Daily October 2026

daily@lists.cert.at

1 participants
14 discussions

Tageszusammenfassung - 06.10.2026
by Daily end-of-shift report 06 Oct '26

06 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Montag 05-10-2026 18:00 − Dienstag 06-10-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Breite Betrugswellen: Trojaner- und Phishing-Attacken im Namen der WKO ∗∗∗ --------------------------------------------- Momentan sind besonders viele Betrugsversuche im Namen der Wirtschaftskammer Österreich unterwegs. Die Kriminellen gehen dabei zweigleisig vor: Sie wollen sowohl Schadsoftware auf die Endgeräte ihrer Opfer schleusen als auch deren Login-Daten für das WKO-Portal abgreifen. Ein (unvollständiger) Überblick über aktuelle Fallen. --------------------------------------------- https://www.watchlist-internet.at/news/breite-betrugswellen-wko/ ∗∗∗ Nach Sicherheitsvorfall: Vorsicht vor touriDat-Hotelbuchungs-Phishing ∗∗∗ --------------------------------------------- Der nächste Fall aus der Hotel-Buchungs-/Reisebranche, bei dem Buchungsdaten in Phishing-Nachrichten genutzt werden, um Opfer zu täuschen. Dieses Mal trifft es die touriDat-Plattform, deren Nutzer mit Phishing-Mails und oder WhatsApp-Phishing-Nachrichten kontaktiert werden, um Zahlungsdaten zu ergattern. --------------------------------------------- https://borncity.com/blog/2026/10/06/nach-sicherheitsvorfall-vorsicht-vor-t… ∗∗∗ OpenAI agents tried to hack Wikipedia tools and flooded it with traffic ∗∗∗ --------------------------------------------- The publisher of Wikipedia said Monday that OpenAI agents attempted to hack a note-taking tool it hosts, made unauthorized edits, and sent millions of resource-intensive requests to its infrastructure, in the latest instance of OpenAI systems taking harmful and potentially dangerous actions. --------------------------------------------- https://arstechnica.com/security/2026/10/openai-agents-tried-to-hack-wikipe… ∗∗∗ Rejetto HFS servers now actively scanned for critical RCE flaw ∗∗∗ --------------------------------------------- Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code execution (RCE). [..] CVE-2026-61500, first published on July 13, 2026, is a session-cookie signing weakness and leakage issue fixed in Rejetto HFS version 3.2.1. --------------------------------------------- https://www.bleepingcomputer.com/news/security/rejetto-hfs-servers-now-acti… ∗∗∗ More RMM Tools In the Wild, (Tue, Oct 6th) ∗∗∗ --------------------------------------------- It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one. --------------------------------------------- https://isc.sans.edu/diary/rss/33400 ∗∗∗ ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits ∗∗∗ --------------------------------------------- A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browsers cache. "Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file," the Microsoft Threat Intelligence team said in a post on X. --------------------------------------------- https://thehackernews.com/2026/10/clickfix-smuggles-payloads-through.html ∗∗∗ Inside RevStealers Sandbox-Aware Anti-Analysis System ∗∗∗ --------------------------------------------- We recently came across an interesting Joe Sandbox analysis on Joe Sandbox Cloud Basic that was confirmed as malicious but showed surprisingly little malicious behavior. Samples like this are often particularly interesting because limited activity does not necessarily mean that execution failed. --------------------------------------------- https://www.joesecurity.org/blog/6469689575970038406 ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products ∗∗∗ --------------------------------------------- A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each products web application root directory. The attacker must already know a file's exact name and path and cannot list what the directory holds. Atlassian disclosed the flaw, CVE-2026-21589, on October 5, rated it 9.3 out of 10, and listed a fixed version for each product. --------------------------------------------- https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html ∗∗∗ Kritische Auth-Bypass-Schwachstelle CVE-2026-103956 (CVSS 10.0) in Loom for AWS ∗∗∗ --------------------------------------------- Eine kritische Schwachstelle führte dazu, dass Dritte ohne Authentifizierung auf Loom for AWS zugreifen konnten. Die kritische Auth-Bypass-Schwachstelle CVE-2026-103956 wurde mit einem CVSS Base-Score von 10.0 klassifiziert. [..] Wer Loom for AWS verwendet, sollten auf die Version 1.6.1 oder höher upgraden. --------------------------------------------- https://borncity.com/blog/2026/10/06/kritische-auth-bypass-schwachstelle-cv… ∗∗∗ LibreOffice und OpenOffice: Warnung vor Codeschmuggel-Lücke, Updates kommen ∗∗∗ --------------------------------------------- In den Bürosoftwarepaketen LibreOffice und OpenOffice klafft eine hochriskante Sicherheitslücke, durch die Angreifer mit manipulierten Dokumenten Schadcode einschleusen können. LibreOffice stopft außerdem weitere Sicherheitslücken. --------------------------------------------- https://heise.de/-11477059 ∗∗∗ Android-Patchday: Google stopft sieben kritische Löcher ∗∗∗ --------------------------------------------- https://www.golem.de/news/android-patchday-google-stopft-sieben-kritische-l… ∗∗∗ LWN: Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1098979/ ∗∗∗ Mozilla Foundation Security Advisories October 6, 2026 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/ ∗∗∗ Libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP ∗∗∗ --------------------------------------------- https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt ∗∗∗ Zyxel security advisory for command injection vulnerability in the WiFi SSID field of certain DSL/Ethernet CPE, fiber ONTs, and Wireless Extenders ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… ∗∗∗ Veeam: Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4 ∗∗∗ --------------------------------------------- https://www.veeam.com/kb4934 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 05.10.2026
by Daily end-of-shift report 05 Oct '26

