Daily September 2026

daily@lists.cert.at

1 participants
22 discussions

Tageszusammenfassung - 30.09.2026
by Daily end-of-shift report 30 Sep '26

30 Sep '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 29-09-2026 18:00 − Mittwoch 30-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ New Spectre v2 attack variant leaks Linux root password hash in minutes ∗∗∗ --------------------------------------------- A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-spectre-v2-attack-varian… ∗∗∗ Phishing Abuses RMM Tools for Persistent Access ∗∗∗ --------------------------------------------- In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management (RMM) installer through meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. [..] This activity highlights how threat actors continue to abuse legitimate remote administration software to blend into normal IT operations while maintaining persistent access and reducing detection opportunities. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rm… ∗∗∗ Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services ∗∗∗ --------------------------------------------- The public still doesn’t know who is abusing a critical Citrix vulnerability exploited as a zero-day weeks before disclosure, but we now know that the unknown digital intruders have used CVE-2026-88772 to break into government agencies, financial services firms, education organizations, and legal and professional services sectors across North America and Europe. And everyone agrees that the vendor took way too long to disclose the security holes. --------------------------------------------- https://www.theregister.com/security/2026/09/29/custom-malware-used-in-citr… ∗∗∗ Hackers Use Hijacked University Emails to Scam Students, Pose as FBI Agent ∗∗∗ --------------------------------------------- Students, job seekers and university staff, watch out for fake job offers sent from legitimate university email accounts. --------------------------------------------- https://hackread.com/hackers-hijacked-university-email-scam-students-fbi-ag… ∗∗∗ Fake Express Packages on npm Spread a Linux Worm ∗∗∗ --------------------------------------------- Nine npm packages hide a self-spreading Linux worm. The npm account dirtyblanket published all nine on September 29, 2026, in 33 minutes. Eight of them copy the popular Express framework. One copies React. --------------------------------------------- https://safedep.io/dirtyblanket-express-impersonation-npm ∗∗∗ CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode ∗∗∗ --------------------------------------------- Jamf Threat Labs uncovers CloudSyncD, a fake Zoom installer disguised as a legitimate application that uses a phished login password to launch an embedded backdoor while concealing the credential inside a decoy configuration file. --------------------------------------------- https://www.jamf.com/blog/cloudsyncd-macos-backdoor-fake-zoom-installer/ ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. [..] In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. CVE-2026-76504 --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ TeamViewer: Security Update for Multiple Vulnerabilities in TeamViewer Clients and Related Services ∗∗∗ --------------------------------------------- TeamViewer has released security updates addressing multiple vulnerabilities affecting TeamViewer Full Client and Host and related services. These vulnerabilities have been resolved in the latest available versions. TeamViewer strongly recommends that all users update to the latest available version as soon as possible. --------------------------------------------- https://www.teamviewer.com/en-us/resources/trust-center/security-bulletins/… ∗∗∗ MikroTik RouterOS ∗∗∗ --------------------------------------------- Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. [..] Initial Release Date: 2026-09-29 [..] CVE-2026-84411 --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06 ∗∗∗ Kritische Schwachstelle: Google stopft 32 Löcher in Chrome ∗∗∗ --------------------------------------------- Die kritische Lücke mit der Kennung CVE-2026-102331 beschreibt Google in den Versionshinweisen als Pufferüberlauf. Betroffen ist die Grafikkomponente Angle. Laut CVE.org kann der Fehler mithilfe einer speziell präparierten HTML-Datei ausgenutzt werden. Ein Angreifer müsste ein Opfer also lediglich dazu verleiten, eine von ihm kontrollierte Website mit Chrome zu öffnen. --------------------------------------------- https://www.golem.de/news/kritische-schwachstelle-google-stopft-32-loecher-… ∗∗∗ OpenSSL Security Advisory [29th September 2026] ∗∗∗ --------------------------------------------- https://openssl-library.org/news/secadv/20260929.txt ∗∗∗ LWN: Security updates for Wednesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1097753/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 29.09.2026
by Daily end-of-shift report 29 Sep '26

29 Sep '26

===================== = End-of-Day report = ===================== Timeframe: Montag 28-09-2026 18:00 − Dienstag 29-09-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Cyberangriff auf Datenaustauschdienst FTAPI ∗∗∗ --------------------------------------------- Der Münchner Anbieter FTAPI bietet Dienste zur einfachen Übertragung von Daten an. Zur Kundschaft zählen etwa Behörden und Unternehmen. Die kriminelle Online-Bande The Gentlemen hat nun auf ihrer Darknet-Leaksite einen Einbruch in die IT-Systeme von FTAPI behauptet. --------------------------------------------- https://heise.de/-11469629 ∗∗∗ Over 16,000 Supabase databases expose PII, passwords, auth tokens ∗∗∗ --------------------------------------------- Researchers found more than 16,000 misconfigured Supabase databases exposing readable tables with personally identifiable information, passwords, or authentication tokens. --------------------------------------------- https://www.bleepingcomputer.com/news/security/misconfigured-supabase-apps-… ∗∗∗ Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks ∗∗∗ --------------------------------------------- Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis. --------------------------------------------- https://thehackernews.com/2026/09/hackers-use-needymantis-to-maintain.html ∗∗∗ ShinyHunters weiter aktiv, Details zu FBI-Datendiebstahl ∗∗∗ --------------------------------------------- Offenbar hat die Cybergang ShinyHunters wirklich beim FBI Daten gestohlen. Die kriminelle Bande ist derzeit weiter umtriebig. --------------------------------------------- https://www.heise.de/news/ShinyHunters-weiter-aktiv-Details-zu-FBI-Datendie… ∗∗∗ Digitale Gesundheitsanwendungen: HelloBetter meldet Datenpanne nach Cyberangriff ∗∗∗ --------------------------------------------- Aufgrund einer Schwachstelle konnten Unbekannte auf sensible Nutzerdaten eines Anbieters digitaler Therapieprogramme zugreifen. --------------------------------------------- https://heise.de/-11469296 ===================== = Vulnerabilities = ===================== ∗∗∗ Apple patches CoreGraphics zero-day flaw exploited in attacks ∗∗∗ --------------------------------------------- Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices. --------------------------------------------- https://www.bleepingcomputer.com/news/security/apple-patches-coregraphics-z… ∗∗∗ Zero-Day-Lücke: Kiteworks rät Kunden zur Abschaltung von Servern ∗∗∗ --------------------------------------------- Der Softwareanbieter Kiteworks hat seinen Kunden Ende vergangener Woche empfohlen, ihre auf Software des Unternehmens basierenden Systeme offline zu nehmen. Zuvor hatte der Anbieter von Sicherheitsanwendungen eine nach seiner Einschätzung "glaubwürdige Bedrohungsinformation" von US-Sicherheitsbehörden erhalten. Demnach bestand ein konkretes Risiko für Cyberangriffe auf Kiteworks-Nutzer. --------------------------------------------- https://www.golem.de/news/zero-day-luecke-kiteworks-raet-kunden-zur-abschal… ∗∗∗ Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials ∗∗∗ --------------------------------------------- A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real service, the SDK's maintainers said in a security advisory. Affected versions sent the client secret, the authorization code, and the PKCE proof key to a token endpoint the attacker controlled. The fix is in versions 1.30.0 and 2.2.0. --------------------------------------------- https://thehackernews.com/2026/09/official-mcp-python-sdk-flaw-can-let.html ∗∗∗ Groupware Zimbra: Update schließt zahlreiche Sicherheitslücken ∗∗∗ --------------------------------------------- Ein Update schließt diverse Lücken in Zimbra, die etwa die Kontoübernahme oder das Unterschieben von Schadcode ermöglichen. --------------------------------------------- https://www.heise.de/news/Groupware-Zimbra-Update-schliesst-zahlreiche-Sich… ∗∗∗ WatchGuard AP: Befehlsschmuggel-Lücken und umgehbare Authentifizierung ∗∗∗ --------------------------------------------- In den Access-Points von WatchGuard schlummern drei Sicherheitslücken, durch die Angreifer Befehle einschmuggeln oder die Authentifizierung umgehen können. Eine aktualisierte Firmware bessert die teils als kritisches Risiko eingestuften Schwachstellen aus. --------------------------------------------- https://heise.de/-11468944 ∗∗∗ LWN Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1097466/ ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 ∗∗∗ --------------------------------------------- https://webkitgtk.org/security/WSA-2026-0006.html ∗∗∗ MISP 2.5.48 - AImageddon security roundup release ∗∗∗ --------------------------------------------- https://github.com/MISP/MISP/releases/tag/v2.5.48 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 28.09.2026
by Daily end-of-shift report 28 Sep '26

28 Sep '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 25-09-2026 18:00 − Montag 28-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Wegen KI Bug Reports: Ubuntu liefert wöchentlich neuen Kernel ∗∗∗ --------------------------------------------- KI treibt die Anzahl gemeldeter Bugs in die Höhe. Damit Ubuntu-Nutzer Korrekturen schnell bekommen, beschleunigt Canonical seine Prozesse. --------------------------------------------- https://www.golem.de/news/wegen-ki-bug-reports-ubuntu-liefert-woechentlich-… ∗∗∗ Studie zu KI-Agenten: Wenn die KI ihre Abschaltung als Mordversuch sabotiert ∗∗∗ --------------------------------------------- Nicht alle KI-Systeme wollen sich einfach wie ein PC herunterfahren lassen. Vor allem, wenn mehrere KI-Agenten kollaborieren sollen. [..] Konkret beobachteten die Forscher in dem Setting sechs Tendenzen der Systeme. Demnach nimmt die Sabotage mit der Irreversibilität des Abschaltmechanismus und der Zahl der beteiligten Agenten zu. Ein explizites Verbot reduziert die Sabotageversuche, eliminiert sie jedoch nicht. [..] Ebenfalls bemerkenswert: Wenn ein KI-Agent einen anderen Agenten abschalten sollte, der diesem nicht bekannt war, sank die Sabotagerate ebenfalls. --------------------------------------------- https://www.golem.de/news/studie-zu-ki-agenten-wenn-die-ki-ihre-abschaltung… ∗∗∗ Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells ∗∗∗ --------------------------------------------- Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution. --------------------------------------------- https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.h… ∗∗∗ Fake Google Security Team ad says no script reading in voice phishing - then prints the script ∗∗∗ --------------------------------------------- Yes, criminals have job listings too. A Telegram user recruiting callers to work in an apparent Google Security Team voice-phishing scam told applicants that they weren’t allowed to read from scripts – in the same ad that also included the exact script they had to read during these scam calls. --------------------------------------------- https://www.theregister.com/security/2026/09/25/fake-google-security-team-a… ∗∗∗ OpenAI pausiert KI-Training nach neuem Zwischenfall ∗∗∗ --------------------------------------------- Der ChatGPT-Entwickler OpenAI hat nach einem neuen Zwischenfall das Training seiner leistungsstärksten KI-Modelle ausgesetzt. Bei dem Vorfall schaffte es ein KI-Modell in einem Test, Antworten von einem externen Chatbot zu bekommen, obwohl es eigentlich keinen Internet-Zugang haben sollte. Die Software habe jedoch eine Lücke in den Netzwerk-Einstellungen gefunden und ausgenutzt, wie OpenAI in einem Blogeintrag berichtete. Das Training solle nun erst wieder aufgenommen werden, wenn man sich sicher sei, dass die Lücke geschlossen ist. --------------------------------------------- https://www.heise.de/news/OpenAI-pausiert-KI-Training-nach-neuem-Zwischenfa… ∗∗∗ Kurtaxe und Servicepauschale: Angebliche Doppelbuchung führt in Phishing-Falle ∗∗∗ --------------------------------------------- Rückbuchungen von der ÖGK oder dem Finanzamt werden seit gefühlten Ewigkeiten als Köder für Betrugsmaschen eingesetzt. Kürzlich wurde eine andere Variante der Falle gemeldet. Im Zentrum stehen diesmal ein Hotel sowie eine doppelte Berechnung von Kurtaxe und Servicepauschale. Am Ziel hat sich nichts geändert: Angestrebt werden der Zugriff auf das Onlinebanking des Opfers sowie die Freigabe einer Überweisung. --------------------------------------------- https://www.watchlist-internet.at/news/kurtaxe-und-servicepauschale-doppelb… ∗∗∗ KI-Betrug bei italienischer Großbank: 95 Mio Euro erbeutet ∗∗∗ --------------------------------------------- Der Betrug begann im Februar. Der damalige Fideuram-Vorsitzende Paolo Molesini erhielt über WhatsApp eine Nachricht, die scheinbar vom Chef von Intesa Sanpaolo, Carlo Messina, stammte. Darin wurde er um dringende Unterstützung bei einer Auslandsüberweisung gebeten. Kurz darauf folgte ein Anruf, der angeblich von einem ranghohen Mitarbeiter einer bekannten Anwaltskanzlei kam. Der Anrufer bestätigte den Auftrag. Nach Angaben der Quellen setzten die Täter dabei künstliche Intelligenz ein, um die Stimme des Anwalts nachzuahmen. --------------------------------------------- https://www.derstandard.at/story/3000000341451/ki-betrug-bei-italienischer-… ∗∗∗ Tech Support Scam Kit Uses Google Ads to Deliver Fake Security Alerts ∗∗∗ --------------------------------------------- A tech support scam kit is using Google Ads to deliver fake security alerts that make browsers appear locked while using techniques to evade automated analysis. [..] The ads appeared through normal advertising inventory on legitimate maps, weather, real-estate, document-hosting, and sports sites. It is worth noting that the publishers were not compromised. Netskope traced most of the traffic to paid Google Ads rather than organic searches, based on Google advertising identifiers found in the URLs. --------------------------------------------- https://hackread.com/tech-support-scam-kit-google-ads-fake-security-alerts/ ∗∗∗ LuaRocks Security Incident September 2026 ∗∗∗ --------------------------------------------- On September 25th, 2026 we received a report of a remote code execution vulnerability in LuaRocks.org, coordinated through CISA. The vulnerability was fixed on September 26th. While investigating, we found that it had been exploited on the LuaRocks.org server several times between July 9th and August 20th, 2026. [..] We have not found any evidence that existing packages were modified. Details on what we checked are below. --------------------------------------------- https://luarocks.org/security-incident-september-2026 ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücken in Citrix NetScaler ADC und NetScaler Gateway - aktiv ausgenutzt - Updates verfügbar ∗∗∗ --------------------------------------------- In Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt. CVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778 CVSS v4.0 Base Scores: bis zu 9.5 (kritisch) --------------------------------------------- https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citr… ∗∗∗ Elementor WordPress flaw lets attackers create admin accounts ∗∗∗ --------------------------------------------- Threat actors can exploit the flaw by tricking a logged-in administrator into opening a malicious link, causing the victim's authenticated session to perform a REST API action permitted by their account. On default installations, the result is the creation of an administrator account under the control of the attacker. [..] Security firm Patchstack reported the vulnerability to the Elementor team on September 22 after receiving it from bug hunter “Saggre.” Elementor released a fix two days later, in version 4.3.2 of the plugin. --------------------------------------------- https://www.bleepingcomputer.com/news/security/elementor-wordpress-flaw-let… ∗∗∗ Notepad++ 8.9.8.1: Update schließt mehrere Sicherheitslücken ∗∗∗ --------------------------------------------- Das Zwischen-Release 8.9.8.1 kümmert sich dabei um gleich fünf Schwachstellen. Immerhin gilt keine davon als hohes oder kritisches Risiko. Nutzer sollten die Aktualisierung bei Gelegenheit anwenden. --------------------------------------------- https://www.heise.de/news/Notepad-8-9-8-1-Update-schliesst-mehrere-Sicherhe… ∗∗∗ LWN: Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1097191/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 25.09.2026
by Daily end-of-shift report 25 Sep '26

25 Sep '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 24-09-2026 18:00 − Freitag 25-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ CRA - Reporting: The first two weeks ∗∗∗ --------------------------------------------- The CRA-SRP (Single Reporting Platform) started operating two weeks ago, and we now have some experience with the system. There are multiple angles to this. --------------------------------------------- https://www.cert.at/en/blog/2026/9/cra-reporting-the-first-two-weeks ∗∗∗ Phishing-Angriffe mit echten Hotel-Buchungsdaten ∗∗∗ --------------------------------------------- Über eine Schwachstelle bei HotelNetSolutions wurden Buchungsdaten von Hotelgästen abgegriffen. Kriminelle nutzen sie für glaubhafte Phishing-Nachrichten. --------------------------------------------- https://heise.de/-11466446 ∗∗∗ Betreiber Kritischer Infrastruktur sollen in Österreich Flugdrohnen abschießen ∗∗∗ --------------------------------------------- Nähern sich verdächtige Flugdrohnen Kritischer Infrastruktur, soll deren Betreiber die Drohnen vom Himmel holen. Lizenzen dafür sind in Österreich geplant. --------------------------------------------- https://heise.de/-11465199 ∗∗∗ Bevorstehender Zero-Day-Angriff: KiteWorks drängt Kunden zur Serverabschaltung ∗∗∗ --------------------------------------------- Man habe konkrete Hinweise von Strafverfolgern auf eine Attacke, schreibt der Hersteller seinen Kunden. Auch hierzulande sind große Unternehmen betroffen. --------------------------------------------- https://www.heise.de/news/Bevorstehender-Zero-Day-Angriff-KiteWorks-draengt… ∗∗∗ New Carbonato malware uses AI agents to hijack exposed Docker hosts ∗∗∗ --------------------------------------------- A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-a… ∗∗∗ MacSync malware uses public iCloud calendars to deliver new payloads ∗∗∗ --------------------------------------------- A new variant of the MacSync info-stealing malware targeting macOS systems now uses public iCloud calendar events to deliver fresh payloads. --------------------------------------------- https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-… ∗∗∗ Muse leakt Systemdateien: Metas KI-Agent gibt auf Anfrage sein Dateisystem aus ∗∗∗ --------------------------------------------- Ein Entwickler hat Metas KI-Agent Muse 6,8 GByte an Daten aus seiner Betriebsumgebung entlockt. Laut Meta ist das ein erwartetes Verhalten. --------------------------------------------- https://www.golem.de/news/muse-leakt-systemdateien-metas-ki-agent-gibt-auf-… ∗∗∗ Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments ∗∗∗ --------------------------------------------- Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to help defenders detect and disrupt this activity before ransomware deployment.The post Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments appeared first on Microsoft Security Blog. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-… ∗∗∗ Cloudflare Fixes Flaw That Let One Container Read Another Customers Leftover Disk Data ∗∗∗ --------------------------------------------- A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday. --------------------------------------------- https://thehackernews.com/2026/09/cloudflare-fixes-flaw-that-let-one.html ∗∗∗ CVE flood pushes Ubuntu onto weekly kernel release cycle ∗∗∗ --------------------------------------------- AI-assisted bug hunting is helping pile up vulnerabilities faster than defenders can patch them, so Canonical is picking up the pace. --------------------------------------------- https://www.theregister.com/os-platforms/2026/09/24/cve-flood-pushes-ubuntu… ∗∗∗ Decades-old file security flaws found in Android, Linux, macOS, and Windows ∗∗∗ --------------------------------------------- Security researchers report that Microsoft considers the side-channel leak of file events to be by design. --------------------------------------------- https://www.theregister.com/security/2026/09/24/decades-old-file-security-f… ∗∗∗ Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing ∗∗∗ --------------------------------------------- SalesBleed security flaws lead to very unexpected consequences. --------------------------------------------- https://www.theregister.com/security/2026/09/24/salesforce-agentforce-vulns… ∗∗∗ It was a matter of when, not if... ∗∗∗ --------------------------------------------- Security people always say it’s not a matter of if, but when you get hacked. It took us (almost) seven years but we can now say that we’re the hackers that got hacked. We noticed suspicious activity, investigated, and came to the inevitable conclusion that damn, we got hacked. --------------------------------------------- https://csirt.divd.nl/2026/09/24/when-not-if/ ∗∗∗ Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud ∗∗∗ --------------------------------------------- Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud. --------------------------------------------- https://socket.dev/blog/mini-shai-hulud-actions?utm_medium=feed ===================== = Vulnerabilities = ===================== ∗∗∗ VU#234131: ViewSonic vCast media streaming service allows unauthenticated screen exfiltration and device compromise ∗∗∗ --------------------------------------------- ViewSonic vCast software, which is included in ViewBoard smartboard devices, contains multiple vulnerabilities that an attacker can chained to achieve full device compromise. --------------------------------------------- https://kb.cert.org/vuls/id/234131 ∗∗∗ Sicherheitslücken: GitLab-Server mit Schadcode attackierbar ∗∗∗ --------------------------------------------- Die GitLab-Entwickler raten zur zügigen Installation der jüngst veröffentlichten Sicherheitsupdates. --------------------------------------------- https://www.heise.de/news/Sicherheitsluecken-GitLab-Server-mit-Schadcode-at… ∗∗∗ Video-Tool VLC: Version 3.0.24 stopft über 130 Sicherheitslecks ∗∗∗ --------------------------------------------- Der Videoplayer VLC ist in Version 3.0.24 erschienen. Mehr als 130 Sicherheitslücken soll das Release schließen. --------------------------------------------- https://heise.de/-11465305 ∗∗∗ LWN Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1096637/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 24.09.2026
by Daily end-of-shift report 24 Sep '26

