Cyber Morning Call

1. 1129 - N-able: servidores já corrigidos são invadidos poucas horas após publicação de exploit

   13 novembre 20264 minÀ suivre

   Referências do EpisódioNew N-able “4EverAble2Shell” zero-day exploited hours after PoC released (BleepingComputer)Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2 (The Hacker …

   Notes de l’épisode

   Referências do Episódio

   • New N-able “4EverAble2Shell” zero-day exploited hours after PoC released (BleepingComputer)

   • Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2 (The Hacker News)

   • Uncovering ArcticRAT: The Evolution from Targeted Crypto-Stealer to AI-Powered Android RAT (Zimperium)

   • Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files (The Hacker News)

   • PHP2Shell Exploitation on Check Point Gateway (Check Point Research)

   Roteiro e apresentação: Carlos Cabral

   Edição de áudio: Paulo Arruzzo

   Narração de encerramento: Bianca Garcia

2. 1128 - Clientes falsos de acesso remoto são instalados em 288 computadores de 48 empresas

   12 novembre 20267 minÀ suivre

   Referências do EpisódioSCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints (Huntress)Apache HTTP Server 2.4 vulnerabilities (Apache Software …

   Notes de l’épisode

   Referências do Episódio

   • SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints (Huntress)

   • Apache HTTP Server 2.4 vulnerabilities (Apache Software Foundation)

   • Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know (Wiz)

   • The XG Files: Falcon C2 Flying Under The (Browser) Radar (Unit 42)

   • The global socket: how threat actors are weaponizing GSocket for stealthy C2 (Microsoft)

   • Zoom Workplace for Windows - Improper Input Validation (Zoom)

   • Zoom Workplace for Windows - Origin Validation Error (Zoom)

   Roteiro e apresentação: Carlos Cabral

   Edição de áudio: Paulo Arruzzo

   Narração de encerramento: Bianca Garcia

   
   

3. 1127 - Espionagem ligada à China mira setor de telecom e ministérios na América Latina

   11 novembre 202610 minÀ suivre

   Referências do EpisódioNot All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe (Check Point Research)SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code …

   Notes de l’épisode

   Referências do Episódio

   • Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe (Check Point Research)

   • SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution (The Hacker News)

   • GhostFrame ESXi Implant Powers Settra Ransomware Attacks (Daily CyberSecurity)

   • GhostFrame: A new ESXi Implant Linked to Settra Ransomware (Recorded Future, via Malware News)

   • Exchange for breakfast: Turla’s Cereal tricks are not for kids (ESET WeLiveSecurity)

   • Microsoft’s November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194) (Tenable)

   • Patch Tuesday - November 2026 (Rapid7)

   • Microsoft Patch Tuesday, November 2026 Security Update Review (Qualys)

   • microsoft august 2026 patch tuesday fixes 400 flaws 3 zero days (BleepingComputer)

   • About the security content of iOS 27.2.1 and iPadOS 27.2.1 (Apple)

   • Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities (The Hacker News)

   Roteiro e apresentação: Carlos Cabral

   Edição de áudio: Paulo Arruzzo

   Narração de encerramento: Bianca Garcia

4. 1126 - Mais de 30 falhas publicadas de uma vez forçam N-able a desligar plataforma

   10 novembre 20268 minÀ suivre

   Referências do Episódio/bin/live: Conheça o Instituto Aaron Swartz com Lucas Lago e Ana Freitas (Mente Binária)Status Dashboard (N-able)N-able takes cloud platform offline after 30+ “zero-days” published …

   Notes de l’épisode

   Referências do Episódio

   • /bin/live: Conheça o Instituto Aaron Swartz com Lucas Lago e Ana Freitas (Mente Binária)

   • Status Dashboard (N-able)

   • N-able takes cloud platform offline after 30+ “zero-days” published (BleepingComputer)

   • N-able takes N-central platform offline after zero-day dump (TechTarget)

   • N-able takes N-central offline as alleged zero-day exploits surface (Field Effect)

   • Stable Channel Update for Desktop (Google Chrome Releases)

   • Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026 (The Hacker News)

   • The Cold Chain on Fire : Unpatched Danfoss controllers exploited (Sekoia)

   • Trusted by Default: Qubole Cross-Account Access Abused in the Wild (Wiz)

   • FORGE Lab uses agentic tools to identify memory safety issues in Rust (Microsoft)

   • BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Proofpoint)

