Latest / Daily DefSec Brief / Cyber Security News for August 13 2026 - Daily DefSec Brief
Transcript
- Jerry: Somewhere out there, a single server has spent seventeen months quietly reading Salesforce and ServiceNow Portals as an unauthenticated guest, and there's one IP address so you can block before lunch. It's item three and it's not even the worst thing on today's board. This is the Daily Def Psych Brief. I'm Jerry Bell, the day's security news in five minutes for Thursday, August thirteenth, twenty twenty-six. Eleven items on the board today. One, that V center Syslog path traversal bug Brockon patched back in July is now being used by an APT for reverse shell persistence with more than three hundred sixty victim IPs across forty seven countries. Patch the fixed build now, get that syslog server off the public internet and go hunt for that persistence. Two, and I know this will shock you, but Fordinet's FortaWeb has an auth bypass bug that lets an unauthenticated attacker log into the GUI with any username and password as long as the non default admin wildcard setting is turned on. Apply the update and check whether you've got that wildcard setting enabled because if you don't need it, you shouldn't have three. This is our opener. One server's been pulling records out of Salesforce and ServiceNow portals through overly permissive guest access for over 17 months, including the first observed abuse of Salesforce's UI API guest service. Lock down your guest user permissions on both platforms, block the source IP in the show notes, and watch for the default Go HTTP client user agent. four. WordPress hands image uploads to ImageMagic and GhostScript and ImageMagic will happily open Postscript and PDF files so an authenticated author can get remote code execution with a crafted upload. Update to 7.0.4 now though your automatic background updates are probably already pulling it. five, an Acura affiliate got in through credential spraying against a Sonic while SSL VPN with no MFA, then rebooted the host into safe mode with networking so most of your endpoint protection sat there offline while it was encrypted. Require MFA and all VPN access and alert on unexpected safe mode reboots. Six the Light LM compromise we covered on Tuesday has now surfaced as a hundred and fifty three gigabyte archive of CI runner dumps tied to twenty four hundred and eighty-eight corporate domains including AWS, Cisco, and Salesforce. I've been wondering when we would start seeing the other shoe drop on these repo worms. Rotate everything those light LLM builds touched and assume any secret those runners cached is already burned. Seven, there's a phishing kit called JWR that impersonates payment and shopping checkout pages and keeps an encrypted web socket open. So a live operator steers each victim's session, harvesting card data, ID documents, SSNs, and 2FA codes. eight. Phantom Stealer is a modular.NET Stealer that hides its next stage inside PNG files, then lifts passwords, browser cookies, and crypto wallet material off of Windows. Watch for.NET processes loading payloads out of image resources and remember that stolen session cookies walk right past passwords, so MFA and session controls are what matter here. Nine. Researchers found more than seven hundred and thirty-seven Chrome extensions impersonating Proton, Nord, and the rest while forcing all your browser traffic through one operator's Sox5 proxies. In one batch, five hundred and twenty and five hundred and twenty-two pointed at the same infrastructure. Audit your installed extensions against sockets list. Remove the fakes and enforce allow lists where you can. Ten encrypted reasoning blocks from the OpenAI, Anthropic, and Google reasoning APIs could be replayed into another session. even handed down to a weaker model in the same family to recover hidden reasoning, API keys, and passwords out of session logs. Don't persist those opaque reasoning objects, treat them as sensitive and rotate any secrets that pass through them. 11. Intel and AMD shipped their August patches covering more than 80 vulnerabilities between them with high severity privileged escalation and code execution bugs across Wi-Fi drivers, Xeon, TDX, AMT, and the management engine. Roll the driver and management software updates through your normal patch cycle and pick up the microcode as your OEM ships BIOS updates. That's the board for today. Thanks for watching. All the sources are in the show notes below. If this was useful, give it a like and subscribe and pass it on to someone who'd want it on their desk in the morning. Back again tomorrow.