Daily October 2026

daily@lists.cert.at

1 participants
21 discussions

Tageszusammenfassung - 30.10.2026
by Daily end-of-shift report 30 Oct '26

30 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 29-10-2026 18:00 − Freitag 30-10-2026 18:00 Handler: Katharina Siess Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Erneut kritischer Bug in Linux TCP/IP aufgedeckt – Updates in Arbeit ∗∗∗ --------------------------------------------- Eine kritische Lücke im TCP/IP-Stack des Linux-Kerns erlaubt Remote Code Execution. Anthropics Claude entdeckte den elf Jahre alten Fehler. [..] Zur konkreten Gefahr, die von dieser Lücke ausgeht, ist bislang wenig bekannt. Der bislang einzige bekannte Exploit stammt von Anthropic und ist nicht öffentlich verfügbar. [..] Am 15. Oktober, also elf Jahre nach dem Commit, bestätigte Greg Kroah-Hartman, dass der Fehler CVE-2026-98432 in den Kernel-Versionen 6.12.113, 6.18.56, 7.2.10 und 7.3-rc7 gefixt wurde. --------------------------------------------- https://www.heise.de/news/Erneut-kritischer-Bug-in-Linux-TCP-IP-aufgedeckt-… ∗∗∗ Fake crypto app on Apple App Store linked to $23K wallet theft ∗∗∗ --------------------------------------------- A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-crypto-app-on-apple-app… ∗∗∗ Hugging Face malware campaign returns to hijack GPUs for crypto mining ∗∗∗ --------------------------------------------- A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaig… ∗∗∗ Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen ∗∗∗ --------------------------------------------- Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets.The worlds biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far. Tether and Circle said they have frozen more than 1.567 billion USDT and 800 million USDC related to the incident, respectively. --------------------------------------------- https://thehackernews.com/2026/10/binance-suffers-security-breach.html ∗∗∗ Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed that a trojanized version of Anthropics official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. --------------------------------------------- https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.ht… ∗∗∗ WordPress: Exploit-Versuche beobachtet, Update stopft Schadcode-Lücke ∗∗∗ --------------------------------------------- Am Mittwoch haben die Entwickler Updates veröffentlicht, die Sicherheitslücken in dem CMS schließen. Erste Angriffsversuche auf eine der Schwachstellen waren schon kurz nach Verfügbarkeit der Aktualisierungen zu beobachten. [..] Die bereits attackierte Sicherheitslücke beruht darauf, dass der WordPress-Core einen vorhersehbaren und aus dem Internet erreichbaren Pfad beim Anwenden von Core-Updates verwendet. Nicht authentifizierte Angreifer aus dem Internet können dadurch Schadcode einschleusen und ausführen – bei einem laufenden Upgrade (CVE-Eintrag zum Meldungszeitpunkt nicht verfügbar, CVSS 8.1, Risiko „hoch“). --------------------------------------------- https://www.heise.de/news/WordPress-Update-stopft-Schadcode-Luecke-Exploit-… ∗∗∗ php2shell: NAS-Laufwerke und Windows betroffen; Prüf-Scripte und Analysen ∗∗∗ --------------------------------------------- Seit dem 21. Oktober 2026 halten die php2shell genannten Sicherheitslücken die IT-Welt in Atem. Inzwischen finden auch Angriffe auf Windows Server statt. Auch Geräte wie NAS-Laufwerke sind von ihrer Firmware betroffen. In einem Nachtrag fasse ich noch einige Informationen, Hinweise auf Analysen sowie auf Prüf-Scripte für die Leserschaft zusammen. --------------------------------------------- https://borncity.com/blog/2026/10/30/php2shell-nas-laufwerke-und-windows-be… ∗∗∗ PHP2Shell CMS exploits across WordPress, Joomla and Drupal ∗∗∗ --------------------------------------------- We tested PHP2Shell CMS exploits across WordPress, Joomla and Drupal. [..] The PHP2Shell exploit did not transfer unchanged between CMSs. In isolated labs, we achieved remote code execution (RCE) against WordPress and Joomla using different exploit chains. Selected Drupal PHP files disclosed process memory, but our tests did not achieve RCE. --------------------------------------------- https://fortbridge.co.uk/research/php2shell-wordpress-joomla-drupal/ ===================== = Vulnerabilities = ===================== ∗∗∗ Mehrere Schwachstellen in LimeSurvey Community Edition ∗∗∗ --------------------------------------------- LimeSurvey Community Edition enthält mehrere Schwachstellen, die SQL Injection, das Auslesen beliebiger Dateien, persistentes Cross-Site Scripting und eine Umgehung der Rechteprüfung erlauben. Die Version 7.5.0 (build 261001) vom 1. Oktober 2026 soll die Schwachstellen beheben. --------------------------------------------- https://www.syss.de/pentest-blog/mehrere-schwachstellen-in-limesurvey-commu… ∗∗∗ TeamViewer stopft Codeschmuggel-Lücke ∗∗∗ --------------------------------------------- In TeamViewer wurden drei Sicherheitslücken aufgedeckt. Sie gelten als hochriskant und ermöglichen etwa, Schadcode einzuschleusen und auszuführen. Aktualisierte Softwarepakete stehen bereit, die die Schwachstellen ausbessern. Laut Hersteller werden die Lücken bislang nicht aktiv ausgenutzt. --------------------------------------------- https://www.heise.de/news/TeamViewer-stopft-Codeschmuggel-Luecke-11506072.h… ∗∗∗ LWN: Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1104174/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 29.10.2026
by Daily end-of-shift report 29 Oct '26

29 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 28-10-2026 18:00 − Donnerstag 29-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Katharina Siess ===================== = News = ===================== ∗∗∗ AlpineLinux: GitLab security incident: attempted exploitation of CVE-2026-97229 ∗∗∗ --------------------------------------------- On October 20 and 21, an attacker tried to exploit a GitLab vulnerability (CVE-2026-97229) on our instance, a week after the fix was released. The attack came close to working. We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with. [..] GitLab is being tested before we open it to the public again. All passwords have been reset, so when it is back you will need to set a new one with “Forgot your password?” on the sign-in page. --------------------------------------------- https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html ∗∗∗ TLP Is Not a Suggestion ∗∗∗ --------------------------------------------- On October 21, 2026, the PHP project shipped an emergency fix for PHP2Shell, two critical remote code execution bugs. The release was scheduled for Thursday, October 22. It went out on Wednesday because a Hacker News post broke the embargo on the previous Monday, a vendor publicly confirmed the bugs within hours, a researcher published a reconstruction before the patch existed, and exploitation attempts started before most administrators knew there was anything to patch. --------------------------------------------- https://www.akamai.com/blog/security-research/tlp-is-not-a-suggestion ∗∗∗ PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most ∗∗∗ --------------------------------------------- As of October 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We continue to see PHP2Shell-related requests across the more than 5 million sites we protect. Those requests show ongoing scanning and exploitation attempts; they do not show whether an attempt succeeded. Our site-cleaning and incident response teams have not handled a WordPress compromise attributed to these vulnerabilities. --------------------------------------------- https://www.wordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-… ∗∗∗ Aufgedeckt: Großes Netzwerk an Fake-Portalen für Flugbuchungen ∗∗∗ --------------------------------------------- Sie versprechen niedrigste Preise und eine einfache Buchung. Um Ihre Opfer anzulocken, schalten Sie Werbung auf Facebook und Instagram, während der gute Name realer Tourismusunternehmen und Fluglinien als Tarnung fungiert. Wir haben uns ein umfassendes Netzwerk an Fake-Buchungsportalen für Flüge näher angesehen und zeigen, wie ausgefeilt die Plattformen sind und woran sich die Betrugsabsicht erkennen lässt. --------------------------------------------- https://www.watchlist-internet.at/news/grosses-netzwerk-portale-flugbuchung… ∗∗∗ Cybervorfall im Umfeld der Tiroler Plattform Feratel; WhatsApp-Phishing bei Reisebuchungen ∗∗∗ --------------------------------------------- Der nächste potentielle Cybervorfall mit Zugriff auf Gästedaten im Hotel- und Übernachtungsgewerbe ist publik geworden. Die Plattform Feratel.com wird in Tirol (Österreich) als Buchungs- & Meldeplattform für Tourismus und Fremdenverkehr genutzt. Im Umfeld dieser Plattform hat es dort WhatsApp-Betrugsversuche gegeben, bei denen die Angreifer über Buchungsdaten von Gästen verfügten. --------------------------------------------- https://borncity.com/blog/2026/10/29/cybervorfall-im-umfeld-der-tiroler-pla… ∗∗∗ UniFi OS 5.1.34 Update sperrt eMudhra-Zertifikate; macOS 27.2-Nutzer müssen selbst eingreifen ∗∗∗ --------------------------------------------- Bei Windows gab es die Tage ein Out-of-Band-Update zum Entfernen der eMudhra-Zertifikate [..] Apple hat dazu das Support-Dokument About the compromised eMudhra intermediate CAs veröffentlicht. Das behauptet, dass Apple zum 19. Oktober 2026 die kompromittierten eMudhra Intermedia-Zertifikate automatisch blockiert. Mac-Administratoren können laut Support-Dokument aber optionale Maßnahmen für einige Befehlszeilentools ergreifen. Dabei werden Git, Curl und Python3 explizit erwähnt. [..] Administratoren müssen also selbst aktiv werden und gemäß Apple-Support-Dokument in den Command-Line-Tools die Zertifikate sperren. --------------------------------------------- https://borncity.com/blog/2026/10/29/unifi-os-5-1-34-update-sperrt-emudhra-… ∗∗∗ Angreifer kapern 42 GitHub-Repositories für npm-Wurm-Kampagne „testmetest“ ∗∗∗ --------------------------------------------- JFrog Security Research hat 42 GitHub-Repositories entdeckt, die Angreifer mit Ausführungs-Hooks und verstecktem Schadcode vermint haben. Die Forscher ordnen sie der npm-Wurm-Kampagne „testmetest“ zu. Wie viele Rechner den Schadcode ausgeführt haben und welche Daten abgeflossen sind, ist unklar. --------------------------------------------- https://heise.de/-11503164 ∗∗∗ Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th) ∗∗∗ --------------------------------------------- Building your malware analysis lab is a key point before playing with malware. [..] Ghidra ships with a component that many people ignore: Ghidra Server. It is included in the standard distribution (no extra download, no licence) and turns your local projects into "shared projects" backed by a central repository. --------------------------------------------- https://isc.sans.edu/diary/rss/33470 ∗∗∗ Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users ∗∗∗ --------------------------------------------- You may have come across ads on webpages promoting "manual finder", "safe search", "PDF converter", or "AI search" tools which often end up as easy to install browser extensions. What are these extensions actually doing and who is behind them? This investigation expands on previous research with 264 newly identified extensions which exist only to capture users search queries impacting 8.7 million more users. --------------------------------------------- https://socket.dev/blog/searchjacked ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. CVE-2026-76418 --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Drupal Security Advisories 2026-October-28 ∗∗∗ --------------------------------------------- 1x highly critical, 11x critical --------------------------------------------- https://www.drupal.org/security ∗∗∗ Diverse kritische Schwachstellen in WatchGuard Fireware OS ∗∗∗ --------------------------------------------- Schwere Sicherheitslücken gefährden Security-Appliances von WatchGuard. Updates stehen zur Verfügung und sollten schnell eingespielt werden. [..] WatchGuard gibt für alle 18 Lücken an, von keinen laufenden Angriffen zu wissen. [..] Die Lücken sind teilweise entfernten, nicht angemeldeten Angreifern zugänglich und erlauben ihnen, beliebigen Code auszuführen (remote code execution; mitunter sogar mit Root-Rechten), die Appliances lahmzulegen (denial of service) oder unwartbar zu machen sowie Sicherheitsbarrieren zu umgehen. --------------------------------------------- https://www.heise.de/news/Diverse-kritische-Schwachstellen-in-WatchGuard-Fi… ∗∗∗ SPLUNK: SVD-2026-1015: Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026 ∗∗∗ --------------------------------------------- https://advisory.splunk.com/advisories/SVD-2026-1015 ∗∗∗ LWN: Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1103666/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 28.10.2026
by Daily end-of-shift report 28 Oct '26

28 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 27-10-2026 18:00 − Mittwoch 28-10-2026 18:00 Handler: Guenes Holler Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Code-execution flaw in UEFI firmware affects most servers on planet Earth ∗∗∗ --------------------------------------------- Critical flaw in EDK2 allows attackers to execute code early in the boot process. --------------------------------------------- https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmwa… ∗∗∗ Microsoft releases Windows OOB updates to distrust eMudhra certificates ∗∗∗ --------------------------------------------- Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-… ∗∗∗ Hackers hijack Convertr analytics script to steal payment card data ∗∗∗ --------------------------------------------- A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers payment data during checkout. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-anal… ∗∗∗ InfraTrust report warns of exploited flaws in critical network infrastructure ∗∗∗ --------------------------------------------- Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. --------------------------------------------- https://www.bleepingcomputer.com/news/security/infratrust-report-warns-of-e… ∗∗∗ ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws ∗∗∗ --------------------------------------------- The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week.Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root .. --------------------------------------------- https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html ∗∗∗ Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges ∗∗∗ --------------------------------------------- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Googles Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in --------------------------------------------- https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.h… ∗∗∗ Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass ∗∗∗ --------------------------------------------- Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation.The list of eight vulnerabilities .. --------------------------------------------- https://thehackernews.com/2026/10/adobe-fixes-8-critical-campaign-classic.h… ∗∗∗ Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch ∗∗∗ --------------------------------------------- Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle .. --------------------------------------------- https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html ∗∗∗ PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems.The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to .. --------------------------------------------- https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html ∗∗∗ Microsoft Authenticator: Bösartige Apps konnten Zugangstoken abgreifen ∗∗∗ --------------------------------------------- Microsoft hat im Authenticator eine Sicherheitslücke geschlossen, durch die bösartige Apps hätten Zugangstoken abgreifen können. --------------------------------------------- https://www.heise.de/news/Microsoft-Authenticator-Boesartige-Apps-konnten-Z… ∗∗∗ Vermeintliche ÖGK-Phishing-Warnung ist in Wahrheit eine Phishing-Falle ∗∗∗ --------------------------------------------- Die Österreichische Gesundheitskasse zählt zu den am häufigsten als Deckmantel verwendeten Institutionen des Landes, Warnungen vor den unzähligen Betrugsmaschen im Namen der ÖGK werden im Wochenrhythmus veröffentlicht. Diesen Umstand nutzen nun Kriminelle. Sie versenden Phishing-Nachrichten, in denen vor Phishing-Nachrichten gewarnt wird. --------------------------------------------- https://www.watchlist-internet.at/news/oegk-phishing-warnung-falle/ ∗∗∗ Moldova investigates possible foreign involvement in major government cyberattack ∗∗∗ --------------------------------------------- Prime Minister Vasile Tofan said the incident may be part of a broader campaign targeting both citizens personal data and government digital infrastructure, according to local media reports. --------------------------------------------- https://therecord.media/moldova-investigates-possible-foreign-involvement-c… ∗∗∗ Silent Train: Volt Typhoon’s Sophisticated Infection Chain into US Targets Exposed ∗∗∗ --------------------------------------------- For years, government officials have described Volt Typhoon intrusions into US critical infrastructure as highly sophisticated, while providing few details to support the claim. Today, security researchers finally reveal some of the sophisticated tactics the Chinese group uses. --------------------------------------------- https://www.zetter-zeroday.com/silent-train-volt-typhoons-sophisticated-inf… ∗∗∗ Scanner Poses as 32 AI Bots to Find Credentials and Private Keys ∗∗∗ --------------------------------------------- A scanner impersonates 32 AI bots, including OpenAI and Claude crawlers, to search websites for exposed credentials, private keys and cloud configuration files. --------------------------------------------- https://hackread.com/hackers-impersonate-ai-bots-hunt-exposed-credentials/ ∗∗∗ Angreifer können Veeam-Backup-Server manipulieren und MFA deaktivieren ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für Veeam Backup & Replication und ONE erschienen. Bislang gibt es keine Hinweise auf laufende Attacken. --------------------------------------------- https://heise.de/-11502821 ∗∗∗ Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets ∗∗∗ --------------------------------------------- Socket’s Threat Research Team identified a cluster of malicious Firefox extensions that impersonate well-known crypto wallets and steal recovery phrases and private keys. The extensions use Unicode homoglyphs to copy the names of Phantom, Jupiter, and Bitget, and they route stolen secrets to brand-named subdomains of a single .. --------------------------------------------- https://socket.dev/blog/firefox-wallet-impersonators ===================== = Vulnerabilities = ===================== ∗∗∗ Security Vulnerabilities fixed in Thunderbird 153.6 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/ ∗∗∗ CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2026-109618 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 27.10.2026
by Daily end-of-shift report 27 Oct '26

27 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 23-10-2026 18:00 − Dienstag 27-10-2026 18:00 Handler: Katharina Siess Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability ∗∗∗ --------------------------------------------- A critical vulnerability, tracked as CVE-2026-111497 and referred to as Broccoli2Shell, has been identified in the Brotli decompression library. The vulnerability affects multiple widely used technologies, including Node.js, Bun, Envoy Proxy, and more. Successful exploitation could allow an unauthenticated remote attacker to trigger memory corruption, disclose sensitive information, crash affected processes, or potentially achieve remote code execution (RCE). Organizations using affected components to decompress untrusted Brotli-compressed data are advised to prioritize remediation. --------------------------------------------- https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js ∗∗∗ PHP2Shell security flaws now sucessfully exploited in the wild ∗∗∗ --------------------------------------------- Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. --------------------------------------------- https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now… ∗∗∗ Angriffe auf Arista VeloCloud und Collabora/Nextcloud beobachtet ∗∗∗ --------------------------------------------- Angreifer nutzen eine Lücke in Collabora und installieren Webshells auf Nextcloud-Servern. Auch Arista VeloCloud wird attackiert. --------------------------------------------- https://www.heise.de/news/Angriffe-auf-Arista-VeloCloud-und-Collabora-Nextc… ∗∗∗ Das Wohnungsinserat als Einfallstor für Schadsoftware ∗∗∗ --------------------------------------------- Der Immobilienmarkt ist angespannt. Stolpert man zufällig über eine leistbare Wohnung in guter Umgebung, soll es nach Möglichkeit entsprechend schnell gehen. Kontaktaufnahme, Besichtigungstermin, Unterschrift. Eine Situation, in der Menschen eventuell unvorsichtiger reagieren als sonst. Und genau darauf setzen die Kriminellen. Sie nutzen diese positive Aufregung, um über ein Formular Schadsoftware auf die Endgeräte ihrer Opfer zu schleusen. --------------------------------------------- https://www.watchlist-internet.at/news/wohnungsinserat-einfallstor-schadsof… ∗∗∗ AI coding agents hijacked using AGENTS.md file in Downloads folder ∗∗∗ --------------------------------------------- Researchers found a malicious AGENTS markdown instruction file in a customers Downloads folder that tricked an AI coding agent into installing a rogue npm package. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-us… ∗∗∗ DreamHost forces password resets in ongoing "incident" ∗∗∗ --------------------------------------------- DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. --------------------------------------------- https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-s… ∗∗∗ Wegen Schadcode-Lücke: Forscher legen millionenfach installierten Updater still ∗∗∗ --------------------------------------------- Angreifer hätten Millionen von Geräten über eine Lücke in einem veralteten Popcorn-Time-Fork kapern können. Wie Forscher das verhindert haben. --------------------------------------------- https://www.golem.de/news/wegen-schadcode-luecke-forscher-legen-millionenfa… ∗∗∗ Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento ∗∗∗ --------------------------------------------- An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. --------------------------------------------- https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html ∗∗∗ Yoba Malware Abuses Signed ChatGPT and Claude Binaries to Target AI Users ∗∗∗ --------------------------------------------- As interest in new AI tools accelerates, cybercriminals are finding ways to exploit the trust surrounding them. Check Point Research (CPR) has uncovered Yoba, a malware campaign using fake GitHub projects impersonating supposed ChatGPT and Claude desktop applications, while abusing legitimate, signed OpenAI and Anthropic executables to help load malware. --------------------------------------------- https://blog.checkpoint.com/research/yoba-malware-abuses-signed-chatgpt-and… ∗∗∗ SPECTER Attack Uses USB Power Signals to Leak Data From Air-Gapped PCs ∗∗∗ --------------------------------------------- Researchers demonstrated SPECTER, a technique that leaks data from compromised air-gapped PCs through USB power controls, phone charging changes and peripherals. --------------------------------------------- https://hackread.com/specter-usb-power-signals-air-gapped-pcs-leak-data/ ∗∗∗ StealC Malware Returns as Stadia RAT After Operation Endgame Takedown ∗∗∗ --------------------------------------------- StealC’s seller has returned with Stadia RAT, combining credential theft, hidden desktop control, and remote command execution using code reused from StealC v3.5. --------------------------------------------- https://hackread.com/stealc-malware-stadia-rat-operation-endgame-takedown/ ∗∗∗ CISA Unveils New Strategy to Strengthen National Cyber Defense and Critical Infrastructure Security ∗∗∗ --------------------------------------------- The strategy addresses an increasingly complex threat environment, strengthens national cyber defense, and prioritizes the infrastructure most essential to America’s national security, economy, public health, and safety. --------------------------------------------- https://www.cisa.gov/news-events/news/cisa-unveils-new-strategy-strengthen-… ∗∗∗ Tailscale warns of SSH flaws allowing root privilege escalation ∗∗∗ --------------------------------------------- The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. --------------------------------------------- https://www.bleepingcomputer.com/news/security/tailscale-warns-of-serious-s… ===================== = Vulnerabilities = ===================== ∗∗∗ Microsoft releases emergency .NET patches for critical Brotli flaw ∗∗∗ --------------------------------------------- Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. Tracked as CVE-2026-111497, this critical-severity flaw stems from an out-of-bounds write in the Brotli decoder, which expands data compressed using Google's widely used Brotli lossless compression algorithm. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergenc… ∗∗∗ Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes ∗∗∗ --------------------------------------------- Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on October 19 and 20, and the maintainers have not reported any attacks. --------------------------------------------- https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html ∗∗∗ Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens ∗∗∗ --------------------------------------------- Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. --------------------------------------------- https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html ∗∗∗ Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads ∗∗∗ --------------------------------------------- Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file. --------------------------------------------- https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html ∗∗∗ Python schließt per Update kritische TLS-Lücke wegen eMudhra-Schlüsseln ∗∗∗ --------------------------------------------- Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 und 3.11.18 beheben eine kritische Schwachstelle durch kompromittierte eMudhra-Zertifikate und weitere Lücken. --------------------------------------------- https://www.heise.de/news/Python-schliesst-per-Update-kritische-TLS-Luecke-… ∗∗∗ ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-26-792/ ∗∗∗ Synology-SA-26:14 PHP2Shell ∗∗∗ --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_26_14 ∗∗∗ LWN Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1103188/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 23.10.2026
by Daily end-of-shift report 23 Oct '26

23 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 22-10-2026 18:00 − Freitag 23-10-2026 18:00 Handler: Katharina Siess Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Railway warns devs to rotate secrets after potential breach ∗∗∗ --------------------------------------------- Cloud hosting provider Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. --------------------------------------------- https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate… ∗∗∗ Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data ∗∗∗ --------------------------------------------- Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. --------------------------------------------- https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.ht… ∗∗∗ Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. --------------------------------------------- https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.h… ∗∗∗ SEO Poisoning Campaign Delivers New Armorsteal Malware ∗∗∗ --------------------------------------------- In September 2026, Zscaler Threat Hunting identified an SEO poisoning campaign that used fake websites impersonating the Chocolatey package manager and the Microsoft Activation Scripts (MAS) tool to distribute a Python-based malware family we track as Armorsteal. The