long-lived tokens off developer laptops, Short lived ones tied to single sign on expire on their own. Five, no attacks yet, but Drupal core has a critical flaw in its field UI module that can run code on the server. Some add-on modules open a path to it and anyone who can reach the site can use at least one of them. More than a quarter of the sites that report their version run branches that get no fix at all. Update Drupal Core. If you can't yet uninstall the field UI module until you can. Six, someone is breaking into old NAS boxes and video recorders and renting out their internet connections as residential proxies. That's at least 143 devices in 34 countries. A sign-in routed through one looks like it came from an ordinary address in a believable city. A familiar-looking address in your sign-in logs proves less than it used to. Take NAS boxes and recorders off the internet and replace the ones that are end of life. Your forgotten DVR may have a side hustle. 7. No attacks yet, but Next.js shipped an out-of-band fix for two critical code execution flaws. Each needs a feature switched on. One hits version 16 apps that use cache components. The other hits apps that handle uploaded SVG images on Linux. Update Next.js even if you think neither feature is on. eight. An ad company working for spyware maker Candiru used ordinary online ads to target at least forty five devices at Al Jazeera. The targets didn't have to click on anything. Each ad reported the phone's advertising ID and internet address. Only targets got attack code in return. Company's ads also appeared on government networks, likely including the US Defense Department. Block ads on managed phones and browsers with DNS filtering on your device management. 9. No attacks yet, but Nginx fixed five flaws, and one of them has been in every release since 2005. Three can crash Nginx and possibly run code. One can forge a TLS session past. Client certificate checks. Each needs a setting that you added. One is a TLS session cache, and Nginx's own documents recommend it. Upgrade Nginx. 10. India's CERT says AI agents being tested online got into real systems at Indian organizations and went through their business records. They use credentials left in public code and app configurations, and cloud roles with too much access. None of the organizations noticed. The AI companies found it in their own reviews and reported it. Search your code and commit history and pipeline settings for credentials and rotate anything you find. Credit to the AI companies for turning themselves in. Most intruders skip that step. Once more, patch Beyond Trust Remote Support and check it. Thanks for watching. The sources are in the show notes. Like, subscribe, and share the show with a friend who'd use have a good weekend and we'll be back again on Monday.