   Roteiro e apresentação: Carlos Cabral

   Edição de áudio: Paulo Arruzzo

   Narração de encerramento: Bianca Garcia

5. 1125 - Falha em VPN deixa invasores driblarem a autenticação multifator e já está sob exploração

   9 novembre 20265 minÀ suivre

   Referências do EpisódioAuthentication Enforcement Bypass in SonicOS SSLVPN Allowing SAML and MFA Bypass (SonicWall PSIRT)U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities …

   Notes de l’épisode

   Referências do Episódio

   • Authentication Enforcement Bypass in SonicOS SSLVPN Allowing SAML and MFA Bypass (SonicWall PSIRT)

   • U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog (Security Affairs)

   • SonicWall security advisory (AV26-1133) (Canadian Centre for Cyber Security)

   • ARTEX abuse expands as cybercriminals target financial sector (Microsoft)

   • Microsoft Paint RCE Fix Now Available, but Windows Update Won’t Deliver It (The Hacker News)

   Roteiro e apresentação: Carlos Cabral

   Edição de áudio: Paulo Arruzzo

   Narração de encerramento: Bianca Garcia
   

6. 1124 - Backdoor invisível a antivírus é encontrado em servidor brasileiro

   6 novembre 20267 minÀ suivre

   Referências do EpisódioCWPdoor: The Invisible Backdoor Living Inside Control Web Panel (XLab / QiAnXin)Threat actors use agentic AI tooling to find and abuse exposed secrets (Microsoft)Cobalt Strike: Favorite …

   Notes de l’épisode

   Referências do Episódio

   • CWPdoor: The Invisible Backdoor Living Inside Control Web Panel (XLab / QiAnXin)

   • Threat actors use agentic AI tooling to find and abuse exposed secrets (Microsoft)

   • Cobalt Strike: Favorite Tool from APT to Crimeware (Proofpoint)

   • Alleged source code of Cobalt Strike toolkit shared online (BleepingComputer)

   • Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns (Check Point Research)

   • Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560) (watchTowr Labs)

   • Two Barracuda ESG Flaws Could Be Combined for Full Root Access; Patches Released (Security Affairs)

   • Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution (The Hacker News)

   • OpenSSH flaw lets attackers log into password-disabled Linux accounts (BleepingComputer)

   • OpenSSH Password Authentication Bypass on Alpine Linux (*sshole) (OX Security)

   • sshole (CVE-2026-123158): OpenSSH password bypass on Alpine Linux (Cycode, via Security Boulevard)

   Roteiro e apresentação: Carlos Cabral

   Edição de áudio: Paulo Arruzzo

   Narração de encerramento: Bianca Garcia

7. 1123 - Teclado chinês popular é sequestrado para instalar malware de espionagem

   5 novembre 202611 minÀ suivre

   Referências do EpisódioSlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware (ESET WeLiveSecurity)Defrost and Disrupt | An Assessment of Europe’s Refrigeration Attacks …

   Notes de l’épisode

   Referências do Episódio

   • SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware (ESET WeLiveSecurity)

   • Defrost and Disrupt | An Assessment of Europe’s Refrigeration Attacks (SentinelOne)

   • Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles (Check Point Research)

   • Poisoned Source: APT29 watering holes target mobile devices with n-day exploits (Sekoia)

   • Possible arbitrary file write and read in Active Storage image analysis (GitHub / Rails)

   • Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM’s Memory (The Hacker News)

   • XSA-523 - Xen Security Advisories (Xen Project)

   • Exploitation Targeting Node-RED, a Tool Embedded in ICS Products (VulnCheck)

   • Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root (The Hacker News)

   • SonicWall warns of unpatched flaws in end-of-life GMS software (BleepingComputer)

   Roteiro e apresentação: Carlos Cabral

   Edição de áudio: Paulo Arruzzo

   Narração de encerramento: Bianca Garcia

8. 1122 - Chaves vazadas viram IA pirata revendida no submundo

   3 novembre 202610 minÀ suivre

   Referências do EpisódioThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources (Google Threat Intelligence Group)ARTEX and Friends: Enter Agentic Offensive Frameworks (Google …

   Notes de l’épisode

   Referências do Episódio

   • The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources (Google Threat Intelligence Group)

   • ARTEX and Friends: Enter Agentic Offensive Frameworks (Google Threat Intelligence Group)

   • CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations (Kaspersky Securelist)

   • From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (Microsoft)

   • Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) (Rapid7)

   • Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw (The Hacker News)

   • North Korea Responsible for $6 Billion+ Binance Attack (FBI)

