Latest / Daily DefSec Brief / Cyber Security News for August 5 2026 - Daily DefSec Brief
Transcript
- Jerry: a self-propagating mpm worm chewed through hundreds of packages in under four hours and while that was happening CISA added two more exploited remote code execution bugs to the Kev. Supply chain and edge exposure are both live today. I hope everyone at Security Summer Camp is having fun while the rest of us are here holding down the fort. This is the Daily DevSec brief. I'm Jerry Bell, the day security news in five minutes for Wednesday, August 5th, 2026. Sixteen items on the board today. One, there's an unauthenticated remote code execution flaw, an IBM slang flow That changed an auto login token endpoint with a code validation endpoint to run arbitrary Python on default installs. and it's now on CISA's Kevlist as actively exploited. I see IBM is in fierce competition with Fortinet and progress software for a pole position on the Kevlist. Two, Apache Tomcat also hit the Kev a missing encryption flaw that lets attackers bypass the encrypt interceptor and read sensitive cluster traffic. advisory for the fixed version that applies to your install. Three, this is a big one, an NPM worm called Chaindrop, a mini Shy Halud variant that runs on pre-install to steal NPM, GitHub, AWS, Kubernetes, and Vault credentials, and then republishes itself to spread. Counts vary by source, but it's somewhere in the hundreds of packages touching dependents with over 500 million weekly downloads. Freeze your dependencies, audit CI for pre-production execution, rotate your MPM and cloud credentials and hunt for a public GitHub repos with Shy Holud in the name. 4. Enable N Central has an alternate path authentication bypass that hands over full admin access, and it's the console the MSPs live in. It's on the Kev list with a three day clock, so apply the current vendor fix, restrict internet exposure, and confirm the earlier fix actually applied. This first one was reportedly incomplete. Five. Veeam113 has an unauthenticated remote code execution bug along with file read, database theft, and privilege escalation flaws. There's a public proof of concept, so update soon. Six Forescout disclosed 15 zero touch provisioning flaws in TP Link Omada gear that chained with serial number guessing. Hand an outside attacker, the controller admin password And a VPN tunnel to the internal network. apply TP Links patches, rotate the site shared password and controller credentials and lockdown cloud controller exposure. Seven. There's a one-click RCE and cursor VS Code in Google Anti-Gravity where a malicious link in a git commit message runs code with full terminal privileges. The moment you click it, no confirmation prompt. Update all three editors and treat commit message links as untrusted. 8. Atrogenized QuickFox VPN installer uses a modified electron file. To fetch a loader that fingerprints the host and drops the FDMTP backdoor tied to the Chinese state actor Mustang Panda. Remove untrusted QuickFox builds, hunt for the loader IOCs, and inspect electron renderer files for injected, fetch, and execute logic. 9.77 Evil Twin extensions on the OpenVSX marketplace impersonated legit developer tools. And shipped host, git, and CI metadata to a shared exfiltration domain. Audit your installed extensions, pull the flagged ones, and block that XFIL domain. 10. Social engineering campaigns using fake Adobe and Zoom updates and Bank of America Account Guard emails are installing Screen Connect agents that beacon to attacker relays and are made hard to uninstall. Alert on unexpected screen connect installs. Block the staging and relay servers in the write up and treat anything branded account guard as malicious. Eleven. The Greatness Phishing Kit added OAuth device code phishing and consent abuse to its MFA bypass toolkit, and it's abusing Ring Central to get past email filters. disable the device code flow where you can, enforce phishing resistant MFA and alert on device code auth from unexpected sources. twelve. Seven zips default handling drops the mark of the web on files extracted from a downloaded zip so a malicious payload runs without a smart screen warning. Update to a version that propagates the mark or enforce a mark aware extraction policy an alert on execution from temp and download paths. Thirteen a gentleman ransomware affiliate used remotely created scheduled tasks to push installers deploying Etheret. A no.js remote access tool that persists after initial compromise. Hunt for unexpected remote schedule tasks and node.js beacons and restrict who can create tasks on remote hosts. 14. It's a new day and there's a new XCS set build that injects a downloader into benign files inside Xcode projects, infecting macOS developers at build time and spreads to every other project on the host. Vet cloned Xcode projects before you build them and watch for injected build scripts. 15. Unit 42 looked at four million dynamic reports and found that forty-five percent of malware with C2 activity made at least one direct IP connection, skipping DNS entirely. Add egress controls that check outbound IP destinations, not just DNS, and flag hard-coded IP connections. 16. And a barracuda POC shows an attacker in a compromised mailbox using the built-in copilot assistant as a living off-the-land tool. Creating hidden inbox rules, escalating to a CEO takeover and redirecting wire transfers. Audit and alert on AI created inbox rules, restrict assistant permissions, and treat mailbox rule changes as an indicator. By the way, it's interesting to see that someone actually found a use for copilot. That's the board for today. Thank you for watching. Sources are in the show notes. If the show is useful to you, please like and subscribe. Back again tomorrow.