Cyber Morning Call

Referências do EpisódioNew N-able “4EverAble2Shell” zero-day exploited hours after PoC released (BleepingComputer)Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2 (The Hacker News)Uncovering ArcticRAT: The Evolution from Targeted Crypto-Stealer to AI-Powered Android RAT (Zimperium)Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files (The Hacker News)PHP2Shell Exploitation on Check Point Gateway (Check Point Research)Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioSCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints (Huntress)Apache HTTP Server 2.4 vulnerabilities (Apache Software Foundation)Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know (Wiz)The XG Files: Falcon C2 Flying Under The (Browser) Radar (Unit 42)The global socket: how threat actors are weaponizing GSocket for stealthy C2 (Microsoft)Zoom Workplace for Windows - Improper Input Validation (Zoom)Zoom Workplace for Windows - Origin Validation Error (Zoom)Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioNot All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe (Check Point Research)SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution (The Hacker News)GhostFrame ESXi Implant Powers Settra Ransomware Attacks (Daily CyberSecurity)GhostFrame: A new ESXi Implant Linked to Settra Ransomware (Recorded Future, via Malware News)Exchange for breakfast: Turla’s Cereal tricks are not for kids (ESET WeLiveSecurity)Microsoft’s November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194) (Tenable)Patch Tuesday - November 2026 (Rapid7)Microsoft Patch Tuesday, November 2026 Security Update Review (Qualys)microsoft august 2026 patch tuesday fixes 400 flaws 3 zero days (BleepingComputer)About the security content of iOS 27.2.1 and iPadOS 27.2.1 (Apple)Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities (The Hacker News)Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio/bin/live: Conheça o Instituto Aaron Swartz com Lucas Lago e Ana Freitas (Mente Binária)Status Dashboard (N-able)N-able takes cloud platform offline after 30+ “zero-days” published (BleepingComputer)N-able takes N-central platform offline after zero-day dump (TechTarget)N-able takes N-central offline as alleged zero-day exploits surface (Field Effect)Stable Channel Update for Desktop (Google Chrome Releases)Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026 (The Hacker News)The Cold Chain on Fire : Unpatched Danfoss controllers exploited (Sekoia)Trusted by Default: Qubole Cross-Account Access Abused in the Wild (Wiz)FORGE Lab uses agentic tools to identify memory safety issues in Rust (Microsoft)BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Proofpoint)Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioAuthentication Enforcement Bypass in SonicOS SSLVPN Allowing SAML and MFA Bypass (SonicWall PSIRT)U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog (Security Affairs)SonicWall security advisory (AV26-1133) (Canadian Centre for Cyber Security)ARTEX abuse expands as cybercriminals target financial sector (Microsoft)Microsoft Paint RCE Fix Now Available, but Windows Update Won’t Deliver It (The Hacker News)Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioCWPdoor: The Invisible Backdoor Living Inside Control Web Panel (XLab / QiAnXin)Threat actors use agentic AI tooling to find and abuse exposed secrets (Microsoft)Cobalt Strike: Favorite Tool from APT to Crimeware (Proofpoint)Alleged source code of Cobalt Strike toolkit shared online (BleepingComputer)Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns (Check Point Research)Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560) (watchTowr Labs)Two Barracuda ESG Flaws Could Be Combined for Full Root Access; Patches Released (Security Affairs)Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution (The Hacker News)OpenSSH flaw lets attackers log into password-disabled Linux accounts (BleepingComputer)OpenSSH Password Authentication Bypass on Alpine Linux (*sshole) (OX Security)sshole (CVE-2026-123158): OpenSSH password bypass on Alpine Linux (Cycode, via Security Boulevard)Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioSlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware (ESET WeLiveSecurity)Defrost and Disrupt | An Assessment of Europe’s Refrigeration Attacks (SentinelOne)Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles (Check Point Research)Poisoned Source: APT29 watering holes target mobile devices with n-day exploits (Sekoia)Possible arbitrary file write and read in Active Storage image analysis (GitHub / Rails)Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM’s Memory (The Hacker News)XSA-523 - Xen Security Advisories (Xen Project)Exploitation Targeting Node-RED, a Tool Embedded in ICS Products (VulnCheck)Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root (The Hacker News)SonicWall warns of unpatched flaws in end-of-life GMS software (BleepingComputer)Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources (Google Threat Intelligence Group)ARTEX and Friends: Enter Agentic Offensive Frameworks (Google Threat Intelligence Group)CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations (Kaspersky Securelist)From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (Microsoft)Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) (Rapid7)Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw (The Hacker News)North Korea Responsible for $6 Billion+ Binance Attack (FBI) Foi assim que Hackers Roubaram Bilhões (canal O Bobo de Wall Street no Youtube)Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioTracking AI adoption in North Korean threat actor tradecraft (Microsoft)NIK C2: The new AI-enabled command-and-control framework (Cisco Talos)New Prompt Injection Techniques Cover Agent-Planning Attacks (CrowdStrike)Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users (Socket)Chrome extensions with 13.4 million installs caught hijacking searches (BleepingComputer)Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do EpisódioSilent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access (Lumen)Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN (Cisco Talos)Juniper Fixes 18 Session Smart Router Vulnerabilities, Two Rated CVSS 9.8 (SecurityOnline)Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch (The Hacker News)Roteiro e apresentação: Carlos CabralEdição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia