Latest / Daily DefSec Brief / Cyber Security News for September 30 2026 - Daily DefSec Brief
Transcript
- Jerryout of: Self-service password reset portals are hard to get right. Recovering from a breach of your Kubernetes clusters might be even harder. This is the daily DevStyp briefer. Wednesday, September 30th, 2026. One, Microsoft says a group it calls Storm3068 got into one user's account through a self-service password reset portal. Then it registered its own sign-in methods. From there it built an Azure DevOps pipeline that collected the credential files for the company's Kubernetes clusters. It used no exploit, only a remote management agent and a tunnel. Set an alert for a password reset that's followed by a new sign-in method. Two, the Python SDK for Amazon Bedrock Agent Core lets a crafted package name run commands in the core interpreter sandbox. If that sandbox has an AWS role attached, Those commands can read the role's temporary credentials. It only works where untrusted input reaches the SDK's package installer. Amazon's first fix was bypass two, so upgrade the SDK to the latest release. Three, anyone who can edit a project in a self-hosted octopus server can run code on the server itself. That server usually holds the credentials for what it deploys to. Octopus Cloud is already patched and there's no workarounds, so upgrade your self-hosted servers. Four. OpenSSL can hand a remote peer leftover heat memory in plain text when a DTLS handshake stalls or it can crash. The peer doesn't need to log in. That matters most in VPNs, voice and IoT products built on OpenSSL. Update OpenSSL wherever DTLS is used, including inside those products, and you better chase after your vendors too. Five. An attacker used stolen staff passwords to take data on about three hundred fifty thousand French taxpayers and a quarter million businesses. The tax agency's staff portal asked for a password and nothing else. The ministry says its checks missed the theft because the attack was sophisticated. France's cyber agency looked and found it wasn't all that sophisticated. Require multi-factor on every portal your staff and partners use. Six. Microsoft shipped a pretty cool new feature on Tuesday. Built-in Linux containers in WSL. Any machine that already has WSL gets it with an update. I suspect it won't be long before attackers use it to keep a foothold after a break-in. Unless your EDR is set up to look inside WSL, what runs in those containers is hard to see. Intune has new settings to turn it off or limit where the images can come from, so set one up now. Seven, developers asked coding agents for before and after screenshots on private repositories. And the agents couldn't attach images from the command line. So they put the screenshots in public GitHub repositories instead. Researchers at Glow Security found more than 13,000 of these screenshots from over 300 organizations. One showed a firm's internal treasury and settlement console. Stop coding agents from creating public repos or pushing to personal accounts. Now in fairness to the agents, someone did actually ask to see the screenshot. If you do only one thing today, alert when a password reset is filed by a new sign-in method. Thanks for watching. Sources are in the show notes. Like, subscribe, and share the show with a friend. I'm Jerry Bell, and the daily DefSec brief is back again tomorrow.