Cyber Morning Call

Referências do EpisódioN-central 2026.3 Hotfix 1 – Mitigation for CVE-2026-18577N-able Says Attackers Take Over N-central Servers After Initial Fix Proves IncompleteCaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theftAdobe fixed a maximum-severity vulnerability flaw in Campaign ClassicSecurity update available for Adobe Campaign Classic | APSB26-114Série de posts da Galaxy Research sobre ataque contra carteiras da ColdcardThe Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET VersionToy Ghouls' new toy: the GenieLocker ransomwareRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio-North Korean hackers behind major open-source supply chain attacks, Amazon says-Amazon identifies North Korean hacker group behind open-source supply chain attacks-ClickFix, EtherHiding & a DPRK Wallet Trail-Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts-(합동사이버보안권고문) 국가배후 해킹조직의 우리 국민·기업 해킹 공격 주의 권고-Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks-OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia-Investigating three real-world incidents in our cybersecurity evaluationsRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioCisco Secure Firewall Management Center Software Static Credential VulnerabilityCisco warns of FMC static credential flaw exploited in zero-day attacksVMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709)Broadcom Patches Critical VMware ESXi Vulnerability Enabling Host Code ExecutionInside Astaroth's New Spambot ComponentStable Channel Update for Desktop - Wednesday, July 29, 2026KindaRails2Shell - Critical Rails Flaw Leaks Secrets — Patching Isn't EnoughCheck Point SmartConsole Authentication Bypass Technical Analysis (CVE-2026-16232)Coordinated “cyberattack” on Minnesota water utilities: What you need to knowClaude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES AttackRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioCritical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as RootFast Remediation Is the New Trust Model: JFrog and OpenAI Collaboration on Zero-Day Security FindingsCritical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077) – Update to 2025.11.7 or 2026.1.3 NowRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioCISA Adds Two Known Exploited Vulnerabilities to CatalogCVE-2025-68686 - SSL-VPN Symlink Persistence Patch BypassCVE-2026-16812 - Arista VeloCloud Orchestrator On-Prem OS Command Injection VulnerabilityMirage Kitten targets Middle East and Africa region with new malwareExpanding the Castle: New Campaigns, New Tooling, and the NeedleStealer ConnectionHelpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC BackdoorBreaking the Sandbox Again: Bypassing n8n's CVE-2026-27577 PatchApple security releasesRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca GarciaX6LO8GntgGb95egmmOCZ

Referências do EpisódioCertighost (CVE-2026-54121)僵尸网络新秀：Dysphoria 演进与深度技术分析Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioThe Signs Were There: What the First Autonomous Ransomware Case ConfirmsChaos ransomware's msaRAT: Living off the browser to build a covert C2 channelCISA, NSA, FBI and Partners Warn Zimbra Collaboration Suite Users of Ongoing Russian State-Supported Malicious Threat ActivityTAG-195 Upgrades MaaS Ecosystem with Modular ToolsKimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers SayRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioCVE-2026-8933: Local Privilege Escalation in Set-Capabilities snap-confineRefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) JadeProx: Tracing a China-nexus Operation Through an OPSEC MistakeLampion's Portugal-focused phishing campaign delivers multistage malwareAttack Cases by the Kimsuky Group Impersonating Diplomats (PebbleDash, PrxClient)Security Advisory – Action Required – July 2026 Security UpdateHermeticReader: The Vulnerability That Turned Adobe's 300M-Install Extension Into a Full WhatsApp TakeoverRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioA new extortion cocktail: office printers, small ransoms, and BitLockerSolarWinds Serv-U Privilege Escalation Vulnerability (CVE-2026-28307)SolarWinds Serv-U Remote Code Execution Vulnerability (CVE-2026-28311)SolarWinds Serv-U Broken Access Control Vulnerability (CVE-2026-28321)Oracle Critical Patch Update Advisory - July 2026OpenAI admits it was the source of the agent swarm that attacked Hugging FacePublic PoC triggers active exploitation of critical SharePoint RCE vulnerability CVE-2026-50522Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioCritical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code ExecutionCVE-2026-6875 - Sandbox Escape in