Latest / Daily DefSec Brief / Cyber Security News for September 23 2026 - Daily DefSec Brief
Transcript
- Jerry: If you run F5's Access Proxy and you want to know how your day is gonna go, go read its logs before you do anything else. This is the daily DevSec brief for Wednesday, September twenty-third, twenty twenty six. One, anyone who can reach an F5 Big IP APM set up as an OAuth authorization server can run code on it without logging in. And F5 says that's already happening. It's tracked as C V E twenty twenty six ninety four one twenty seven and And APM used only as an auth client isn't affected. The hotfixes came out yesterday, so patch those boxes today. Two. Attackers have been uploading and running scripts on checkpoint management servers since july twenty-third. Checkpoint ship the fix yesterday. Get that patch installed. Three, the Evil Tokens phishing service got into more than twelve thousand Microsoft three sixty five inboxes through device code sign-ins. Within ten minutes of a breach, its operators registered a device of their own in the victim's tenant. Microsoft has disrupted the service, but that doesn't fix anything already attached to your tenant. Block device code sign in wherever you don't need it. And for any account that was fished, remove that device as well as revoking the sessions. Four, anyone with network access to an on premise Arista Velocloud Orchestrator And the public half of OneEdges certificate can reach his privileged functions without a login, And that's being actively exploited. The public half is the easy half, by the way. Patch it and keep that orchestrator web interface on your admin network only. Five, the checkpoint VPN flaw that lets an unauthenticated attacker run code on a gateway with a crafted certificate is now being exploited against Spark firewalls. The FIX shipped September ninth and the attacks started three days later. So if that patch is still in your queue, apply it today. Six. Nightmare Eclipse, the researcher who keeps publishing Defender exploits has released a tool that stops Microsoft Defender from installing platform and signature updates while Defender itself keeps running. There's no patch, so alert on defender's signature age the way you'd alert on an EDR agent going quiet Because a stale defender agent still looks healthy on a dashboard that only checks that it's running. Seven, somebody who already holds global administrator in Entra can register a fake external MFA provider that slips a convincing password prompt into real sign-ins and it catches the new password after a reset too. Alert on changes to external authentication methods, and if you ever find a rogue one, disable it before you reset anybody's password. And by the way, try to keep those undocumented admins out of your Entra account. Eight, any low privilege user on a Windows machine running the Veeam agent can now get system with exploit code that's been public since September fourteenth. Veeam fixed it back in May, so update the agent on any machine that missed it, starting with shared endpoints in terminal servers. Nine, anyone with no account at all can make WordPress load a PHP file from outside its theme folders. And on some servers that turns into code execution. WordPress released effects yesterday and last week's security release is affected too. So check that automatic updates actually installed on every site rather than assuming they did. ten. Anyone at a Windows login screen that carries Manage Engine's AD Self Service Plus password reset client can run CODA system. No account needed. The fixed build has been out since August 24th. So go upgrade it. Until you do that login screen works as an admin prompt. Eleven. Anybody with an ordinary SharePoint account can run code on an on-premise SharePoint server through a flaw. Microsoft first published as spoofing and relabeled as code execution in late August. The researcher behind the tool shell has not published the full details. The fix is in the August updates, so if you park this one as a low priority spoofing bug, go install it now. twelve. If a next.js app builds social preview images with image response and puts anything from the request into them, an attacker can run code on the server. Versal fixed it yesterday, only in the new rest release though. thirteen, a single unauthenticated request to the BitFrost AI gateway. In its default setup makes it run whatever command the attacker names on the same server that holds the API keys for every model the provider talks to. Upgrade it and if yours was reachable with authentication off, rotate every provider key it held. Fourteen, Cisco Talus has taken apart a Windows implant called Closed Quorum that sends what it finds on a machine to four AI models. Gemini, Deep Seek, Coin, and Mistral. And has them vote on what to do next. Steal, inject, persist, or move laterally with Deep Seek breaking ties. Nobody has confirmed it in the wild yet. By the way, the build Talus looked at has no code behind the move laterally option, so the committee can vote for lateral movement all it likes. Alert on endpoints calling AI provider APIs that they have no reason to call. If you do only one thing today, patch that big IP APM if it runs as an OAuth authorization server. Thanks for watching. Sources are in the show notes. Like, subscribe, and share the show with a friend. Back again tomorrow.