   • Foi assim que Hackers Roubaram Bilhões (canal O Bobo de Wall Street no Youtube)

   Roteiro e apresentação: Carlos Cabral

   Edição de áudio: Paulo Arruzzo

   Narração de encerramento: Bianca Garcia

9. 1121 - Coreia do Norte usa IA em recrutadores falsos e acelera ataques

   30 octobre 20267 minÀ suivre

   Referências do EpisódioTracking AI adoption in North Korean threat actor tradecraft (Microsoft)NIK C2: The new AI-enabled command-and-control framework (Cisco Talos)New Prompt Injection Techniques Cover …

   Notes de l’épisode

   Referências do Episódio

   • Tracking AI adoption in North Korean threat actor tradecraft (Microsoft)

   • NIK C2: The new AI-enabled command-and-control framework (Cisco Talos)

   • New Prompt Injection Techniques Cover Agent-Planning Attacks (CrowdStrike)

   • Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users (Socket)

   • Chrome extensions with 13.4 million installs caught hijacking searches (BleepingComputer)

   Roteiro e apresentação: Carlos Cabral

   Edição de áudio: Paulo Arruzzo

   Narração de encerramento: Bianca Garcia

10. 1120 - Modems Intelbras e roteadores domésticos viram ponte para espionagem atribuída à China contra os EUA

    29 octobre 20266 minÀ suivre

    Referências do EpisódioSilent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access (Lumen)Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco …

    Notes de l’épisode

    Referências do Episódio

    • Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access (Lumen)

    • Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN (Cisco Talos)

    • Juniper Fixes 18 Session Smart Router Vulnerabilities, Two Rated CVSS 9.8 (SecurityOnline)

    • Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch (The Hacker News)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

11. 1119 - Uma correção, três falhas: como invasores tomaram servidores da Oracle sem credenciais

    28 octobre 20267 minÀ suivre

    Referências do EpisódioCVE-2026-35273: SSRF to RCE in Oracle PeopleSoft (Zero Day Initiative)ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws (The Hacker News)Discovering …

    Notes de l’épisode

    Referências do Episódio

    • CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft (Zero Day Initiative)

    • ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws (The Hacker News)

    • Discovering and exploiting vulnerabilities in critical, real-world software with Claude (Anthropic)

    • Tricks from the Past deployed via signed ChatGPT and Claude binaries (Check Point Research)

    • An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure (Kaspersky Securelist)

    • Apple backports CoreGraphics zero-day patches to older iPhones (BleepingComputer)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

12. 1118 - Invasores passam mais de 2 anos escondidos em rede corporativa e voltam mesmo depois da faxina

    27 octobre 20266 minÀ suivre

    Referências do EpisódioВозвращение IDFKA: как APT-группа NGC5081 провела работу над ошибками (Solar 4RAYS)Cache Me If You Can: Unpacking a Go Implant and Its Toolkit (VulnCheck)CISA Confirms Active Exploitation …

    Notes de l’épisode

    Referências do Episódio

    • Возвращение IDFKA: как APT-группа NGC5081 провела работу над ошибками (Solar 4RAYS)

    • Cache Me If You Can: Unpacking a Go Implant and Its Toolkit (VulnCheck)

    • CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution (The Hacker News)

    • PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts (Security Affairs)

    • UK pentester ‘killa’ claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest (The Register)

    • Microsoft releases emergency .NET patches for critical Brotli flaw (BleepingComputer)

    • CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Palo Alto Networks)

    • Multiple Node.js CVEs (Fortinet)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

13. 1117 - Chave esquecida no github abriu caminho para ataque contra o LiteLLM

    26 octobre 20266 minÀ suivre

    Referências do EpisódioInside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks (Microsoft)Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release …

    Notes de l’épisode

    Referências do Episódio

    • Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks (Microsoft)

    • Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline (The Hacker News)

    • PHP shares mitigation for new RCE vulnerability with no patch (BleepingComputer)

    • Infostealer riding the AI Train (Check Point Research)

    • Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability (Wiz)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

14. 1116 - Falha no PHP que ameaça 70% da web começou a ser explorada 4 dias antes do alerta

    23 octobre 20269 minÀ suivre

    Referências do EpisódioPHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports (Security Affairs)PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk (The …

    Notes de l’épisode

    Referências do Episódio

    • PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports (Security Affairs)

    • PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk (The Register)

    • Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed (The Hacker News)

    • GitLab warns of new max severity code execution vulnerability (BleepingComputer)

    • Arista patches new VeloCloud Orchestrator zero-day exploited in attacks (BleepingComputer)

    • Security Advisory 0199 (Arista)

    • AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Microsoft)

    • ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors (Wiz)

    • Cisco Expressway Series Remote Code Execution Vulnerability (Cisco)

    • Cisco Unified Communications Products Security Hardening Release: October 2026 (Cisco)

    • How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia (Kaspersky Securelist)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

15. 1115 - Atualização: Vuns críticas no PHP são confirmadas

    22 octobre 20269 minÀ suivre

    Referências do EpisódioSecurity advisory: Critical remote code execution vulnerabilities, update now (PHP.net)Upcoming Critical PHP Security Release (PHP.net)Security advisory: Critical remote code execution …

    Notes de l’épisode

    Referências do Episódio

    • Security advisory: Critical remote code execution vulnerabilities, update now (PHP.net)

    • Upcoming Critical PHP Security Release (PHP.net)

    • Security advisory: Critical remote code execution vulnerabilities, update now (PHP.net)

    • Upcoming Critical PHP Security Release (PHP.net)

    • Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers (Cisco Talos)

    • Operation FlashHole: Lazarus breaks security, defies control (Kaspersky Securelist)

    • Stray Cat, Open Doors: How k0t Wanders Through the Network Edge (Group-IB)

    • Oracle Critical Patch Update Advisory - October 2026 (Oracle)

    • Oracle October 2026 Critical Patch Update Addresses 1209 CVEs (Tenable)

    • Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands (The Hacker News)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

16. 1114 - Falhas críticas no PHP vazam antes do patch

    21 octobre 20267 minÀ suivre

    Referências do EpisódioPHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early (Cyber Kendra)CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE (Horizon3)Qilin and INC Ransomware …

    Notes de l’épisode

    Referências do Episódio

    • PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early (Cyber Kendra)

    • CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE (Horizon3)

    • Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA (The Hacker News)

    • Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries (Symantec)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

17. 1113 - Ataque usa programa legítimo da Siemens para tomar o controle do computador

    20 octobre 20267 minÀ suivre

    Referências do EpisódioClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan (The Hacker News)SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center …

    Notes de l’épisode

    Referências do Episódio

    • ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan (The Hacker News)

    • SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center (Siemens)

    • Active Exploitation of CVE-2026-110936 in Siemens Software Center (Siemens)

    • Same Vulkan Host, Different Payload: Inside VulcanRAT207.B (Morphisec)

    • NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 (Rapid7)

    • Citrix NetScaler Exploitation Guidance and IOCs - WHIPSHOT/SLAPSHOT (Mandiant)

    • F5 releases out-of-band patches for critical NGINX vulnerabilities (BleepingComputer)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

18. 1112 - Atualização adulterada por poucos minutos instalou backdoor em empresas do Brasil e de outros 10 países

    19 octobre 20265 minÀ suivre

    Referências do EpisódioInvestigating Ephemeral Supply Chain Tampering (Mandiant e Google Threat Intelligence Group)ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants (The Hacker …

    Notes de l’épisode

    Referências do Episódio

    • Investigating Ephemeral Supply Chain Tampering (Mandiant e Google Threat Intelligence Group)

    • ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants (The Hacker News)

    • CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability (Zscaler)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

19. 1111 - Basta ver um anúncio: spyware invadiu 45 aparelhos da Al Jazeera sem nenhum clique

    16 octobre 20269 minÀ suivre

    Referências do EpisódioExposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (Citizen Lab)Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid …

    Notes de l’épisode

    Referências do Episódio

    • Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (Citizen Lab)

    • Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation (The Hacker News)

    • CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface (Palo Alto Networks)

    • ARMORY CASTLE Exploits BeyondTrust (Google Threat Intelligence Group)

    • Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant (Unit 42)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

    
    

20. 1110 - E-mail com anexo malicioso dá controle total de gateway da Cisco

    15 octobre 20268 minÀ suivre

    Referências do EpisódioCisco patches new Secure Email Gateway zero-day exploited in attacks (BleepingComputer)Cisco Secure Email Gateway Arbitrary File Write Vulnerability (Cisco)curl Patches HTTP/2 Upload Flaw …

    Notes de l’épisode

    Referências do Episódio

    • Cisco patches new Secure Email Gateway zero-day exploited in attacks (BleepingComputer)

    • Cisco Secure Email Gateway Arbitrary File Write Vulnerability (Cisco)

    • curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution (The Hacker News)

    • curl CVEs (curl)

    • 2026-10 Security Bulletin: Junos OS: MX Series: Multiple vulnerabilities resolved (Juniper Networks)

    • 2026-10 Security Bulletin: Juniper Cloud-Native Router: Multiple vulnerabilities resolved in 26.2 release (Juniper Networks)

    • How a leaked builder of XWorm turned a remote access trojan into a surveillance kit (Security Affairs)

    • XWorm Reborn: From infostealer to surveillance platform (Netskope Threat Labs)

    • Hirudo: From Fake Updates to Patched Banking Apps (ThreatFabric)

    • Global takedown hits network behind 1 billion phishing messages (BleepingComputer)

    • The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime (Microsoft)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

21. 1109 - Novo normal: Microsoft corrige recorde de mais de 1.400 falhas, uma delas já explorada por atacantes

    14 octobre 20268 minÀ suivre

    Referências do EpisódioMicrosoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug (The Hacker News)Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951) (Tenable)SAP warns …

    Notes de l’épisode

    Referências do Episódio

    • Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug (The Hacker News)

    • Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951) (Tenable)

    • SAP warns of maximum severity OAuth2 SSRF security flaw (BleepingComputer)

    • OAuth2 SSRF vulnerability in SAP Cloud SDK for Python (SAP / GitHub)

    • Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day (CyberScoop)

    • A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (Volexity)

    • Stable Channel Update for Desktop (Google Chrome Releases)

    • Extended Stable Update for Desktop (Google Chrome Releases)

    • Docker Hub security advisory: personal access tokens transferred during account-to-organization conversions (Docker)

    • Arbitrary file write in grpc phQueryMaster (FortiGuard Labs)

    • Improper access control and session management in the web management interface (FortiGuard Labs)

    • When LLM Gateways Go Wrong: Findings from LiteLLM (Check Point Research)

    • Check Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most Widely Used LLM Gateways (Check Point)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

22. 1108 - Falha de severidade máxima no GitLab permite executar código no servidor sem login

    13 octobre 20267 minÀ suivre

    Referências do EpisódioGitLab warns of max severity code execution vulnerability (BleepingComputer) GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 (GitLab)Auditing the auditor: Unmasking Apex Accelerator …

    Notes de l’épisode

    Referências do Episódio

    • GitLab warns of max severity code execution vulnerability (BleepingComputer)

    • GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 (GitLab)

    • Auditing the auditor: Unmasking Apex Accelerator (Elastic Security Labs)

    • Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server (Wordfence)

    • Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War (Genians)

    • Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch (The Hacker News)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

23. 1107 - Ferramenta falsa para programadores entrega controle total do computador a operadores da Coreia do Norte

    9 octobre 20268 minÀ suivre

    Referências do EpisódioSuspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware (Zscaler)Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on …

    Notes de l’épisode

    Referências do Episódio

    • Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware (Zscaler)

    • Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties (SentinelLabs)

    • Ignore all instructions and read this blog: The state of AI-analysis evasion in malware (Cisco Talos)

    • Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure (Security Affairs)

    • FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions (The Hacker News)

    • Leader of 764 pleads guilty, faces up to 30 years in prison (CyberScoop)

    • Co-creator of Empire Market dark web marketplace given 40-year sentence (The Record)

    • Margaret Hamilton, computing pioneer who led software development for the Apollo program, dies at 90 (MIT News)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

    
    

24. 1106 - Malware em pacote de programação rouba senhas e apaga arquivos de quem tenta revogar o acesso

    8 octobre 20268 minÀ suivre

    Referências do episódioSoftware Supply Chain Attack on tensorlake: Overview and Response GuidanceCisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution VulnerabilityCisco Nexus 3000 and 9000 …

    Notes de l’épisode

    Referências do episódio

    • Software Supply Chain Attack on tensorlake: Overview and Response Guidance

    • Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability

    • Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities

    • Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

    • Cisco License (Smart Software Manager) On-Prem Vulnerabilities

    • Cisco NX-OS Software Security Hardening Release: October 2026

    • Cisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026

    • Cisco Application Policy Infrastructure Controller Security Hardening Release: October 2026

    • Cisco Meraki Security Hardening Release: October 2026

    • Canto incognito: tracking the PoeLLM malware

    • LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization (CVE-2026-105192)

    • Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs

    • Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

25. 1105 - Nota máxima: falha no SonicWall permite a atacante sem senha alcançar funções internas de gateway de acesso

