Latest / Daily DefSec Brief / Cyber Security News for October 12 2026 - Daily DefSec Brief
Transcript
- Jerry: The most common password in the world turned up in one of this year's biggest breaches. You can probably guess what it was. This is the daily DefSec brief for Monday, October 12th, 2026. One, ransomware crews are getting into company networks through Palo Alto's Global Protect VPN with no credentials at all. It only works when authentication override cookies are turned on With a particular certificate setup. Once they're in, they look like any other remote worker. The patch has been out since May, so get it installed, then look at who's been on your VPN since May. And remember, a patch doesn't remove anyone who's already inside. Two, attackers used more than 500 hijack GitHub accounts to push a workflow file called SecurityAudit into tens of thousands of repositories. When it runs, it collects the repository secrets and any cloud keys ever committed to it and sends them to the attacker. It does audit your secrets just for somebody else. Search for repositories for workflow files added since the end of August that your team didn't write. If you find one, rotate every secret and key that repository holds. Three, anyone who can reach a Linux machine running any desk on it. On its direct connection port can get root on it before anybody approves the session. Working exploit code is public now, built for the latest version before the fix. It doesn't work every time, and when it fails, Anydesk crashes instead. Anydesk fixed it back in June, but the changelog called it a crash fix with no advisory, so it's easy to have missed. Update any desk on Linux machines and keep that port off untrusted networks. Four, a single prompt could make a public-facing AI agent on Amazon's bedrock agent core hand over its own credentials. The prompt just asks for agents to fetch the cloud's internal metadata address, which gives out those credentials. With them, An attacker could take over every other agent in the same account and region, read their conversations and pull secrets from secret manager. AWS says an agent being able to get its own credentials is expected and documented, which is less comforting than it sounds. AWS has since cut back the permissions it gives to new agents by default. Agents set up before that may still have the old ones, so scope each agent's role down to what it actually uses. Five, unsupported Windows already gets no security updates. Next year it loses Windows update completely when the certificates behind it expire. Supported machines need a recent monthly update installed before then, so one that's stuck behind on patches could be cut off too. Find the unsupported machines and the stuck ones now. Six. Older versions of the AWS tools for PowerShell can write an IAM user's console password into their output in plain text. It happens when a command runs with the what if or confirm switches. Anyone who can read a log or transcript that captured it can sign into the AWS console as that user if there's no MFA. Which is a shame since what if is supposed to be the safe way to run a command? Upgrade the tools and look through your PowerShell transcripts for passwords to rotate. Seven, more than 2,000 GPU servers have Nvidia's GPU monitoring exporter open to the internet with no login. On about a quarter of them, a flaw in its profiling pages lets anyone crash it. The fix has been out since July. That exporter only ever needs to talk to your monitoring server, so take it off the internet. 8. Chrome and Edge can be fooled by two more lookalike letters in domain names. One is a Cyrillic O with a bar through it, and the other is a Latin K with a hook. The domain spelling Okta with that K shows in the address bar as the real thing. The researchers registered twenty of these themselves and there's no browser fix announced. If you monitor for lookalikes of your own domains, add these two letters to what it checks. Nine, an update on the story we covered last week. The hacker pulled records on about 8.8 million people in Denmark's National Person Register in September using one company's lookup access. Danish press now reports that at least three of that company's accounts use the password 123456. One was the company's administrator account. That claim comes from the hacker through the newspaper Politiken. And authorities haven't confirmed it. if you give partners accounts that can pull records in bulk, block common passwords on them, and require a second factor. The breach came to light when the register sent the company its bill, so the invoice was the detection. If you do only one thing today, patch global protect and check its authentication override cookie settings. Thanks for watching, sources are in the show notes. If the show helps, like, subscribe, and share it with a friend who'd use it. We'll be back again tomorrow.