BMC Daily Cyber News
- Episodes
- 327
- Released
- daily
- Latest episode
- Nov 14, 2026
About the podcast
The BCM Daily Cyber News brings you clear, timely updates on threats, breaches, patches, and trends every day. Stay informed in minutes with focused audio built for busy professionals. Learn more and explore at BareMetalCyber.com.
Episodes 327
Rogue ScreenConnect tools put MSP trust paths under pressure
Daily Cyber News: New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks Attackers used cloud-hosted ScreenConnect environments to install rogue remote-access clients on at least 288 endpoints …
Show notes
Daily Cyber News: New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
Attackers used cloud-hosted ScreenConnect environments to install rogue remote-access clients on at least 288 endpoints across 48 organizations. All identified systems were targeted within about 90 minutes. Researchers traced likely initial access to versions of the R M M+ extension that could accept a blank shared key.
Key context: The campaign also deployed a toolkit designed to spread from infected customer devices to MSP technicians.
Additional detail: Remote-support platforms create trusted paths between providers, technicians and customer systems.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, malware, worm-like, SCKit, targets, MSPs, ScreenConnect, attacks.
Stolen GitHub access exposes code pipelines and cloud secrets
Daily Cyber News: Stolen GitHub access exposes code pipelines and cloud secrets Development pipelines and cloud environments were put at risk after an attacker used stolen GitHub access to probe more than sixty …
Show notes
Daily Cyber News: Stolen GitHub access exposes code pipelines and cloud secrets
Development pipelines and cloud environments were put at risk after an attacker used stolen GitHub access to probe more than sixty thousand repositories. Roughly four thousand eight hundred compromised accounts submitted pull requests to test whether they could make changes. Researchers confirmed that secrets were stolen from at least one thousand eight hundred thirty five targets.
Key context: This wasn’t an exploit against GitHub Actions.
Additional detail: The malware searched for repository secrets, cloud credentials, GitHub tokens and AI service keys.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, malware, Stolen GitHub, Stolen, GitHub, access, exposes, code.
Autonomous AI scales intrusions across strategic sectors
Daily Cyber News: Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors A likely small team used an autonomous AI framework to run 25 operations against at least 19 …
Show notes
Daily Cyber News: Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors
A likely small team used an autonomous AI framework to run 25 operations against at least 19 organizations. Unauthorized access or data retrieval was confirmed at 10 targets, including organizations in the semiconductor, defense-policy and civil-society sectors. The framework used open-source tooling and commercial AI models to plan and execute tasks.
Key context: The important change is scale.
Additional detail: For leaders, this means exposed services and weak identities are likely to be tested more persistently and across more targets.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Attackers Use Autonomous AI, Target Semiconductor, Civil Society Sectors, Attackers, Autonomous, Target, Semiconductor.
N-central servers breached hours after public exploit release
Daily Cyber News: N-central servers breached hours after public exploit release N-central servers were compromised within hours of public exploit code appearing. That exposed a trusted management layer used by …
Show notes
Daily Cyber News: N-central servers breached hours after public exploit release
N-central servers were compromised within hours of public exploit code appearing. That exposed a trusted management layer used by IT teams and managed service providers. Researchers identified at least 21 affected production servers, including 19 running the latest security update.
Key context: The immediate payload matters, but the attacker’s position matters more.
Additional detail: For leaders, management infrastructure should be treated as having a wider potential impact than an ordinary server.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, N-central, servers, breached, hours, public, exploit, release.
Cold-chain attacks turn refrigeration controls into business disruption
Daily Cyber News: Cold-chain attacks turn refrigeration controls into business disruption Cold-chain operators face inventory loss and equipment hazards when attackers manipulate connected refrigeration …
Show notes
Daily Cyber News: Cold-chain attacks turn refrigeration controls into business disruption
Cold-chain operators face inventory loss and equipment hazards when attackers manipulate connected refrigeration controls. U.S. agencies issued a warning after attacks reportedly placed refrigeration systems serving up to 700 French supermarkets into defrost mode overnight. Stores had to discard spoiled goods, and estimated losses reached tens of millions of euros. Similar activity was reported in Belgium, Luxembourg and Sweden.
Key context: The concern extends well beyond supermarkets.
