Latest / Daily DefSec Brief / Cyber Security News for August 21 2026 - Daily DefSec Brief
Transcript
- Jerry: Entra ID had a max severity flaw under active exploitation, but it's okay because it's fixed now. Happy Friday, friends. This is the Daily DefSec Brief. I'm Jerry Bell, the Day Security News, in five minutes for Friday, August 21st, 2026. 14 items on the board today. One, there was a max severity deserialization flaw in Entra ID that let an unauthenticated attacker run code in low complexity attacks and it was exploited before the fix was out. Microsoft says it's fully patched server side and there's no customer action needed, so relax. It's probably fine. Probably. two, CISA added a TrueConf server code injection bug to the Kev list where an unauthenticated remote attacker on port forty three seven can break out of the isolation environment and run code on the host. Apply the vendor mitigations and restrict or block forty three seven exposures. Three, the second true conf entry is a missing authentication flaw on the same port that lets a remote attacker run an arbitrary script. At least this is also fixed by the same patch as the last one. four. Elementor Pro has an unauthenticated RCE where the validation loop and the processing loop disagree about empty file name uploads so the attacker can slip a PHP payload into a public directory. That is not awesome. Five, Spring Security's embedded unbound ID LDAP server has a critical flaw that can hand a remote attacker admin access to an exposed in memory directory. Check the advisory for the fixed version, and since that in-memory LDAP is meant for testing, make sure it isn't reachable in production. Six. Google's threatened tail team is tracking three suspected Russian clusters running adaptive phishing that abuses OAuth and legitimate authentication flows. So it doesn't read as phishing to the victim. Hunt for anomalous OAuth app consents and token grants. Tighten your consent policies and review captive portal redirects. 7. Attackers are hiding malware commands inside FTP server greeting banners as dead drop resolvers. Using LNK files to pull instructions and drop two new rats. Hunt for unexpected outbound FTP from endpoints and LNK-triggered FTP activity, and treat those banner fetches as command and control. Eight. Researchers published two DOS attacks called C DN Tsunami that exploit how CDNs down convert client HTTP three to HTTP one point one at the origin, amplifying a low bandwidth stream up to three hundred and fifty times. Check whether your HTTP three is enabled at your edge and confirm your CDN's mitigation status for both variants to be sure you aren't part of the problem that will surely come. Nine. Checkpoint reverse engineered Defender's own boot time removal driver and showed it can be turned into a universal kernel engine to bypass endpoint security. The signed remediation driver becomes the bring your own vulnerable driver. Hunt for BTR.sys loading outside remediation windows. 10. AWS disclosed five issues in the container D CRI plugin, including unvalidated checkpoint image references that allow image cache poisoning and cross pod code execution. On shared Kubernetes nodes. This covers container D 1.7 through 2.3. It's Friday, which means it's the perfect day to patch your fleet. 11. The Amazon Redshift JDBC driver under certain conditions loads and runs arbitrary classes from parameters in the connection URL. So anyone who can influence that URL runs code in your app context. Upgrade to two dot two dot two or later and treat connection URLs as untrusted input. twelve a design flaw in Enable's Passportal Credential Manager lets any malicious website obtain complete persistent access to a customer's password vault. Apply the patch, then rotate everything that lived in the exposed vault because the report notes the cloud design leaves residual risk even after patching. That's roughly 2500 MSPs and 165,000 SMBs downstream by the way. thirteen, a bandwidth sharing app called Peer to Profit installed by an employee routes outside paying traffic through a work device that can reach internal systems. Block and hunt for proxyware on managed devices and enforce a policy against it since it doesn't look like traditional malware to your controls. fourteen Atlassian and Splunk together shipped patches for more than two hundred and fifty vulnerabilities. Dozens of them critical, spanning bamboo, bitbucket, confluence, Jira and the Splunk products. Go check out the Atlassian and Splunk advisories and prioritize their critical dependency issues. I'm sure your teams will be so sad if Jira were down for a few hours. That's the board for today. Thanks for watching. All the sources are linked in the show notes. If this was useful, give us a like and subscribe and tell someone who you think would get something out of it. We'll be back again on Monday.