SecBlog Weekly — Issue 001: The Signal, Not the Noise
Week of Sep 4, 2026 · secblog.reedcloudsec.com
The signal, not the noise, in security. Five things from this week worth your five minutes.
Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root (CVE-2026-20212, CVSS 9.8)
The flaw comes down to two TCP ports (43210/43211) binding to an unrestricted address inside the default VRF — reachable ports that let anyone who can route to the switch talk directly to the service and get arbitrary code executed as root, no login required. Cisco says it hasn't seen active exploitation yet, but there's no fixed release either, only a temporary "Live Protect" shield and an ACL you write yourself — worth doing that ACL now rather than waiting on a patch timeline Cisco hasn't published. This is also a good prompt to revisit some fundamentals: root-level services have no business being reachable at all in a properly segmented environment — defense in depth means firewalling switches and networking gear the same way you'd firewall a server, not treating them as implicitly trusted because they're "just infrastructure." Pair that with an IAM review built on a one-way-in, one-way-out model for management access — a single, audited path in and a single, audited path out — rather than assuming a switch's management plane is safe by default.
via The Hacker News · Sep 3, 2026
Coder's registry infrastructure compromised to push malicious modules
The attack happened one layer up from the code itself: attackers got into Coder's Cloudflare infrastructure and added their own servers to the registry.coder.com origin pool, so Cloudflare quietly routed some requests to attacker-controlled servers serving credential-stealing Terraform modules instead of the real ones. Coder's customer list includes Dropbox, Palantir, and multiple government/defense organizations — if your team pulls from this registry, the compromise was at the infrastructure-routing level, so checking package hashes against what you pulled during the incident window matters more than checking your lockfile. Attacks like this often start with reconnaissance timed for off-hours windows, when infrastructure changes draw less scrutiny — whether that's what happened here hasn't been confirmed, but it's the kind of gap worth assuming rather than dismissing. The broader hardening lesson: an origin-pool hijack like this one sits in the same threat category as domain spoofing — both exploit trust in a domain rather than verification of what's actually being served from it. Worth building integrity checks (signed artifacts, hash verification) into your pipeline that don't depend on the domain staying honest.
via BleepingComputer · Sep 3, 2026
FBI Probes Service Selling 153M+ Drivers Licenses
The service, calling itself "Nexus" (no relation to the Cisco vulnerability above), is selling scans from a claimed active breach at a Louisiana identity-verification vendor whose clients include multiple Fortune 500 companies — and the listings aren't hypothetical: Krebs's own license was offered as a free sample, and a sitting U.S. Defense Secretary's license was found for sale. The FBI's New Orleans field office has opened an inquiry, but the record count is reportedly still climbing (up ~400,000 in 24 hours) — this one isn't over. The bigger pattern worth naming: centralized identity-verification systems are exactly the kind of target that makes a breach this size possible in the first place — one compromise nets scans for every company that outsourced its ID-check step to the same vendor. Whether the actual leak traces to an external attacker, internal points of contact willing to facilitate access, or compromised individuals whose access was hijacked rather than handed over, the lesson for anyone using a centralized verification provider is the same: that vendor is now part of your attack surface, not just a compliance checkbox.
via Krebs on Security · Sep 1, 2026
US and Canadian court data exposed in Thomson Reuters breach
The exposure runs through C-Track, a Thomson Reuters subsidiary's court case-management platform, and traces to unauthorized access first gained in March that wasn't caught until June — a three-month dwell time. At least 12 states' appellate courts plus U.S. Virgin Islands and Canadian courts are confirmed affected, with SSNs, driver's license numbers, medical information, and in some cases sealed court records potentially exposed; Thomson Reuters hasn't yet said how many people that touches, or how the attacker got in. That silence on the access vector is itself notable: a three-month dwell time reads as a potential internal controls issue — and with Thomson Reuters unable to say how the attacker got in, that can't be ruled out. Dormant credentials for former employees and third-party access granted once and never revisited are exactly the kind of gap that produces this pattern. Worth checking whether anything in your own critical-system access list doesn't expire on a defined schedule.
via The Record · Sep 3, 2026
Inductive Automation Ignition — CISA ICS Advisory (CVE-2026-77393, CVSS 8.8)
The bug is almost embarrassingly simple: Ignition's Gateway "Create Project Role(s)" setting shipped blank by default, so any authenticated user who could run gateway scripts could create projects — no privilege-escalation exploit needed, just a permission that was never actually set. Fixed in 8.1.54 (the newer 8.3 series was never affected). The version check is only half the fix, though: this is exactly the class of gap that access controls meeting federal/government hardening standards exist to catch, and it's a good prompt to confirm network segmentation is actually doing its job — a Gateway with no real business reason to be reachable from the broader network shouldn't be, regardless of what its internal permissions allow. Defense in depth means a bug this dumb shouldn't have been enough on its own.
via CISA ICS Advisories · Sep 3, 2026
That's Issue 001. Free weekly, no spam, unsubscribe anytime — secblog.reedcloudsec.com
