Latest / Daily DefSec Brief / Cyber Security News for September 28 2026 - Daily DefSec Brief
Transcript
- Jerry: It's a new week, and that means there's a new Netscaler Zero Day waiting for you. This is the daily DefSec brief for Monday, September 28th, 2026. One, anyone who can reach a Citrix Netscaler ADC or gateway can run commands on it without logging in, and attackers were doing that before Citrix had a fix. One of the two flaws works on every configuration, including the default, and the other needs DTLS, Which is on by default for VPN virtual servers. At this point, I suspect you already have a process for handling these, and if you don't, now is a good time to write one down. Two Shiny Hunters is back on the PeopleSoft Law from June, and this time it's getting past the WAF rules people put up instead of patching. It asks for the environment management hub with a P written as a percent five zero. And the WAF rule looking for the plane path doesn't match. And PeopleSoft decodes the request and serves it anyway. There are web shells on dozens of systems in education, healthcare, and government. The patch has been out since June 10th, so apply it and stop counting on the WAF rule. Three, a SharePoint flaw that Microsoft first published in August as spoofing and later relabeled it as code execution is now being exploited according to CISA. It needs only a low privilege account. The fix shipped August 11th, so make sure that update is on every farm you have. Four, someone who never logged into a microtic routers SSH service can ask for a key renegotiation, land in a session anyway. And send commands that create or overwrite files on the router, including us configuration files. That one is being exploited, and CISA says it changed with a router OS SSH login flaw from earlier this month to get in without credentials. Upgrade router OS and keep SSH reachable only from your management network. By the way, this isn't the first exploited SSH flaw on these routers just this month. Five. The WordPress core flaw that makes a site load a PHP file from outside his theme with no account is being exploited to. The fix has been out since the 22nd. Make sure it actually reached every site you have, including the ones you assume update themselves. 6. A crew Microsoft tracks as Storm3168 went after more than a hundred Azure storage accounts and deleted most of them, along with a key vault and a set of app resources. Using a service principal secret, an employee had pasted into a public GitHub issue. The issue was later edited to tag out the secret, but it stayed readable in the issue's edit history. Resource locks and deletion protection stopped some of the deletes. If a service principal secret has ever been posted anywhere public, rotate it immediately. And should also take a look at those resource locks. Seven. Researchers showed that anyone could fill in a company's public Salesforce web to lead form with instructions hidden in a field. And when Agent Force later processed that lead, it followed them, looked up the account data, and sent it out in image links. No login and no click. Salesforce fixed it by mid August, so there's nothing to patch, But it's worth finding out which of your agents read things the public can submit and cutting what those agents can reach. Eight, a new Windows remote access to mine, tied to malicious MPM packages, takes its orders over Tailcat, an open source Tailscale tool. So there's no command and control domain to block. Alert on Tailscale and other VPN software turning up on machines where you did not deploy it. Nine, a pair of GitHub issues that were disabled in May after the mini Shy Haludworm compromised them came back online september sixteenth With their release tags still pointing at the malware. For nine days, every workflow that used Actions Cool, Issues Helper, or maintain one comment by tag ran the payload again, and about 15,000 repositories depend on the first one. Pin your third-party dependencies to commit hashes so a tag can't change underneath you. If you ran either one in that window, consider every secret that workflow could read as stolen. If you do only one thing today, patch Netscaler, then look for signs that it was already hit. Thanks for watching. Sources are in the show notes. Like, subscribe and share with a friend. I'm Jerry Bell and I'll be back again tomorrow.