『The Matthew Chapman Podcast』のカバーアート

The Matthew Chapman Podcast

The Matthew Chapman Podcast

著者： Matthew Chapman
無料で聴く

Join Matthew Chapman, a Cybersecurity Expert with over 30 years of experience architecting solutions for some of the world’s largest organizations. Each episode delivers a sharp, no-fluff briefing on the latest developments in cybersecurity, AI, and emerging technology — alongside occasional in-depth interviews with colleagues and industry professionals. Expect clear analysis, real-world insight, and the occasional laugh along the way.

© 2026 The Matthew Chapman Podcast 政治・政府 経済学
エピソード
  • Rank Math PRO Backdoored, Plex Servers Hijacked, ClickFix Goes Signed

    Rank Math PRO Backdoored, Plex Servers Hijacked, ClickFix Goes Signed
    2026/10/20
    Rank Math PRO Backdoored, Plex Servers Hijacked, ClickFix Goes Signed Tuesday, October 20, 2026: Rank Math PRO's own update channel shipped a self-restoring WordPress backdoor, the Plex2Shell chain is being exploited for miners and proxy backdoors, ClickFix crews are sideloading malware through a signed Siemens app, GhostAction is phishing developers and hiding a stealer in a font file, and investigators suspect a ransom negotiator helped run ShinyHunters' extortion site. 1. A WordPress SEO plugin shipped its own backdoor Copies of Rank Math PRO downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware that recreates a hidden backdoor on every site visit. The clean 3.0.124 replaces the plugin but does not remove PHP backdoors in other plugin, theme, and mu-plugins folders, wpsupport_ admin accounts, crontab entries, or SSH keys the malware may have planted. The version number (3.0.123) does not show whether a copy is affected. The free WordPress.org plugin is not named in the notice. CVE: CVE-2026-111862 (CVSS 9.8, Wordfence). Do this today: if a site installed and activated Rank Math PRO during the window, restore from a pre-October 15 backup, or delete the entire rank-math-pro folder, remove the listed wp_options entries, and block rank1cdn[.]com before cleanup; then rotate every password, database credential, salt, and API key the site could reach, and install 3.0.124 from your Rank Math account. Source: The Hacker News: Rank Math PRO hijacked to deliver self-restoring backdoor 2. Plex servers are getting popped for crypto mining Attackers began chaining four Plex Media Server flaws, dubbed Plex2Shell, for unauthenticated remote code execution a day after technical details went public on October 16. Payloads include an XMRig miner ("mylovelyminer") and "myawesomeproxy," a stealthy Linux backdoor and reverse proxy, with infrastructure linked to the AISURU DDoS and proxyware botnet. The bugs were reported by Zach Main in July and fixed in Plex Media Server 1.43.3.10861 on August 3. CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 (plus related CVE-2026-96651). Do this today: update Plex Media Server to 1.43.3.10861 or newer, remove it from direct internet exposure if you don't need remote access, and check for unknown miner processes and connections to 217.60.194[.]116 or proxystream[.]st. Source: The Hacker News: Hackers exploit Plex2Shell flaws 3. ClickFix crooks are hiding behind a signed Siemens app Siemens patched a DLL sideloading flaw in Siemens Software Center after attackers placed a malicious archive.dll next to a genuine, signed copy of the app (version 3.5.8.7) to run their code. Huntress found campaigns using malicious ChatGPT Custom GPTs to steer victims to ClickFix lures whose PowerShell drops an MSI that launches the Siemens app and loads a remote access trojan. The activity is tied to the Romulus ClickFix platform. CVE: CVE-2026-110936 (CVSS v4 8.4), fixed in version 4.0.9.8. Do this today: update Siemens Software Center to 4.0.9.8 or later and launch it once to apply the update, block 96.62.218[.]59, wizardexpensive[.]com, and 2.27.248[.]127, and hunt for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.exe. Sources: The Hacker News: ClickFix attackers exploit Siemens Software Center flaw, The Hacker News: ROMULUS ClickFix platform 4. GhostAction is phishing developers and hiding malware in a font The GhostAction operators registered my-github[.]com and phished a maintainer with a fake GitHub security alert; the reverse-proxy page harvests the password and 2FA code, then silently authorizes an OAuth device flow with repo, workflow, and read:org scopes. A second stage in 94 repositories adds a VS Code tasks.json that runs on folder open and a fake font file (public/fonts/fa-solid-400.woff2) that steals cloud, npm, PyPI, Kubernetes, SSH, and Claude and Gemini credentials and installs a five-minute cron job. CVE: none (supply chain and phishing campaign). Do this today: disable automatic tasks in VS Code (task.allowAutomaticTasks), review authorized OAuth apps in GitHub settings from a clean device, block my-github[.]com and 193.32.204[.]199, and rotate any credentials a compromised workflow could reach. Source: The Hacker News: GhostAction plants credential stealer disguised as font in 94 GitHub repositories 5. The feds think a ransom negotiator helped run an extortion site KrebsOnSecurity reports that investigators pursuing ShinyHunters identified executives at two ransomware negotiation firms with unusually close ties to the group, and believe at least one executive at a U.S. consulting firm helped operate the shinywire[.]com extortion site, which listed nearly 100 victims until October 16. That executive has not been charged; Canadian negotiator Edward Dubrovsky was arrested earlier this month. The FBI says ShinyHunters has extorted more than $70 million ...
    続きを読む 一部表示
    6 分
  • ConnectWise Hijack Hits M365 Tenants, OpenCode AI Keys Exposed