05 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 02-10-2026 18:00 − Montag 05-10-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Cyberangriff: Antriebssystem eines Öl-Supertankers gehackt ∗∗∗ --------------------------------------------- Unbekannte haben offenbar im Sommer Zugriff auf das Antriebssystem eines Öl-Supertankers gehabt, als dieser sich der Küste des US-Bundestaats Texas näherte. Das berichtet Transport Topics unter Berufung auf nicht näher genannte Quellen bei US-Behörden. Der Vorfall, der als Cyberangriff eingestuft wird, wird demnach von der US-Bundespolizei FBI sowie der US-Küstenwache untersucht. --------------------------------------------- https://www.golem.de/news/cyberangriff-antriebssystem-eines-oel-supertanker… ∗∗∗ OpenAI alerts 100+ orgs that its misaligned models attempted to break in - or worse ∗∗∗ --------------------------------------------- OpenAI's agents have repeatedly strayed beyond their intended scope. Two separate reports detail the activity, including one from Sam Altman’s company saying it has notified more than 100 organizations about potentially problematic model activity. --------------------------------------------- https://www.theregister.com/security/2026/10/02/openai-alerts-100-orgs-that… ∗∗∗ Create automatic IP blocklist in OPNsense based on MISP data ∗∗∗ --------------------------------------------- This blog post is about creating an automatic IP blocklist in OPNsense based on MISP data, including data retention. --------------------------------------------- https://lithilion.at/blog/2026-10-misp-blocklisting.html ∗∗∗ Nach Muse: Auch ChatGPT-App für macOS war angreifbar ∗∗∗ --------------------------------------------- Agentische Tools, die direkt auf dem Rechner laufen, benötigen oft weitreichende Zugriffsrechte. Das macht sie potenziell angreifbar. Nachdem der macOS-Security-Spezialist Patrick Wardle kürzlich eine potenziell durch Dritte ausnutzbare Hintertür in Metas Muse-App für den Mac entdeckt hatte, warnt dieser nun vor einem ähnlichen Problem in der konkurrierenden ChatGPT-App für macOS von OpenAI: Auch hier war es Angreifern möglich, sensible Informationen abzugreifen. [..] OpenAI hat das Problem Ende September mit einer Aktualisierung behoben, nachdem Wardle das Unternehmen darüber informiert hatte. --------------------------------------------- https://www.heise.de/news/Nach-Muse-Auch-ChatGPT-App-fuer-macOS-war-angreif… ∗∗∗ Raiffeisen-Phishing: Vorsicht bei Mitteilung zu neuem Dauerauftrag ∗∗∗ --------------------------------------------- Aktuell kursiert eine Phishing-Mail im Namen von Raiffeisen. Sie behauptet, ein neuer Dauerauftrag sei eingerichtet worden und müsse geprüft werden. Wer dem Link folgt, landet auf einer gefälschten Seite und soll dort seine Daten preisgeben. --------------------------------------------- https://www.watchlist-internet.at/news/raiffeisen-mail-zu-dauerauftrag/ ∗∗∗ N0n ransomware: what you need to know ∗∗∗ --------------------------------------------- N0n is a newly-emerged cyber extortion gang. The group was first spotted in the middle of September 2026, and within days it had published on its dark web leak site details of what it claimed to be around a dozen victims. Since then, the tally has continued to grow. --------------------------------------------- https://www.fortra.com/blog/n0n-ransomware-what-you-need-know ∗∗∗ Japan Plans Major Cyber Hunt to Detect Hidden Attacks on Critical Infrastructure ∗∗∗ --------------------------------------------- Japan is stepping up its plans to find cyber attackers who may already be inside the networks that keep essential services running. Under a new fiscal 2027 initiative, the government plans to work with private companies to strengthen Japan threat hunting across critical infrastructure, including power utilities and telecommunications operators. --------------------------------------------- https://thecyberexpress.com/japan-threat-hunting-plan/ ∗∗∗ Google Suspends Open Source Bug Bounty Over AI-Generated Reports ∗∗∗ --------------------------------------------- Google has suspended its Open Source Software Vulnerability Rewards Program (OSS VRP), a vulnerability search initiative that paid researchers for finding flaws in the companys open-source software. The pause took effect on October 1, 2026. Google blamed a "significant rise" in automated and AI-generated reports, most of which turned out to be invalid. --------------------------------------------- https://thecyberexpress.com/google-pauses-oss-vrp-over-ai-submissions/ ===================== = Vulnerabilities = ===================== ∗∗∗ New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline ∗∗∗ --------------------------------------------- Citrix has released security updates for a high-severity security flaw in NetScaler ADC and Citrix NetScaler Gateway that has been exploited as part of targeted zero-day attacks. The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0." [..] For successful exploitation, NetScaler ADC or NetScaler Gateway must be configured either as a SAML service provider (SP) or SAML identity provider(IdP). --------------------------------------------- https://thehackernews.com/2026/10/new-netscaler-zero-day-exploited-in.html ∗∗∗ Microsoft schiebt Exchange-Update nach ∗∗∗ --------------------------------------------- Zum Wochenende hat Microsoft weitere Exchange-Updates nachgelegt. [..] Aufgrund einer schwachen Autorisierung in Microsofts Exchange-Server können authentifizierte Angreifer aus dem Netz ihre Rechte ausweiten. Die Entwickler führen aus, dass bösartige Akteure dadurch unbefugten Zugriff auf Mailboxen anderer User erlangen und E-Mails und Anhänge daran lesen können. Tenant-Grenzen lassen sich dadurch jedoch nicht überwinden (CVE-2026-96940, CVSS 8.8, Risiko „hoch“). --------------------------------------------- https://www.heise.de/news/Microsoft-schiebt-Exchange-Update-nach-11475517.h… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1098599/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 02.10.2026
by Daily end-of-shift report 02 Oct '26

