Latest / Daily DefSec Brief / Cyber Security News for August 28 2026 - Daily DefSec Brief
Transcript
- Jerry: There's a flaw in OwnCloud where somebody who knows your username can read, change, or delete your files without ever logging in. It's being exploited right now, and the bug is from 2023. This is the daily DefSec Brief. I'm Jerry Bell with the day's security news in five minutes for Friday, August 28th, 2026. 14 items on the board today. One, there's a flaw in OwnCloud where an attacker who knows a username can read, change, or delete that person's files without authenticating. As long as the account has no signing key set, it's being actively exploited right now, So pull the fixed version from Own Cloud's advisory, confirm signing keys are configured, and figure out why those patches haven't been applied in three years. 2. ServiceNow Apatch 3 Flaws in its AI platform rated 10 out of 10, including code injection in the GraphQL composite data API that lets an unauthenticated attacker run code and read or change instance data. Hosted instances are already fixed. If you self-host, Thursday's update is yours to apply. 3. In cPanel and WHM, an account holder who can add a parked or add-on domain can write arbitrary files and end up running code as root, which is basically the entire server. Update to the patch build for your release branch. The privilege you need for this is the ability to add a domain. Four versal patched two critical flaws in Next.js that both give unauthenticated remote code execution. One is a path traversal that only hits servers on a Windows file system. And the other is a heap overflow in the image library that fires when next.js optimizes an attacker's AVIF file. Update to the latest and treat the Windows side as urgent because Versal says there's no workaround for it. Five, there's a privilege escalation flaw in the Linux kernel's IPv6 subsystem that's being exploited now. And it reaches across distributions including SUSI and Red Hat. Apply your distro's kernel update today. 6. In JFrog Artifactory, an authenticated user can write data outside the intended Docker cache path under certain remote repository conditions. Get the fixed version from JFrog's advisory. It scores a five point three, but it's on the exploited list anyway. Seven. Recorded Future found a previously undocumented backdoor called HookEdge, a lightweight batch script arriving in macro enabled Word documents with diplomatic lures aimed at government and diplomatic targets in Romania, Spain, and Turkey. Block macro enabled office documents coming in by mail and hunt for batch scripts spawned as children of Word. And don't take solace that this is only being targeted at diplomats because we know that the bad guys are. Copy tactics. Eight, Trellix is calling this one Ghost SPN. An intruder with delegated directory rights temporarily attaches a service principal name to an ordinary user account, requests a Kerberos ticket, and takes it off again. Alert on service principal names appearing and disappearing on user accounts and audit who holds those delegated right rights. The account looks completely ordinary before and after, which is the whole point. 9. CISA flagged the ASE 2000 communication test set, where an XML external entity flaw lets an attacker read and write local files, and weak certificate validation lets them impersonate the trusted peer and read traffic. Check the advisory for the fixed version and keep the test set off routable networks. ten. All lines fuel boss systems have an argument injection flaw and a buffer overflow that together give remote code execution. Check CES advisory for the fix and get those off any internet reachable path. By the way, these CVEs were patched in twenty eighteen and twenty nineteen. 11. The eByte NA111M gateway carries 13 separate issues, including missing authentication on critical functions, clear text transmission of sensitive data, and broken cryptography, which together let an attacker fully compromise the device. Segment these off any routable network and watch for fixed firmware. Are you starting to get the sense of what the problem is here? 12. Rockwell's Auto Fleet Manager hashes passwords with a Bcrypt work factor set to low, which makes offline cracking a lot cheaper. Update pass 2.36.2 and force a password reset because the old hashes are already cheap for anyone who took them. 13. Census found an open directory holding Moobot's botnet source code alongside a denial service panel with 16 registered accounts and 32 attacks logged on the day they looked. That botnet was taken down in 2024, but it looks like it might still be active. 14 Rapid7 is tracking dark web markets selling Social Security numbers belonging to executives and board members. And unlike a payment card, nobody can cancel one of these. Freeze credit for your executives and board and stop letting your help desk verify anyone with an SSN or a date of birth. that's the board for today, sources are in the show notes. if the show is useful to you, like it, subscribe, and pass it on to someone who gets some mileage out of it. Thanks for watching, and I'll be back on Monday.