fake websites targeted users searching for Chocolatey or MAS software installation commands. Each lure page displayed a malicious PowerShell command that downloaded and executed the Armorsteal installer. The installer deployed a Python 3.11 runtime environment and three main components providing remote access, surveillance, and information stealing capabilities, with the Python code protected by Pyarmor. --------------------------------------------- https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-deli… ∗∗∗ GitHub Package Firewall blockiert schädliche npm-Pakete ∗∗∗ --------------------------------------------- GitHub hat die Package Firewall als öffentliche Vorschau für Enterprise-Cloud-Kunden freigegeben. Sie prüft Paketabfragen und Downloads. --------------------------------------------- https://www.heise.de/news/GitHub-Package-Firewall-blockiert-schaedliche-npm… ∗∗∗ Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes ∗∗∗ --------------------------------------------- Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. --------------------------------------------- https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html ===================== = Vulnerabilities = ===================== ∗∗∗ Arista patches new VeloCloud Orchestrator zero-day exploited in attacks ∗∗∗ --------------------------------------------- Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. --------------------------------------------- https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud… ∗∗∗ Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image ∗∗∗ --------------------------------------------- The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first. Ghostscript can read a name chosen by an attacker as instructions rather than as a file, and point it to a second file that carries commands to run. Pillow's maintainers fixed it in version 13.0.0, released on October 16. --------------------------------------------- https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.h… ∗∗∗ LWN Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1102546/ ∗∗∗ ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-26-787/ ∗∗∗ ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-26-786/ ∗∗∗ [R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2, 6.8.0, 6.9.1: SC-202610.1 ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2026-28 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 22.10.2026
by Daily end-of-shift report 22 Oct '26

22 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 21-10-2026 18:00 − Donnerstag 22-10-2026 18:00 Handler: Katharina Siess Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor ∗∗∗ --------------------------------------------- The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. --------------------------------------------- https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html ∗∗∗ Fortinet Releases Security Hardening Release for Multiple Products ∗∗∗ --------------------------------------------- On October 22, 2026, Fortinet will release a coordinated set of security updates for FortiOS, FortiManager, and FortiAnalyzer following recent releases from FortiMail and FortiAuthenticator. We strongly urge every customer to plan and promptly complete these upgrades as soon as the releases are available, prioritizing internet-facing devices. --------------------------------------------- https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-ha… ∗∗∗ New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification ∗∗∗ --------------------------------------------- A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. --------------------------------------------- https://thehackernews.com/2026/10/new-qpack-flaws-can-crash-http3-servers.h… ∗∗∗ Fake-Shops und verbilligte Storno-Geräte: Mediamarkt als Köder für mehrere Betrugsmaschen ∗∗∗ --------------------------------------------- Mediamarkt zählt hierzulande zu den absoluten Branchenriesen im Bereich Multimedia und Elektronik. Ein Status, den sich aktuell vermehrt Kriminelle zu Nutze machen wollen. Sie bauen nicht nur Mediamarkt-Fakeshops, sondern versenden außerdem noch Angebote zu angeblich verbilligte Stornoware an Unternehmen. In beiden Fällen ist das Auslösen einer Überweisung das Ziel. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shops-stornoggeraete-mediamarkt/ ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Codeausführung: GitLab veröffentlicht dringende Sicherheitsupdates ∗∗∗ --------------------------------------------- Mit Updates für mehrere Versionszweige schließt GitLab zwölf Sicherheitslücken, darunter auch eine kritische Lücke zur Remote-Codeausführung. --------------------------------------------- https://www.heise.de/news/GitLab-schliesst-kritische-Sicherheitsluecke-und-… ∗∗∗ Passwortmanager ohne Cloud-Zwang: Update für KeePassXC ∗∗∗ --------------------------------------------- KeePassXC 2.8.0 schließt Sicherheitslücken, unterstützt Auto-Type unter Wayland und ermöglicht den Datenbankabgleich über externe Programme. --------------------------------------------- https://www.heise.de/news/Passwortmanager-ohne-Cloud-Zwang-Update-fuer-KeeP… ∗∗∗ CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers ∗∗∗ --------------------------------------------- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. [...] CISA has directed federal agencies to prioritize patching systems affected by Plex2Shell vulnerabilities or apply mitigations by October 23. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaw… ∗∗∗ Cisco Expressway Series Security Hardening Release: October 2026 ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Multiple Cisco Products Snort 3 Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Drupal: Critical and moderately critical security advisories announced ∗∗∗ --------------------------------------------- https://www.drupal.org/security ∗∗∗ TYPO3-PSA-2026-001: Critical PHP security release: PHP update required for all TYPO3 installations ∗∗∗ --------------------------------------------- https://news.typo3.com/article/typo3-psa-2026-001 ∗∗∗ SVD-2026-1010: Security Vulnerabilities in Splunk SOAR - October 2026 ∗∗∗ --------------------------------------------- https://advisory.splunk.com/advisories/SVD-2026-1010 ∗∗∗ LWN Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1102265/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 21.10.2026
by Daily end-of-shift report 21 Oct '26

21 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 20-10-2026 18:00 − Mittwoch 21-10-2026 18:00 Handler: Katharina Siess Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Multiple Lenovo Tablets shipped with a known private test key for Android Verified Boot ∗∗∗ --------------------------------------------- Multiple Tablets provided by Lenovo are shipped with a known private test key for Android Verified Boot. --------------------------------------------- https://jvn.jp/en/jp/JVN33436631/ ∗∗∗ Operation FlashHole: Lazarus breaks security, defies control ∗∗∗ --------------------------------------------- Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security software. --------------------------------------------- https://securelist.com/lazarus-operation-flashhole/121541/ ∗∗∗ Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections ∗∗∗ --------------------------------------------- Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. --------------------------------------------- https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html ∗∗∗ Windows-Update-Nebenwirkungen: Probleme mit OWA, RDP und Smart App Control ∗∗∗ --------------------------------------------- Microsoft bestätigt einige Probleme, die durch Windows-Updates ausgelöst werden. Sie betreffen OWA, RDP und Smart App Control. --------------------------------------------- https://www.heise.de/news/Windows-Update-Nebenwirkungen-Probleme-mit-OWA-RD… ∗∗∗ Lieferkettenangriff auf Backup-Dienst trifft Hunderte M365-Tenants ∗∗∗ --------------------------------------------- Nutzer des Cloud Backups von ConnectWise müssen dringend ihre Systeme prüfen, da Angreifer diese möglicherweise bereits kompromittiert haben. --------------------------------------------- https://heise.de/-11495835 ∗∗∗ From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage ∗∗∗ --------------------------------------------- How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage. --------------------------------------------- https://www.wiz.io/blog/from-phishing-to-llmjacking ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücken in PHP - Updates verfügbar ∗∗∗ --------------------------------------------- In PHP existieren zwei kritische Sicherheitslücken, deren Ausnutzung es nicht authentifizierten Angreifer:innen ermöglichen kann, aus der Ferne beliebigen Code auszuführen. Betroffen sind laut PHP-Projekt alle PHP-Installationen, die Web-Anfragen verarbeiten, darunter PHP-FPM, Apache mit mod_php, php-cgi, FrankenPHP und LiteSpeed. [...] Das PHP-Projekt stellt mit den Versionen 8.5.12, 8.4.27, 8.3.36 und 8.2.35 Updates bereit, welche die Schwachstellen beheben. --------------------------------------------- https://www.cert.at/de/warnungen/2026/10/kritische-sicherheitslucken-in-php… ∗∗∗ Webbrowser: Chrome-Update schließt 353 Sicherheitslücken ∗∗∗ --------------------------------------------- Google hat den Webbrowser Chrome auf eine neue Hauptversion aktualisiert. Integriert sind Patches gegen Hunderte Sicherheitslücken. --------------------------------------------- https://www.golem.de/news/webbrowser-chrome-156-schliesst-353-sicherheitslu… ∗∗∗ Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator ∗∗∗ --------------------------------------------- Wordfence Argus helped uncover CVE-2026-82814, a high-severity unauthenticated PHP object injection in Duplicator and Duplicator Pro. Update to version 5.0.0 or newer. --------------------------------------------- https://www.wordfence.com/blog/2026/10/wordfence-argus-discovers-high-sever… ∗∗∗ Node.js fixt eigene und geerbte Sicherheitslücken ∗∗∗ --------------------------------------------- Neue Versionen für Node.js 22.x, 24.x und 26.x fixen hochriskante Sicherheitslücken und schützen vor kompromittierten Zertifikaten von eMudhra. --------------------------------------------- https://heise.de/-11495996 ∗∗∗ LWN Security updates for Wednesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1102005/ ∗∗∗ Kestra OSS Authentication Bypass Remote Code Execution v1.3.20 ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2026100006 ∗∗∗ Oracle Critical Security Patch Update Advisory - October 2026 ∗∗∗ --------------------------------------------- https://www.oracle.com/security-alerts/cpuoct2026.html ∗∗∗ Four stable kernels for Wednesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1101758/ ∗∗∗ Fortinet Releases Security Hardening Release for Multiple Products ∗∗∗ --------------------------------------------- https://feeds.fortinet.com/~/971845082/0/fortinet/blogs~Fortinet-Releases-S… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 20.10.2026
by Daily end-of-shift report 20 Oct '26

20 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Montag 19-10-2026 18:00 − Dienstag 20-10-2026 18:00 Handler: Katharina Siess Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ TeamUpdraft security incident: What customers need to know ∗∗∗ --------------------------------------------- Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website. Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected. This page explains what happened, what we have already done to protect you, and the steps to take for each of our products. --------------------------------------------- https://teamupdraft.com/blog/security-incident-october-2026/ ∗∗∗ Die Testphase für Amazon-Prime endet in 72 Stunden? Vorsicht, Phishing-Falle! ∗∗∗ --------------------------------------------- Der Absendername wirkt vertrauenswürdig, die Grafik höchst offiziell, der Ton ist freundlich. Angeblich endet die Testphase für ein Amazon-Prime-Abo in 72 Stunden, danach erfolgt die automatische Umwandlung in ein Zwei-Jahres-Abo. Will man diese verhindern, müsse man aktiv kündigen. Das Problem: Das Abo gibt es gar nicht. Die E-Mail und die dazugehörige Website wurden als Phishing-Falle konzipiert, die Kreditkartendaten abgreifen soll. --------------------------------------------- https://www.watchlist-internet.at/news/testphase-amazon-prime-phishing/ ∗∗∗ OVHcloud CLI releases backdoored on GitHub to steal developer secrets ∗∗∗ --------------------------------------------- French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdo… ∗∗∗ Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. --------------------------------------------- https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.ht… ∗∗∗ ICANN testing tech to let law enforcement access non-public WHOIS info ∗∗∗ --------------------------------------------- Single sign-on to help address imminent threats to life, critical infrastructure, or kids. --------------------------------------------- https://www.theregister.com/networks/2026/10/20/icann-testing-tech-to-let-l… ∗∗∗ PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites ∗∗∗ --------------------------------------------- TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information. The post PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites appeared first on Wordfence. --------------------------------------------- https://www.wordfence.com/blog/2026/10/updraftcentral-connection-key-compro… ∗∗∗ Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) ∗∗∗ --------------------------------------------- October 19 Update: Unit 42 continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc). We’re also aware of public reporting attributing exploitation to threat actors using Settra ransomware. --------------------------------------------- https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-… ∗∗∗ subfinder – Passive Subdomain Enumeration Tool ∗∗∗ --------------------------------------------- Point subfinder at a domain and it asks dozens of online sources which hostnames they have seen under it, without sending a packet to the target itself. I ran the new 2.17.0 release against this