InfoSecBulletin Cybersecurity for mankind
BIND9 DNA Cache poisoning impact 267 IPs in Bangladesh via CVE: 2025-40778. The high severity flaw can allow remote attackers to inject forged DNS records into resolver caches.
BGD e-GOV CIRT published an advisory stating all organizations operating BIND 9 resolvers in Bangladesh (ISPs, data centers, government, enterprises) must upgrade to ISC (Internet Systems Consortium) patched releases 9.18.41, 9.20.15, 9.21.14 (or S1 variants) immediately. If cannot patch immediately, restrict recursion to trusted networks, enable DNSSEC validation where possible, and monitor DNS logs for anomalous answers.
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
The vulnerability (CVSS 8.6) in BIND 9 lets attackers inject fake DNS records into resolver caches through regular queries. It affects BIND versions 9.11.0–9.16.50, 9.18.0–9.18.39, 9.20.0–9.20.13, and 9.21.0–9.21.12 (including S1 previews). This can lead to DNS cache poisoning and redirect users to harmful sites.
Researchers released the PoC that demonstrates how an unauthenticated, remote attacker could poison DNS caches in vulnerable BIND 9 resolvers.
Mitigation & Recommended Actions:
Immediate Actions:
* Upgrade resolver instances to the patched BIND releases that correspond to respective
branch: 9.18.41, 9.20.15, 9.21.14 (and S1 variants 9.18.41-S1, 9.20.15-S1 where
applicable). If any affected 9.x version is running, upgrade to the closest patched release
from ISC immediately.
* ISP/recursive resolver operator or host a resolver for many clients (e.g., public DNS, ISP,
cloud provider), schedule an emergency update window and announce it to customers;
treat this as an urgent operational priority.
* If BIND instance is authoritative-only and does not perform recursion, it is likely not
directly exploitable, confirm configuration and ensure recursion is disabled for public
networks. (But verify with named -V and configurations)
Temporary mitigations (until you patch): (These reduce risk but are not full fixes)
* Restrict recursion to trusted IP ranges only (use allow-recursion and allow-query-cache to
trusted networks). This prevents external attackers from triggering recursive queries
against your resolver.
* Disable recursion on servers that must be authoritative-only (recursion no;) if possible
* If environment allows, reduce cache lifetime (TTL) temporarily to reduce window of
poisoned entries (shorter TTL means forged entries expire sooner). Note: this is disruptive
and should be used carefully.
* Use DNSSEC validation on resolvers (enable validation with a validating resolver or dnssec
enable/dnssec-validation in BIND); while this doesn’t protect all record types, DNSSEC
validation prevents signed zones from being silently replaced by unsigned forged records.
Note: enabling DNSSEC validation requires configuration and trust-anchor setup.
* Use upstream, validated recursive resolvers from trustworthy providers if local resolver
cannot be patched immediately (need to ensure clients are protected).
* Firewall / rate-limit DNS responses from the outside where practical, and monitor for
unusual DNS answer patterns/TTL/unknown authoritative servers.
DDoS Scandals Hit Bangladesh ISP Sector: BTRC Prepares Crackdown
