Cyber Morning Call

Referências do Episódio

• CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products (Atlassian)

• Atlassian warns of critical file access flaw in its datacenter products (The Register)

• ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure (FortiGuard Labs)

• Rejetto HFS servers now actively scanned for critical RCE flaw (BleepingComputer)

• Dell Urges Customers to Patch Critical DSU Flaw That Can Give Attackers Root Access (Security Affairs)

• Exchange Flaw CVE-2026-96940 Exposes Users' Mailboxes (Cyber Kendra)

• ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits (The Hacker News)

• Microsoft Threat Intelligence no X (@MsftSecIntel)

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• Understanding and Addressing CVE-2026-88779 in Citrix NetScaler ADC and Citrix NetScaler Gateway

• New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

• SMTP is the key: BPFDoor and AVERAT hitting the network edge

• AI agent exploits Zammad zero-days in DIVD breach: What we know and how to detect it

• GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1

• CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino

• FG-IR-26-175: Improper limitation of a pathname to a restricted directory

• Teenager suspected of leading KillSec ransomware group as law enforcement seizes servers and leak site

• Police disrupt KillSec ransomware, arrest suspected teenage leader

• 16-year-old suspected leader of KillSec ransomware group arrested

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

• Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

• Vulnerability Discovery and Exploitation Trends in the AI Era

• Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

• Disrupting a coordinated model-distillation campaign

• CVE-2026-86950: The Great Glyph Grift

• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

• TV-2026-1010: Security Update for Multiple Vulnerabilities in TeamViewer Clients and Related Services

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)

• Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances

• Citrix, Check Point, F5 e Arista: mais uma semana com falhas críticas sob ataque na borda das empresas

• Star Blizzard refines phishing and malware delivery with the RedFlick technique

• Alleged ShinyHunters leader arrested in the Netherlands

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• About the security content of iOS 26.7.1 and iPadOS 26.7.1

• Apple patches CoreGraphics zero-day flaw exploited in attacks

• From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

•  Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

• NetScaler ADC and NetScaler Gateway Security Bulletin (CTX697096)

• Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities

• ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

• Storm-3168: Agentic-driven cloud attacks using compromised service principals

• Kiteworks urges 6-hour server shutdown over potential zero-day attacks

• Imminent Zero-Day Attack: KiteWorks Urges Customers to Shut Down Servers

• Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

• Roundcube security advisory (AV26-503) – Update 1

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• The Psychedelic Stealer: When a CAPTCHA Becomes an Installer

• MacSync under the microscope: new delivery methods and a new payload

• Uncovering a SectopRAT Variant Embedded in Legitimate Software

• Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

• Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)

• U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog

• OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• 3a Edição da Human Risk Conference

• Novel supplychain.local Go worm appears

• MemTensor npm and PyPI Packages Hit by a Go Worm

• MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack

• Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes

• Meet AvisLoader: A Windows Loader Built to Outlast a Takedown

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia

Referências do Episódio

• Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616

• Chaotic Eclipse Released BigDiskBuster, A PoC For Windows Defender Update DoS Zero-Day

• The Closed Quorum: Inside the first reported autonomous AI C2 implant

• D-Link warns of max severity zero-day bug in DIR-822A routers

• Arista Security Advisory 0183

• SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability (CVE-2026-28324)

• SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability (CVE-2026-28326)

• WordPress 7.1.2 Release

• K000162605: BIG-IP APM vulnerability CVE-2026-94127

• CISA Adds Four Known Exploited Vulnerabilities to Catalog

• BIG-IP APMs expostos por continente

• Disrupting EvilTokens: The AI Chatbot Built for Cybercrime

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo 

Narração de encerramento: Bianca Garcia