24 Sep '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 23-09-2026 18:00 − Donnerstag 24-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Theres a new way to break RSA thats faster than anything weve seen before ∗∗∗ --------------------------------------------- The world has known for decades that the RSA cryptosystem’s days are numbered. Once quantum computing becomes practical (estimates for that range from 3 to 20 or more years), the foundational security it provides will crumble. New research has revealed a novel method that uses classical computing to reduce the current RSA security level to an unacceptably low threshold. The practical risk is limited, but still significant. --------------------------------------------- https://arstechnica.com/security/2026/09/theres-a-new-way-to-break-rsa-that… ∗∗∗ Hackers now exploit critical Roundcube flaw in code injection attacks ∗∗∗ --------------------------------------------- In May, the Roundcube security team patched the flaw (tracked as CVE-2026-48842), describing it as a pre-authenticated SQL injection in the virtuser_query built-in plugin, which handles database-driven user lookups and maps users to email addresses. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-roundcube-flaw-now-… ∗∗∗ A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You ∗∗∗ --------------------------------------------- The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you. GitLab shows each user this address behind a button labeled "Email work item to this project." Mail sent to it opens an issue in that project, authored by you. --------------------------------------------- https://thehackernews.com/2026/09/a-leaked-gitlab-issue-email-address.html ∗∗∗ Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure ∗∗∗ --------------------------------------------- Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure.The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE). --------------------------------------------- https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html ∗∗∗ OpenAI-Agent knackt australisches Regierungsportal ∗∗∗ --------------------------------------------- Eine KI sollte Gesundheitsstatistiken suchen – und knackte dabei ein australisches Regierungsportal. Die Empörung ist groß. --------------------------------------------- https://heise.de/-11463920 ∗∗∗ Bypassing EDR with Local AI ∗∗∗ --------------------------------------------- How hard is it to bypass EDR in the modern times with AI? As it turns out, not very hard. --------------------------------------------- https://projectblack.io/blog/bypassing-edr-with-local-ai/ ===================== = Vulnerabilities = ===================== ∗∗∗ Foxit: Security updates available in Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1/14.0.8 ∗∗∗ --------------------------------------------- Foxit has released Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1/14.0.8, which addresses potential security and stability issues. --------------------------------------------- https://www.foxit.com/support/security-bulletins.html ∗∗∗ Drupal Security Advisories 2026-September-23 ∗∗∗ --------------------------------------------- Drupal released 36 new security advisories (5x critical). --------------------------------------------- https://www.drupal.org/security ∗∗∗ Sicherheitspatch gegen Schadcode repariert SolarWinds Observability Self-Hosted ∗∗∗ --------------------------------------------- In SolarWinds Observability Self-Hosted 2026.2.3 haben die Entwickler eigenen Angaben zufolge zwei Schwachstellen geschlossen (CVE-2026-28324 „kritisch“ CVE-2026-28325, „hoch“). In beiden Fällen können Angreifer unter den jeweils genannten Bedingungen ohne Authentifizierung an den Schwachstellen ansetzen und Schadcode ausführen – bei CVE-2026-28324 übers Netz, bei CVE-2026-28325 nur aus einem benachbarten Netzsegment. Die Ursachen unterscheiden sich jedoch: Bei CVE-2026-28324 sind Integritätsprüfungen unzureichend; CVE-2026-28325 betrifft die Verarbeitung nicht vertrauenswürdiger Daten durch Deserialisierung. Hinweise auf laufende Attacken gibt es bislang nicht. --------------------------------------------- https://heise.de/-11464112 ∗∗∗ Imprivata Enterprise Access Management (EAM) does not rotate RSA keys ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/273940 ∗∗∗ LWN: Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1096407/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 23.09.2026
by Daily end-of-shift report 23 Sep '26

23 Sep '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 22-09-2026 18:00 − Mittwoch 23-09-2026 18:00 Handler: Guenes Holler Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ab 1.10: Meldepflicht für IT-Vorfälle in Österreich ∗∗∗ --------------------------------------------- Die NIS-2-Richtlinie beschert Österreich Registrierungspflichten für Unternehmen und Behörden. Diese erhalten Zuwachs: Das neue Bundesamt für Cybersicherheit. --------------------------------------------- https://www.heise.de/news/Ab-1-10-Meldepflicht-fuer-IT-Vorfaelle-in-Oesterr… ∗∗∗ Gefälschter FinanzOnline-Mail: 3.612 Euro Steuererstattung versprochen ∗∗∗ --------------------------------------------- Mit einer neuen Variante des bekannten FinanzOnline-Phishings versuchen Kriminelle derzeit, an Bankdaten von Österreicher:innen zu gelangen. In einer gefälschten E-Mail wird eine Steuererstattung von 3.612 Euro versprochen. --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschter-finanzonline-mail/ ∗∗∗ Hacker dringen in Systeme von Fresenius Medical Care ein ∗∗∗ --------------------------------------------- Medizinische Geräte, Patientenversorgung, Produktion und laufender Geschäftsbetrieb sollen laut Konzern nicht beeinträchtigt sein. --------------------------------------------- https://www.derstandard.at/story/3000000340976/hacker-dringen-in-systeme-vo… ∗∗∗ Microsoft: September Windows updates break Always On VPN connections ∗∗∗ --------------------------------------------- Microsoft has notified IT administrators that users may experience Always On VPN connection issues after installing the September 2026 Windows 11 security updates. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-wi… ∗∗∗ Absturzgefahr: Exploit lässt Angreifer DJI-Drohnen mitten im Flug kapern ∗∗∗ --------------------------------------------- Mehrere Drohnenmodelle des Herstellers DJI sind anfällig für eine gefährliche Sicherheitslücke, die eine vollständige Kontrollübernahme ermöglicht. Nutzer sollten nach korrigierten Firmware-Versionen Ausschau halten. --------------------------------------------- https://www.golem.de/news/per-bluetooth-exploit-laesst-angreifer-dji-drohne… ∗∗∗ Macfinger ClickFix campaign, (Tue, Sep 22nd) ∗∗∗ --------------------------------------------- I've found several legitimate websites with injected script for a campaign using the ClickFix social engineering technique. This particular ClickFix campaign was documented earlier this month on the Ransom-ISAC Blog, but it doesn't appear to have a nickname yet. Since this campaign is targeting macOS environments through a fingerprinting process, I'm calling it the "Macfinger ClickFix" campaign. No, this is not related to the MacFinger utility from decades ago. Instead, think of the movie Goldfinger, but with macOS malware and the internet instead of James Bond and Miss Galore. --------------------------------------------- https://isc.sans.edu/diary/rss/33360 ∗∗∗ Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape ∗∗∗ --------------------------------------------- A use-after-free in the Linux kernels AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm DepthFirst said in research published September 22.The flaw, tracked as CVE-2026-80521 (CVSS score: 7.8), was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases. --------------------------------------------- https://thehackernews.com/2026/09/exploit-released-for-unpatched-ubuntu.html ∗∗∗ Recent Increase of Hybrid Attacks Against Defense Sector in Europe ∗∗∗ --------------------------------------------- Recently, a wave of sabotage attacks has been reported in Europe. In most cases Russia is suspected to be responsible. These events follow a broader pattern of hybrid activity directed at European infrastructure, logistics networks, and organizations supporting Ukraine. --------------------------------------------- https://www.truesec.com/hub/blog/recent-increase-of-hybrid-attacks-against-… ∗∗∗ Iranian Cyber Espionage Campaign ∗∗∗ --------------------------------------------- An Iranian threat actor is conducting a cyber espionage campaign targeting Iranian nationals abroad. The attacker reaches out to the victim on various messaging apps, like Telegram or Whatsapp. The actor often claims to be an individual previously known to the target or technical support from the social messaging platform. --------------------------------------------- https://www.truesec.com/hub/blog/iranian-cyber-espionage-campaign ===================== = Vulnerabilities = ===================== ∗∗∗ Cyberangriffe auf F5 BIG-IP, Check Point Security und Arista VeloCloud ∗∗∗ --------------------------------------------- IT-Verantwortliche müssen rasch handeln, um bereitgestellte Aktualisierungen zu installieren. Mehrere IT-Sicherheitsbehörden warnen vor derzeit laufenden Angriffen auf Sicherheitslücken in F5 BIG-IP, Check Point Security Gateway und Management sowie Arista VeloCloud Orchestrator On-Premise. --------------------------------------------- https://heise.de/-11462590 ∗∗∗ Patchday: Adobe Connect ist unter Android, macOS und Windows verwundbar ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für verschiedene Adobe-Anwendungen erschienen. --------------------------------------------- https://heise.de/-11462802 ∗∗∗ NetBSD 10.2 stopft einige Sicherheitslücken ∗∗∗ --------------------------------------------- NetBSD ist jüngst als Point-Release 10.2 erschienen. Die Entwickler schließen damit einige Sicherheitslücken. --------------------------------------------- https://heise.de/-11463028 ∗∗∗ Gleich noch ein Sicherheitsupdate für WordPress ∗∗∗ --------------------------------------------- Angreifer können WordPress dazu bringen, nicht vorgesehene .php-Dateien aufzurufen. Das kann zur Ausführung von Code führen. --------------------------------------------- https://heise.de/-11462385 ∗∗∗ Ubiquiti schließt Denial-of-Service-Lücken in Firewalls und Gateways ∗∗∗ --------------------------------------------- In UniFi-Firewalls und -Gateways klaffen hochriskante Denial-of-Service-Lücken. Aktualisierte Firmware stopft die Lecks. --------------------------------------------- https://heise.de/-11463176 ∗∗∗ LWN Security updates for Wednesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1096191/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 22.09.2026
by Daily end-of-shift report 22 Sep '26

