Daily DefSec Brief·Oct 9, 2026·5m

Cyber Security News for October 9 2026 - Daily DefSec Brief

Show notes

1. AhsayCBS backup consoles exploited, no patch — CVE-2026-105134, CVE-2026-105133 — Do: Take the AhsayCBS console off the internet — https://www.huntress.com/blog/ahsaycbs-flaws-exploit

2. China-linked crew stays in through a VPN client — CVE-2014-6278, CVE-2015-3306, CVE-2015-5477 (+ 5 more) — federal due 2026-10-11 — Do: Alert on VPN software you didn't deploy — https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a

3. NetScaler's new SAML flaw hits last week's build — CVE-2026-107406 — Fixed: 14.1-73.46 or 13.1-64.29 — Do: Update every NetScaler running SAML — https://support.citrix.com/external/article/CTX697191/

4. Ollama model pulls can plant root code — CVE-2026-103663 — Fixed: 0.35.0 — Do: Upgrade Ollama and check what it will load — https://cert.pl/en/posts/2026/10/CVE-2026-103663/

5. Cisco License On-Prem resets any password — CVE-2026-20328, CVE-2026-76454 — Fixed: 10-202608 — Do: Upgrade Cisco License On-Prem — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE

6. Ransomware shut a cloud and its consoles — Do: Test a restore without your provider's console — https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/

7. Vault deny rules miss differently cased names — CVE-2026-89322, CVE-2026-105818 — Fixed: 2.1.2, 1.21.12, 1.20.17 or 1.19.23 — Do: Lowercase your Vault policies, then upgrade — https://cyber.gc.ca/en/alerts-advisories/hashicorp-security-advisory-av26-1019

8. 17,610 fake GitHub repos re-aimed at malware — Do: Use app control on developer workstations — https://www.bleepingcomputer.com/news/security/fakegit-malware-campaign-returns-with-17-610-malicious-github-repos/

9. Let's Encrypt moves to 64-day certificates — Do: Test your renewals against Let's Encrypt staging — https://letsencrypt.org/2026/10/07/64-day-certs

10. Spirit wants to sell staff Teams chats to Google — Do: Set a retention limit on Teams chats — https://therecord.media/lawmakers-warn-of-google-spirit-ai-training-deal

← Previous

Cyber Security News for October 8 2026 - Daily DefSec Brief

1. AhsayCBS backup consoles exploited, no patch — CVE-2026-105134, CVE-2026-105133 — Do: Take the AhsayCBS console off the internet — https://www.huntress.com/blog/ahsaycbs-flaws-exploit 2. China-linked crew stays in through a VPN client — CVE-2014-6278, CVE-2015-3306, CVE-2015-5477 (+ 5 more) — federal due 2026-10-11 — Do: Alert on VPN software you didn't deploy — https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a 3. NetScaler's new SAML flaw hits last week's build — CVE-2026-107406 — Fixed: 14.1-73.46 or 13.1-64.29 — Do: Update every NetScaler running SAML — https://support.citrix.com/external/article/CTX697191/ 4. Ollama model pulls can plant root code — CVE-2026-103663 — Fixed: 0.35.0 — Do: Upgrade Ollama and check what it will load — https://cert.pl/en/posts/2026/10/CVE-2026-103663/ 5. Cisco License On-Prem resets any password — CVE-2026-20328, CVE-2026-76454 — Fixed: 10-202608 — Do: Upgrade Cisco License On-Prem — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE 6. Ransomware shut a cloud and its consoles — Do: Test a restore without your provider's console — https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/ 7. Vault deny rules miss differently cased names — CVE-2026-89322, CVE-2026-105818 — Fixed: 2.1.2, 1.21.12, 1.20.17 or 1.19.23 — Do: Lowercase your Vault policies, then upgrade — https://cyber.gc.ca/en/alerts-advisories/hashicorp-security-advisory-av26-1019 8. 17,610 fake GitHub repos re-aimed at malware — Do: Use app control on developer workstations — https://www.bleepingcomputer.com/news/security/fakegit-malware-campaign-returns-with-17-610-malicious-github-repos/ 9. Let's Encrypt moves to 64-day certificates — Do: Test your renewals against Let's Encrypt staging — https://letsencrypt.org/2026/10/07/64-day-certs 10. Spirit wants to sell staff Teams chats to Google — Do: Set a retention limit on Teams chats — https://therecord.media/lawmakers-warn-of-google-spirit-ai-training-deal