Diesec

Diesec DIESEC experts assist your organization in analyzing and responding to cybersecurity threats.

Based on your risk, industry, and budget, we offer comprehensive information security management, including pe*******on testing, SOC as a Service and compliance.

15/10/2026

AhsayCBS backups under attack: 10.3.4 was not the fix, a hotfix is

AhsayCBS, the management console for Ahsay backup servers, is being exploited. The version everyone was told to install did not close the hole.

Two flaws chain into unauthenticated code ex*****on as SYSTEM (CVE-2026-105133 and CVE-2026-105134, the second rated CVSS 9.3). Huntress saw exploitation from October 7 and counted five organizations by October 8. After the break-in, attackers drop a web shell and then a Monero miner disguised as Microsoft Edge. The public CVE entries called version 10.3.4 fixed. Huntress found it affected too, and on October 10 Ahsay confirmed it and released hotfix 10.3.4.45. We found no CISA KEV entry as of October 14.

The miner is only the visible part. A web shell with SYSTEM rights on a backup server sits on a machine that usually holds credentials to everything it protects. Huntress says AhsayCBS is mostly run by service providers and system integrators, so one console can front many customers.

Next 48 hours:
- Install hotfix 10.3.4.45 (version 10) or 9.15.2.70 (versions 7 to 9) and reboot. A plain upgrade to 10.3.4.0 is not a fix.
- Allow only trusted IP addresses or a VPN to the AhsayCBS web console and the replication endpoint.
- Hunt for web shells in the CBS web directory, a service named MicrosoftEdgeUpdateSvc and unexpected child processes of the CBS service. The hotfix does not remove an attacker who is already in. If you find any, re-image from a trusted backup.

Links for a deeper technical dive are in the comments.

15/10/2026

One ransomware attack on one cloud region took 495 customers down with it.

IDC Frontier, a SoftBank subsidiary, said its IDCF Cloud service in East Japan was hit by ransomware on October 7. The attack hit companies and local governments at the same time, and the provider also locked customer access to its management consoles in all regions while it checked them. JR East says about 6.09 million customer accounts may be affected.

What happened:

IDC Frontier shut down the network and systems of East Japan Region 1 and is working to find the intrusion route. The attacker's message to locked-out customers claims a seven-minute breach and 225 encrypted databases (3.6 PB). That is the attacker's claim, unverified. Several other Japanese firms disclosed breaches that week; we found no confirmed link between them and IDC Frontier. As of October 13, IDC Frontier says data in four East Japan zones can only be restored from customers' own backups. Japan's ruling-party cybersecurity chief warned of "a state of emergency in cyber space".

The uncomfortable part: customers lost access even where their own systems were untouched. When the provider's management plane goes, your recovery plan goes with it if it lives in the same place.

Three things to check:

List critical workloads by provider and region, and mark every one without a tested recovery path outside that provider.
Keep backups outside the primary provider and outside the same management plane.
Ask suppliers how fast they notify you of an incident and who you can reach when consoles are locked.

Links for a deeper technical dive are in the comments.

14/10/2026

Third max-severity SonicWall SMA1000 flaw in three months.

SonicWall fixed a CVSS 10.0 pre-authentication flaw in its SMA1000 remote-access appliances. A security firm says its honeypots saw exploitation attempts; SonicWall says it has no evidence of exploitation. Either way, the box in front of your network has needed an emergency fix three times since July.

What happened:

CVE-2026-102255 is a server-side request forgery in the WorkPlace interface of SMA1000 models 6210, 7210 and 8200v. An attacker without credentials can make the appliance send requests on their behalf and reach internal functions. There is no workaround. Previdian reports crafted requests aimed at the appliance's internal database service. That is one source describing attempts, not confirmed compromises. We found no CISA KEV entry as of October 9.

The uncomfortable part: in September we wrote that a third occurrence would be a governance conversation, not just a patching one. That conversation is now due. The technique differs, the appliance line does not, and your risk register probably holds three separate tickets instead of one recurring exposure.

Three things to check:

Install the October hotfix (12.4.3-03670 or 12.5.0-03082 or later) and verify the build numbers in SonicWall's advisory SNWLID-2026-0017; one regional alert lists different numbers.
Confirm the July and September fixes are on every appliance too.
Decide whether SMA1000 stays your remote-access architecture, with monitoring to match, or whether it is time to plan a replacement.

Links for a deeper technical dive are in the comments.

14/10/2026

Hackers turned up the heat on hundreds of French supermarkets overnight.

Attackers reached the controllers that run each store's fridges and freezers and forced them into defrost, up to 50°C. Several chains threw stock away. The controller is a Danfoss unit that maintenance firms can manage remotely. Who can do that to your equipment?

What happened:

On the night of October 11 to 12, stores of Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E[.]Leclerc were hit. Store counts differ by source: about 150 to at least 300 for the Mousquetaires group, 80 for Coopérative U and 80 for Carrefour. CERT-FR reports numerous compromises of Danfoss AK-SM and AK-SC controllers and of Copeland xweb and Dixell xweb units, and tells operators to remove their internet exposure. Danfoss says most affected units are older models it no longer updates. As of October 13, nobody has named the attacker or the entry route. The Paris prosecutor has opened an investigation.

Where this bites: no data was stolen and nothing was encrypted. A thermostat controller with remote access was enough to cost real money. These devices usually sit with facilities or a maintenance contractor, not on the security team's asset list.

Three things to check:

Ask facilities and your refrigeration or building contractors which controllers are reachable from outside, and whether any are Danfoss AK-SM or AK-SC, Copeland xweb or Dixell xweb.
Cut or restrict that access: allow-list the source addresses or require a VPN with multi-factor authentication. Check your insurance terms before cutting the contractor's data feed.
Set temperature alarms that do not depend on the same controller, and agree a manual runbook with your maintenance provider.

Links for a deeper technical dive are in the comments.

13/10/2026

GhostAction now reads your git history, deleted secrets included

GhostAction is back. This time the fake "Security Audit" workflow it plants in GitHub repositories does not stop at your Actions secrets. It reads the entire git history.

On October 8, attackers used two hijacked maintainer accounts, one of them the original author of Uber's athenadriver, to push the workflow into 345 repositories within minutes. The commits went straight to the default branch, with no pull request. StepSecurity confirmed that the run in the Uber repository delivered its data to the attacker's server. Socket counts more than 500 accounts and tens of thousands of repositories since October 7. No malicious package releases have been reported so far.

The uncomfortable part: a key committed in 2019 and deleted the next day is still in the history, and the workflow takes it. Rotating the secrets in your repository settings no longer closes the exposure. The likely entry point is a leaked personal access token; that is the researchers' inference, not a confirmed finding.

Next 48 hours:
- Search your repositories for workflows named Security Audit or Github Actions Security. A hit since August 31 means treat it as a breach.
- Rotate every credential ever committed to any branch, revoke the token that allowed the push, and delete the workflow from all branches and forks.
- Require approval for workflow runs and allow only listed outbound destinations from runners. In one repository, the approval gate stopped the theft.

Links for a deeper technical dive are in the comments.

12/10/2026

Two Chinese hacking tools lost their servers last week, and the advisory that came with it describes an attack you can check for today.

On October 8 the FBI seized seven domains behind MicroScan, a vulnerability scanner, and FishHub, a spear-phishing and data-theft tool. The Justice Department says Integrity Technology Group, a Chinese company with government contracts, operated both for the group known as Flax Typhoon. Scan targets included a US power company, airports in Japan and Poland and Taiwanese energy firms. The Justice Department counts about 20 Taiwanese universities as confirmed FishHub victims; the court affidavit refers to six universities among more than 20 entities.

The uncomfortable part: nothing here is a zero-day. The advisory lists eight CVEs from 2014 to 2023 (Struts, GitLab, Pulse Secure and others) plus password spraying against Microsoft Exchange. A scanner finds what has stayed exposed for years, and clients pick their targets from the result. A seizure takes domains offline, not the tools.

Three things to check:
- Search DNS, proxy and mail logs back to March for the seized domains and the Microsoft, LinkedIn and YouTube lookalikes listed in the advisory.
- Look for password spraying in Exchange and directory sign-in logs (many accounts, few tries each) and enforce MFA on all mail access.
- Find unexpected SoftEther VPN software, and inventory exposed legacy services from the CVE list.

