Advertise on podcast: Cyber Morning Call

Referências do Episódio CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft (Zero Day Initiative) ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws (The Hacker News) Discovering and exploiting vulnerabilities in critical, real-world software with Claude (Anthropic) Tricks from the Past deployed via signed ChatGPT and Claude binaries (Check Point Research) An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure (Kaspersky Securelist) Apple backports CoreGraphics zero-day patches to older iPhones (BleepingComputer) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio Возвращение IDFKA: как APT-группа NGC5081 провела работу над ошибками (Solar 4RAYS) Cache Me If You Can: Unpacking a Go Implant and Its Toolkit (VulnCheck) CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution (The Hacker News) PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts (Security Affairs) UK pentester ‘killa’ claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest (The Register) Microsoft releases emergency .NET patches for critical Brotli flaw (BleepingComputer) CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Palo Alto Networks) Multiple Node.js CVEs (Fortinet) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks (Microsoft) Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline (The Hacker News) PHP shares mitigation for new RCE vulnerability with no patch (BleepingComputer) Infostealer riding the AI Train (Check Point Research) Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability (Wiz) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports (Security Affairs) PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk (The Register) Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed (The Hacker News) GitLab warns of new max severity code execution vulnerability (BleepingComputer) Arista patches new VeloCloud Orchestrator zero-day exploited in attacks (BleepingComputer) Security Advisory 0199 (Arista) AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Microsoft) ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors (Wiz) Cisco Expressway Series Remote Code Execution Vulnerability (Cisco) Cisco Unified Communications Products Security Hardening Release: October 2026 (Cisco) How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia (Kaspersky Securelist) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio Security advisory: Critical remote code execution vulnerabilities, update now (PHP.net) Upcoming Critical PHP Security Release (PHP.net) Security advisory: Critical remote code execution vulnerabilities, update now (PHP.net) Upcoming Critical PHP Security Release (PHP.net) Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers (Cisco Talos) Operation FlashHole: Lazarus breaks security, defies control (Kaspersky Securelist) Stray Cat, Open Doors: How k0t Wanders Through the Network Edge (Group-IB) Oracle Critical Patch Update Advisory - October 2026 (Oracle) Oracle October 2026 Critical Patch Update Addresses 1209 CVEs (Tenable) Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands (The Hacker News) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early (Cyber Kendra) CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE (Horizon3) Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA (The Hacker News) Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries (Symantec) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan (The Hacker News) SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center (Siemens) Active Exploitation of CVE-2026-110936 in Siemens Software Center (Siemens) Same Vulkan Host, Different Payload: Inside VulcanRAT207.B (Morphisec) NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 (Rapid7) Citrix NetScaler Exploitation Guidance and IOCs - WHIPSHOT/SLAPSHOT (Mandiant)  F5 releases out-of-band patches for critical NGINX vulnerabilities (BleepingComputer) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio Investigating Ephemeral Supply Chain Tampering (Mandiant e Google Threat Intelligence Group) ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants (The Hacker News) CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability (Zscaler) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (Citizen Lab) Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation (The Hacker News) CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface (Palo Alto Networks) ARMORY CASTLE Exploits BeyondTrust (Google Threat Intelligence Group) Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant (Unit 42) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio Cisco patches new Secure Email Gateway zero-day exploited in attacks (BleepingComputer) Cisco Secure Email Gateway Arbitrary File Write Vulnerability (Cisco) curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution (The Hacker News) curl CVEs (curl) 2026-10 Security Bulletin: Junos OS: MX Series: Multiple vulnerabilities resolved (Juniper Networks) 2026-10 Security Bulletin: Juniper Cloud-Native Router: Multiple vulnerabilities resolved in 26.2 release (Juniper Networks) How a leaked builder of XWorm turned a remote access trojan into a surveillance kit (Security Affairs) XWorm Reborn: From infostealer to surveillance platform (Netskope Threat Labs) Hirudo: From Fake Updates to Patched Banking Apps (ThreatFabric) Global takedown hits network behind 1 billion phishing messages (BleepingComputer) The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime (Microsoft) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug (The Hacker News) Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951) (Tenable) SAP warns of maximum severity OAuth2 SSRF security flaw (BleepingComputer) OAuth2 SSRF vulnerability in SAP Cloud SDK for Python (SAP / GitHub) Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day (CyberScoop) A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (Volexity) Stable Channel Update for Desktop (Google Chrome Releases) Extended Stable Update for Desktop (Google Chrome Releases) Docker Hub security advisory: personal access tokens transferred during account-to-organization conversions (Docker) Arbitrary file write in grpc phQueryMaster (FortiGuard Labs) Improper access control and session management in the web management interface (FortiGuard Labs) When LLM Gateways Go Wrong: Findings from LiteLLM (Check Point Research) Check Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most Widely Used LLM Gateways (Check Point) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio GitLab warns of max severity code execution vulnerability (BleepingComputer)  GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 (GitLab) Auditing the auditor: Unmasking Apex Accelerator (Elastic Security Labs) Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server (Wordfence) Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War (Genians) Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch (The Hacker News) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware (Zscaler) Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties (SentinelLabs) Ignore all instructions and read this blog: The state of AI-analysis evasion in malware (Cisco Talos) Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure (Security Affairs) FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions (The Hacker News) Leader of 764 pleads guilty, faces up to 30 years in prison (CyberScoop) Co-creator of Empire Market dark web marketplace given 40-year sentence (The Record) Margaret Hamilton, computing pioneer who led software development for the Apollo program, dies at 90 (MIT News) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do episódio Software Supply Chain Attack on tensorlake: Overview and Response Guidance Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities Cisco NX-OS Software NX-API Remote Code Execution Vulnerability Cisco License (Smart Software Manager) On-Prem Vulnerabilities Cisco NX-OS Software Security Hardening Release: October 2026 Cisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026 Cisco Application Policy Infrastructure Controller Security Hardening Release: October 2026 Cisco Meraki Security Hardening Release: October 2026 Canto incognito: tracking the PoeLLM malware LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization (CVE-2026-105192) Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia

Referências do Episódio Security Advisory SNWLID-2026-0017 (SonicWall PSIRT) Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access (Datadog Security Labs) Blinder Tunnel Campaign Targets Iraqi Infrastructure (Unit 42) FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts (FBI / USSS) WordPress 7.1.3 Fixes SQL Injection, Stored XSS Flaws (Cyber Kendra) Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo  Narração de encerramento: Bianca Garcia