Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 7 2026
Transcript
- Jerry: If you run Beyond Trust for remote support or Cisco ISE for network access control, today's your day to log in and start patching. and while you're at it, your help desk needs to hear that attackers are cold calling employees on teams pretending to be IT. This is the daily DefSec Brief. I'm Jerry Bell. Your few minutes on what matters to people defending networks for July 7th, 2026, four things today. First up, and this is the big one, Beyond Trust has patched a pair of critical authentication bypass flaws in its remote support and privileged remote access platforms, So the way these work, one of them is an improper authentication weakness that lets an unprivileged attacker reach the appliance, including privileged accounts. The other one mishandles remote support authentication requests, which gives an unauthenticated remote attacker access outright. They're tracked as CVE 2026, 40138, and 4139 respectively, and there are five more CVEs covered in the same advisory. This hits remote support and privileged remote access versions 25.3.2 and earlier. Now I haven't seen this confirmed as being exploited in the wild yet, but exploit probability on this is sitting at the 100th percentile, Which is about as strong a signal as that model gives you. So I treat it as imminent. Go patch your RS and PRA today. Remote support tools are a favorite for ransomware actors. So if you genuinely can't patch right now, lock the management interface down to a trusted network until you can. Alright, the next one is a live social engineering campaign. Unit 42 at Palo Alto is reporting attackers who send a phishing email with an employee survey PDF lure and then follow up with a Microsoft Team's voice call. A call comes from an external tenant and the caller impersonates a system administrator. They talk the victim into installing what looks like a legitimate remote management tooling, and alongside it, A node.js based loader that drops malware called Etheret for initial access. This is active right now, not a theoretical risk, and it affects basically any organization running Microsoft Teams with external communications turned on, which is to say most M365 tenants. So a few things here. Confirm your tenant is set to flag or block calls from external unverified tenants. The external unfamiliar label is the tell. Train your staff that IT support does not cold call people over Teams and go hunt for unexpected installs of remote management tools paired with Node.js processes because that pairing is the fingerprint for this one. Next up is Cisco. They've patched two independent vulnerabilities in Identity Services Engine and Identity Service Engine-PIC. if ISC is your network access control backbone, this is one to schedule for this week. The first one's CVE 2026. 20181 lets an authenticated admin run arbitrary commands on the underlying operating system through a crafted HTTP request because of insufficient input validation. The second one, CVE 2026-20190, is a separate information disclosure vulnerability. By the way, Cisco notes the two aren't dependent on each other and don't necessarily affect the same releases, so don't assume patching one covers the other. There's no report of anyone exploiting these, and the command execution one needs valid admin credentials, which raises the bar somewhat. So apply the fixed release from Cisco's advisory for your ISE version. And since that first flaw needs admin access, tightening who holds ISE admin and keeping an eye on admin sessions is a reasonable interim control while you schedule the work. Alright, the last one comes from Security Week and it's for the virtualization crowd. there's a use after free vulnerability in shadow MMU code of the Linux KVM hypervisor dubbed Januuscape, which lets a guest VM escape to the host and run code there. What makes it notable is that it's the first KVM exploit demonstrated to work on both Intel and AMD. It came out of a researcher named Hyanwoo Kim, who found it as a zero day in Google's KVM CTF bug bounty program. So this is a research demonstration, not something being used in the wild. The exploit probability score is basically zero. Still, if you run multi-tenant virtualization on KVM with untrusted guests, this is worth a look. Patch your host kernels once your distro ships effects. So check with your Linux vendor for the patch version. If you're running untrusted multi-tenant workloads, you might consider restricting nested virtualization until you're patched. That's the brief. Thanks for watching. All the sources are in the show notes. if this was useful, like and subscribe and pass it along to a friend who'd put it to use. Jerry Bell and I'll see you again tomorrow.