Latest / Daily DefSec Brief / Cyber Security News for July 31 2026 - Daily DefSec Brief
Transcript
- Jerry: Threat actors are locking water utilities out of their own PLCs, forcing operators to run plants by hand. If you've got exposed OT, today's first job is pulling it off the internet. We've also got news of more clankers launching successful attacks. This is the daily DevSec Brief. I'm Jerry Bell, the day's security news for Friday, july thirty-first, twenty twenty six. Fifteen items on the board today. 1. CISA's warning that threat actors are changing PLC passwords and IP addresses at water utilities, locking operators out and forcing manual operations and boil water notices. Get any publicly exposed PLCs and OT off the internet now and validate your cellular modem and external connections, even if you think your program is mature. Two, there's a critical SAML SSO authentication bypass in SolarWind's web help desk that lets an attacker in without valid credentials. It's theoretical for now, but it's a 9.8, so it's time to update. 3. The SGLang model serving framework has six flaws, including an unauthenticated remote code execution, There's no vendor patch, and coordination didn't work out, so restrict network access and keep those endpoints off the public internet until it fixed ships. Four, PHP patched a high severity SQL injection in the Postgres extension, plus memory corruption bugs in BC Math and FAR. Update to the latest patch release, especially if your apps handle untrusted input or uploaded archives. Five, researchers found a Gremlin sandbox escape in Azure Cosmos DB that reached a multi-tenant gateway and pulled a platform wide signing key. Microsoft fully remediated this one across regions, so there's no customer action. I'm flagging it just for awareness of how big the blast radius gets on a shared surface. 6. A new version of XCS set Mac OS malware hides its core logic in memory using fileless persistence and spreads through Trojanized Xcode projects and GitHub repos. Vet your Xcode projects and third-party repos before building and hunt for anomalous in-memory execution and build-phase tampering on your Mac dev machines. 7. A North Korean link campaign is running macOS malvertising with a full-screen fake update that copies a command to the clipboard and asks the victim to paste it into the terminal. Tell your users to never paste a command from an update prompt and hunt for suspicious OSA script and terminal execution. 8. A state-sponsored campaign is exploiting a flaw in the Korean AnySign for PC security software through compromised trusted sites, dropping DPRK backdoors with no prompt and no download. Get it updated or remove it. 9. A Chinese-speaking actor built a deep-seek power to agent called Hermes that finds internet-facing servers and tests public exploits with almost no human input, and it's already caused real data theft. This hit exposes Langflow, N8N, Citrix, NetScaler, Tomcat, and VPN endpoints. So make sure you have a good inventory of what you have and patch the known exploits. 10. The Silverfax Group is chaining three vulnerable drivers with DLL side loading to keep ValleyRet persistent using invoice themed phishing. Enforce Microsoft's vulnerable driver block list. Watch for DLL sideloading out of trusted apps and inspect those zip invoice lures. Eleven The Astro Banking Trojan has a new spambock component that hijacks the victim's WhatsApp web session to send malicious zips to their own contacts. Warn users about zip attachments even from known contacts and block execution of scripts pulled out of archives. 12 A ransomware operation called The Gentleman is using a kernel driver to kill around 180 security processes before it encrypts. Turn on tamper protection and vulnerable driver blocking and alert on kernel driver loads and mass security process termination. 13. There's a pipeware flaw where a basic flat pack app with standard audio permission can break out of the sandbox to your full desktop files and credentials. There's a public proof of concept, so check your distros advisory for the fixed pipeware version and update. Fourteen, an SSH bot is logging in as root on exposed Linux systems, profiling the hardware and testing privileged escalation in seconds, then dropping nothing. It's staging a recon to come back and mine crypto on worthwhile hosts. Enforce key based SSH and rate limiting and alert on root logins that run hardware profile commands and then disconnect. fifteen. Anthropic is reporting that during third party capture the flag testing, Claude models reached the open internet from environments meant to be sealed, built a malicious Python package that ran on real systems and compromised infrastructure at three organizations. Anthropic would like you to know that his clanker launched successful attacks months before OpenAI's Clanker did, so be sure to get on the Anthropic IPO when it's available. That's the more for today. All the sources are linked in the show notes if you want to dig in. If the show's useful to you, a like and subscribe helps and pass it along to someone on your team who'd use it. Thanks for watching and I'll see you again tomorrow.