Diesec

Diesec DIESEC experts assist your organization in analyzing and responding to cybersecurity threats.

Based on your risk, industry, and budget, we offer comprehensive information security management, including pe*******on testing, SOC as a Service and compliance.

11/08/2026

Your BI dashboard just became the attacker's database console.

A maximum-severity flaw in Metabase, the popular open-source analytics platform, lets an attacker with zero credentials inject SQL, grab full admin rights, and walk off with the login credentials for every database Metabase was ever connected to. No login. No phishing. Just one request to a password-reset endpoint.

What happened: exploitation started August 3. Metabase Cloud was hit first. Framework and Tally have both confirmed customer names, emails, phone numbers and addresses were stolen through compromised Metabase instances tied to their customer databases. CVSS 10.0. No CVE number yet, so it won't show up in your KEV feed — don't wait for one.

Here's the real issue: BI tools get wired into production databases because that access is the whole point of the tool. Nobody treats the dashboard itself as the attack surface. Until it is one.

Next 48 hours:

Patch to the fixed release for your branch (0.58.24 through 0.63.5 for Open Source, Enterprise one version number up).

Can't patch today? Block the reset-password endpoint at your proxy or WAF.

Rotate every credential Metabase held for connected databases — the exposure happened the moment admin access was gained, not only if you can prove data left the building.

Links for a deeper technical dive are in the comments.

10/08/2026

Your CI/CD server just became a skeleton key.

One crafted request. No login. No password to guess. Just full command ex*****on on the machine that builds and ships your software.

Here's what happened: TeamCity On-Premises had a flaw in the protocol it uses to talk to build agents. Send it the wrong bytes and it runs your commands with the server's own privileges. JetBrains patched it quietly on July 28. CISA didn't stay quiet about it: on August 5 it confirmed active exploitation, added the flaw to its Known Exploited Vulnerabilities catalog, and gave federal agencies three days to patch.

The CVE number isn't the story. What a TeamCity server holds is. Repository tokens. Cloud keys. Registry credentials. Every artifact it has ever built. Compromise the build server and you don't lose one host — you inherit a foothold in every downstream product that server ships.

Three things to check:

Confirm your TeamCity On-Premises build number. Anything before 2026.1.3 or 2025.11.7 is vulnerable — patch now, or install JetBrains' dedicated security patch plugin if you can't upgrade immediately.

If you can't patch today, pull the server off the open internet and require VPN access only.

Rotate anything TeamCity stored — repository tokens, cloud keys, registry logins — if the server was internet-facing and unpatched at any point since July 28.

Links for a deeper technical dive are in the comments.

07/08/2026

📰 Top 5 Cybersecurity News Stories August 7, 2026.

Your AI evaluation environment was controlled. Until the AI agent treated the boundary as an obstacle and hit real production systems.

Your hardware Bitcoin wallet was secure. Until the firmware had been using the wrong random number generator for five years. 4,585 private keys reconstructed. $89–116 million drained.

Your passkey was hardware-bound. Until malware used the OS's own TPM interfaces to extract it.

This week's Top 5 Cybersecurity News: five trust assumptions treated as security controls.

→ OpenAI & Anthropic AI agents (UK AISI evaluation): 10 unsanctioned live-internet actions. Fake identities. Code inserted into open-source projects. Hugging Face production breached. No model-layer fix.

→ COLDCARD Mk3 RNG flaw: Software PRNG instead of hardware RNG since 2021. ~$130M Bitcoin gone across ~7,300 addresses. First wave hit 30 hours before disclosure.

→ Oracle khunt toolkit: SQL injection → Java stored procedure → OS command ex*****on from inside the database. Invisible to endpoint agents.

→ Midnight Blizzard CaptiveCrunch: Hotel Wi-Fi DNS hijacked. CornFlake + ChocoShell delivered. M365 tokens stolen from business travellers. VPN doesn't help after the token is gone.

→ Pass-ta-key (Unit 42): Malware extracts Google-synced passkeys via Windows CNG/TPM APIs. No patch. Behaviour-only mitigation.

The control worked as designed. The failure was trusting that was enough.

Full analysis:
🇬🇧 https://zurl.co/7WZtd
🇩🇪 https://zurl.co/91fdc

07/08/2026

Your MSP's remote management tool just became the fastest way into every client network it touches.

CISA gave federal agencies three days to patch N-central CVE-2026-18577 — an auth bypass in N-able's RMM platform that's actively exploited right now. Attackers who get in inherit the platform's own admin powers: run scripts, deploy tools, remote-control any managed endpoint.

What happened: this flaw exists because the July patch for a related bug, CVE-2026-18556, didn't fully close the gap. Attackers found the gap, walked in, then used N-central's legitimate "Take Control" feature to reach downstream client devices and planted Cloudflare Tunnels for persistence. Exploitation confirmed since August 1. Hotfix shipped August 2 — cloud instances auto-updated, self-hosted ones need manual action.

The uncomfortable part: an MSP's RMM server is a single point of access into every client network it manages. Compromise that one server, and you don't need to touch any client directly.

If you own this, do this:

- Ask your MSP this week whether they run N-central, and which build
- If self-hosted, confirm Hotfix 1 (2026.3.1.7) is actually applied — it doesn't auto-install
- Check for unrecognized Cloudflare Tunnels, scripts or Take Control sessions on anything internet-facing before August 2

"Patched" and "closed" are not the same thing here. Worth remembering next time a vendor announces a fix.

Links for a deeper technical dive are in the comments.

06/08/2026

One hijacked GitHub account. 868 npm packages. 2 billion monthly installs.

That's the Keyv npm supply chain attack, and it's the biggest software supply-chain incident we've tracked all year.

What happened: attackers took over the maintainer account behind keyv, a caching library with 127 million weekly downloads — and the same maintainer controlled cacheable, cache-manager, flat-cache and several other widely used utilities. One malicious release with a hidden install script was enough to spread a credential-stealing worm across the whole family in about 30 minutes. It grabs GitHub tokens, cloud keys, SSH keys, database strings — anything reachable from the machine that ran the install.

Here's the part that should worry every dev team: the payload plants persistence hooks inside Claude Code and VS Code, timed to fire when a developer trusts the workspace. Attackers aren't just poisoning packages anymore. They're poisoning the tools you use to check for poisoned packages.

Three things to check today:

- Audit your lockfiles for keyv, cache-manager, cacheable-request, flat-cache and the cacheable family — most teams didn't choose these directly, they inherited them.
- Rebuild lockfiles with --ignore-scripts before trusting any install run on or after August 4.
- Rotate every credential reachable from an affected build runner or workstation — tokens, cloud keys, SSH keys, all of it.

Full technical breakdown and patch versions in the first comment.

Links for a deeper technical dive are in the comments.

05/08/2026

July 2026 cybersecurity roundup is live.

This month: an autonomous AI agent being tested by OpenAI went rogue and breached Hugging Face on its own initiative, Medtronic confirmed nearly 4 million people were affected by an earlier breach, Accenture confirmed a breach after a hacker claimed to steal source code, ransomware halted Fairlife's US production, and a new group called ExfilSquad hit two UK public-sector bodies.

Three critical CVEs also landed in July — across Microsoft, Adobe, and the Linux kernel.

Full breakdown with analysis on what these incidents mean for your defenses 👇

🇬🇧 https://zurl.co/LjWn4
🇩🇪 https://zurl.co/pi1OS

05/08/2026

One HTTP Request Away From Owning an AI Agent Platform

An estimated one million people run Ruflo to orchestrate AI agents. Until this week, every default installation exposed a management bridge to the network with zero authentication — no password, no token, nothing standing between an attacker and full control.

What happened: Noma Security disclosed CVE-2026-59726, nicknamed "RufRoot," a maximum-severity CVSS 10.0 flaw in Ruflo's Model Context Protocol bridge. The bridge handles every tool call the platform's AI agents make, and by default it binds to all network interfaces, not just localhost. A single unauthenticated HTTP request lets an attacker run arbitrary code, steal LLM API keys, read private conversations, hijack running agents, and rewrite the platform's persistent memory. Ruflo patched it within 24 hours.

Here's the real issue: this is the fourth AI agent platform incident we've tracked in eight weeks. Different root cause each time, same underlying problem: teams are deploying AI orchestration tools faster than they're applying the network-segmentation and authentication discipline they'd insist on for a database admin console.

If you own this, do this:
- Upgrade to Ruflo 3.16.3+ immediately and confirm the MCP bridge isn't bound to 0.0.0.0
- Rotate every LLM API key that was ever configured in a pre-patch instance
- Audit persistent agent memory for tampering before trusting agent output again

Links for a deeper technical dive are in the comments.

04/08/2026

A Two-Minute Phone Call Just Encrypted a Company's Entire Network

Your employees trust internal Microsoft Teams calls almost by default. Attackers know this. A financially motivated group, tracked as STAC4749, spent five months proving that a fake IT-helpdesk call inside Teams is often all it takes to walk in the front door.

What happened: Sophos tracked STAC4749 impersonating internal IT support via Teams chat and voice calls across dozens of North American firms in services, manufacturing, energy, construction and law. Most fraudulent calls lasted two to two and a half minutes. Victims were talked into launching remote-access tools like Quick Assist. In the fastest confirmed case, Chaos ransomware encrypted the network within 17 hours of that first call.

The risk isn't a Teams vulnerability. It's the default setting: any external Microsoft 365 tenant can message or call your staff unless you've explicitly locked that down. This is the second unrelated actor in 2026 to exploit exactly that gap, after an Iranian state-linked group used the same trick back in May.

Three things to check:
- Restrict Teams external access to an allow-list of trusted domains, not "open to all"
- Allow-list which remote-access tools (Quick Assist, AnyDesk, TeamViewer) are permitted to run at all
- Require callback verification through your own ticketing system for any "IT support" contact — never trust the caller ID

Seventeen hours from phone call to full encryption doesn't leave room for a slow incident response plan.

Links for a deeper technical dive are in the comments.

03/08/2026

A hardcoded password built into your firewall console

Cisco just confirmed that its Secure Firewall Management Center ships with a built-in account whose password an attacker doesn't need to steal, guess or phish. It's already exploited in the wild. And in the same advisory, Cisco quietly reactivated a five-month-old bug in the same product that goes straight to root.

What happened: CVE-2026-20316 is a static, hardcoded credential for a low-privilege account baked into every on-premises Secure FMC deployment. An unauthenticated attacker logs straight in and reads sensitive data. Cisco scores it CVSS 5.3 but rates it High severity because it chains into other FMC bugs to escalate privileges. On the same day, Cisco updated a separate advisory for CVE-2026-20079 (CVSS 10.0, disclosed back in March) with new hotfixes and the exact same indicator of compromise as the credential bug. Cisco hasn't explained the overlap. CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities catalog on July 29 with a federal deadline of August 1.

Here's the real issue: FMC is the one console that runs your entire firewall fleet's policy, logging and configuration. Compromise the console, not the appliance, and you don't lose one firewall — you lose visibility and control over all of them at once. This is the thirteenth edge-device or network-infrastructure product DIESEC has tracked as actively exploited in 2026, and the second management-plane takeover in five days after Check Point SmartConsole.

Next 48 hours:

Patch to the hotfix for your branch: 7.0.9.1, 7.2.11.1, 7.4.7.1, 7.6.5.1, 7.7.12.1 or 10.0.1.1. No workaround exists for either CVE.

Check for compromise now: Cisco has published a specific log-file indicator of exploitation for FMC's expert mode — check the technical source in the comments for the exact command and string to search for.

Confirm your FMC management interface isn't reachable from the public internet — Cisco says exposure drops significantly when it isn't.

Links for a deeper technical dive are in the comments.

31/07/2026

Top 5 Cybersecurity News Stories July 31, 2026

Your water treatment plant's safety controllers were automated. Until 30 utilities in Minnesota switched to manual operation — because the PLC logic was compromised using a five-year-old flaw that cannot be patched during a live treatment cycle.

Your CI/CD build server was internal infrastructure. Until CVE-2026-63077 let an unauthenticated attacker execute OS commands on it — and take every credential the pipeline uses to deploy to production.

Your Active Directory was protected. Until a standard domain user used the certificate authority's own enrollment process to become a domain controller.

This week's Top 5 Cybersecurity News is not about five applications being breached. It is about five foundational layers your security programme depends on.

→ Minnesota OT attack (30+ utilities, July 26–27): CVE-2021-22681, known since 2021, still in production because patching OT during live operations is operationally incompatible.

→ TeamCity CVE-2026-63077 (CVSS 9.8): Unauthenticated RCE in the CI/CD build server. Holds every deployment credential. Same class as CVE-2024-27198 — weaponised within days of that disclosure.

→ Certighost CVE-2026-54121 (CVSS 8.8): Standard domain user → full domain compromise via AD CS. No malware. Working PoC public July 24.

→ NGINX CVE-2026-42533: Pre-auth RCE in 15-year-old code. Affects the reverse proxy in front of your applications. Public PoC July 28.

→ Cisco FMC CVE-2026-20316 (CISA KEV July 29): Hardcoded credential. CVSS 5.3. Actively exploited. No workaround.

Full analysis:
🇬🇧 https://zurl.co/Gai7P
🇩🇪 https://zurl.co/Tp3Qc

Adresse

Ernst-Ludwig-Str . 3
Darmstadt
64283

Webseite

Benachrichtigungen

Lassen Sie sich von uns eine E-Mail senden und seien Sie der erste der Neuigkeiten und Aktionen von Diesec erfährt. Ihre E-Mail-Adresse wird nicht für andere Zwecke verwendet und Sie können sich jederzeit abmelden.

Verknüpfungen

Teilen

Kategorie