Daily DefSec Brief

Oct 23, 20264m

Attackers are exploiting a third VeloCloud Orchestrator zero-day, stolen Microsoft 365 tokens were replayed against 79 organizations from one hosting range, and Railway is telling every customer to rotate their secrets.

Oct 22, 20264m

Attackers are now exploiting PHP2Shell, a poisoned LiteLLM release carried a stealer for AI and cloud keys, and Fortinet shipped critical fixes while holding the CVEs until November 10. Every version number and every fix

Oct 21, 20264m

PHP ships fixes today for two critical flaws whose details leaked ahead of disclosure, and a certificate authority's signing keys turned out to be guessable, one of them the number four. Also: a joint advisory on SafePay

Oct 20, 20264m

The NetScaler flaw that crashed appliances is a step in a root takeover whose implant tries to copy itself to the HA partner. ClickFix crews bring a signed Siemens program to run their malware, Plex servers are being hij

Oct 19, 20265m

Attackers used ConnectWise's app credentials to enter Microsoft 365 tenants. Also: a FortiGate implant, stolen UpdraftCentral keys, NTLMv1 blocks, AOMEI's update servers, and fixes. Every version number and every fix in

Oct 16, 20264m

Attackers are using a BeyondTrust Remote Support zero-day and the Atlassian Data Center file-read flaw. Also: Office Preview Pane flaws, AI coding tokens stolen, Drupal, Next.js and NGINX fixes, hijacked NAS boxes, spywa

Oct 15, 20265m

Attackers are getting root on Cisco Secure Email Gateways with a crafted attachment, and the fix is a month old. Also: a PAN-OS zero-day, Ahsay's failed patch, Nextcloud, Zimbra, curl, Claude Code Desktop, and which pack

Oct 14, 20264m

Attackers chained Ivanti Connect Secure zero-days to take over VPNs without a login, one of them fully patched, and Microsoft's record October updates fix a Windows flaw that skips the warning on downloaded files. Also:

Oct 13, 20264m

1. GitLab fixes a 10.0 pre-login code execution flaw — CVE-2026-97229 — Fixed: 19.4.2, 19.3.5 or 19.2.8 — Do: Upgrade self-managed GitLab — https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ 2

Oct 12, 20265m

1. GlobalProtect bypass still feeds ransomware — CVE-2026-0257 — Fixed: 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6, or the matching hotfix — Do: Patch GlobalProtect and review VPN sessions — https://security.paloaltonetworks.c

Oct 9, 20265m

1. AhsayCBS backup consoles exploited, no patch — CVE-2026-105134, CVE-2026-105133 — Do: Take the AhsayCBS console off the internet — https://www.huntress.com/blog/ahsaycbs-flaws-exploit 2. China-linked crew stays in thr

Oct 8, 20264m

1. Japan's data thefts came through internal APIs — CVE-2026-72898 — Do: Find the internal APIs your apps expose — https://www.jpcert.or.jp/at/2026/at260030.html 2. Phishing now hides orders for your inbox AI — Do: Confi

Oct 7, 20264m

1. FortiBleed is active and locking admins out — Do: Reset Fortinet admin and VPN passwords — https://www.ic3.gov/CSA/2026/261006.pdf 2. Ninja Forms flaw is being used to add admins — CVE-2026-94504, CVE-2026-93836 — Fix

Oct 6, 20264m

1. ClickFix stages its payload in the browser cache — Do: Disable Windows Script Host where it isn't needed — https://thehackernews.com/2026/10/clickfix-smuggles-payloads-through.html 2. Atlassian Data Center leaks files

Oct 5, 20264m

1. NetScaler SAML flaw exploited after last fix — CVE-2026-88779 — Fixed: 14.1-73.41 or 13.1-64.28 — federal due 2026-10-07 — Do: Update NetScaler again if it uses SAML — https://support.citrix.com/external/article/CTX69

Oct 2, 20263m

1. FortiMail zero-day exploited, no patch yet — CVE-2026-104286 — federal due 2026-10-04 — Do: Take FortiMail's admin interface off the internet — https://fortiguard.fortinet.com/psirt/FG-IR-26-175 2. Warlock still break

Oct 1, 20263m

1. Cisco SD-WAN Manager zero-day gives admin — CVE-2026-76504 — Fixed: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1 — federal due 2026-10-03 — Do: Patch SD-WAN Manager, then check its logs — https://sec.c

Sep 30, 20263m

1. A password reset led to Kubernetes credentials — Do: Alert on sign-in methods added after resets — https://www.microsoft.com/en-us/security/blog/2026/09/29/beyond-source-code-a-path-to-the-keys-to-the-kingdom/ 2. A pa

Sep 29, 20264m

1. Exploited Apple flaw fixed for older releases — CVE-2026-86950 — Fixed: 26.7.1 · 15.8.1 — Do: Update iPhones and Macs still on older releases — https://support.apple.com/en-us/149229 2. Featured Chrome ad blocker is s

Sep 28, 20264m

1. NetScaler zero-days exploited before the patch — CVE-2026-88771, CVE-2026-88772 — Fixed: 14.1-73.37, 13.1-64.23, 13.1-37.279 (FIPS and NDcPP) — federal due 2026-09-30 — Do: Patch NetScaler, then hunt for compromise —

Sep 25, 20264m

1. One affiliate, four ransomware brands, one toolkit — Do: Hunt for remote access tools you didn't deploy — https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-trade

Sep 24, 20264m

1. Roundcube pre-login SQL injection now exploited — CVE-2026-48842 — Fixed: 1.6.16 or 1.7.1 — Do: Upgrade Roundcube webmail — https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1 2. TeamCity RCE now u

Sep 23, 20265m

1. F5 BIG-IP APM zero-day exploited for code execution https://my.f5.com/manage/s/article/K000162605 2. Check Point management servers exploited since July https://support.checkpoint.com/results/sk/sk1000171 3. Device-co

Sep 22, 20264m

1. A thousand switches gave up the network map — CVE-2026-7273 — Fixed: 2.90(ABTQ.2)C0 on the 48HPv2 — each model has its own 2.90 build ending .2)C0 — federal due 2026-09-24 — Do: Upgrade the GS1900s and change their pa

Sep 21, 20265m

1. Orkes Conductor RCE exploited for a month — CVE-2026-58138 (fixed in 3.30.2) — Do: Patch Conductor, put its API behind login — https://research.empiricalsecurity.com/research/september-2026-cve-of-the-month 2. Three L