BMC Daily Cyber News

Daily Cyber News: Telecom systems face active attacks on sensitive configurations Telecom and hosted communications environments face active attacks through Cisco BroadWorks. The weakness allows an unauthenticated remote attacker to send crafted XML and read sensitive configuration information. Cisco patched the issue in August, but CISA has now added it to its catalog of exploited vulnerabilities. Key context: BroadWorks supports cloud voice and collaboration services delivered by carriers and managed service providers. Additional detail: The broader pattern is continued targeting of shared service platforms that can expose multiple customers. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, cisco, Telecom, systems, face, active, attacks, sensitive.

Daily Cyber News: Outlook attacks raise urgency across a massive Microsoft update Authentication information is at risk through an Outlook weakness that attackers are already exploiting. A target must open a specially crafted message file. That action can make Outlook connect to an attacker-controlled network location without displaying its usual external-content warning. Key context: Microsoft’s November release addresses one thousand ninety five vulnerabilities, including 64 rated critical and 48 critical code-execution issues. Additional detail: For leaders, Office needs to be included in the emergency patch decision rather than hidden behind general Windows update reporting. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, windows, Outlook, attacks, raise, urgency, across, massive.

Daily Cyber News: AI attack agents accelerate web and cloud credential theft Production secrets and cloud data were exposed in attacks linked to self-hosted AntiFox systems. The open-source AI penetration-testing platform was operated from Alibaba Cloud infrastructure against internet-facing web services and AWS environments. Attackers deployed a webshell, examined application configuration, and used valid AWS identities for rapid discovery. Key context: The platform can automate repeated attack steps across web servers and cloud services with limited human effort. Additional detail: The durable pattern is faster chaining of web compromise, credential access, and cloud discovery. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, credential theft, attack, agents, accelerate, cloud, credential, theft.

Daily Cyber News: N-able upgrades hosted systems as exposed servers face scanning Managed service providers faced disruption after N-able took hosted N-central environments offline across the Americas, Europe, and Asia-Pacific. The company has now upgraded its hosted systems and released N-central 2026.4 HF2 for critical security issues. On-premises customers were strongly urged to upgrade before restoring normal access. Key context: N-central centrally manages networks and devices for enterprises and service providers, so a security failure could have broad reach. Additional detail: The broader lesson is that centralized management tools remain high-value targets because one console can affect many systems. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, N-able, upgrades, hosted, systems, exposed, servers, face.

Daily Cyber News: Poland takes public services offline after stopping cyberattack Citizens, businesses, and public institutions lost access to online government services after Poland temporarily shut down its ePUAP platform. Officials said security teams detected and stopped a cyberattack, then disabled the service as a precaution. The government said the infrastructure supporting key digital services remained secure. Key context: The disruption affects electronic document submissions, government communications, and other administrative procedures. Additional detail: Organizations running essential digital services should review their shutdown criteria, alternative service channels, and public communication plans. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Poland, takes, public, services, offline, stopping, cyberattack.

Daily Cyber News: N-able takes hosted management platform offline over disclosed risks N-able customers face management disruption after the company took its hosted N-central environment offline as a precaution. The action followed public disclosure of 33 critical security vulnerabilities while a hotfix was still being developed. N-able said it had not seen active exploitation at the time of its notice. Key context: Hosted customers cannot access the classic N-central environment, and associated services may be unavailable. Additional detail: Keep affected servers offline, use the alternate services that remain available, and wait for N-able’s remediation guidance before restoring access. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, active exploitation, N-able, takes, hosted, management, platform, offline.

Daily Cyber News: Trusted cloud access exposes multiple AWS environments and data Multiple AWS environments had secrets and data accessed after a threat actor used credentials from an account associated with Qubole. Between October 14th and October 26th, the attacker assumed customer roles that still trusted the vendor account. Some of those roles had little or no recent legitimate use. Key context: The incident turned a routine integration into a cloud supply-chain risk. Additional detail: Organizations should audit external AWS trust relationships, remove unused roles, revoke suspicious sessions, and rotate every secret those sessions could read. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Trusted, cloud, access, exposes, multiple, environments, data.

Daily Cyber News: Microsoft fixes exploited Outlook attack in massive patch release Organizations face an actively exploited Outlook credential-theft path within a record-breaking Microsoft update covering one thousand two hundred thirty five flaws. A malicious message file must be opened. Outlook can then connect to an attacker-controlled location without showing its usual external-content warning and expose an NTLM authentication hash. Key context: The size of the update creates a difficult prioritization problem for large Windows estates. Additional detail: Patch the exploited Outlook issue first, then accelerate testing and deployment for exposed network services and high-value systems. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, remote code execution, windows, Microsoft, fixes, exploited, Outlook, attack.

Daily Cyber News: Railway breach leads to $740,000 in fraudulent AI charges Railway customers face about seven hundred forty thousand dollars in fraudulent AI usage after attackers stole authentication secrets. The company says the attackers exploited two infrastructure weaknesses, obtained internal source code, and reached credentials used to decrypt customer environment variables. At most one point eight five percent of workspaces, or approximately one hundred thousand, were potentially affected. Key context: The incident shows how stolen platform secrets can create immediate financial harm. Additional detail: Organizations should rotate potentially exposed secrets, revoke linked tokens, and immediately review AI-provider usage for unauthorized charges. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Railway, breach, leads, fraudulent, charges.

Daily Cyber News: Email security gateways targeted for full administrative control A small number of organizations were compromised through two recently patched Barracuda Email Security Gateway weaknesses. When used together, the issues can bypass authorization and execute commands with root privileges. Successful attacks require access to the appliance’s administrative interface. Key context: A compromised email security appliance gives an attacker high-level control over a trusted system at the edge of an organization. For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.Cybersecurity training, courses, books, and resources: BareMetalCyber.com. Topics: cybersecurity news, cybersecurity, cyber risk, Email, security, gateways, targeted, full, administrative, control.