Latest / Daily DefSec Brief / Cyber Security News for October 9 2026 - Daily DefSec Brief
Transcript
- Jerry: Old Teams messages turns out to have a price. Today's last story has the number and the buyer. This is the daily DefSec brief for Friday, October 9th, 2026. One attackers are breaking into AhsayCBS the backup console that a lot of MSPs run, and there's no patch. Two chained flaws get them code execution as system with no login. They've been dropping web shells and crypto miners since Wednesday night. The miner is the noisy part and the web shell is the part that matters. Take AhsayCBS console off the internet and limit it to trusted addresses or your VPN. Two, agencies from seven countries have published How a China linked crew gets into networks. They exploit old flaws, some as old as Shell Shock from 2014. They also password spray Microsoft 365 and exchange accounts through almost every way into Exchange from Outlook on the web to PhoneSync. Once in, they installed the Soft Ether VPN client. They name the installer after a Windows process and then pull out mail. ShellShock turned 12 this year and it's still finding work. Set an alert for VPN software turning up where you did not deploy it. 3. Netscaler has a new critical flaw in its SAML handling, and an attacker doesn't need to log in to reach it. It can mean code execution or a crashed appliance, and hybrid secure private access setups are hit too. Citrix isn't aware of it being exploited. Last week's zero-day fix isn't enough this time. If your Netscaler is a SAML identity provider, that build is still exposed. Update every Netscaler running SAML. 4. Anyone who can reach an Ollama server can plan a file that runs as root the next time it restarts. That's true in most of its Docker setups. The model download feature doesn't check where it's writing. An attacker can point it at the folder Ollama loads its own libraries from. A planted file runs on the next restart, so check that folder before any restart. Upgrade Ollama and look in that library folder for anything you didn't put there. Five, Cisco's on-premise license server lets anyone reset any account's password, administrators included without logging in. A second critical flaw lets them write files. The same advisory fixes a bug that lets an admin run commands as route. So a reset admin password is worth more than it sounds. There's no workaround upgrade Cisco license on-prem. Six. Ransomware took down a region of IDCF Cloud, a Japanese cloud provider earlier this week. Almost 500 companies in local governments use that region. The provider has also turned off customer access to its management consoles in every region while it checks them. So customers who weren't hit can't reach their own consoles either. Test a restore that doesn't depend on your provider's console. 7. A delegated admin in HashiCorp Vault could get past the deny rule by changing the capitalization of a name after a recent update. Vault check the rule against the name as typed. Then normalized it afterwards. After the upgrade, a rule with capital letters in the name stops matching. So rewrite those names in lowercase before you upgrade. Skip that step and the patch quietly switches those deny rules off. eight. The operator behind the fake Git campaign pointed more than seventeen thousand GitHub repositories at malware this month. Nearly every change researchers sampled touched only the README. Most pointed its download button at a zip that installs the smart loader malware. Takedowns missed most of the repos, and at least 700 of the accounts seem to belong to real developers. Use application control on developer workstations to mitigate that risk. who am I kidding? We have to let developers run anything they want, right? 9. Let's encrypt certificates drop from 90 days to 64 days in February, and the staging environment starts issuing them this week. Renewals done by hand or on a schedule written for 90 days can start letting certificates expire. Point one of your renewal clients at Let's Encrypt Staging next week and see what breaks. 10. Spirit Airlines said in May it would shut down. Now it wants to sell Google about 100 million emails and 500 million Microsoft Teams messages. Employment contracts and payroll records are in the deal too for $10 million. Google wants it to train AI and says it will strip out personal details first. 114 members of Congress have asked both companies to stop. Their point is that removing names doesn't necessarily make a dataset like that anonymous. Everything a company keeps is something it can sell when it fails. Set a retention limit on your Teams chats and probably your email. Somewhere in there, by the way, a model is about to learn that a meeting could have been an email. If you do only one thing today, take your Ase CBS backup console off the internet. Thanks for watching. Sources are in the show notes. Like it, subscribe, and share the show with a friend who'd use it. We're back again on Monday.