Latest / Daily DefSec Brief / Cyber Security News for October 6 2026 - Daily DefSec Brief
Transcript
- Jerry: If a partner account quietly worked through your whole customer list, would you even notice? In Denmark, one ran for about ten days. This is the daily Def Sec Brief for Tuesday, October sixth, twenty twenty six. One, attackers running clickfix now plant the payload on the victim's machine before the victim pastes anything. A hacked website loads a script into the browser cache disguised as an image. The command the fake CAPTCHA asks you to paste just finds that file, copies it out, and runs it. The pasted command downloads nothing, so tools watching for downloads miss the first step. Microsoft says the payload goes on to target browser and device credentials. Disable Windows script host on machines that don't need it. ClickFix now has been on the show 17 times, and it keeps finding new places to hide the same trick. 2. Anyone who can reach a self-hosted Atlassian data center server can read files from its web directory without logging in. That covers Jira, Confluence, Bitbucket, and 5 other data center products. The attacker needs the exact file name, but Atlassian warns some setups keep sensitive files there. Atlassian's cloud is already fixed. Their patch shipped yesterday, So install it or take the server off the internet until you can. 3. A remote attacker with no login can become an administrator on an HPE ILO 7 controller. It affects one firmware release in setups managed through HPE's ComputeOps management. An ILO admin controls the server's power, its console, and virtual drives. All that sits below the operating system. HPE shipped the fix yesterday, so update the ILO 7 firmware. HPE calls it a user validation failure, which is a polite way to describe letting a stranger in as an admin. 4. Attackers are using a new Linux backdoor called Cling Stun to take over old routers, video recorders, and unpatched Ivante Connect secure gateways. It uses about two dozen known flaws and it survives a reboot. Each one becomes a relay for someone else's traffic coming out of your address. It keeps its link to the attackers alive through public stun servers so that traffic looks like ordinary internet calls. Replace the edge devices that no longer get updates. Five, Dell System Update is the tool admins use to push firmware and drivers to PowerEdge servers. Dell says a flaw in it lets an attacker with no login run code as root. The fix has been out since last Thursday, so update Dell System Update on your PowerEdge servers. This time the patching tool is what needs patching. Six, attackers have put backdoors on mail security gateways in South Korea and Taiwan. One of them calls home on the mail port. It starts like a normal mail server conversation and then switches to its own encryption. On a mail gateway, sending mail is the device's whole job so the traffic looks like work. Rapid7 doesn't say how the attackers got in. Hunt your mail gateways for running processes whose program file has been deleted. Seven Bromcom makes software for UK schools. It replaced an old sign on registration service but left it running because an internal system called it. An attacker used that old service to pull email addresses, which sign-in server each person used, and their sign-in dates. No passwords were held there. Bromcom spotted the break-in on September 6th and told customers later that month. Most networks have a service like that somewhere. When you replace a service, find out what still calls the old one and switch it off. Eight. A small Danish company had legitimate access to Denmark's National Population Register. For about ten days in September, attackers used it. They ran automated lookups and pulled names, addresses, and ID numbers for about 8.8 million people. An employee at the register noticed the unusual activity on October 2nd. Denmark has about six million people. The register also keeps the dead and everyone who has moved abroad. If you give partner lookup access to your data, put an alert on how much they look up. Eight point eight million records in ten days isn't a partner integration, it's a census. If you do only one thing today, patch Atlassian Data Center or take it off the internet until you can. Thanks for watching. Sources are in the show notes. Like, subscribe and share the show with a friend who'd use it. I'm Jerry Bell and I'll see you tomorrow.