ServiceNow AI PlatformCookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin RansomwareExploitation in the Wild of wp2shellRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioProxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitationwp2shell: Pre Authentication RCE in WordPress CoreWordPress Core "wp2shell" RCE flaws get public exploits, patch nowThree Steps to the Terminal: A Siemens ROX II Zero-Day TrilogyHOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control ChannelsOpenSSL HollowByte: A DoS Hiding in 11 BytesNew North Korean campaign uses fake coding interviews to steal developer credentialsRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioUAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaignClickLock Stealer: Paste Once, Lose EverythingACR Stealer: Two observed intrusion chains amid increased threat activitySpirals: New Stealthy Ransomware Deployed Against Asian IT CompanyGoSerpent: a persistent threat evolves with sophisticated data collection and exfiltrationRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioChaotic Eclipse Unveils LegacyHive Exploit Affecting Fully Patched Windows SystemsTuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted DevelopmentClaudeFix: Shared Claude Chats Meet ClickFixRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioSonicWall SMA1000 Series Appliances Affected By Multiple VulnerabilitiesTwo SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin CommandsMicrosoft July 2026 Security UpdatesSAP Security Patch Day - July 2026Progress confirms ShareFile zero-day flaw behind Storage Zone shutdownRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioWEBINAR: A CONFIANÇA COMO PORTA DE ENTRADA DO ATACANTEOne Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing OperatorsImprove Router Hygiene to Protect Against Russian State-Sponsored TargetingCrashStealer: C++ macOS infostealer posing as crash reporterOAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioWEBINAR: A CONFIANÇA COMO PORTA DE ENTRADA DO ATACANTEProgress Told ShareFile Customers to Pull the Plug on Their Servers. Here's What We Know.Unfit to Boot: Breaking U-Boot's FIT Signature VerificationCritical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User SessionsOne Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law EnforcementRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioWEBINAR: A CONFIANÇA COMO PORT A DE ENTRADA DO ATACANTEGodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable DefensesGigaWiper: Anatomy of a destructive backdoor assembled from multiple malwareRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioWEBINAR: A CONFIANÇA COMO PORT A DE ENTRADA DO ATACANTEGhostApproval: A Trust Boundary Gap in AI Coding AssistantsClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud ToolkitMicrosoft patches RoguePlanet Defender zero-day vulnerabilityHackers can use 9 of the most popular AI tools to assemble massive botnetsCoordinated npm and PyPI Campaign Typosquats Popular Secure Payment AppsSygnia Investigation Finds AI Accelerated Attack Enabled Lone Threat Actor to Rapidly Compromise Enterprise Cloud EnvironmentJuniper Security AdvisoriesPalo Alto Networks Security AdvisoriesChrome ReleasesRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioWEBINAR: A CONFIANÇA COMO PORT A DE ENTRADA DO ATACANTEUAT-7810 continues building ORB networks using new malwareAn Introduction to Operational Relay Box (ORB) Networks - Unpatched, Forgotten, and ObscuredIonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux DistrosVidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File InflationThe ‘Ghost' in the Database: Recovering Active ADFS Signing Keys via Machine DPAPIOne Email Closer to the Edge: UNK_MassTraction & the Physics of ExploitationCritical Gitea Docker Bug Under Active Exploitation Exposes Repositories and SecretsRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioWEBINAR: A CONFIANÇA COMO PORTA DE ENTRADA DO ATACANTETenda firmware (multiple versions) contains hidden authentication backdoorCavern Manticore: Exposing Iran-Linked Modular C2 FrameworkAdobe ColdFusion flaw CVE-2026-48282 now exploited in the wildGolpe do falso CEO: criminosos usam Microsoft Teams para enganar funcionários19-Year-Old Linux Kernel Bug Earns $80K Bounty, Grants Root in Under a Second16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 SystemsRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioWEBINAR: A CONFIANÇA COMO PORTA DE ENTRADA DO ATACANTEArmored Likho digging a snake pit: inside the covert BusySnake Stealer campaignNew "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits AndroidCyber Criminal