Links for a deeper technical dive are in the comments.

09/10/2026

Top 5 Cybersecurity News October 9.

Your firewall admin account was yours. Until an attacker deleted it and left you locked out.
Your internal portals were too obscure to bother with. Until an AI tool tried every one of them.
Your backups were your way back. Until ransomware reportedly reached them first.

This week's Top 5 is not about a new exploit. It is about accounts, portals, platforms and servers that organisations already owned and stopped watching.

→ FortiBleed: the FBI and Secret Service warn that attackers sometimes delete original admin accounts on compromised Fortinet devices. SOCRadar counts more than 86,000.
→ South Korea: an open-source AI pe*******on-testing tool has been linked to the breaches at Shinhan and other banks, all through internal systems.
→ ASOS: customers got a "hacked" push notification through the retailer's own app, sent via third-party platforms.
→ Osaka: about 500 servers at Osaka Metropolitan University have been down since October 2, backups reportedly encrypted too.
→ Warlock: unpatched SharePoint servers gave the group a path to a water utility and a telecom provider.

Read the full analysis in the comments.

09/10/2026

Denmark CPR Data Breach: 8.8 Million Records

The access itself was lawful. A smaller company's lookup account pulled 8.8 million records out of Denmark's population register in about ten days.

The Danish Central Person Register (CPR) says names, addresses and CPR numbers (the ID used for taxes, healthcare and banking) of about 8.8 million people were taken, roughly four in five records, including the deceased and people who moved abroad. Unauthorized parties used a private company's legitimate access. Officials quoted by TV 2 put it at more than 14 million lookup attempts in September.

No alarm is reported to have fired. The register's administration noticed on October 2 because the invoice for that account was unusually large. Denmark's digitalization minister said it is clear there is a flaw in the CPR system's security.

Here's the real issue: the access was valid, purpose-limited on paper, and had no volume ceiling in practice. How the attackers got the company's access, and whether they kept the data, is still open.

Three things to check:
- List every account that can query your personal data in bulk, partner APIs included, and give each one a volume ceiling plus an alert, not a monthly invoice.
- Alert on enumeration: dense or sequential identifier lookups and odd hit-to-miss ratios.
- Stop accepting a static ID number or date of birth as the only proof of identity.

Links for a deeper technical dive are in the comments.

08/10/2026

Atlassian File Access Vulnerability in Data Center

A login page does nothing against an unauthenticated flaw. Atlassian says so itself, and it applies to eight of its self-hosted products right now.

CVE-2026-21589 (CVSS 9.3): an attacker with no account can read specific files from the web root of Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center. Every version is affected until it is upgraded.

Atlassian published its advisory on October 5, and fixed releases exist for every product. Neither Atlassian nor watchTowr has seen exploitation, and the CVE was not in CISA's KEV catalog as of October 6. The attacker has to know the exact file name and path, and cannot list directories.

The uncomfortable part: that bar is lower than it sounds. The products are downloadable, so file locations are public knowledge, and web roots on long-running servers collect configuration copies and backups. watchTowr also warns that with SSO through Crowd, authentication details sit in plaintext at a predictable path.

Three things to check:
- Inventory all eight products and upgrade internet-facing instances first. Atlassian no longer ships binary patches, so this is a move to a new maintenance release.
- If you cannot upgrade today, take the instance off the internet or apply Atlassian's WAF or rewrite rule and restart the nodes.
- Decode access-log requests and search for two dots next to a slash. Rotate any secret that ever sat in a web root.

Links for a deeper technical dive are in the comments.

Adresse

Ernst-Ludwig-Str . 3
Darmstadt
64283

Website

Benachrichtigungen

Erfahren Sie als Erste/r von Neuigkeiten und Aktionen: Wir schicken Ihnen eine E-Mail, wenn Diesec etwas veröffentlicht. Ihre E-Mail-Adresse wird für keinen anderen Zweck verwendet, und Sie können sich jederzeit abmelden.

Verknüpfungen

Teilen

Kategorie