Cyber Morning Call

Referências do Episódio
New N-able “4EverAble2Shell” zero-day exploited hours after PoC released (BleepingComputer)

Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2 (The Hacker News)

Uncovering ArcticRAT: The Evolution from Targeted Crypto-Stealer to AI-Powered Android RAT (Zimperium)

Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files (The Hacker News)

PHP2Shell Exploitation on Check Point Gateway (Check Point Research)

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia

Referências do Episódio
SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints (Huntress)

Apache HTTP Server 2.4 vulnerabilities (Apache Software Foundation)

Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know (Wiz)

The XG Files: Falcon C2 Flying Under The (Browser) Radar (Unit 42)

The global socket: how threat actors are weaponizing GSocket for stealthy C2 (Microsoft)

Zoom Workplace for Windows - Improper Input Validation (Zoom)

Zoom Workplace for Windows - Origin Validation Error (Zoom)

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia

Referências do Episódio
Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe (Check Point Research)

SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution (The Hacker News)

GhostFrame ESXi Implant Powers Settra Ransomware Attacks (Daily CyberSecurity)

GhostFrame: A new ESXi Implant Linked to Settra Ransomware (Recorded Future, via Malware News)

Exchange for breakfast: Turla’s Cereal tricks are not for kids (ESET WeLiveSecurity)

Microsoft’s November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194) (Tenable)

Patch Tuesday - November 2026 (Rapid7)

Microsoft Patch Tuesday, November 2026 Security Update Review (Qualys)

microsoft august 2026 patch tuesday fixes 400 flaws 3 zero days (BleepingComputer)

About the security content of iOS 27.2.1 and iPadOS 27.2.1 (Apple)

Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities (The Hacker News)

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia

Referências do Episódio
/bin/live: Conheça o Instituto Aaron Swartz com Lucas Lago e Ana Freitas (Mente Binária)

Status Dashboard (N-able)

N-able takes cloud platform offline after 30+ “zero-days” published (BleepingComputer)

N-able takes N-central platform offline after zero-day dump (TechTarget)

N-able takes N-central offline as alleged zero-day exploits surface (Field Effect)

Stable Channel Update for Desktop (Google Chrome Releases)

Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026 (The Hacker News)

The Cold Chain on Fire : Unpatched Danfoss controllers exploited (Sekoia)

Trusted by Default: Qubole Cross-Account Access Abused in the Wild (Wiz)

FORGE Lab uses agentic tools to identify memory safety issues in Rust (Microsoft)

BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Proofpoint)

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia

Referências do Episódio
Authentication Enforcement Bypass in SonicOS SSLVPN Allowing SAML and MFA Bypass (SonicWall PSIRT)

U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog (Security Affairs)

SonicWall security advisory (AV26-1133) (Canadian Centre for Cyber Security)

ARTEX abuse expands as cybercriminals target financial sector (Microsoft)

Microsoft Paint RCE Fix Now Available, but Windows Update Won’t Deliver It (The Hacker News)

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia