Cyber Morning Call

Referências do Episódio

• PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early (Cyber Kendra)

• CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE (Horizon3)

• Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA (The Hacker News)

• Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries (Symantec)

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan (The Hacker News)

• SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center (Siemens)

• Active Exploitation of CVE-2026-110936 in Siemens Software Center (Siemens)

• Same Vulkan Host, Different Payload: Inside VulcanRAT207.B (Morphisec)

• NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 (Rapid7)

• Citrix NetScaler Exploitation Guidance and IOCs - WHIPSHOT/SLAPSHOT (Mandiant) 

• F5 releases out-of-band patches for critical NGINX vulnerabilities (BleepingComputer)

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• Investigating Ephemeral Supply Chain Tampering (Mandiant e Google Threat Intelligence Group)

• ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants (The Hacker News)

• CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability (Zscaler)

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (Citizen Lab)

• Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation (The Hacker News)

• CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface (Palo Alto Networks)

• ARMORY CASTLE Exploits BeyondTrust (Google Threat Intelligence Group)

• Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant (Unit 42)

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• Cisco patches new Secure Email Gateway zero-day exploited in attacks (BleepingComputer)

• Cisco Secure Email Gateway Arbitrary File Write Vulnerability (Cisco)

• curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution (The Hacker News)

• curl CVEs (curl)

• 2026-10 Security Bulletin: Junos OS: MX Series: Multiple vulnerabilities resolved (Juniper Networks)

• 2026-10 Security Bulletin: Juniper Cloud-Native Router: Multiple vulnerabilities resolved in 26.2 release (Juniper Networks)

• How a leaked builder of XWorm turned a remote access trojan into a surveillance kit (Security Affairs)

• XWorm Reborn: From infostealer to surveillance platform (Netskope Threat Labs)

• Hirudo: From Fake Updates to Patched Banking Apps (ThreatFabric)

• Global takedown hits network behind 1 billion phishing messages (BleepingComputer)

• The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime (Microsoft)

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug (The Hacker News)

• Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951) (Tenable)

• SAP warns of maximum severity OAuth2 SSRF security flaw (BleepingComputer)

• OAuth2 SSRF vulnerability in SAP Cloud SDK for Python (SAP / GitHub)

• Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day (CyberScoop)

• A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (Volexity)

• Stable Channel Update for Desktop (Google Chrome Releases)

• Extended Stable Update for Desktop (Google Chrome Releases)

• Docker Hub security advisory: personal access tokens transferred during account-to-organization conversions (Docker)

• Arbitrary file write in grpc phQueryMaster (FortiGuard Labs)

• Improper access control and session management in the web management interface (FortiGuard Labs)

• When LLM Gateways Go Wrong: Findings from LiteLLM (Check Point Research)

• Check Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most Widely Used LLM Gateways (Check Point)

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• GitLab warns of max severity code execution vulnerability (BleepingComputer) 

• GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 (GitLab)

• Auditing the auditor: Unmasking Apex Accelerator (Elastic Security Labs)

• Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server (Wordfence)

• Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War (Genians)

• Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch (The Hacker News)

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware (Zscaler)

• Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties (SentinelLabs)

• Ignore all instructions and read this blog: The state of AI-analysis evasion in malware (Cisco Talos)

• Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure (Security Affairs)

• FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions (The Hacker News)

• Leader of 764 pleads guilty, faces up to 30 years in prison (CyberScoop)

• Co-creator of Empire Market dark web marketplace given 40-year sentence (The Record)

• Margaret Hamilton, computing pioneer who led software development for the Apollo program, dies at 90 (MIT News)

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do episódio

• Software Supply Chain Attack on tensorlake: Overview and Response Guidance

• Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability

• Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities

• Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

• Cisco License (Smart Software Manager) On-Prem Vulnerabilities

• Cisco NX-OS Software Security Hardening Release: October 2026

• Cisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026

• Cisco Application Policy Infrastructure Controller Security Hardening Release: October 2026

• Cisco Meraki Security Hardening Release: October 2026

• Canto incognito: tracking the PoeLLM malware

• LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization (CVE-2026-105192)

• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs

• Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• Security Advisory SNWLID-2026-0017 (SonicWall PSIRT)

• Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access (Datadog Security Labs)

• Blinder Tunnel Campaign Targets Iraqi Infrastructure (Unit 42)

• FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts (FBI / USSS)

• WordPress 7.1.3 Fixes SQL Injection, Stored XSS Flaws (Cyber Kendra)

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia