Daily Brief

Fortra just told BoKS owners to patch the autoregistration service

Fortra just told BoKS owners to patch the autoregistration service

A critical remote stack overflow in boks_autoregisterd. Move to 8.1.0.24 or 9.0.0.7 and lock down port 6507....
Your FortiMail management plane has a Saturday deadline

Your FortiMail management plane has a Saturday deadline

Fortinet confirmed active exploitation of an unauthenticated management-interface file-write bug. CISA's federal due date is Saturday, October 4. Workaround, hunt,…
Thursday’s brief: SD-WAN admin bypass due Saturday, then TeamViewer, OpenSSL, MikroTik

Thursday’s brief: SD-WAN admin bypass due Saturday, then TeamViewer, OpenSSL, MikroTik

Cisco Catalyst SD-WAN Manager is under active exploitation with a federal clock ending Saturday. Also: TeamViewer 15.82, an OpenSSL DTLS…
CISA flagged a MikroTik web-management bug that can root the router with one request

CISA flagged a MikroTik web-management bug that can root the router with one request

Pre-auth integer underflow in RouterOS HTTP body handling. Keep management off the internet and move past 7.23 / onto 7.24....
OpenSSL’s DTLS fix matters if you ship calls, WebRTC, or UDP TLS

OpenSSL’s DTLS fix matters if you ship calls, WebRTC, or UDP TLS

A high-severity handshake resend bug can leak heap memory or crash the process. Public fixes are out; OpenSSL 3.0 needs…
TeamViewer just told every desktop owner to update before the weekend

TeamViewer just told every desktop owner to update before the weekend

Five high-severity client and host flaws, including a session access-control bypass that can lead to remote code execution. Move to…
Your SD-WAN Manager has a Saturday deadline — and attackers already have admin

Your SD-WAN Manager has a Saturday deadline — and attackers already have admin

Cisco Catalyst SD-WAN Manager auth bypass is in the wild. CISA's federal due date is Saturday, October 3. Patch, then…
Wednesday’s brief: Azure wiped in minutes, then Elementor, Spectre, and a NetScaler hunt

Wednesday’s brief: Azure wiped in minutes, then Elementor, Spectre, and a NetScaler hunt

Storm-3168 used stolen Azure service principals to delete storage in seven minutes. Also: Elementor CSRF, a new Spectre Linux leak,…
Federal NetScaler clock ends today. Mandiant just published the web shells to hunt

Federal NetScaler clock ends today. Mandiant just published the web shells to hunt

CISA's due date is Wednesday. Mandiant documented WHIPSHOT and SLAPSHOT on appliances hit before the patch. Patch, then hunt....
A new Spectre trick can pull a Linux root password hash in minutes

A new Spectre trick can pull a Linux root password hash in minutes

Branch Target Reuse works on modern CPUs. Kernel fixes are in; patch Linux hosts that share space with untrusted code....
One link in Elementor 4.3 can make an admin create another admin

One link in Elementor 4.3 can make an admin create another admin

Versions 4.3.0 and 4.3.1 skip WordPress REST CSRF checks. Update to 4.3.2 before someone clicks the wrong email....
Someone stole an Azure service principal and wiped storage in seven minutes

Someone stole an Azure service principal and wiped storage in seven minutes

Storm-3168 used compromised workload identities to delete Azure Storage, Key Vaults, and Function Apps. Check your service principals before standup....
Tuesday’s brief: PeopleSoft attackers slip past WAFs, then Kiteworks, iPhones, and leaky Supabase apps

Tuesday’s brief: PeopleSoft attackers slip past WAFs, then Kiteworks, iPhones, and leaky Supabase apps

ShinyHunters is back on unpatched PeopleSoft, Kiteworks’ weekend shutdown, an iPhone fix for targeted attacks, and 16,326 open Supabase databases....