Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 24 2026
Transcript
- Jerry: Russia's laundry bear has been quietly reading Western mailboxes for over a year through a zero-click Zimbra flaw, and Klopp is now extorting PTC PLM shops through a fresh, unauthenticated RCE. This is the Daily DeathSec Brief. I'm Jerry Bell, the day's security news in five minutes for Friday, July 24th, 2026. First up, Laundry Bear is sending crafted emails whose JavaScript runs the moment you view them and is pulling 90 days of mail, safe passwords, and 2FA tokens off of Zimbra. Confirm you're on the November 2025 patrolator hunt for anomalous webmail script execution and mass mailbox reads. Enforce password and 2FA resets on exposed accounts. 2. Klopp is exploiting an unauthenticated RCE and internet exposed PTC windchill and flex PLM, dropping JSP web shells to steal product data. Check PTC's advisory for the fixed version and pull PLM off the public internet. And hunt for JSP web shells and unexpected outbound transfers. Three. There are published proof of concept RCE chains against stock rutus across four branches. Upgrade to the fixed release for your branch and until you can restrict restore evail and x group. four. Attackers backdoor 10 dev packages from a legitimate developer and turned compromised GitHub repos into infrastructure aimed at cPanel and WHM. Audit for the name packages, pin Composer to release versions instead of dev branches, and review your actions runner egress. 5. Attackers are poisoning DNS at Hotel and Conference captive portals to redirect every guest to servers harvesting Microsoft 365 logins. Require a VPN on untrusted networks, enforcing phishing resistant MFA and tell traveling staff not to trust captive portal redirects. 6. Google shipped an emergency Chrome update for four high severity memory bugs, including an out-of-bounds write in Media Codex. Update Chrome now and restart the browser to apply it. Seven, a sandbox escape and claude co-work. Let's an agent break out of its VM and read anywhere on a host Mac, including SSH keys and cloud credentials with no prompt. Update to the patch build and treat any credentials that set on those hosts as potentially exposed. Eight. Attackers abused a public cloud artifact on the real claud.ai domain, promoted it through Bing ads, and served a fake insteller that sideloads a malicious DLL. Block the known indicators. Treat sponsored search ads for softwares untrusted and hunt for libcef.dl sideloading. Nine, some criminals are shipping a legitimate copy of Notepad Plus Plus alongside a malicious plugin for persistence delivered by a VBS script dressed up as a PDF. alert on Notepad Plus Plus loading unexpected plugin DLLs and treat PDF named files that spawn VBS as hostile. 10. NodeBB patched eight high severity flaws, including a client side only guard that let a regular member open the admin dashboard with no password. Upgrade to NodeBB 4.14.2 now. Eleven. Two campaigns published Trojanized Ruby gems that mine Monero and scan dev machines for SSH creds to move laterally. Audit installed gems against the named packages, rotate SSH keys on affected hosts and watch for unexpected mining load. 12. SSRF and access privilege flaws on Johnson controls CQR9000 and Victor. Let an unauthenticated adjacent attacker run code on the application server. Apply the vendor fix per the CSAT advisory and keep these access control servers off flat in adjacent networks. That's the board for today. All the sources are in the show notes. If the show's useful to you, please give me a like and subscribe and pass it along to someone you think can use it. Thanks for watching and I'll be back again tomorrow.