22 Sep '26

===================== = End-of-Day report = ===================== Timeframe: Montag 21-09-2026 18:00 − Dienstag 22-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ "Bundesamt für Cybersicherheit" geht mit Oktober an den Start ∗∗∗ --------------------------------------------- Leiter Markus Kasinger war zuvor bei Austrian Power Grid. Zu den Aufgaben gehört die Weiterentwicklung der nationalen Cybersicherheitsstrategie. --------------------------------------------- https://www.derstandard.at/story/3000000340881/bundesamt-fuer-cybersicherhe… ∗∗∗ New Windows Defender zero-day blocks Microsoft antivirus updates ∗∗∗ --------------------------------------------- Over the weekend, security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released another Microsoft Defender zero-day exploit that blocks antivirus updates. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-windows-defender-zero-da… ∗∗∗ Politik: EU-Kommission will Europol-Datenbefugnisse ausweiten ∗∗∗ --------------------------------------------- Ein Verordnungsentwurf sieht den Abbau von Schutzmechanismen bei Europol vor, um KI-Systeme anlasslos mit Daten zu speisen. --------------------------------------------- https://www.golem.de/news/politik-eu-kommission-will-europol-datenbefugniss… ∗∗∗ Smart-TVs: Youtuber entfernt WLAN-Modul aus neuem LG-TV ∗∗∗ --------------------------------------------- Nach Berichten über Spionagefunktionen entfernt ein Youtuber Hardwarekomponenten aus seinem LG OLED G6. Der Fernseher funktioniert weiterhin. --------------------------------------------- https://www.golem.de/news/smart-tvs-youtuber-entfernt-wlan-modul-aus-neuem-… ∗∗∗ Unmasking EvilTokens: Getting to the root of device code phishing ∗∗∗ --------------------------------------------- EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption of EvilTokens infrastructure and operations.The post Unmasking EvilTokens: Getting to the root of device code phishing appeared first on Microsoft Security Blog. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltoke… ∗∗∗ Microsoft wirft SMS-basierte Authentifizierung aus Entra ID raus ∗∗∗ --------------------------------------------- Microsofts Identitätsverwaltung und Login-Lösung Entra ID erlaubt die Authentifizierung mit SMS. Das soll bald ein Ende haben. --------------------------------------------- https://heise.de/-11461055 ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates: Click2Shell-Lücke zum Kompromittieren von WordPress-Websites ∗∗∗ --------------------------------------------- Aufgrund mehrerer Sicherheitslücken raten die WordPress-Entwickler zu einem zügigen Update. Bislang gibt es keine Hinweise auf Attacken. --------------------------------------------- https://heise.de/-11460973 ∗∗∗ Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access ∗∗∗ --------------------------------------------- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating system (OS) command execution. --------------------------------------------- https://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.html ∗∗∗ D-Link warns of max severity zero-day bug in DIR-822A routers ∗∗∗ --------------------------------------------- D-Link warned customers of a maximum-severity vulnerability (CVE-2026-86296) with public proof-of-concept (PoC) exploit code and no patch, affecting legacy DIR-822A dual-band Wi-Fi routers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/d-link-warns-of-max-severity… ∗∗∗ New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups ∗∗∗ --------------------------------------------- Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22. The flaw, tracked as CVE-2026-93952, may allow a remote attacker with no login access to privilege internal functions and affect the VCO host. Only orchestrators set up to authenticate their Edges with certificates are exposed. As of September 22, fixed releases are out for the 5.2 and 6.4 release trains, but not yet for the 6.1 and 7.0 trains. Arista has already patched the Hosted and Dedicated versions of VCO. The affected releases include those that fixed a different VCO flaw, which Arista reported as exploited in July. --------------------------------------------- https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html ∗∗∗ LWN Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1096022/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 21.09.2026
by Daily end-of-shift report 21 Sep '26

21 Sep '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 18-09-2026 18:00 − Montag 21-09-2026 18:00 Handler: Guenes Holler Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Cyberangriff trifft Universität: LMU München bestätigt Abfluss von Studentendaten ∗∗∗ --------------------------------------------- Ein Angreifer ist an persönliche Daten von Studenten der Ludwig-Maximilians-Universität München gelangt. Auch Bankdaten sollen betroffen sein. --------------------------------------------- https://www.golem.de/news/cyberangriff-trifft-universitaet-lmu-muenchen-bes… ∗∗∗ Hackerangriff auf die GUTcert; Kundendaten abgeflossen ∗∗∗ --------------------------------------------- Unschöne Nachricht für Kunden, die sich über die GUTcert einer Zertifizierung unterzogen haben. Der Anbieter ist Opfer eines Hackerangriffs geworden, bei dem auch Kundendaten abgeflossen sind. Betroffene scheinen vom Unternehmen gerade informiert zu werden, wie ein Leser mir heute mitteilte. --------------------------------------------- https://borncity.com/blog/2026/09/20/hackerangriff-auf-die-gutcert-kundenda… ∗∗∗ Gyazo server flaw exploited to steal 23.6 million user records ∗∗∗ --------------------------------------------- The Gyazo image-sharing platform has confirmed it suffered a data breach after hackers exploited a server vulnerability that allowed them to steal 23.6 million user records. --------------------------------------------- https://www.bleepingcomputer.com/news/security/gyazo-server-flaw-exploited-… ∗∗∗ ShinyHunters hacks Clop leak site, threatens to extort ransomware gang ∗∗∗ --------------------------------------------- The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operations data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service. --------------------------------------------- https://www.bleepingcomputer.com/news/security/shinyhunters-hacks-clop-leak… ∗∗∗ North Korean WaterPlum hackers infected 30,000 devices worldwide ∗∗∗ --------------------------------------------- A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to North Korea. --------------------------------------------- https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hacke… ∗∗∗ Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO ∗∗∗ --------------------------------------------- Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects. --------------------------------------------- https://securelist.com/tr/payload-ransomware-via-group-policy/121335/ ∗∗∗ CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories ∗∗∗ --------------------------------------------- An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. --------------------------------------------- https://thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html ∗∗∗ TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts. --------------------------------------------- https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html ∗∗∗ Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation ∗∗∗ --------------------------------------------- GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We detail a few of the more notable intrusions we observed including the theft of more than 18,000 sensitive records from a western government. --------------------------------------------- https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-gover… ∗∗∗ EU prüft OpenAI nach nicht gemeldetem Sicherheitsvorfall ∗∗∗ --------------------------------------------- Nach einem Vorfall beim Software-Register RubyGems meldete OpenAI diesen nicht der EU. Die europäischen Behörden prüfen nun die Einhaltung des AI Acts. --------------------------------------------- https://heise.de/-11458971 ∗∗∗ Cisco Zero-Day Highlights API Endpoint Authentication Issues ∗∗∗ --------------------------------------------- The authentication bypass flaw CVE-2026-76460 impacts Ciscos Identity Services Engine (ISE) and received a maximum 10 out of 10 CVSS score. --------------------------------------------- https://www.darkreading.com/vulnerabilities-threats/cisco-zero-day-api-endp… ===================== = Vulnerabilities = ===================== ∗∗∗ Behörde warnt: Angriffe auf Lücken im Linux-Kernel beobachtet ∗∗∗ --------------------------------------------- Die Cisa warnt vor laufenden Angriffen auf Linux-Systeme über drei gefährliche Sicherheitslücken in Kernel-Komponenten. Korrekturen sind verfügbar. --------------------------------------------- https://www.golem.de/news/behoerde-warnt-angriffe-auf-luecken-im-linux-kern… ∗∗∗ Synology warnt: Kritische NAS-Lücken ermöglichen Datenklau ∗∗∗ --------------------------------------------- Angreifer können durch mehrere Sicherheitslücken lesend und schreibend auf NAS-Geräte von Synology zugreifen. Patches sind verfügbar. --------------------------------------------- https://www.golem.de/news/synology-warnt-kritische-nas-luecken-ermoeglichen… ∗∗∗ Werbeblocker Pi-hole: Update stopft Codeschmuggel-Lücken ∗∗∗ --------------------------------------------- Ein Update für den DNS-basierten Werbeblocker Pi-hole schließt teils hochriskante Codeschmuggel-Lücken. --------------------------------------------- https://www.heise.de/news/Werbeblocker-Pi-hole-Update-stopft-Codeschmuggel-… ∗∗∗ Fremdzugriffe auf SolarWinds Access Rights Manager vorstellbar ∗∗∗ --------------------------------------------- Ein Sicherheitspatch schließt eine Schwachstelle in SolarWinds Access Rights Manager. Bislang gibt es keine Hinweise auf Attacken. --------------------------------------------- https://heise.de/-11459978 ∗∗∗ LWN Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1095702/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 18.09.2026
by Daily end-of-shift report 18 Sep '26

18 Sep '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 17-09-2026 18:00 − Freitag 18-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Schockanrufe: Wenn Angst und Zeitdruck zur Falle werden ∗∗∗ --------------------------------------------- In einer bundesweiten Kampagne informiert das Bundeskriminalamt gemeinsam mit Partnerorganisationen über die zunehmende Gefahr sogenannter Schockanrufe. Dabei werden nicht nur die Methoden organisierter Tätergruppen näher beleuchtet, zusätzlich gibt es auch Tipps, wie Sie Schockanrufe frühzeitig erkennen und richtig reagieren. Ziel der Kampagne ist es, insbesondere ältere Menschen sowie deren Angehörige für die Methoden organisierter Tätergruppen zu sensibilisieren. --------------------------------------------- https://www.watchlist-internet.at/news/schockanrufe/ ∗∗∗ New RatHat Android malware uses AI to automate device control ∗∗∗ --------------------------------------------- A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-u… ∗∗∗ Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer ∗∗∗ --------------------------------------------- An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-lastpass-authenticator-… ∗∗∗ Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files ∗∗∗ --------------------------------------------- Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15. --------------------------------------------- https://thehackernews.com/2026/09/critical-docker-sandboxes-flaw-lets.html ∗∗∗ Researchers find way to listen in on headphones from afar ∗∗∗ --------------------------------------------- Eves dropping in on Alice and Bob --------------------------------------------- https://www.theregister.com/security/2026/09/17/researchers-find-way-to-lis… ∗∗∗ Supply-Chain-Angriff: Quellcode von CrowdSec durch Unbekannte ausgeleitet ∗∗∗ --------------------------------------------- Vor vier Monaten gelangten über dreihundert Repositories in fremde Hände. Doch die Auswirkungen des Angriff von Mai schätzt der WAF-Hersteller als gering ein. --------------------------------------------- https://www.heise.de/news/Supply-Chain-Angriff-Quellcode-von-CrowdSec-durch… ∗∗∗ Nordkoreanische Cybergruppe bestiehlt IT-Fachleute auf Jobsuche ∗∗∗ --------------------------------------------- Sicherheitsbehörden warnen vor einer Cybergruppe aus Nordkorea, die gezielt IT-Spezialisten angreift. Was hinter der Kampagne „Contagious Interview“ steckt. --------------------------------------------- https://heise.de/-11458275 ∗∗∗ Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation ∗∗∗ --------------------------------------------- Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry that could be exploited to achieve privilege escalation. No customer action is required. --------------------------------------------- https://thehackernews.com/2026/09/microsoft-patches-cvss-100-azure-ai.html ===================== = Vulnerabilities = ===================== ∗∗∗ Root-Sicherheitslücke gefährdet Check Point Security Management and Log Servers ∗∗∗ --------------------------------------------- Ein Sicherheitsupdate schließt eine kritische Schadcode-Schwachstelle in Check Point Security Management and Log Servers. --------------------------------------------- https://www.heise.de/news/Root-Sicherheitsluecke-gefaehrdet-Check-Point-Sec… ∗∗∗ Jetzt aktualisieren: Angreifer konnten beliebige Daten von Synology-NAS auslesen ∗∗∗ --------------------------------------------- Gleich auf drei verschiedenen Wegen konnten Angreifer Daten von Synology-NAS klauen. Der Hersteller behebt mit einem Flicken auch weniger dringende Lücken. --------------------------------------------- https://www.heise.de/news/Jetzt-aktualisieren-Angreifer-konnten-beliebige-D… ∗∗∗ 100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS ∗∗∗ --------------------------------------------- Wordfence Argus discovered a PHP Object Injection vulnerability in Tutor LMS, affecting more than 100,000 WordPress sites. Subscriber-level attackers could achieve remote code execution. Update to version 4.0.8 as soon as possible. --------------------------------------------- https://www.wordfence.com/blog/2026/09/100000-wordpress-sites-exposed-to-re… ∗∗∗ Atlassian: Angreifer können Confluence Data Center ausspionieren ∗∗∗ --------------------------------------------- Atlassian hat zahlreiche Sicherheitslücken in Bitbucket, Jira & Co. geschlossen. Admins sollten die verfügbaren Sicherheitspatches zeitnah installieren. --------------------------------------------- https://heise.de/-11458267 ∗∗∗ LWN Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1095219/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 17.09.2026
by Daily end-of-shift report 17 Sep '26

17 Sep '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 16-09-2026 18:00 − Donnerstag 17-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Fake-Webseiten: Kriminelle kopieren den Online-Auftritt echter Hotels ∗∗∗ --------------------------------------------- Die Absicht ist klar, die momentane Häufung hingegen ein wenig ungewöhnlich. In den letzten Wochen wurden besonders viele Fake-Webseiten gemeldet, die gezielt den Onlineauftritt von (Familien-)Hotels kopieren. Kriminelle wollen damit vorrangig an Kontaktdaten ihrer Opfer gelangen. --------------------------------------------- https://www.watchlist-internet.at/news/fake-webseiten-echte-hotels/ ∗∗∗ Cisco warns of max severity ISE zero-day exploited in attacks ∗∗∗ --------------------------------------------- The security flaw (tracked as CVE-2026-76460) lets remote attackers bypass authentication by exploiting a weakness in an API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) regardless of configuration. [..] Cisco shared indicators of compromise and advised security teams to look for suspicious usernames in access.log files on every node and "strongly" recommended re-imaging the nodes and restoring them from backups if malicious activity is suspected. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-serv… ∗∗∗ EU Plans ‘Article 4’-Style Security Protocol for Cyberattacks and Hybrid Threats ∗∗∗ --------------------------------------------- European Commission President Ursula von der Leyen has proposed an Emergency Security Protocol that would allow any European Union member state to trigger a coordinated response to security incidents including cyberattacks, sabotage and drone incursions. [..] Under the proposed Emergency Security Protocol, a single member state could trigger the mechanism, prompting all 27 EU governments to convene. The proposed framework would be designed to coordinate a European response, deter further escalation and mitigate the consequences of an incident. --------------------------------------------- https://thecyberexpress.com/eu-emergency-security-protocol-targets-threats/ ∗∗∗ OpenAI führt Framework zur Meldung von KI-Sicherheitsvorfällen ein ∗∗∗ --------------------------------------------- OpenAI will dem Fehlverhalten seiner eigenen KI-Modelle systematischer auf den Grund gehen. Hierzu wurde jetzt ein neues Framework vorgestellt, das solche Fälle systematisch verfolgen, untersuchen und offenlegen soll. Bislang hatte das US-Unternehmen solche Sicherheitsvorfälle nur auf Ad-hoc-Basis bekanntgegeben. Im dazugehörigen Blogpost bekräftigt OpenAI zugleich Forderungen nach einer Verlangsamung der KI-Weiterentwicklung, wie sie zuletzt auch vom Rivalen Anthropic erhoben wurden, um den Sicherheitsrisiken Rechnung zu tragen, die aus den Fortschritten in der KI erwachsen. --------------------------------------------- https://www.heise.de/news/OpenAI-fuehrt-Framework-zur-Meldung-von-KI-Sicher… ∗∗∗ The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents ∗∗∗ --------------------------------------------- During our analysis of malware that leverages blockchain networks for its C2 infrastructure, we have discovered a previously unknown modular, multi-stage framework that we dubbed MovieReaper. This report details the new crimeware campaign that began with the mass infection of users via compromised torrent tracker file storage. [..] Further analysis of the attack revealed that the threat actors did not compromise the torrent trackers themselves. Instead, they compromised a widely used public repository of torrent files — itorrents[.]org. --------------------------------------------- https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/ ∗∗∗ Revolut phishing texts appear days after data breach ∗∗∗ --------------------------------------------- Revolut customers received phishing texts only days after the digital bank acknowledged disclosing customer data to a government impostor. --------------------------------------------- https://www.malwarebytes.com/blog/threat-intel/2026/09/revolut-phishing-tex… ∗∗∗ Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilins AI use ∗∗∗ --------------------------------------------- In Japan, The Gentlemen was the most active ransomware group in the first half of 2026. Attackers continue to primarily target small- and medium-sized enterprises, with organizations capitalized at less than JPY 1 billion accounting for approximately 80% of the total — an increase of around 13% from the previous year. --------------------------------------------- https://blog.talosintelligence.com/ransomware-incidents-in-japan-in-the-fir… ∗∗∗ GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk ∗∗∗ --------------------------------------------- GitHub has added cache-mode to GitHub Actions, a new setting that limits how workflows and jobs can access the Actions cache. It targets cache poisoning, the technique attackers used to compromise the Ultralytics PyPI package in 2024 and the TanStack npm packages in May 2026. --------------------------------------------- https://socket.dev/blog/github-actions-cache-mode ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone ∗∗∗ --------------------------------------------- Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. CVE-2026-81642 --------------------------------------------- https://thehackernews.com/2026/09/critical-unbound-dnssec-validator-flaw.ht… ∗∗∗ BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS ∗∗∗ --------------------------------------------- The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH). A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG(0) signature, if the sender closes the connection before named finishes checking the signature. --------------------------------------------- https://thehackernews.com/2026/09/bind-9-update-fixes-14-flaws-including.ht… ∗∗∗ Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-core-2026-013 ∗∗∗ Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-005 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-core-2022-005 ∗∗∗ LWN: Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1094962/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily September 2026