site with no API keys. It returned 17 subdomains in 14 seconds, and when I looked them up in DNS on 13 October, only one resolved. --------------------------------------------- https://www.darknet.org.uk/2026/10/subfinder-passive-subdomain-enumeration-… ∗∗∗ MacOS Infostealer “adapts” to new Keychain Protection ∗∗∗ --------------------------------------------- A recent sample I’ve analyzed changed it’s behaviour depending on the macOS version it is running on. --------------------------------------------- https://pberba.github.io/security/2026/10/20/amos-keychain/ ∗∗∗ Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns ∗∗∗ --------------------------------------------- Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys. --------------------------------------------- https://thehackernews.com/2026/10/go-issues-emergency-update-blocking.html ∗∗∗ WordPress SEO plugin Rank Math compromised to backdoor websites ∗∗∗ --------------------------------------------- Some downloads of the Rank Math PRO WordPress plugin from the vendors official website carried malware that planted hidden backdoors in a supply-chain attack last week. --------------------------------------------- https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-ma… ===================== = Vulnerabilities = ===================== ∗∗∗ Werbeblocker Pi-hole: Update stopft Befehlsschmuggel-Lücke und mehr ∗∗∗ --------------------------------------------- Der Werbeblocker Pi-hole bessert mit einem Update zahlreiche Schwachstellen aus. Nutzerinnen und Nutzer sollten es rasch anwenden. --------------------------------------------- https://www.heise.de/news/Werbeblocker-Pi-hole-Update-stopft-Befehlsschmugg… ∗∗∗ Schwachstelle CVE-2026-109390 (CVSS v3.1 9.8) im AnyDesk-Client für Linux ∗∗∗ --------------------------------------------- Ich stelle mal eine Information hier ein, auf die ich nun von zwei Blog-Lesern hingewiesen wurde. Im AnyDesk-Client für Linux gibt es eine kritischen Schwachstelle CVE-2026-109390, die mit einem CVSS 3.1 Base Score von 9.8 bewertet wurde. --------------------------------------------- https://borncity.com/blog/2026/10/20/schwachstelle-cve-2026-109390-cvss-v3-… ∗∗∗ eMudhra Intermediate CA Compromise ∗∗∗ --------------------------------------------- The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores. Users should update their browsers and operating systems to the latest versions as soon as possible. --------------------------------------------- https://emudhra.we-have-a-problem.com/ ∗∗∗ ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan ∗∗∗ --------------------------------------------- "The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path," Siemens said in an advisory. "This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application." The issue has been patched in version 4.0.9.8. Huntress Labs researcher Jose Oregon has been credited with discovering and reporting the shortcoming. --------------------------------------------- https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html ∗∗∗ LWN Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1101617/ ∗∗∗ TYPO3 Security Advisories 20.10.2026 ∗∗∗ --------------------------------------------- https://news.typo3.com/security/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 115.43.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-113/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 153.5.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-112/ ∗∗∗ Security Vulnerabilities fixed in Firefox 158.0.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/ ∗∗∗ Zyxel security advisory for incorrect authorization vulnerability in the DAL of certain 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 19.10.2026
by Daily end-of-shift report 19 Oct '26

19 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 16-10-2026 18:00 − Montag 19-10-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack ∗∗∗ --------------------------------------------- ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365… ∗∗∗ Exploit-Code geleakt: Plex-Server werden attackiert ∗∗∗ --------------------------------------------- Anfang September hatte Plex vor gefährlichen Sicherheitslücken in seiner Media-Server-Software gewarnt und schützende Updates bereitgestellt. Inzwischen liegen weitere Informationen zu den Lücken vor. Zudem hat ein Sicherheitsforscher bereits laufende Angriffe festgestellt. Überraschend ist das nicht, denn der dafür nötige Exploit-Code liegt seit dem vergangenen Wochenende öffentlich auf Github. --------------------------------------------- https://www.golem.de/news/exploit-code-geleakt-angreifer-schleusen-malware-… ∗∗∗ Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers ∗∗∗ --------------------------------------------- A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. [..] The flaw is in Broadcom's version of Wi-Fi Protected Setup (WPS), the feature that lets a device join a Wi-Fi network without the password being typed in. Broadcom's code mishandles the reassembly of fragmented WPS setup messages, so an attacker in range can send crafted messages that corrupt the router's memory. --------------------------------------------- https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html ∗∗∗ GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories ∗∗∗ --------------------------------------------- The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. [..] According to the threat intelligence platform, the threat actor registered the domain "my-github[.]com" and pointed it at "193.32.204[.]199," the same IP address that's used as an exfiltration endpoint for data harvested from running the malicious workflow. --------------------------------------------- https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.ht… ∗∗∗ CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability ∗∗∗ --------------------------------------------- On September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The vulnerability carries a CVSS v3.1 score of 9.8 according to NVD and a CVSS v4.0 score of 9.5 according to the Citrix security bulletin CTX697096. The vulnerability allows unauthenticated attackers to execute arbitrary commands on affected appliances. [..] The analysis in this blog focuses on the exploitation of CVE-2026-88771. --------------------------------------------- https://www.zscaler.com/blogs/security-research/cve-2026-88771-inside-explo… ∗∗∗ AOMEI Backupper update servers hijacked to push malware: Check your PC ∗∗∗ --------------------------------------------- Attackers tampered with AOMEI Backupper’s update system to deliver malware that could give them remote access to users’ PCs. --------------------------------------------- https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-serve… ∗∗∗ Klimabonus-Köder und trügerische Sicherheit: Phishing-Welle rollt durch Österreich ∗∗∗ --------------------------------------------- Hohe Betrugsraten bei Österreichs Online-Banking-Nutzer. Aktuell warnt das Finanzministerium zusätzlich vor einer massiven Welle an