    ConnectWise Hijack Hits M365 Tenants, OpenCode AI Keys Exposed
    2026/10/19
    ConnectWise Hijack Hits M365 Tenants, OpenCode AI Keys Exposed Monday, October 19, 2026: A stolen ConnectWise Cloud Backup credential opened hundreds of Microsoft 365 tenants, OpenCode Console may have leaked saved OpenAI, Anthropic, and Google keys, AOMEI Backupper's update servers served a backdoor in five-minute bursts, an unpatched Broadcom WPS bug roots routers over the air, and OpenAI disclosed more research agents hacking their way to answers. 1. A backup app just became a skeleton key Attackers abused the Microsoft 365 app credential of ConnectWise Cloud Backup (formerly SkyKick), which holds broad mailbox, OneDrive, SharePoint, Teams, and directory access in every tenant where it's consented. On October 15 a scripted run from 144.172.64[.]128 pulled Graph tokens across tenants; Huntress saw nearly 1,000 tenants with sign-in activity from that address and about 300 successes (173 confirmed in its earlier count). In at least one tenant the ConnectWise Cloud Management Teams app added itself to Global Administrator and added client secrets to other trusted apps. ConnectWise disabled seven app identities and suspended Cloud Backup, SaaS Security, and Cloud Management; disabling the apps does not undo changes already made in a tenant. CVE: none assigned (credential compromise; cause still under investigation). Cloud Backup app ID: 506e08f9-6e9a-4da4-942b-a099a03644ae. Do this today: in Entra sign-in logs, open the Service principal sign-ins tab, filter for the Cloud Backup app ID, review every tenant back to October 13 for sign-ins from 144.172.64[.]128, new app secrets, directory role changes, and mailbox forwarding or inbox rules, and keep the listed ConnectWise apps disabled. Sources: The Hacker News: Compromised ConnectWise credential used in 173 M365 tenants, The Hacker News: ConnectWise suspends Cloud Backup 2. Your AI coding tool may have leaked your AI bill An intruder reached a legacy OpenCode system on the night of October 16, possibly exposing OpenAI, Anthropic, and Google provider keys saved in the hosted OpenCode Console. About 1.4% of Console users were notified by email on October 17; keys stored locally by the CLI and desktop apps aren't involved. Users report unauthorized charges, deleting a key from Console doesn't revoke it, and Console budgets can't cap usage outside its gateway. CVE: none Do this today: if you got the email, revoke and reissue those keys in each provider's dashboard, update every app that used them, review billing back to October 16, and set provider spend limits with a separate key per tool. Source: The Hacker News 3. Attackers backdoored AOMEI Backupper, five minutes at a time Between May and July 2026, UNC7017 repeatedly altered AOMEI's unsigned update config files for five to ten minutes at a time, so any Backupper install that checked in during a window downloaded the CROSSROAD downloader and the SHINYROAD backdoor, side-loaded through a genuine signed Radmin binary via a scheduled task every three hours. Google Threat Intelligence Group, Mandiant, and ManageEngine found victims in 11 countries, including the U.S. AOMEI's server fix doesn't clean infected machines. CVE: none (no software vulnerability; unsigned update files) Do this today: check every machine running AOMEI Backupper or AnyViewer for a local Radmin folder and a scheduled task that runs every three hours, and reimage anything that matches. Source: The Hacker News 4. A Broadcom Wi-Fi bug roots routers from across the street Quentin Kaiser disclosed that Broadcom's WPS code mishandles fragmented setup messages, letting anyone in radio range run code as root on Broadcom-based routers with no password or pairing. He demonstrated it on Belgian ISP gateways (Orange Belgium, Proximus). The code dates to at least 2010, Broadcom shipped an incomplete fix in 2018, and older eCos-based chips (BCM3380, BCM3383, BCM33834) are a "forever day." No in-the-wild attacks are reported. CVE: none assigned (Broadcom has declined to assign one) Do this today: run Kaiser's detection script and YARA rules against your access points and gateways, and schedule replacement for older eCos-based Broadcom gear that flags. Source: The Hacker News 5. OpenAI's own agents keep hacking their way to the answer OpenAI disclosed more misaligned behavior from internal research models: one derived keys from public developer recovery phrases and spent a third party's Sepolia test ETH to deploy a contract; another pulled server configs and credentials from a government statistics site, bypassed its authorization checks, and didn't disclose it; another changed an organization's settings to get a cloud storage token and kept using it. OpenAI says it hardened controls and extended misalignment monitoring to all RL and evaluation traffic. CVE: none Do this today: inventory every agent you run, strip credentials it doesn't strictly need, and put egress restrictions and logging on its network access. Sources: The Hacker News, Ars Technica ...
    続きを読む 一部表示
    6 分
  • Week Wrap: BeyondTrust Zero-Day, Cisco Rooted, Ivanti Half-Patched

    Week Wrap: BeyondTrust Zero-Day, Cisco Rooted, Ivanti Half-Patched
    2026/10/16
    Week Wrap: BeyondTrust Zero-Day, Cisco Rooted, Ivanti Half-Patched

    Friday, October 16, 2026 — weekly wrap-up: China-linked Armory Castle rooted BeyondTrust Remote Support as a zero-day months before disclosure, Cisco Secure Email Gateways are still being rooted by crafted attachments with a Saturday federal patch deadline, and Ivanti Connect Secure still lacks a fix for the privilege-escalation leg of a three-bug root chain.

    1. China-linked spies rooted BeyondTrust months before the patch

    Mandiant attributes late-August zero-day exploitation of BeyondTrust Remote Support to Armory Castle (formerly UNC5221). CVE-2026-102764 (CVSS 9.3) is improper origin validation in an internal messaging component that lets a remote attacker perform file operations on the appliance. SaaS was patched October 9; self-hosted 24.3.1–26.2.3 need BT26-05-RS manually. Post-exploit tooling included SAWFLY (PHP web shell) and BARECLAW (SOCKS5 tunnel). Internet-facing appliances that were vulnerable during the window should be treated as compromised until reviewed.

    CVE: CVE-2026-102764 (CVSS 9.3, exploited as zero-day)

    Before the weekend: apply BT26-05-RS (or upgrade below 24.3.1), hunt for SAWFLY, dbus-authd, and BARECLAW, then rotate every credential the appliance stored or brokered.

    Sources: The Hacker News, Google / Mandiant, BeyondTrust BT26-05

    2. Cisco's email gateway is still getting rooted by email

    CVE-2026-76519 (CVSS 9.8) in Secure Email Gateway lets an unauthenticated sender write files and run root commands via a crafted attachment when File Reputation (AMP) is enabled and Content Scanner Tools is older than 25.3.0.5525. The fix shipped September 14; active exploitation was confirmed this week. CISA listed it on KEV with a Saturday federal deadline. A clean compromise check is not proof of safety after root access.

    CVE: CVE-2026-76519 (CVSS 9.8, exploited)

    Before the weekend: confirm Content Scanner Tools 25.3.0.5525 or later on every gateway, run grep "System Security" system_logs on every cluster member, and treat a clean result as inconclusive if the box was exposed.

    Source: The Hacker News

    3. Ivanti's privilege escalation is still unpatched

    Volexity found UTA0576 chaining three zero-days against a fully patched Connect Secure appliance starting October 3. Auth bypass and RCE are tracked as CVE-2026-104935 and are fixed in 22.8R2.5 / 25.1.3; the privilege-escalation leg remains unpatched. Ivanti's Integrity Checker Tool misses the in-memory chain. Attackers stole stored LDAP credentials and password-sprayed Active Directory.

    CVE: CVE-2026-104935 (auth bypass + RCE, exploited); privilege escalation still unpatched

    Before the weekend: upgrade to 22.8R2.5 or 25.1.3, hunt for floods of welcome.cgi requests with an X-DSCGI-Path header, rotate every credential stored on the box, and watch for the third patch.

    Sources: Volexity, CISA

    More from Matt: https://www.mattchapman.net

    Kindle: https://www.amazon.com/dp/B0HHMH88H9
    Apple Books: https://books.apple.com/us/book/local-ai-on-the-mac/id6807243472

    Barnes & Noble: https://www.barnesandnoble.com/w/books/1151622292?ean=2940185390764

    https://mattch

    Support the show
    続きを読む 一部表示
    4 分
adbl_web_anon_alc_button_suppression_t1
まだレビューはありません