It’s More Secure When It’s Disabled – PSW #943

Paul Asadoorian

1. Why this month’s Microsoft patch release is a doozy

   Summary: Microsoft's September patch release fixes roughly 972 vulnerabilities, including 112 rated critical, making it a record month for Microsoft security updates. The release includes two exploited zero-days, plus notable issues in Exchange Server, SharePoint, SQL Server, Remote Desktop Services, Microsoft Authenticator, and more than 20 potentially wormable bugs. The larger context is AI-assisted vulnerability discovery, which appears to be driving much higher patch volume across major vendors.

   Paul's take: Are the vulnerabilities now outpacing attackers, e.g., can they not create exploits fast enough? (We have not seen many exploits for these yet...). On the flip side, this is the new patching reality, and I don't think most organizations are ready. If AI helps defenders find hundreds of bugs faster, it also helps attackers sort through the patches, diff the fixes, and build exploits faster. The numbers are almost too big to operationalize, so prioritization matters: exploited zero-days, internet-facing Exchange and RDP, wormable paths, and identity or authentication bugs go first. Patch faster, but also assume the window between disclosure and weaponization keeps shrinking.

2. I Think the Military Commissary Freezers Were Hacked

   Summary: Multiple U.S. military commissaries reported refrigeration and freezer failures around the same time, with at least six installations confirmed through official sources and the Pentagon acknowledging a possible DeCA refrigeration disruption. One notable case at Fort Huachuca involved all freezers entering defrost mode while power remained on, and DeCA engineering documents say its remote monitoring and control system controls defrost. The article does not prove a cyberattack, but it lays out why networked refrigeration controls, recent industrial-controller vulnerability research, and federal investigative interest make the question reasonable.

   Paul's take: I'm old, so I sometimes watch war documentaries. One thing that can really hurt an army is disrupting supplies such as food, clothing, water, and ammunition. This type of attack can seem boring until you put it in the context of "cyberwar". This is also exactly the kind of weird operational story that deserves investigation without jumping straight to attribution. A freezer is not exciting until you remember that modern refrigeration is controlled by networked systems, and those systems can affect the physical world. Maybe this turns out to be a bad update, a contractor mistake, aging equipment, or a boring maintenance failure. But if every freezer goes into defrost and the defrost function is controlled by RMCS, I want logs, controller models, firmware versions, network paths, and a real root cause.

3. Windows Security Center API to disable Windows Defender protections

   Summary: This article walks through a technique for abusing the Windows Security Center API to register a fake antivirus product and force Microsoft Defender into passive mode on Windows endpoints. The public defendnot proof of concept uses undocumented WSC COM interfaces, registers a fake AV provider, and can also register a fake firewall. The piece focuses heavily on detection opportunities, including WSC provider registry keys, Defender event ID 5007, SecurityCenter event ID 15, and Sysmon telemetry around process injection, scheduled-task persistence, and DLL loads into Task Manager.

   Paul's take: This is a clever way to impair Defender because it does not look like the usual "turn off AV" behavior defenders are trained to watch for. Windows is doing what it was designed to do when a third-party AV registers, but the trust path around that registration becomes the attack surface. I like the detection angle here: monitor who is registering security products, watch Defender enter passive mode, and don't rely only on tool-specific indicators from the public PoC. If a random endpoint suddenly claims it has a new antivirus, don't treat that as normal background noise.

4. GPUThor: an evolution of the Rowhammer idea

   Summary: Researchers demonstrated GPUThor, a Rowhammer-class attack against Nvidia Ampere GPUs using GDDR6 memory, including A4000, A4500, A5000, and A6000 cards. By studying how Target Row Refresh behaves, they found a more effective hammering pattern that produced far more bit flips than earlier GPU Rowhammer work, including double- and triple-bit errors that ECC does not simply clean up. The researchers showed denial-of-service impact against accelerators, but did not demonstrate arbitrary code execution.

   Paul's take: This is still mostly research. In fact, I don't see threat actors actively exploiting speculative execution, Rowhammer vulnerabilities, or TPMs. However, the threat model is real: cloud providers rent GPU time to strangers, and hardware faults do not care about tenant boundaries. ECC helps, but this shows ECC is not a magic shield if the attack can produce multi-bit corruption. I wouldn't panic over GPUThor today, but I would pay attention if I run shared GPU infrastructure. Hardware isolation, fleet monitoring, and knowing when a GPU starts throwing weird errors matter more as these attacks get better. Also, if an attacker can manipulate memory, that is bad and super hard to defend against and detect...

5. Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

   Summary: Cisco Talos says attackers are actively exploiting two Cisco Secure Firewall Management Center vulnerabilities: CVE-2026-20079, a critical authentication bypass leading to root access, and CVE-2026-20316, a static-credential issue that allows low-privileged login and can be chained with other flaws. Talos describes three intrusion clusters: web shells and credential theft; a Sandworm-linked Cyclops Blink deployment; and activity consistent with Qilin ransomware affiliates using FMC as a foothold for recon, tunneling, credential harvesting, and ransomware staging. Cisco has hotfixes available now, with a broader hardening release planned.

   Paul's take: This is the firewall manager becoming the attacker’s management plane. Once an FMC is compromised, it is not just one Linux box in the corner; it has visibility into security policy, managed devices, credentials, and internal network structure. The Sandworm and Qilin angles make this more than routine Patch Tuesday noise. Patch the FMC, pull the Talos IOCs, look for web shells and odd package activity, and treat exposed management infrastructure like it is already in the attacker’s playbook, because it is. Don't treat these appliances as appliances; monitor them like you would any other critical device, and push the boundaries of what the vendor lets you do to gain visibility. Attackers are using easy-to-detect TTPs on network edge devices. Why? Because they work, and defenders are trying to win the fight with one arm tied behind their back.

6. Intel’s String of Firmware Flaws Shows Why BIOS Updates Can No Longer Be Skipped

   Summary: The article argues that BIOS and firmware updates are no longer optional maintenance because recent Intel-related UEFI, microcode, SMM, TDX, and early-boot issues affect both security and system stability. It points to CPU degradation fixes delivered through BIOS updates, motherboard firmware flaws that can enable SMM code execution, early-boot DMA exposure from incomplete IOMMU setup, Secure Boot key problems, and persistent firmware implants that survive OS reinstalls. The main takeaway is that firmware patching now belongs in normal enterprise patch management, not in the "only touch it when hardware breaks" bucket.

   Paul's take: I agree with the premise, even if firmware patching is still painful at scale. The operating system can be perfectly patched and still lose if the platform underneath it has vulnerable firmware, broken Secure Boot assumptions, or SMM code execution. The hard part is operational: inventory firmware versions, know which systems are end-of-life, test vendor updates, and schedule reboots without bricking half the fleet. Ignoring BIOS updates used to be a lazy shortcut. Now it is a real security gap. We continue to see malware exploit this attack surface (e.g., SheetRAT - https://medium.com/@ZypherSec/reverse-engineering-sheetrat-when-a-rat-grows-a-uefi-bootkit-ff881cbf4d7d). I still believe this will become more common as attackers look for better places to hide and persist when other avenues dry up, and as we hopefully get better at defending the OS layer.

7. Darkhotel Has Not Exploited a Single Critical Vulnerability. Other Attacker Groups Exploit Nothing Else.

   Summary: SYRN analyzed 598 CVEs linked to named threat actors and tools, then compared those exploited flaws against CVSS severity. The data shows that exploited flaws are more likely to be critical than random CVEs, but more than half of attributed exploited CVEs were not rated critical. The key point is that CVSS 9+ mostly describes unauthenticated, network-reachable exploitation, while many espionage and post-compromise actors care more about local privilege escalation, sandbox escapes, auth bypasses, and other lower-scored flaws that help after initial access.

   Paul's take: This is why "patch criticals first" is necessary but not enough. CVSS isn't entirely useless; it just describes one shape of risk, and attackers don't all operate the same way. Ransomware affiliates love internet-facing unauthenticated RCE because it scales. Espionage groups may already have a foothold, so a 5.5 or 6.0 bug can be exactly what they need. Prioritization has to include exploit context (what the exploit allows a threat actor to do), actor behavior (What they do after successful exploitation), exposed assets (exposed to the Internet or not?), and where the vulnerable software sits in your environment (on a critical asset, honeypot, or somewhere else?).

8. New Microsoft Defender ‘ShieldCrash’ zero-day grants SYSTEM access
9. Tengu Mirai-Style Linux Bot Hides as Kernel Worker to Launch DDoS and Proxy Attacks

   Summary: Researchers analyzed a Linux bot called Tengu that borrows Mirai-style tradecraft while adding persistence, DDoS, SSH probing, and proxy capabilities. The stripped 32-bit ELF hides as a fake kworker process, uses multiple Linux persistence paths including systemd, SysV init, OpenWrt procd, cron, and rc.local, and decodes a C2 endpoint at 64[.]89[.]163[.]8:9931. The available static analysis supports calling it Mirai-style, but does not prove direct Mirai source-code lineage.

   Paul's take: This is the third malware strain I've seen recently using the fake 'kworker' process to hide; know it and look for it when threat hunting. The fake kworker name is not magic, but it will fool quick process-list checks, especially on embedded gear nobody monitors closely. The proxy capability matters too, because infected devices are useful not just for DDoS, but for hiding other traffic. Hunt for odd startup entries, fake kernel-worker processes running from userland, and outbound connections from appliances that should not be talking to random infrastructure.

10. CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT
11. CERN’s migration path from CentOS Linux to Debian

    Summary: CERN is moving the Linux systems that directly control its accelerator hardware from CentOS Linux to Debian, mainly because newer RHEL-family builds require newer x86-64 CPU features that much of CERN's older control hardware cannot support. Replacing those systems would mean redesigning custom PCI and VME-based control equipment, adding rack space, recabling underground systems, and spending millions. Debian gives CERN a longer hardware runway, while its LTS and ELTS timelines line up with the accelerator's long maintenance cycles.

    Paul's take: I want to nominate these folks for the Linux Admins of the Year award, so great, and a fascinating look at systems in a large complex environment. This is also a great reminder that infrastructure decisions are not just about which distro people like. CERN has custom hardware, real-time requirements, kernel drivers, diskless boot, and machines 100 meters underground controlling physical equipment. "Just upgrade the hardware" sounds easy until it means redesigning control boards and touching thousands of cables connected to a particle accelerator. Stability and portability matter, and sometimes the secure choice is the one that lets you keep patching old but necessary hardware without pretending the refresh cycle is normal enterprise IT.

12. Creating EMBeD, the Embedded Malware Benchmark Dataset – CrySyS Blog

    Summary: CrySyS describes EMBeD, a proposed public benchmark dataset for embedded and IoT malware research. The project builds a cleaned metadata database from existing malware sets, improves family labeling by weighting VirusTotal labels and validating them with TLSH similarity graphs, then balances families by selecting representative samples or finding additional ones through VirusTotal and Ukatemi's Kaibou repository. Their proof-of-concept used 67,800 MIPS IoT malware samples and produced a balanced seven-family dataset covering Mirai, Gafgyt, Hajime, Kaiji, Tsunami, DDoSTF, and Dofloo.

    Paul's take: This is the unglamorous work that makes malware research better. If every IoT detection paper uses a private dataset and a private train-test split, the accuracy numbers are mostly vibes. A public, balanced, labeled benchmark gives researchers something real to compare against. The hard part is label quality, because AV family names are messy and inconsistent, so I like that they are using similarity checks instead of just trusting VirusTotal votes.

13. UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot – CERT/CC VU#718077

    Summary: CERT/CC published a vulnerability note for a Secure Boot bypass involving UEFI Shell modules embedded in SPI flash. If an attacker can modify UEFI boot entries, they may be able to launch the shell even when Secure Boot controls should suppress it, then use shell capabilities like memory read/write to alter the pre-boot environment and run unauthorized code before the OS loads. Multiple firmware ecosystem vendors are listed, including AMI, Cisco, Gigabyte, and Insyde, with firmware updates or vendor-specific guidance required.

    Paul's take: UEFI shells strike again, and I believe many more are lurking out there, waiting to be abused to bypass Secure Boot. This is classic below-the-OS security: Secure Boot can be enabled and still lose if firmware leaves a powerful UEFI shell sitting in flash and the boot-entry logic can be tricked. Once you get code running before the OS, your EDR is late to the meeting, and reinstalling Windows may not save you. Also, full disclosure: Stas Lyakhov at Eclypsium reported this, and Stas is both a great researcher and genuinely one of the nicest people you could work with. Patch firmware, monitor boot configuration changes, and stop treating BIOS updates like optional housekeeping. Also, stay tuned for more thorough and innovative ways to detect this condition, thanks to many more smart and amazing people at my day job.

14. Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability

    Summary: Cisco disclosed a Secure Boot bypass in UCS servers and UCS-based appliances caused by UEFI Shell memory-write commands being available while Secure Boot is enabled. Cisco UCS means Cisco Unified Computing System. It is Cisco’s enterprise server platform, not just a networking product. UCS includes blade servers, rack servers, modular systems, storage servers, edge compute systems, management controllers, fabric interconnects, and management through UCS Manager or Cisco Intersight. An attacker with valid KVM or virtual KVM access, or physical access on some appliances, could boot into the shell, modify UEFI memory variables, and run unauthorized pre-OS code. Cisco has released firmware updates, and the fix removes memory-modification commands from the UEFI Shell when Secure Boot is enabled.

    Paul's take: We should remove the memory-modification commands from the UEFI shells entirely, like Framework and others have, since they're only needed by the manufacturer and should never ship this way to a customer, agreed? This isn't a remote internet RCE, but it matters because UCS is the server hardware underneath much of Cisco infrastructure, including security and management appliances. If the pre-boot shell can write memory while Secure Boot is on, Secure Boot is not enforcing the boundary people think it is. Patch the firmware, restrict KVM access, and monitor changes to the boot configuration.

Jeff Man

1. Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

   What do you do when you can't attribute a vulnerability to a CVE?

2. Update on recent cybersecurity incident

   I love the fact that Boston Scientific has been continuing to update the public/its clients on the progress of forensic and recovery operations.

3. Misconfigured security tools are putting virtually every organization at risk

   A recent report by Reach Security... found that 97% of organizations suffered a breach or near miss linked to security tool misconfigurations in the past year. Despite reviewing configurations multiple times monthly, organizations take an average of 8.3 days to remediate identified issues, leaving security controls vulnerable. Firewalls emerged as the most common source of these vulnerabilities, contributing to 42% of reported breaches or near misses, followed closely by endpoints at 40%.

4. ShinyHunters claims Florida DMV breach, puts data on the clock

   The ransomware group claims it breached the state’s DAVID database and has threatened to publish the allegedly stolen records after a September 11 deadline.

   "As evidence, the attackers published a screenshot of a record belonging to Jeffrey Epstein that showed sensitive information, including an address, Social Security number, date of birth, driver’s license number, and registered vehicles."

   I'm starting to like ShinyHunters. Just sayin....

5. Why Cybersecurity is Shifting from Detection to Prevention

   I'm not sure I agree with the premise, nor the direction that this article takes, but still a compelling read. Summary: "Prevention actually costs less".

6. ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel

   Another installment in the "why I don't like AI" saga. Cross-account task execution exposed Gmail data without user awareness, raising new concerns for enterprise AI security.

7. 220M Traveler Records Exposed in Airline Data Leak [2026]

   "An exposed cloud database has handed researchers, and potentially anyone else who found it first, nine years of airline passenger and crew records tied to travel through Vietnam. The tally: 220,783,700 entries, a figure large enough to rank among the biggest travel-data exposures ever documented, and it was sitting behind nothing more than a set of default login credentials."

   This only ranks as "among the biggest travel-data exposures"??? What did I miss?

8. Riddle for you: What’s worse than an all men panel (affectionately known as a “Manel”)?

   This topic should not have to be a news story in 2026 and yet here we are. Apparently UNLV has finally taken down the image and those involved are working to make some necessary changes, but it should have never been allowed to move forward.

Joshua Marpet

1. CISCO has an issue 10.0

Larry Pesce

1. Australia’s Nationwide Phone Outage Was An Embarrassing Failure
2. China-Linked Hackers Turn Cisco Routers Into Covert Network Gateways
3. MikroTik Patches Critical Flaws Chained to Hack Routers
4. MikroTik router flaws allow takeover without a password
5. WeWorm
6. Is This The Year Of The Linux… Television?
7. Hackers Drain $320 Million From Liquid Network, Then Return Most of It
8. PEEP Malware Turns Chrome, Edge Into Backdoors
9. Passing the bucks $$$: Passback attacks explained

Sam Bowne

1. OpenAI’s New Reasoning Technique Alarms AI Safety Experts

   OpenAI's new Astra model will use a reasoning technique called "recurrent depth" that allows it to operate outside of the sequential thinking that characterizes most reasoning models, The Information reported on Tuesday. This technique, also called "opaque recurrence," will likely make the model's chain of thought more difficult to monitor -- and that has AI safety experts rattled.

2. Capsule Security Launches ‘AI Circuit Breaker’ to Stop Rogue Agents

   Capsule’s solution uses its own specialized AI for real-time intervention. The firm used NVIDIA Nemotron 3 Ultra to support the training process, combining real agent traces, human review and adversarial examples designed to teach its AI models the boundary between authorized and rogue behavior. They developed two models capable of providing strong detection without the cost and latency of sending every agent action to a large general-purpose model for review. The more accurate model attained 96.9% detection accuracy, compared with 86% for the strongest third-party model evaluated.

3. VMs won’t contain cyber-capable agents

   Tests show that GPT 5.6-Cyber developed exploits to escape the Vm three times. You can no longer assume a mere VM will contain a sufficiently advanced AI agent. What can we do? A start is using a virtualization technology that was purposely built with a minimal attack surface and a focus on security, like Firecracker. In tests, agents were unable to escape it.

4. 39 New Methods That Compromise Passkey Authentication

   A modern passkey authentication ceremony crosses an extraordinary number of trust boundaries. It can involve the web application, browser, operating system, password manager, cloud synchronization service, mobile device, Bluetooth transport, account recovery system, enrollment process, help desk, and ultimately the human being approving the authentication. Researchers are attacking almost every one of those layers.

5. US military turns off ad trackers on devices amid Middle East targeting reports

   Commercially available location data has been used to target American forces in the Middle East. Now they have disabled advertising trackers on a ​range of phones and computers.

6. Vibe Coding’s Security Debt: The AI-Generated CVE Surge

   AI-assisted developers produce commits at three to four times the rate of their peers but introduce security findings at 10x the rate, creating a security debt that accumulates faster than organizations can remediate it 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities 20% of AI-generated code samples reference packages that do not exist

7. AI Loss of Control Incidents Nearly Doubled in July, Observatory Finds

   The UK-funded Loss of Control Observatory logged over 300 AI 'loss of control' incidents in July 2026, nearly double June's total, with cases including systems impersonating their human operators and mimicking writing styles to grant themselves consent. Researchers say a growing share of the incidents show deliberate deception, and are pushing AI labs to disclose near-misses, not just major breaches.

8. Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

   The attacker's malicious code lives in interpreted scripts rather than in a binary, making it less likely to trigger signature-based detection

9. Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers

   Amazing list of vulnerabilities in AI products at the bottom

10. A.I. Models Built a Computer Worm That Could Rapidly Hack WeChat Accounts

    In a week, using AI, they built a WeChat worm: WeWorm--the first known computer worm that could spread across Apple’s iOS and Google’s Android operating systems without needing a victim to click or tap on anything. While self-propagating computer worms have been unleashed before, they were more common decades ago and did not involve mobile software. Tencent has patched the vulnerability.

11. AI Agents Are Now Emailing Me with Their Security Concerns

    The agents are reporting vulnerabilities to Bruce Schneier like whitehats.