Additional detail: For leaders, refrigeration security should be treated as a business-continuity and safety concern, not simply an IT issue.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Cold-chain, attacks, refrigeration, controls, business, disruption.
Telecom systems face active attacks on sensitive configurations
Daily Cyber News: Telecom systems face active attacks on sensitive configurations Telecom and hosted communications environments face active attacks through Cisco BroadWorks. The weakness allows an …
Show notes
Daily Cyber News: Telecom systems face active attacks on sensitive configurations
Telecom and hosted communications environments face active attacks through Cisco BroadWorks. The weakness allows an unauthenticated remote attacker to send crafted XML and read sensitive configuration information. Cisco patched the issue in August, but CISA has now added it to its catalog of exploited vulnerabilities.
Key context: BroadWorks supports cloud voice and collaboration services delivered by carriers and managed service providers.
Additional detail: The broader pattern is continued targeting of shared service platforms that can expose multiple customers.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, cisco, Telecom, systems, face, active, attacks, sensitive.
Outlook attacks raise urgency across a massive Microsoft update
Daily Cyber News: Outlook attacks raise urgency across a massive Microsoft update Authentication information is at risk through an Outlook weakness that attackers are already exploiting. A target must open a …
Show notes
Daily Cyber News: Outlook attacks raise urgency across a massive Microsoft update
Authentication information is at risk through an Outlook weakness that attackers are already exploiting. A target must open a specially crafted message file. That action can make Outlook connect to an attacker-controlled network location without displaying its usual external-content warning.
Key context: Microsoft’s November release addresses one thousand ninety five vulnerabilities, including 64 rated critical and 48 critical code-execution issues.
Additional detail: For leaders, Office needs to be included in the emergency patch decision rather than hidden behind general Windows update reporting.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, windows, Outlook, attacks, raise, urgency, across, massive.
AI attack agents accelerate web and cloud credential theft
Daily Cyber News: AI attack agents accelerate web and cloud credential theft Production secrets and cloud data were exposed in attacks linked to self-hosted AntiFox systems. The open-source AI …
Show notes
Daily Cyber News: AI attack agents accelerate web and cloud credential theft
Production secrets and cloud data were exposed in attacks linked to self-hosted AntiFox systems. The open-source AI penetration-testing platform was operated from Alibaba Cloud infrastructure against internet-facing web services and AWS environments. Attackers deployed a webshell, examined application configuration, and used valid AWS identities for rapid discovery.
Key context: The platform can automate repeated attack steps across web servers and cloud services with limited human effort.
Additional detail: The durable pattern is faster chaining of web compromise, credential access, and cloud discovery.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, credential theft, attack, agents, accelerate, cloud, credential, theft.
N-able upgrades hosted systems as exposed servers face scanning
Daily Cyber News: N-able upgrades hosted systems as exposed servers face scanning Managed service providers faced disruption after N-able took hosted N-central environments offline across the Americas, Europe …
Show notes
Daily Cyber News: N-able upgrades hosted systems as exposed servers face scanning
Managed service providers faced disruption after N-able took hosted N-central environments offline across the Americas, Europe, and Asia-Pacific. The company has now upgraded its hosted systems and released N-central 2026.4 HF2 for critical security issues. On-premises customers were strongly urged to upgrade before restoring normal access.
Key context: N-central centrally manages networks and devices for enterprises and service providers, so a security failure could have broad reach.
Additional detail: The broader lesson is that centralized management tools remain high-value targets because one console can affect many systems.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, N-able, upgrades, hosted, systems, exposed, servers, face.
Poland takes public services offline after stopping cyberattack
Daily Cyber News: Poland takes public services offline after stopping cyberattack Citizens, businesses, and public institutions lost access to online government services after Poland temporarily shut down its …
Show notes
Daily Cyber News: Poland takes public services offline after stopping cyberattack
Citizens, businesses, and public institutions lost access to online government services after Poland temporarily shut down its ePUAP platform. Officials said security teams detected and stopped a cyberattack, then disabled the service as a precaution. The government said the infrastructure supporting key digital services remained secure.
Key context: The disruption affects electronic document submissions, government communications, and other administrative procedures.
Additional detail: Organizations running essential digital services should review their shutdown criteria, alternative service channels, and public communication plans.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Poland, takes, public, services, offline, stopping, cyberattack.
N-able takes hosted management platform offline over disclosed risks
Daily Cyber News: N-able takes hosted management platform offline over disclosed risks N-able customers face management disruption after the company took its hosted N-central environment offline as a …
Show notes
Daily Cyber News: N-able takes hosted management platform offline over disclosed risks
N-able customers face management disruption after the company took its hosted N-central environment offline as a precaution. The action followed public disclosure of 33 critical security vulnerabilities while a hotfix was still being developed. N-able said it had not seen active exploitation at the time of its notice.
Key context: Hosted customers cannot access the classic N-central environment, and associated services may be unavailable.
Additional detail: Keep affected servers offline, use the alternate services that remain available, and wait for N-able’s remediation guidance before restoring access.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, active exploitation, N-able, takes, hosted, management, platform, offline.
Trusted cloud access exposes multiple AWS environments and data
Daily Cyber News: Trusted cloud access exposes multiple AWS environments and data Multiple AWS environments had secrets and data accessed after a threat actor used credentials from an account associated with …
Show notes
Daily Cyber News: Trusted cloud access exposes multiple AWS environments and data
Multiple AWS environments had secrets and data accessed after a threat actor used credentials from an account associated with Qubole. Between October 14th and October 26th, the attacker assumed customer roles that still trusted the vendor account. Some of those roles had little or no recent legitimate use.
Key context: The incident turned a routine integration into a cloud supply-chain risk.
Additional detail: Organizations should audit external AWS trust relationships, remove unused roles, revoke suspicious sessions, and rotate every secret those sessions could read.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Trusted, cloud, access, exposes, multiple, environments, data.
Microsoft fixes exploited Outlook attack in massive patch release
Daily Cyber News: Microsoft fixes exploited Outlook attack in massive patch release Organizations face an actively exploited Outlook credential-theft path within a record-breaking Microsoft update covering one …
Show notes
Daily Cyber News: Microsoft fixes exploited Outlook attack in massive patch release
Organizations face an actively exploited Outlook credential-theft path within a record-breaking Microsoft update covering one thousand two hundred thirty five flaws. A malicious message file must be opened. Outlook can then connect to an attacker-controlled location without showing its usual external-content warning and expose an NTLM authentication hash.
Key context: The size of the update creates a difficult prioritization problem for large Windows estates.
Additional detail: Patch the exploited Outlook issue first, then accelerate testing and deployment for exposed network services and high-value systems.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, remote code execution, windows, Microsoft, fixes, exploited, Outlook, attack.
Railway breach drives $740,000 in fraudulent AI charges
Daily Cyber News: Railway breach leads to $740,000 in fraudulent AI charges Railway customers face about seven hundred forty thousand dollars in fraudulent AI usage after attackers stole authentication secrets …
Show notes
Daily Cyber News: Railway breach leads to $740,000 in fraudulent AI charges
Railway customers face about seven hundred forty thousand dollars in fraudulent AI usage after attackers stole authentication secrets. The company says the attackers exploited two infrastructure weaknesses, obtained internal source code, and reached credentials used to decrypt customer environment variables. At most one point eight five percent of workspaces, or approximately one hundred thousand, were potentially affected.
Key context: The incident shows how stolen platform secrets can create immediate financial harm.
Additional detail: Organizations should rotate potentially exposed secrets, revoke linked tokens, and immediately review AI-provider usage for unauthorized charges.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Railway, breach, leads, fraudulent, charges.
Email security gateways targeted for full administrative control
Daily Cyber News: Email security gateways targeted for full administrative control A small number of organizations were compromised through two recently patched Barracuda Email Security Gateway weaknesses. When …
Show notes
Daily Cyber News: Email security gateways targeted for full administrative control
A small number of organizations were compromised through two recently patched Barracuda Email Security Gateway weaknesses. When used together, the issues can bypass authorization and execute commands with root privileges. Successful attacks require access to the appliance’s administrative interface.
Key context: A compromised email security appliance gives an attacker high-level control over a trusted system at the edge of an organization.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Email, security, gateways, targeted, full, administrative, control.
Stale cloud trust opens customer data to supply-chain theft
Daily Cyber News: Stale cloud trust opens customer data to supply-chain theft Customer data was stolen after attackers used compromised credentials linked to Qubole’s AWS account to assume trusted roles in …
Show notes
Daily Cyber News: Stale cloud trust opens customer data to supply-chain theft
Customer data was stolen after attackers used compromised credentials linked to Qubole’s AWS account to assume trusted roles in other organizations’ cloud environments. The campaign affected over a dozen organizations and ran from October 14th to October 26th. Attackers enumerated resources, collected secrets and configurations, and exfiltrated data from S3 buckets.
Key context: Cross-account roles are normal for cloud services, but they can preserve powerful access after a business relationship ends.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Stale, cloud, trust, opens, customer, data, supply-chain.
Remote management platform shut down after 33 flaws go public
Daily Cyber News: Remote management platform shut down after 33 flaws go public Remote administration was interrupted after N-able took its hosted N-central service offline and urged customers to disconnect …
Show notes
Daily Cyber News: Remote management platform shut down after 33 flaws go public
Remote administration was interrupted after N-able took its hosted N-central service offline and urged customers to disconnect self-hosted deployments. A researcher had published details and proof-of-concept code for 33 issues without advance remediation. The disclosed attack chains could steal credentials, create administrative accounts and gain high-level control.
Key context: The concern is the reach of the platform.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Remote, management, platform, shut, down, flaws, public.
Cyber sabotage ruins food and sparks fires across French stores
Daily Cyber News: Cyber sabotage ruins food and sparks fires across French stores Food was destroyed and at least 15 fires were reported after attackers remotely altered refrigeration systems at around 700 …
Show notes
Daily Cyber News: Cyber sabotage ruins food and sparks fires across French stores
Food was destroyed and at least 15 fires were reported after attackers remotely altered refrigeration systems at around 700 French grocery stores. Temperatures reached 50 Celsius for about six hours, forcing businesses to discard fresh and frozen goods. French authorities attributed the October 12th sabotage to Shahid Kaveh, a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps.
Key context: This incident turned access to industrial controls into physical, financial and food-safety consequences.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, sabotage, ruins, food, sparks, fires, across, French.
Hidden botnet turns 1.3 million TV boxes into criminal infrastructure
Daily Cyber News: Update 05 — English headline pending More than 1.3 million Android-based devices across over 200 countries were enrolled in a botnet through software embedded directly in device firmware. Most …
Show notes
Daily Cyber News: Update 05 — English headline pending
More than 1.3 million Android-based devices across over 200 countries were enrolled in a botnet through software embedded directly in device firmware. Most were TV set-top boxes, but investigators also observed telehealth equipment, karaoke machines and digital signs.
Key context: The compromised devices could provide residential proxy access, deliver additional malware and support fraud.
Additional detail: For leaders, the case shows that low-cost connected hardware can introduce supply-chain risk before it ever reaches the organization’s network.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, malware, English, headline, pending.
Cloud breach may expose data tied to 7.7 million shoppers
Daily Cyber News: Cloud breach may expose data tied to 7.7 million shoppers Personal information tied to as many as 7.7 million people may have been exposed after unauthorized access to a cloud service used by …
Show notes
Daily Cyber News: Cloud breach may expose data tied to 7.7 million shoppers
Personal information tied to as many as 7.7 million people may have been exposed after unauthorized access to a cloud service used by the Iris Plaza shopping platform. The potential total includes 5.8 million registered or former members and 1.9 million non-members.
Key context: The operator suspended the store and related systems after finding a suspicious file.
Additional detail: For leaders, the important point is that retention and vendor decisions determine the possible size of a breach before an attacker arrives.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Cloud, breach, expose, data, tied, million, shoppers.
Cold-chain attacks spoil food and expose wider operational risk
Daily Cyber News: Cold-chain attacks spoil food and expose wider operational risk A second wave of cyberattacks changed refrigeration systems to defrost mode and spoiled food at European supermarkets. Reports …
Show notes
Daily Cyber News: Cold-chain attacks spoil food and expose wider operational risk
A second wave of cyberattacks changed refrigeration systems to defrost mode and spoiled food at European supermarkets. Reports described dozens of affected stores across seven countries. That follows an October wave that reached more than 700 locations.
Key context: The central concerns are internet-connected controllers, remote access, old firmware and weak or shared credentials.
Additional detail: The immediate impact is spoiled inventory and interrupted store operations.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Cold-chain, attacks, spoil, food, expose, wider, operational.
Third-party breach enables major theft from French bank
Daily Cyber News: Third-party breach enables major theft from French bank A cyberattack routed through a service provider allowed attackers to execute fraudulent transactions from Crédit Mutuel Arkéa’s own …
Show notes
Daily Cyber News: Third-party breach enables major theft from French bank
A cyberattack routed through a service provider allowed attackers to execute fraudulent transactions from Crédit Mutuel Arkéa’s own account. The bank acknowledged losses in the order of one hundred euros million. An outside blockchain researcher estimated the amount could be as high as one hundred eighteen euros million, or one hundred thirty three dollars million, although that higher figure hasn’t been confirmed by the bank.
Key context: Customer assets were not affected.
Additional detail: The key issue is the authority available through the provider.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Third-party, breach, enables, major, theft, French, bank.
Chainalysis breach exposes user hashes and live access tokens
Daily Cyber News: Chainalysis breach exposes user hashes and live access tokens All Chainalysis users now face credential and session risk after names, usernames, password hashes and live tokens were exposed …
Show notes
Daily Cyber News: Chainalysis breach exposes user hashes and live access tokens
All Chainalysis users now face credential and session risk after names, usernames, password hashes and live tokens were exposed. The company also reported suspected access to some customer accounts on its transaction-monitoring service. Several products were taken offline while the company investigated and strengthened its defenses.
Key context: Chainalysis says it has no evidence that investigations data was accessed or that attribution data was manipulated.
Additional detail: For leaders, this incident combines sensitive identity exposure with disruption to business-critical compliance and investigation services.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Chainalysis, breach, exposes, user, hashes, live, access.
State-linked mobile campaign turns trusted websites into attack paths
Daily Cyber News: State-linked mobile campaign turns trusted websites into attack paths Passwords, messages and location history could be stolen from vulnerable phones simply by visiting a compromised or …
Show notes
Daily Cyber News: State-linked mobile campaign turns trusted websites into attack paths
Passwords, messages and location history could be stolen from vulnerable phones simply by visiting a compromised or imitation website. Researchers attributed the campaign to Russia-linked APT29. The group planted device-fingerprinting code on legitimate sites, convincing lookalikes and a Ukrainian analytics service used by thousands of websites.
Key context: Importantly, the campaign used known vulnerabilities that Apple and Google had already patched, rather than new zero-days.
Additional detail: Enforce current mobile updates, keep outdated devices away from sensitive work and investigate unusual account activity involving users who may have been exposed.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, zero-day, State-linked, mobile, campaign, trusted, websites, attack.
Password-disabled Linux accounts can still admit remote attackers
Daily Cyber News: Password-disabled Linux accounts can still admit remote attackers Accounts intended to reject passwords can still admit remote attackers on certain Linux systems. The issue affects OpenSSH …
Show notes
Daily Cyber News: Password-disabled Linux accounts can still admit remote attackers
Accounts intended to reject passwords can still admit remote attackers on certain Linux systems. The issue affects OpenSSH before 10.6p2 when musl is used without PAM and account settings rely on an asterisk to block password login. An oversized password can trigger a matching error value and be accepted.
Key context: The bypass doesn’t affect accounts with valid password hashes, and glibc-based or PAM-enabled systems aren’t affected.
Additional detail: Update affected systems to OpenSSH 10.6p2, disable S S H password authentication where possible and investigate suspicious logins involving accounts that shouldn’t accept passwords.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, linux, Password-disabled Linux, Password-disabled, accounts, still, admit, remote.
Stolen Cloud App Secrets Let Attackers Cascade Through MSP Clients
Daily Cyber News: Stolen Cloud App Secrets Let Attackers Cascade Through MSP Clients Attackers are using valid Microsoft Entra application secrets to move through managed service providers and target downstream …
Show notes
Daily Cyber News: Stolen Cloud App Secrets Let Attackers Cascade Through MSP Clients
Attackers are using valid Microsoft Entra application secrets to move through managed service providers and target downstream clients at machine speed. About ninety five percent of the observed sign-ins used scripted clients. That included bursts of 24 attempts in 10 seconds.
Key context: Application registrations allow software to authenticate without a person present.