Group TeamPCPRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioWEBINAR: A CONFIANÇA COMO PORTA DE ENTRADA DO ATACANTEPamStealer: a Rust-based macOS infostealer that validates credentials through PAMGoogle's Continued Disruption of Malicious Residential Proxy NetworksRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioWEBINAR: A CONFIANÇA COMO PORTA DE ENTRADA DO ATACANTEDon't Eat The ChocoPoCs! How Vulnerability Researchers Were Repeatedly Targeted By Trojanised ExploitsARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack TechniqueCisco Catalyst Center Arbitrary File Read VulnerabilityClamAV Vulnerabilities Affecting Cisco Products: July 2026Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation AttemptsRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioWEBINAR: A CONFIANÇA COMO PORTA DE ENTRADA DO ATACANTEPhantom Squatting: AI-Hallucinated Domains as a Software Supply Chain VectorSecuring AI agents: When AI tools move from reading to actingGuardFall: a universal shell injection vulnerability in open-source AI agentsSecurity updates available for Adobe Campaign Classic | APSB26-69Security update available for Adobe ColdFusion | APSB26-68Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-ServiceNetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)Chrome Releases - Stable Channel Update for Desktop - Tuesday, June 30, 2026Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioWEBINAR: A CONFIANÇA COMO PORTA DE ENTRADA DO ATACANTEOracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the WildChromium extension uses AI‑related branding to redirect browser searchAbout the security content of iOS 26.5.2 and iPadOS 26.5.2About the security content of macOS Tahoe 26.5.2About the security content of Safari 26.5.2A Djinn in the Machine: TaskWeaver's Node.js Intrusion ChainRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioWEBINAR: A CONFIANÇA COMO PORTA DE ENTRADA DO ATACANTEDissecting and Exploiting Linux LPE Variant: DirtyClone (CVE-2026-43503)MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code ExtensionAlert Number: I-062626-PSA | 26 June 2026 - Russian Intelligence Services Continue to Target Commercial Messaging ApplicationsCL-STA-1062 Targets Southeast Asian Governments and Critical InfrastructureTONResolver RAT Abuses TON Blockchain to Target Japan's Hotel IndustryRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioMais de 430 mil firewalls corporativos são comprometidos em operação de roubo de credenciaisKazuar: Anatomy of a nation-state botnetSTOCKSTAY Another Day: The Latest Addition to Turla's Intelligence Gathering ApparatusBluekit Phishing-as-a-Service: Browser-in-the-Middle, EvolvedAISLE Discovers 6 New CVEs in curl, Including the Oldest Issue Ever ReportedTuring Day 2026 | 6º ediçãoRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioTURING DAY 2026 | 6ª EDIÇÃO - DIA 25/06Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN ManagerCVE-2026-20245 - Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation VulnerabilityCVE-2026-20127 - Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCVE-2026-20182 - Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityBackdoor.Mistic: New Backdoor May be Linked to Ransomware Access BrokerStrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoaderESET takes part in Operation Endgame to disrupt Amadey and StealcStealC and Amadey: Breaking down infostealers and the cybercrime services that deliver themStealC You Later: Proofpoint and IBM X-Force Support Operation Endgame DisruptionsAmadey and StealC: Malware-as-a-Service UnavailableRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioTURING DAY 2026 | 6ª EDIÇÃO - DIA 25/06macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the SandboxNew macOS ClickFix attack silently mounts DMGs to push infostealerCisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to RootRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioTURING DAY 2026 | 6ª EDIÇÃO - DIA 25/06A VBScript campaign distributed through WhatsApp deploying RMM softwareFortiBleed campaign used custom FortiGate sniffer to steal credentialsFrom Langflow to Monero: Inside CVE-2026-33017 CryptominerPixelSmash – Critical FFmpeg Vulnerability Turns Media Files into WeaponsDifyTap: Zafran discovers how attackers can silently wiretap AI data across tenants on a platform powering 1M+ appsRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioTURING DAY 2026 | 6ª EDIÇÃO - DIA 25/06Introducing usbliter8: An A12/A13 SecureROM exploitWebinar Tempest - Superfície exposta, acesso concedido: como ativos esquecidos formam o caminho para o atacanteSalesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer DataRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioTURING DAY 2026 | 6ª EDIÇÃO - DIA 25/06K000161616: NGINX ngx_http_v3_module vulnerability CVE-2026-42530K000161584: NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability CVE-2026-42055Killing me gently: Inside Gentlemen's EDR killer frameworkLost in relocation: analysis of a new loader distributing CASTLESTEALERAutoJack: How a single page can RCE the host running your AI agent Oracle Critical Security Patch Update Advisory - June 2026PeopleSoft PeopleTools Pre-Authentication RCE: A PSIGW SSRF Chain That Executes Inside the JVMRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioTURING DAY 2026 | 6ª EDIÇÃO - DIA 25/06FortiBleed — 75k Fortinet firewalls have admin passwords crackedFortiBleed Exposes Admin Passwords for 75,000 Fortinet FirewallsFortiBleed - HudsonRockClickFix Campaign Generated Via AI Delivers SmartRATFrom package to postinstall payload: Inside the Mastra npm supply chain compromiseFrom Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard HijackerMalware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader ChainRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio/bin/live: CISOs - com Fabiana Tanaka e Denis NesiTURING DAY 2026 | 6ª EDIÇÃO - DIA 25/06FishMonger's arsenal upgraded: SprySOCKS for Windows隐形毒刺：超4000台老旧路由器遭AryStinger入侵，沦为黑客全球攻击跳板Rokarolla : Android Banker with Complete Device Takeover CapabilitiesPickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCECritical Fortinet FortiSandbox flaws now exploited in attacksChrome Releases - Tuesday, June 16, 2026GitBait: Phishing the Mexican Financial SectorRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioTURING DAY 2026 | 6ª EDIÇÃO - DIA 25/06Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense ResearchSearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration WeaponCVE-2026-42824 - M365 Copilot Information Disclosure VulnerabilityUnveiling ErrTraffic: inside a growing ClickFix malware distribution frameworkFI-2026-007 - Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerabilityEvilTokens: A phishing attack that doesn't steal your passwordRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioMS 사칭 피싱과 Dead-drop C2 기반 APT37 NarwhalRAT 분석Atomic Arch: Attackers Hijack Trusted AUR Packages to Deliver Rootkit-Like MalwareUnauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk EnterpriseWhy Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE)FBI takes down massive China-based cybercrime network that caused $1.9B in lossesIran-Linked Handala Breached a California Water Utility. It Could Have Done Worse, and It Knows That.Cyber Intel Brief: Handala Claims Breach of California Water ServiceRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioShinyHunters Targets Education Sector with Oracle PeopleSoft ExploitOracle Security Alert Advisory - CVE-2026-35273Oracle mitigates PeopleSoft zero-day exploited in data theft attacksVelvet Ant's Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network UndetectedInside OnyxC2: The New Stealer Targeting 210 AppsOceanLotus: From external espionage to domestic targetingArctic Wolf Observes an Increase in Palo Alto Networks GlobalProtect Authentication Bypass Exploitation via CVE-2026-0257From SQLi to RCE – Exploiting LangGraph's CheckpointerRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioUnpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCEExpanded JDY IoT and SOHO botnet enables rapid vulnerability exploitationCVE-2026-0274 Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integrationWho Runs the Ransomware Group ‘The Gentlemen?'GitHub to Disable npm Install Scripts by Default to Stop Supply Chain AttacksRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioMSRC - June 2026 Security UpdatesCVE-2026-45586 - Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability CVE-2026-49160 - HTTP.sys Denial of Service Vulnerability CVE-2026-50507 - Windows BitLocker Security Feature Bypass VulnerabilityRoguePlanetMicrosoft Defender 'RoguePlanet' zero-day grants SYSTEM privilegesSAP Security Patch Day - June 2026ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer InstancesMore Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520)Vulnerability Resolved in Veeam Backup & Replication 12.3.2.4854CVE-2026-25089 - Second-Order OS Command Injection via JSON Input on start vnc featureRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioGoogle patches new Chrome zero-day flaw exploited in the wildChrome Releases - Stable Channel Update for Desktop - Monday, June 8, 2026Security Advisory – Action Required – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751)Off By !: Exploiting a Use-after-Free in the Linux KernelShai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI WaveWhen “Hi, This Is IT” Comes Through Microsoft TeamsCisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch AvailableCisco Catalyst SD-WAN Manager Authenticated Privilege Escalation VulnerabilityRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio1-Click GitHub Token Stealing via a VSCode BugError 524 Decoy: Unmasking a Global Smishing Operation Hiding Behind Error PagesOperation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell BackdoorBoletim de segurança do Android: junho de 2026CISA flags two-year-old Oracle flaw as actively exploited in attacksRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio32 Red Hat npm packages backdoored in 72 secondsMiasma: Supply Chain Attack Targeting RedHat npm PackagesMeet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised SitesCritical Windows Netlogon RCE flaw now exploited in attacksRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioRapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)FSB's matryoshka #1/3 – Gamaredon's gifts that keeps unpacking – GammaPhish and GammaWormMalicious npm packages abuse dependency confusion to profile developer environmentsRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioAuthenticated RCE via Argument Injection in Gogs (NOT FIXED)Typosquatted npm packages used to steal cloud and CI/CD secretsDownload pumping: New npm deception technique for supply chain attacksRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioFortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet PatchPirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for yearsCommit to Compromise: A New Threat Actor Targeting the Cryptocurrency Industry's Software Development InfrastructureGlassWorm Malware Takedown Disrupts Developer Supply Chain Attack InfrastructureRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioBTMOB: A stealthy RAT burrowing deep into Android devicesDetecting Tycoon 2FA AiTM attacks across Entra ID and Google WorkspaceMicrosoft SharePoint Has a New RCE Flaw. If You Haven't Patched Yet, Go Do That.CVE-2026-45659 - Microsoft SharePoint Remote Code Execution VulnerabilityFake software on GitHub and SourceForge distribute Deno RAT Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioSmart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC TestnetExploitation of KnowledgeDeliver via ViewState Deserialization VulnerabilityRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioTrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages and Hundreds of Versions Across npm, PyPI, and Crates.io2 PhaaS 2 Furious: The Evolution of Chinese-language Phishing ServicesAnalyzing Void Dokkaebi's Cython-Compiled InvisibleFerret MalwareFast and Furious – Nimbus Manticore Operations During the Iranian ConflictTracking Iranian APT Screening Serpens' 2026 Espionage CampaignsU.S. CISA adds a flaw in Drupal Core to its Known Exploited Vulnerabilities catalogRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioCVE-2026-41091 - Microsoft Defender Elevation of Privilege VulnerabilityCVE-2026-45498 - Microsoft Defender Denial of Service VulnerabilityITW SECURITY BULLETIN: Apex One and Vision One – Standard Endpoint Protection (SEP) May 2026 Security BulletinA New SonicWall Scanning Spike Echoes the Pattern That Preceded CVE-2026-0400CVE-2026-40369: Twelve Bytes to Escape the Browser SandboxMiddle East Malicious Infrastructure Report: 1,350+ C2 Servers Mapped Across 98 ProvidersRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioDrupal core - Highly critical - SQL injection - SA-CORE-2026-004Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333)PinTheft: Another Linux Privilege Escalation, Another Working Exploit, This Time Targeting ArchHackers bypass SonicWall VPN MFA due to incomplete patchingTracking TamperedChef Clusters via Certificate and Code ReuseA malicious VS code extension just breached GitHub ‘s internal repositoriesCVE-2026-20223 - Cisco Secure Workload Unauthorized API Access VulnerabilityRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioDirtyDecrypt: Linux kernel LPE in the RxGK subsystem (CVE-2026-31635) with public PoCDirtyDecrypt / DirtyCBCExposing Fox Tempest: A malware-signing service operationFrom PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threatdurabletask: TeamPCP's Latest PyPi CompromiseMicrosoft shares mitigation for YellowKey Windows zero-dayCompromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer/bin/live: Caio Lüders e Jardel MatiasRoteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia