Show Notes
1. Chrome patches a V8 zero-day that attackers are already using — CVE-2026-85046 — The Hacker News — https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html 2. Coder's package registry served Terraform modules that steal credentials (malicious modules served 07:35–21:45 UTC, Mon 31 Aug, advisory GHSA-vx42-ghc9-gw65) — BleepingComputer — https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised-to-push-malicious-modules/ 3. HPE patches unauthenticated code execution in ArubaOS-CX switches (fixed in 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, 10.10.1181) — CVE-2026-73749 — BleepingComputer — https://www.bleepingcomputer.com/news/security/hpe-patches-critical-arubaos-cx-remote-code-execution-flaw/ 4. Casdoor lets one tenant's admin act on every other tenant, with no patch available (3.115.0 and earlier) — CVE-2026-15630 — CERT/CC — https://kb.cert.org/vuls/id/889462 5. Cisco ships seven IOS XR flaws as one hardening release (no fixed release, upgrade to a release with SMUs, then apply them) — CVE-2026-20274, CVE-2026-20279 — Cisco PSIRT — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM 6. Phishing hides lure words from email filters with invisible Unicode (strip U+E0000–U+E007F before applying signatures) — Microsoft Security — https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/ 7. AWS patches command injection in the CodeCatalyst blueprints framework (@amazon-codecatalyst/blueprints.blueprint before 0.3.156) — CVE-2026-85012 — AWS Security Bulletin — https://aws.amazon.com/security/security-bulletins/rss/2026-095-aws/ 8. A China-linked espionage crew is running its intrusions through AI agents — Security Affairs — https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html 9. BraZetsu packages a compromised Windows host into something an access broker can sell — The Hacker News — https://thehackernews.com/2026/09/brazetsu-malware-turns-compromised.html 10. Toy Ghouls runs its new backdoor's command channel over HiveMQ and Element — Securelist — https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/ 11. Fourteen fake macOS installers deliver the OtterCookie remote access trojan — Jamf Threat Labs — https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/ 12. A phishing kit produced 700 new pages in the month after its servers were seized — Infosecurity Magazine — https://www.infosecurity-magazine.com/news/outsider-phishing-kit-survives/ 13. The 153 million driver's licence scans have a suspected source — Security Affairs — https://securityaffairs.com/198388/security/dark-web-service-nexus-sells-153m-drivers-licenses.html 14. Thomson Reuters breach exposed sealed court records across eleven states — The Hacker News — https://thehackernews.com/2026/09/thomson-reuters-court-software-breach.html 15. A fake acquisition, a forged NDA, and instructions not to tell your colleagues — Dark Reading — https://www.darkreading.com/cyberattacks-data-breaches/large-enterprises-fake-merger-acquisition-scams 16. An AI found 23,000 vulnerabilities and nobody has looked at 21,000 of them — Help Net Security — https://www.helpnetsecurity.com/2026/09/04/echo-claude-mythos-vulnerability-findings/
More from Daily DefSec Brief
Attackers are exploiting a third VeloCloud Orchestrator zero-day, stolen Microsoft 365 tokens were replayed against 79 organizations from one hosting range, and Railway is telling every customer to rotate their secrets. Plus eMudhra's root leaving Chrome on October 27, and a firewall whose admin password was "password". Every version number in this episode was checked against the vendor's own advisory before it aired. Today's question: How does your team keep audit findings from turning into a pay negotiation? Reply in the comments or at [email protected].
Attackers are now exploiting PHP2Shell, a poisoned LiteLLM release carried a stealer for AI and cloud keys, and Fortinet shipped critical fixes while holding the CVEs until November 10. Every version number and every fix in this episode was checked against the vendor's own advisory or the researchers' report before it aired. Today's question: How do you check that your security alerts still reach a person? Reply in the comments or at [email protected].
PHP ships fixes today for two critical flaws whose details leaked ahead of disclosure, and a certificate authority's signing keys turned out to be guessable, one of them the number four. Also: a joint advisory on SafePay ransomware, a hijacked account that swapped OVHcloud's CLI downloads for a stealer, and a test account with the password Password1. Fixes were checked against the vendor's advisory or release notes where one exists, and against the researchers' report where not. Today's question: How does your team find accounts that should have been deleted? Reply in the comments or at [email protected].
The NetScaler flaw that crashed appliances is a step in a root takeover whose implant tries to copy itself to the HA partner. ClickFix crews bring a signed Siemens program to run their malware, Plex servers are being hijacked a day after an exploit went public, and a fake WatchGuard download site collects VPN logins. Every version number and every fix in this episode was checked against the vendor's advisory, release notes or the CVE record before it aired. Today's question: Where does your team tell people to get the VPN client? Reply in the comments or at [email protected].
Attackers used ConnectWise's app credentials to enter Microsoft 365 tenants. Also: a FortiGate implant, stolen UpdraftCentral keys, NTLMv1 blocks, AOMEI's update servers, and fixes. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: How do you review vendor apps in your tenant? Reply in the comments or at [email protected].