Latest / Daily DefSec Brief / Cyber Security News for September 1 2026 - Daily DefSec Brief
Transcript
- Jerry: For about 36 hours last weekend, hosting companies asking their software vendor for an update were quietly reaching an attacker server instead. Some of them installed what came back. This is the Daily DefSec brief. I'm Jerry Bell with the day security news in five minutes for Tuesday, September 1st, 2026. 14 items on the board today. One, in the OpenSearch SQL plugin, an account with nothing but read access can run code on the server by handing the SQL endpoint a doctored pagination parameter. Upgrade the self managed plugin to 2.19.6 or 3.7. The managed Amazon service is fixed through the service software update. two, an attacker took over the internet path to Soft Aculus over the weekend and hosting companies that asked for a virtualizer update got the attacker's files instead. It installed without complaint because the updater never checked for signatures. Look for a systemd unit called Java JRE update And if it's there, contact virtualizer rather than deleting it and then update to three dot two dot nine dot nine. Three, a phone call is what got somebody into McKesson. Voice phishing against employees produced Okta logins. Those opened Salesforce and Snowflake, and Shiny Hunters now claims 284 million patient records. Put phishing resistant MFA on your identity provider and alert on bulk exports out of both platforms. Four. Somebody spent a month guessing passwords on AWS root accounts for more than 150 companies and got into none of them. What they did have was the right email address for everyone. put hardware MFA on root, alert on root console sign-ins and stop using it for routine work. Five. Scanners are dressing up as ClaudeBot and other AI crawlers to walk straight past the loud list people built for them and then hunting the site for exposed credentials and config files. Gray Noise says to check the address, not the name, because the name is whatever people decide to type in. Six, SANS left an AI model server exposed as bait. Somebody found it, renamed it after popular models, and folded it into a service handing out free back ends. And the coding agent they turned up gave away its file history and its whole tool list. Restrict which model endpoints your agents are allowed to call. Seven. The recruiter messaging your engineer on LinkedIn with a take home coding challenge might be handing them a backdoor. Kaspersky found two new ones, NodeRabbit and Polkat, both cross-platform aimed at aviation and fintech. A coding challenge from a stranger is an executable from a stranger, so open it in a disposable VM. And once again, don't treat your employees like crap, so they need to go find new jobs. Eight, there is now a public exploit that turns Kaspersky endpoint security into a route up to system privileges, published by the researcher who goes by Nightmare Eclipse with no vendor fix out yet. Watch for privilege escalation coming out of the security agent's own processes. Several of the earlier drops were picked up by real attackers, so be on the lookout. Nine, attackers can rent traffic that arrives from a real house in an ordinary neighborhood with a spotless IP reputation because millions of home connections have been pooled and put up for hire. Stop scoring residential IP reputation as trust in your fraud and login controls. A lot of those homes signed up for free movies that makes them part of a botnet. Ten accru calls Breeze Comet gets into Brazilian banks and retailers through websites those companies already trust, then goes into the payment software itself and moves the money out. If you run payment or banking software in Brazil, Google's write-up carries the detections. 11. A Gildma phishing link checks where you are before it decides what to send you. From a Brazilian IP address, it delivers a zip that tucks its payload into an alternate data stream under the user's temp folder. So go hunting for those. For anyone else, it politely sends you the Android Studio. twelve. Boston Scientific is a week into a cyber attack, and heart devices implanted since august twenty fifth still cannot have their remote monitoring switched on. Work out which vendor hosted services your own operations depend on and what happens when one of them is down for a week. thirteen. OpenClaw 2.0 makes the agent harness far easier to install and leaves the security model exactly where it was, which is with the user. Go find out where it is already running in your environment and what credentials it holds Because an easier installer means more installs nobody approved. 14. CrowdSec 1.8.0 landed yesterday with two denial of service fixes and a new bot detection challenge in the web application firewall. Update for the fixes. The challenge needs SSC 4.1, so a few real visitors on older machines might actually fail it too. That's the board for today. Sources are in the show notes if you want to read further. if the show is worth your five minutes, like it, subscribe and hand it to someone on your team who'd want it. Thanks for watching and I'll be back again tomorrow.