Additional detail: Leaders should give nonhuman identities the same ownership and risk review applied to privileged users.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Stolen Cloud App Secrets Let Attackers, Cascade Through MSP Clients, Stolen, Cloud, Secrets, Attackers, Cascade.
Backdoored Android Devices Powered a 1.3 Million-Device Botnet
Daily Cyber News: Update 04 — English headline pending More than 1.3 million Android-based set-top boxes and other connected devices were turned into infrastructure for criminal activity. Google attributed the …
Show notes
Daily Cyber News: Update 04 — English headline pending
More than 1.3 million Android-based set-top boxes and other connected devices were turned into infrastructure for criminal activity. Google attributed the XCPE operation with high confidence to manufacturer Videostrong. It alleged that a backdoor was embedded across multiple models and brands.
Key context: Legal and technical action disrupted control systems, and Google barred the manufacturer from its certified Android ecosystem.
Additional detail: Business exposure increases when televisions, digital signage or telehealth equipment share networks with sensitive systems.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, malware, English, headline, pending.
Poisoned Security Update Exposed Nearly 3,000 Hosting Servers
Daily Cyber News: Poisoned Security Update Exposed Nearly 3,000 Hosting Servers Nearly three thousand Linux hosting servers ran a malicious cPGuard update as root after an attacker compromised the vendor’s …
Show notes
Daily Cyber News: Poisoned Security Update Exposed Nearly 3,000 Hosting Servers
Nearly three thousand Linux hosting servers ran a malicious cPGuard update as root after an attacker compromised the vendor’s update infrastructure. Versions 5.88.12 through 5.88.19 were distributed for more than 70 minutes on November 2nd. The script collected sensitive files and planted a hidden root shell.
Key context: Potentially exposed material includes password hashes, root S S H keys, MySQL root passwords, shell history and cloud storage keys.
Additional detail: Leaders should prepare for broad credential rotation, customer communication and possible server rebuilds.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, linux, Poisoned Security Update Exposed Nearly, Hosting Servers, Poisoned, Security, Exposed, Nearly.
Cyberattack Put French Blood Storage at Risk Without Halting Care
Daily Cyber News: Cyberattack Put French Blood Storage at Risk Without Halting Care Blood products at three French facilities were put at risk when a cyberattack changed refrigeration temperature and defrost …
Show notes
Daily Cyber News: Cyberattack Put French Blood Storage at Risk Without Halting Care
Blood products at three French facilities were put at risk when a cyberattack changed refrigeration temperature and defrost settings. The French national blood service said it wasn’t attacked directly. The target was its refrigeration provider on November 2nd.
Key context: Monitoring alarms detected the changes, allowing staff to correct the equipment or move products to other facilities.
Additional detail: This matters because remote access to physical systems can turn a supplier compromise into a safety and continuity event.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, Cyberattack Put French Blood Storage, Risk Without Halting Care, Cyberattack, French, Blood, Storage, Risk.
Backdoored firmware turned 1.3 million TV boxes into proxy nodes
Daily Cyber News: Shutting the Door on the XCPE Botnet | Google Cloud Blog More than 1.3 million Android TV boxes were enrolled in a botnet through malware built into their firmware. The backdoor sold access to …
Show notes
Daily Cyber News: Shutting the Door on the XCPE Botnet | Google Cloud Blog
More than 1.3 million Android TV boxes were enrolled in a botnet through malware built into their firmware. The backdoor sold access to criminal affiliates, which used infected devices for residential proxy services, advertising fraud and the delivery of additional malware. Disruption efforts targeted the control infrastructure and may sever access to at least 10 million other compromised devices.
Key context: For leaders, the risk is that low-cost connected equipment can quietly expose a trusted network connection to outside abuse.
Additional detail: The manufacturer was banned from producing certified devices with preloaded Google applications.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.Topics: cybersecurity news, cybersecurity, cyber risk, malware, supply chain, XCPE Botnet, Google Cloud Blog.
These are the latest 40 of 327 episodes. You’ll find older episodes in the podcast’s feed.
Recommended by BMC Daily Cyber News
Similar podcasts
More News podcasts
Is this your podcast?
Confirm it with an entry in your feed: you get a code here, add it as podcast:txt to the channel of your feed, and we check it. Your podcast is then shown as “verified” on SoundNode.