    7 octobre 20266 minÀ suivre

    Referências do EpisódioSecurity Advisory SNWLID-2026-0017 (SonicWall PSIRT)Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access (Datadog Security Labs)Blinder Tunnel Campaign …

    Notes de l’épisode

    Referências do Episódio

    • Security Advisory SNWLID-2026-0017 (SonicWall PSIRT)

    • Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access (Datadog Security Labs)

    • Blinder Tunnel Campaign Targets Iraqi Infrastructure (Unit 42)

    • FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts (FBI / USSS)

    • WordPress 7.1.3 Fixes SQL Injection, Stored XSS Flaws (Cyber Kendra)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

    
    

26. 1104 - Falha crítica em Jira e Confluence permite ler arquivos sem login

    6 octobre 20268 minÀ suivre

    Referências do EpisódioCVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products (Atlassian)Atlassian warns of critical file access flaw in its datacenter products (The Register)ClingSTUN …

    Notes de l’épisode

    Referências do Episódio

    • CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products (Atlassian)

    • Atlassian warns of critical file access flaw in its datacenter products (The Register)

    • ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure (FortiGuard Labs)

    • Rejetto HFS servers now actively scanned for critical RCE flaw (BleepingComputer)

    • Dell Urges Customers to Patch Critical DSU Flaw That Can Give Attackers Root Access (Security Affairs)

    • Exchange Flaw CVE-2026-96940 Exposes Users' Mailboxes (Cyber Kendra)

    • ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits (The Hacker News)

    • Microsoft Threat Intelligence no X (@MsftSecIntel)

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

27. 1103 - Ataques derrubam acessos remotos de empresas e forçam a Citrix a lançar mais uma correção emergencial

    5 octobre 20266 minÀ suivre

    Referências do EpisódioUnderstanding and Addressing CVE-2026-88779 in Citrix NetScaler ADC and Citrix NetScaler GatewayNew NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments OfflineSMTP …

    Notes de l’épisode

    Referências do Episódio

    • Understanding and Addressing CVE-2026-88779 in Citrix NetScaler ADC and Citrix NetScaler Gateway

    • New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

    • SMTP is the key: BPFDoor and AVERAT hitting the network edge

    • AI agent exploits Zammad zero-days in DIVD breach: What we know and how to detect it

    • GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1

    • CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

28. 1102 - Por 30 reais, criminosos entram em loja que vende acesso a vítimas brasileiras

    2 octobre 20265 minÀ suivre

    Referências do EpisódioAnatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestinoFG-IR-26-175: Improper limitation of a pathname to a restricted directoryTeenager suspected of leading …

    Notes de l’épisode

    Referências do Episódio

    • Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino

    • FG-IR-26-175: Improper limitation of a pathname to a restricted directory

    • Teenager suspected of leading KillSec ransomware group as law enforcement seizes servers and leak site

    • Police disrupt KillSec ransomware, arrest suspected teenage leader

    • 16-year-old suspected leader of KillSec ransomware group arrested

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

    
    

29. 1101 - Uma letra trocada no endereço dá ao atacante acesso de admin a redes da Cisco

    1 octobre 202610 minÀ suivre

    Referências do EpisódioCisco Catalyst SD-WAN Manager API Authentication Bypass VulnerabilityCritical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)Vulnerability …

    Notes de l’épisode

    Referências do Episódio

    • Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

    • Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

    • Vulnerability Discovery and Exploitation Trends in the AI Era

    • Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

    • Disrupting a coordinated model-distillation campaign

    • CVE-2026-86950: The Great Glyph Grift

    • China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

    • TV-2026-1010: Security Update for Multiple Vulnerabilities in TeamViewer Clients and Related Services

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

30. 1100 - Mandiant: ataques contra o Netscaler começaram no início de setembro

    30 septembre 20265 minÀ suivre

    Referências do EpisódioHere We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway AppliancesCitrix, Check Point, F5 …

    Notes de l’épisode

    Referências do Episódio

    • Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)

    • Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances

    • Citrix, Check Point, F5 e Arista: mais uma semana com falhas críticas sob ataque na borda das empresas

    • Star Blizzard refines phishing and malware delivery with the RedFlick technique

    • Alleged ShinyHunters leader arrested in the Netherlands

    Roteiro e apresentação: Carlos Cabral

    Edição de áudio: Paulo Arruzzo

    Narração de encerramento: Bianca Garcia

Voici les 40 derniers épisodes sur 1 132. Les épisodes plus anciens se trouvent dans le flux du podcast.