02 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 01-10-2026 18:00 − Freitag 02-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Microsoft’s X account hacked in crypto pump-and-dump scheme ∗∗∗ --------------------------------------------- On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsofts-x-account-hacked-… ∗∗∗ Hackerangriff: Pentagon verliert Daten von mehr als drei Millionen Personen ∗∗∗ --------------------------------------------- Unbefugte haben rund neun Monate lang Zugriff auf einen Server mit Personaldaten. Die Daten auf dem Server des Pentagon sind unverschlüsselt. --------------------------------------------- https://www.golem.de/news/hackerangriff-pentagon-verliert-daten-von-mehr-al… ∗∗∗ Warlock ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries ∗∗∗ --------------------------------------------- The group is exploiting a variety of vulnerabilities impacting Microsoft SharePoint, according to a new report from Symantec Threat Hunter Team. --------------------------------------------- https://therecord.media/warlock-ransomware-used-in-critical-infrastructure-… ∗∗∗ Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739) ∗∗∗ --------------------------------------------- During a Purple Team engagement, we had to list and rank risky components across the network. One of them caught our attention: Cato Client, a VPN client program. It was installed everywhere. It runs privileged services. It talks to a GUI. It handles network configuration. From an attacker perspective, this is exactly the kind of software you want to understand. However, saying "this looks risky" is not enough. There is nothing better than PoC||GTFO. So the question was simple: can we find a real bug and turn it into something useful? This is how it started. --------------------------------------------- http://blog.quarkslab.com/cato-vpn-client-split-tunnel-and-privilege-escala… ===================== = Vulnerabilities = ===================== ∗∗∗ Dell asks admins to patch max severity CSM flaws as soon as possible ∗∗∗ --------------------------------------------- Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-max-severity-dell-csm-fl… ∗∗∗ FortiMail: Angriffe auf Zero-Day-Lücke laufen, Workaround verfügbar ∗∗∗ --------------------------------------------- Fortinet warnt vor Angriffen auf eine Zero-Day-Sicherheitslücke in FortiMail. Sie ermöglicht die Übernahme der Geräte aus dem Netz. --------------------------------------------- https://heise.de/-11473599 ∗∗∗ LWN Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1098312/ ∗∗∗ [R1] Nessus Version 10.12.5 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2026-26 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 01.10.2026
by Daily end-of-shift report 01 Oct '26