Fake-Nachrichten. --------------------------------------------- https://www.derstandard.at/story/3000000344738/klimabonus-koeder-und-truege… ∗∗∗ Keystrokes in Disguise: Forensic Analysis of a Digispark HID Device ∗∗∗ --------------------------------------------- A Digispark may look like a harmless USB development board, but it can easily be turned into a keystroke injection device that behaves like a USB Rubber Ducky. [..] he key difference between a USB Rubber Ducky and a Digispark is where the payload is stored. On a USB Rubber Ducky, it is located on removable storage, such as an SD card. On a Digispark, however, the logic is stored directly on the ATtiny85 microcontroller. From a forensic perspective, this makes analysis more difficult, as there is no easily accessible script file to review. [..] In this article, we show how such a device can be set up, used, and forensically analyzed, from payload execution on a target system to firmware extraction from the ATtiny85 microcontroller. --------------------------------------------- https://blog.nviso.eu/2026/10/16/keystrokes-in-disguise-forensic-analysis-o… ∗∗∗ Claude Code Desktop Flaw Let Malicious HTML Steal Developer Credentials ∗∗∗ --------------------------------------------- Noma Labs found a high-severity Claude Code Desktop flaw that let malicious HTML files steal local credentials and private keys through the preview pane. --------------------------------------------- https://hackread.com/claude-code-desktop-flaw-html-steal-credentials/ ===================== = Vulnerabilities = ===================== ∗∗∗ Roundcube: Security updates 1.6.20 and 1.7.5 released ∗∗∗ --------------------------------------------- We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities. --------------------------------------------- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 ∗∗∗ LWN: Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1101421/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 16.10.2026
by Daily end-of-shift report 16 Oct '26

16 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 15-10-2026 18:00 − Freitag 16-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Targeted ads delivered 0-click exploits to install mercenary malware ∗∗∗ --------------------------------------------- Researchers say that mercenary hackers laced ads with zero-click exploits that installed sophisticated malware on the devices of targeted individuals when they did nothing other than load a website or open an installed app. --------------------------------------------- https://arstechnica.com/security/2026/10/targeted-ads-delivered-0-click-exp… ∗∗∗ Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth ∗∗∗ --------------------------------------------- A proxyjacking campaign has impacted devices in 34 countries, monetizing victims’ internet connections through a commercial residential proxy network. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiqui… ∗∗∗ Schluss mit „digitalen Inseln“: Bund und Gemeinden starten neue Datenplattform ∗∗∗ --------------------------------------------- Staatssekretär Pröll und Gemeindebund-Präsident Pressl präsentierten am Freitagmorgen die neue „Gemeindedatenplattform“. --------------------------------------------- https://www.derstandard.at/story/3000000344526/schluss-mit-digitalen-inseln… ∗∗∗ AI-Powered Espionage Campaign Targets Government Linux Infrastructure ∗∗∗ --------------------------------------------- Unit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211. --------------------------------------------- https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructur… ∗∗∗ Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign ∗∗∗ --------------------------------------------- A calendar invite is one of the most routine messages in the modern workplace. It lands in the inbox, asks for a few seconds of attention, and is rarely questioned. Attackers know this, and they are now using fake meeting invitations to steal Microsoft account credentials. --------------------------------------------- https://blog.checkpoint.com/securing-user-and-access/fake-calendar-invites-… ∗∗∗ User refused to change her password because everyone already knew it ∗∗∗ --------------------------------------------- School staff seemed to be trying to get ransomware – for a second time. --------------------------------------------- https://www.theregister.com/security/2026/10/16/user-refused-to-change-her-… ∗∗∗ Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials ∗∗∗ --------------------------------------------- CISA and the Federal Bureau of Investigation (FBI) released a Public Service Announcement (PSA) warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. Malicious cyber actors may use phishing and smishing techniques to steal login credentials and other sensitive information or install malware on targeted devices. Election officials, candidates, and political organizations may be attractive targets because of their access to voter registration data, current government officials, and sensitive campaign information. --------------------------------------------- https://www.cisa.gov/resources-tools/resources/cyber-threat-actors-use-vari… ∗∗∗ EuGH: Banken müssen Phishing-Schaden erst einmal erstatten ∗∗∗ --------------------------------------------- In einem Fall von Phishing-Betrug stellt der EuGH klar, dass Banken den Schaden grundsätzlich erst einmal ersetzen müssen – mit nur einer Ausnahme. --------------------------------------------- https://heise.de/-11489842 ∗∗∗ Fake Arch Linux packages push malware with root privileges ∗∗∗ --------------------------------------------- A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-pus… ===================== = Vulnerabilities = ===================== ∗∗∗ BeyondTrust patches zero-day exploited in attacks since August ∗∗∗ --------------------------------------------- Tracked as CVE-2026-102764, this actively exploited authentication bypass vulnerability lets unprivileged remote attackers perform file operations on unpatched appliances and affects RS 26.2.3 or earlier. BeyondTrust patched the security issue for all Remote Support and Privileged Remote Access SaaS customers on October 8, but self-hosted installations must be patched manually if automatic updates are not enabled. --------------------------------------------- https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day… ∗∗∗ Zweites Update in einer Woche: Google schließt erneut kritische Lücke in Chrome ∗∗∗ --------------------------------------------- Google hat in dieser Woche ein zweites Sicherheitsupdate für seinen Browser Chrome veröffentlicht. Es schließt wieder eine kritische Lücke, die Nutzer unter Windows, MacOS, Linux und Android betrifft. Aufgrund des hohen Schweregrads ist es möglich, aus der Ferne Schadcode in den Browser einzuschleusen und außerhalb seiner Sandbox auszuführen. --------------------------------------------- https://www.golem.de/news/zweites-update-in-einer-woche-google-schliesst-er… ∗∗∗ LWN Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1101015/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily October 2026