Latest / Daily DefSec Brief / Cyber Security News for October 2 2026 - Daily DefSec Brief
Transcript
- Jerry: Most users skip the install instructions. Today an attacker wrote instructions good enough to talk you past your Mac's protection. Happy Friday, my friends. This is the daily DefSec brief for Friday, October 2nd, 2026. One, attackers are writing files onto Fortimail email gateways without logging in. Fortinet has announced fixed releases but hasn't shipped them yet. Until it does, one workaround is to take the management interface off the internet. The other workaround and the files to look for are on the slide. Two The crew behind Warlock Ransomware is still breaking into on-premise SharePoint, likely through last year's ToolShell flaws. Symantec says the group hit at least four organizations in the past two months, including a water utility and a telecom provider. Once inside, it steals SharePoint's machine keys, which let it forge requests the server trusts. The ToolShell fixes have been out since July of last year. Patch to current and then rotate those machine keys because a patch doesn't take back keys that were already stolen. Three, Kiteworks fixed one hundred twenty six flaws in its latest updates. The worst could let anyone who can reach its email protection gateway take it over its route with no login. None are reported as exploited. Last weekend, Kiteworks asked customers to shut down their systems over a credible threat. Upgrade to the current release, four. Dayforce payroll has two flaws that need no login. One is SQL injection through the password recovery page. The other reads any file off the server. Cert Polska says it couldn't reach Dayforce, so there's no word on a fix yet. Payroll holds your employees' bank details, so ask Day Force in writing whether these are fixed in your environment. Five, just selecting a model in Unsloth Studio ran Python code from that model's repository before the model itself even loaded. That code would run with the developer's access to tokens, SSH keys, and cloud credentials. Unsloth fixed it in June, but published no CVE or advisory because it calls Studio a beta. Studio shipped in the regular Unsloth package on PyPi, so upgrade that package. Six, a fake zoom installer from Macs comes with pictures to help the user through the install process. They walk the user into system settings to click open anyway and type in their admin password. Then the installer asks for the password itself, checks that it's correct, and hides it in a fake settings file. It uses that password to launch a backdoor. Jamf which found it. Calls the backdoor CloudSync D. JAMF hasn't seen victims yet, but the samples point at working servers. It only works on someone who has an admin password and can install their own software. So deliver Zoom and other software through your MDM and keep everyday users off of local admin. Honestly, this is the friendliest setup wizard I've seen in a little while. If you do only one thing today, take Fortimail's management interface off the internet. Thanks for watching. The sources are in the show notes. Like, subscribe and share the show with a friend. I'm Jerry Bell. Have a good weekend and I'll see you again on Monday.