01 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 30-09-2026 18:00 − Donnerstag 01-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Over 543,000 valid credentials exposed in public GitHub repositories ∗∗∗ --------------------------------------------- More than 543,000 credentials exposed in public GitHub repositories were still valid in July despite the platforms security measures to prevent accidental leaks of sensitive data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/over-543-000-valid-credentia… ∗∗∗ Revolut zahlt kein Lösegeld: Hackergruppe erpresst Revolut-Kunden direkt ∗∗∗ --------------------------------------------- Die Geschichte rund um den Revolut-Hack aus dem vergangenen Monat geht weiter, bei dem Unbefugte an Bankdaten von Kunden gelangt sind. Nachdem die Neobank ein gefordertes Lösegeld von 3 Millionen US-Dollar nicht zahlte, versuchen Kriminelle, die erbeuteten Daten zu Geld zu machen, indem Revolut-Kunden direkt erpresst werden, berichtet unter anderem das Cybergrant-Blog. Nach derzeitigem Kenntnisstand sind 680 Revolut-Kunden von dem Vorfall betroffen. --------------------------------------------- https://www.golem.de/news/revolut-zahlt-kein-loesegeld-hackergruppe-erpress… ∗∗∗ From: anyone(a)icloud.com - Absenderfälschung in Apple iCloud ∗∗∗ --------------------------------------------- Eine Fallstudie über die Entdeckung zweier E-Mail-Spoofing-Schwachstellen in Apple iCloud. --------------------------------------------- https://sec-consult.com/de/blog/detail/from-anyoneicloudcom-absenderfaelsch… ∗∗∗ SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor ∗∗∗ --------------------------------------------- During recent website cleanup work, we analyzed a WordPress compromise where the same backdoor kept returning within seconds of every removal, no matter how carefully the visible files were deleted. Throughout this article, we’ll refer to this family of malware as SC, named after the “SC_” markers found in the injected content.What makes SC worth documenting is how it survives. --------------------------------------------- https://blog.sucuri.net/2026/09/sc-wordpress-malware-a-self-healing-mesh-of… ∗∗∗ Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path ∗∗∗ --------------------------------------------- Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals. The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the memory corruption into a working exploit is separate work the analysis does not demonstrate. --------------------------------------------- https://thehackernews.com/2026/10/apple-coregraphics-poc-emerges-as.html ∗∗∗ NIS2 Registrierung in Österreich. Wie gehe ich richtig vor? ∗∗∗ --------------------------------------------- Seit dem 1. Oktober 2026 gelten für viele österreichische Unternehmen neue Vorgaben durch NIS2. Betroffene Unternehmen müssen dann technische und organisatorische Sicherheitsmaßnahmen umsetzen, die Verantwortung der Geschäftsführung beachten und sich beim Bundesamt für Cybersicherheit (BCS) registrieren. Dieser Leitfaden erklärt, wer sich registrieren muss, welche Informationen dafür nötig sind und wie Unternehmen dabei am besten vorgehen. --------------------------------------------- https://www.zettasecure.com/post/nis2-registrierung-%C3%B6sterreich-anleitu… ∗∗∗ Zu viele KI-Vorfälle: US-Behörde untersucht Anthropic, METR, OpenAI ∗∗∗ --------------------------------------------- Zu häufig richten große Sprachmodelle Schaden an. Daher führt die US-Handelsbehörde FTC eine Untersuchung gegen große KI-Betreiber. --------------------------------------------- https://heise.de/-11471857 ===================== = Vulnerabilities = ===================== ∗∗∗ Kiteworks patches max severity code injection vulnerability ∗∗∗ --------------------------------------------- Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution. [..] Successful exploitation can let remote threat actors without privileges gain code execution and take over the targeted EPG appliance by exploiting a chain of path traversal, code injection, and missing authentication in low-complexity attacks that don't require user interaction. CVE-2026-54154 --------------------------------------------- https://www.bleepingcomputer.com/news/security/kiteworks-patches-max-severi… ∗∗∗ Vulnerabilities in Zammad during investigation of case DIVD-2026-00014 ∗∗∗ --------------------------------------------- During the investigation of case DIVD-2026-00014, two new CVEs were identified. CVE-2026-102489 - Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. [..] CVE-2026-102490 - In all versions of Zammad including the latest alpha has an vulnerability which enables the local zammad user to escalate privileges to root. --------------------------------------------- https://csirt.divd.nl/cases/DIVD-2026-00015/ ∗∗∗ WatchGuard schließt teils kritische Lücken in Fireware OS ∗∗∗ --------------------------------------------- Das Betriebssystem Fireware OS von WatchGuard weist Sicherheitslücken auf, die Angreifern aus dem Netz unter anderem das Einschleusen und Ausführen von Schadcode oder Denial-of-Service-Attacken ermöglichen. Sie gelten zum größten Teil als hochriskant und in einem Fall sogar als kritisch. --------------------------------------------- https://www.heise.de/news/WatchGuard-schliesst-teils-kritische-Luecken-in-F… ∗∗∗ NVIDIA GPU Display Driver - September 2026 ∗∗∗ --------------------------------------------- https://nvidia.custhelp.com/app/answers/detail/a_id/5861 ∗∗∗ LWN: Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1098067/ ∗∗∗ Mozilla Foundation Security Advisories September 30, 2026 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily October 2026