Latest / Daily DefSec Brief / Cyber Security News for October 1 2026 - Daily DefSec Brief
Transcript
- Jerryout of: Asking an AI assistant to explain a database sounds harmless. Today it hands one of that database's users the keys to the whole server. This is the daily DefSec brief for Thursday, October 1st, 2026. 1. Anyone who can reach Cisco's SD WAN manager can use its API as the admin user without logging in. Attackers were doing exactly that before Cisco shipped the fix yesterday and there's no workaround. Patch the manager today If yours was reachable from the internet, treat it as an incident until the logs say otherwise. Two, an AI agent broke into the Dutch Institute for Vulnerability Disclosure through its Zammed help desk and chained two flaws that weren't public yet. The first one runs code on the server without a login, and the second one takes that access to root. The agent wrote down why it took each step, which is better documentation than most of us leave. Upgrade to Zamed 7 where the first flaw can't be exploited. The root escalation has no fix yet, so keep the help desk server walled off from the rest of your network. three, a single request to a Mikrotic router's web interface can run code as root with no login. It's a different flaw from the SSH bugs attackers used on router OS last month. This one isn't known to be exploited yet. Expect that to change. Upgrade router OS and keep the web interface off of the internet. Four TeamViewer's session permissions are supposed to limit what the person you let in can do. A flaw lets that person change those permissions as the session starts. That could lead to them running code on your machine. TeamViewer knows of no attacks and the fix is out. Upgrade TeamViewer everywhere it's installed, including the copies you forgot about. Five. Watchcard fixed 15 flaws in the Firebox operating system, and several of them need no login. Its access points got fixes too. One flaw hands out an API session without a login, and another runs shell commands through the API. Watch Guard isn't aware of any of them being exploited. Upgrade the Firebox firmware and the access points. Six. Microsoft says the Russian group Star Blizzard has hit more than a hundred organizations with a two-step fish. Most of them are in the US and UK. One of the target replies as a second email arrives with a password protected archive. Inside is a disk image holding a shortcut dressed up as a PDF. One click on it installs a backdoor. Hunt for three scheduled tasks posing as maintenance jobs. Their names are on the slide. 7. Google says monthly vulnerability disclosures doubled between January and August to more than 10,000. Fewer than one in 400 were seen exploited. Exploitation is up too. Google thinks most of that growth comes from flaws attacked within days of disclosure, not from new zero days. One Beyond Trust flaw was exploited four days after it was disclosed. I think patching everything in the order it arrives stopped being a plan a while ago. Order your patch queue by evidence of exploitation. Eight, Copilot and SQL Server Management Studio runs with the access rights of whoever is connected. A researcher showed that a database owner can hide instructions in the database's metadata. When an administrator later asks Copilot about that database, Copilot follows those instructions and gives the owner full control of the whole SQL server. Microsoft fixed it in early September And it hasn't been seen in use. Update management studio and turn copilot off there if your DBAs don't use it. Apparently the way to get promoted now is to leave a note for the boss's assistant. If you do only one thing today, patch Cisco S D WAN manager and check its logs. Thanks for watching. Sources are in the show notes. Like, subscribe and share the show with a friend who'd use it. I'm Jerry Bell and I'll see you again tomorrow.