Latest / Daily DefSec Brief / Cyber Security News for August 19 2026 - Daily DefSec Brief
Transcript
- Jerry: There's active exploitation of a Windows Ike RCE that's accessible on ports designed to be exposed. Meanwhile, AI keeps finding and coughing up new flaws faster than anyone can patch them. So today's list is a little bit of both. This is the Daily DefSec Brief. I'm Jerry Bell, the day security news in five minutes for Wednesday, August 19th, 2026. Fifteen items on the board today. One, there's a double free in the Windows Ike service extensions that lets an unauthenticated attacker run code with crafted packets on UDP five hundred or forty five hundred and it's being exploited in the wild right now. It hits every supported Windows client and server release and patches are available. Two, that Mac OS screen sharing auth bypass we covered on Monday is now in the Kev catalog with active exploitation. Apply Apple's fix by Friday and restrict screen sharing exposure until you do. Three, two more are under active attack in unauthenticated SSRF in ML flow that reaches cloud metadata endpoints to steal creds and a missing auth flaw in FUCSA SCADA That allows unauthenticated file rights. Patch or upgrade both and get them off the internet. Four. There's a zero day in the cursor IDE on Windows where a malicious git.exe planted at the repo route runs the moment a developer opens the project. No prompt injection, no AI in the loop, just opening the folder. Five. Three flaws in Microsoft Copilot personal chained together so a single click on a link silently pulls data from your connected apps. Microsoft patched this yesterday and there's nothing to do but perhaps take note of what Copilot has access to. Six. Chrome's stable update fixes fifteen flaws including critical buffer overflows in WebGL and ON. 7. Firefox 154 patches 58 CVEs, including six use after free and multiple memory save bugs that could allow code execution. I brought these up because it seems like the vulnerability count's starting to return to normal on these browsers. Meanwhile on the other side of the fence, eight! Oracle's monthly drop covers 925 CBEs, about 90 of them at CBSS 9.8 or higher, with WebLogic flaws that allow unauthenticated full server takeover. Over 460 are remotely exploitable without Auth, so start with the WebLogics and Fusion Middleware fixes and work down from there. Nine, a modular Python implant called TwinLoot runs its entire command and control inside Microsoft Cloud, tasking through SharePoint deadrops over the graph API and routing operator access through Teams Turn servers. Hunt for headless edge instances, making graph API calls and unexpected SharePoint dead drop activity. ten. NASA's AIT GUI ground console binds to all interfaces and lets an unauthenticate attacker issue spacecraft commands and run server-side scripts. This is a good reminder to keep your satellites patched. 11. Two high severity flaws in beyond trust endpoint management lets a local attacker elevate privileges or bypass the anti-tamper controls. Twelve. Researchers found over 50,000 unique Stripe merchant keys sitting in public repos, CI logs, and misconfigured servers, with some still active in 659 accounts tied to 35GB of customer data on a trading form. Scan your repos CI logs for Stripe keys. Rotate anything exposed now and tighten the keyscopes. Stripe itself wasn't touched, the keys were just left out. thirteen, Slovakia's Cyber Authority says Nero R one traffic speed cameras carry a backdoor that runs code sent by SMS from hard coded Russian phone numbers. Makes you wonder where else this sort of thing's gonna turn up fourteen, Rapid Sevens Q two report. argues that rising disclosure volume, faster POCs, and quicker weaponization are overwhelming standard patch cycles. There's no patch here, just a nudge to prioritize by exploitability instead of raw CVE count, and lean on compensating controls when you can't patch in time. And no, the risk register is still not a compensating control. fifteen Anthropic and EPFL demonstrated a self propagating payload that hides in an agent's editable system prompt file and spreads to other agents reading shared state tested across a six agent setup. nothing in the wild yet, so treat system prompt files as untrusted state. That's the board for today. All the sources are in the show notes below. If this was useful, please give me a like and subscribe and pass it on to someone who put it to good use. I'll be back again tomorrow.