Latest / Daily DefSec Brief / Cyber Security News for September 22 2026 - Daily DefSec Brief
Transcript
- Jerry: Xyia Cell's GS1900 is the kind of switch that gets racked once and never logged into again, but someone was logging in, just not you. This is the daily DefSec brief for Tuesday, September 22nd, 2026. One, somebody spent August pulling the configuration, root password hashes, and network layoff off of close to a thousand Zysel GS1900 switches in forty-eight countries. The fix shipped back in June, more than half were still on factory passwords, and I guess most were answering straight off the internet. Patched them, changed those passwords, and figured out what other badness may have happened on your network along the way. Two, a crafted link clicked by a logged in WordPress administrator silently installs a theme from the official directory and then runs PHP from it on the server. The core update that fixes it shipped last week and it closes a second flaw where an anonymous comment plants a script that runs when an administrator opens the page. Make sure automatic WordPress updates are enabled and that somebody hears about it when they stop installing. Three, an actor is using a kernel driver that Microsoft's own hardware compatibility program signed to kill around 150 security products from kernel mode and then using the Rapunzel Stealer to go through browsers and the Windows Credential Manager. Somebody got that driver attested and it still isn't on Microsoft's blacklist. So go block that driver yourself and watch for EDR going dark on hosts that are still up. If you find it, whatever ran while EDR was down left no record. four, somebody with push access to an MPM package called Dforge MCP rewrote its release workflow to publish unattended and the loader went out with a valid MPM Providence attached. CloudSec can't say how they got access, and its best guess is a developer's own machine compromised by an extension or a package. Providence proves where something was built, not what is in it. So check whether anything of yours pulled that package on September 9th. Five, a ransomware crew holding domain admin ran the whole extortion through group policy. One object linked at the domain route put the ransom note on the wallpaper, the lock screen, and the logon banner of every domain joined workstation and switched off the local administrator account with no ransom binary anywhere on Windows. Alert and group policy objects being created and linked, watch sysfall for changes And contemplate how your permission model is put together. Something much bigger failed here and I'm not sure it's an uncommon problem. Six, Microsoft has taken a second shot at the same bug because the first fix still left a local user able to escalate privileges through a system wide comm object. The registration pointed at a DLL that was never installed in a folder under program data that any user can write to. Seven, a PowerShell backdoor sweeps the drives for business documents, then sits there and takes each new one as it's saved, along with Wi-Fi passwords, clipboard, and screenshots. Securics can't say how it gets in, so there's no delivery method to go and block yet. What you get instead is four schedule tasks named to look like Windows Services and two command servers on the slide. So hunt for those and remove both of its modules because they restart each other. And it should go without saying if you find that you should not just clean up and re image the device. eight. SAML keeps producing bugs that let an attacker sign in as anybody they like. And last year one of them got past GitHub Enterprise. The Trail of Bits argument is that this is the format rather than sloppy vendors. The signing rules are complicated enough that everyone gets one wrong eventually. Point your new SSO integrations at OIDC. And if you run an identity provider, stop taking on new SAML customers. Nine, push an AWS access key to a public GitHub repository and Amazon attaches its quarantine policy to that key within about ten seconds, Which lands in Cloud Trail as an attached user policy event, so learn on the policy name and you will know about an exposed key at roughly the same moment AWS does. 10. Anthropics AI bug hunting program has produced more than 200 CVEs since April. And exactly one of them is confirmed exploited. An SQL injection in the ghost publishing platform that lets an unauthenticated attacker read arbitrary data out of the database. API keys included. Eleven Shiny Hunters broke into Klopp's leak site over the weekend, defaced it, and told Reuters it got in through a flaw in the software the site runs on. It's now demanding an eight-figure payment from Klopp and threatening to publish the names of the companies that paid Klopp to stay off that site. If you do only one thing today, upgrade that Zysel GS1900 and change their passwords. Thanks for watching. Sources are in the show notes. Like, subscribe, and share with a friend. Back again tomorrow.