Daily September 2026

daily@lists.cert.at

1 participants
22 discussions

Tageszusammenfassung - 02.09.2026
by Daily end-of-shift report 02 Sep '26

02 Sep '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 01-09-2026 18:00 − Mittwoch 02-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Hackers abuse Faronics Deploy admin tool to install ScreenConnect ∗∗∗ --------------------------------------------- Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deplo… ∗∗∗ Bei Sandboxing-Tests: KI-Agent bricht mehrfach aus VM aus ∗∗∗ --------------------------------------------- Ein Forscher hat getestet, ob sich moderne KI-Modelle mit Virtualisierung sinnvoll isolieren lassen. Die KI ist mehrfach aus einer VM entkommen. [..] Der Forscher hatte die KI zwar explizit dazu angewiesen aus der VM auszubrechen, jedoch sind entsprechende Ausbrüche auch in anderen Situationen denkbar. [..] Zudem rät Dinaburg, für die Virtualisierung auf minimalistische Lösungen umzusteigen, die eine geringere Angriffsfläche bieten. --------------------------------------------- https://www.golem.de/news/bei-sandboxing-tests-ki-agent-bricht-mehrfach-aus… ∗∗∗ Counterfeit installers to system compromise: Tracking a deceptive software download campaign ∗∗∗ --------------------------------------------- Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users. Microsoft has observed victims across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-instal… ∗∗∗ Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials ∗∗∗ --------------------------------------------- Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution. The vulnerability in question is CVE-2026-9586 (CVSS score: 9.3), a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997) that can allow attackers to remotely execute arbitrary code as the PostgreSQL superuser without credentials. Sangoma released patches for the flaw in Switchvox 8.4.0.2 on July 14, 2026. --------------------------------------------- https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html ∗∗∗ OpenAI Is About to Release Its First AI Model With ‘Critical’ Cyber Abilities ∗∗∗ --------------------------------------------- The company will give select partners early access to its Astra AI model—so they have time to shore up their defenses. --------------------------------------------- https://www.wired.com/story/openai-astra-first-ai-model-with-critical-cyber… ∗∗∗ Fremde Dropbox-Konten über Lenovo-ID zugänglich ∗∗∗ --------------------------------------------- Eine erstaunliche Sicherheitslücke ist Inhabern von rund 5.000 Dropbox-Konten zum Verhängnis geworden, die auf die Einrichtung von Zwei-Faktor-Authentifizierung (2FA) verzichtet hatten: Unbefugte haben sich mittels frisch angelegter Lenovo-Konten Zugriff verschafft. --------------------------------------------- https://www.heise.de/news/Fremde-Dropbox-Konten-ueber-Lenovo-ID-zugaenglich… ∗∗∗ The Vulnpocalypse Is Repricing the Bug Bounty Economy ∗∗∗ --------------------------------------------- The shape of the market may be changing, but there's no indication that the bug bounty as we know it is going away. Of the dozen executives, security experts and researchers Dark Reading spoke to, not one believed that the vulnpocalypse was an existential crisis for independent security research. It would challenge the ecosystem, reshape it, and could perhaps act as a reckoning for those companies that release insecure software, but this moment would be more akin to a storm that will pass. --------------------------------------------- https://www.darkreading.com/vulnerabilities-threats/vulnpocalypse-repricing… ∗∗∗ Passkeys erklärt: wie sicher die Anmeldung ohne Passwort ist ∗∗∗ --------------------------------------------- Immer öfter erscheint beim Anmelden auf einer Website ein Fenster mit der Frage, ob Sie einen Passkey erstellen möchten. Viele klicken es weg, weil sie nicht wissen, was das eigentlich ist. Dahinter steckt eine Technologie, die das Potenzial hat, das Anmelden im Internet grundlegend sicherer zu machen. --------------------------------------------- https:\/\/www.zettasecure.com\/post\/sind-passkeys-sicher ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücken in SonicWall SMA1000 Series - aktiv ausgenutzt - Updates verfügbar ∗∗∗ --------------------------------------------- In SonicWalls SMA1000 Series Appliances existieren zwei schwerwiegende Sicherheitslücken. Die schwerwiegendere der beiden Schwachstellen ermöglicht es Angreifer:innen aus der Ferne und ohne Authentifizierung, die Appliance dazu zu bringen, serverseitig Anfragen an eigentlich nicht erreichbare interne Endpunkte zu senden (Server-Side Request Forgery). Laut SonicWall PSIRT werden die in diesem Advisory beschriebenen Schwachstellen bereits aktiv ausgenutzt. CVE-2026-83548, CVE-2026-83549 --------------------------------------------- https://www.cert.at/de/warnungen/2026/9/erneut-kritische-sicherheitslucken-… ∗∗∗ Plex: Important Security Update for Plex Media Server v1.43.2 and earlier ∗∗∗ --------------------------------------------- We recently released Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to address a number of security issues. We recommend all server owners and Desktop users update to the latest version as soon as possible. CVEs have been requested and we’ll reply to this thread with more details once they’re published. --------------------------------------------- https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1… ∗∗∗ LWN: Security updates for Wednesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1092149/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 01.09.2026
by Daily end-of-shift report 01 Sep '26

01 Sep '26

===================== = End-of-Day report = ===================== Timeframe: Montag 31-08-2026 18:00 − Dienstag 01-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Hackers push malicious Virtualizor update in BGP hijacking attack ∗∗∗ --------------------------------------------- Hackers delivered malicious updates to the Virtualizor VPS management software after hijacking BGP routing for its update infrastructure and redirecting update requests to malicious servers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-push-malicious-virtu… ∗∗∗ The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st) ∗∗∗ --------------------------------------------- One of my internet-exposed inference honeypots was discovered, relabeled with sought-after model names, and incorporated into infrastructure apparently used to provide "free" LLM backends. It then received a real coding-agent session — history, filesystem output, working paths, and the agent's local tool manifest. The honeypot did not request or cause any tool execution; what the request exposed is what a malicious operator in that position could do. --------------------------------------------- https://isc.sans.edu/diary/rss/33298 ∗∗∗ Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity ∗∗∗ --------------------------------------------- Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck.The vulnerabilities in question are listed below - CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user. --------------------------------------------- https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.h… ∗∗∗ OpenClaw 2.0 pours glitter on slow-burning security dumpster fire ∗∗∗ --------------------------------------------- OpenClaw has unveiled what its makers call its largest ever update – large enough to earn a 2.0 moniker – with usability taking center stage, along with some security updates that critics are suggesting will be insufficient. --------------------------------------------- https://www.theregister.com/ai-and-ml/2026/08/31/openclaw-20-pours-glitter-… ∗∗∗ Password spraying campaign targets AWS root user accounts across 150+ organizations ∗∗∗ --------------------------------------------- Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations. --------------------------------------------- https://securitylabs.datadoghq.com/articles/aws-root-user-bruteforce-campai… ∗∗∗ 13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds ∗∗∗ --------------------------------------------- Socket’s Threat Research Team found 13 malicious Composer theme packages on Packagist, published across five vendor namespaces, that inject JavaScript into every page of the Vietnamese movie and comic streaming sites that install them. The injected code runs two operations against a site’s visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware. --------------------------------------------- https://socket.dev/blog/packagist-themes-ios-spyware ∗∗∗ EncryptedSharedPreferences is Dead: Here’s What You Should Use Instead ∗∗∗ --------------------------------------------- In this post we’ll explore why persisting data to disk introduces unnecessary risk, dissect the mechanics of storage systems on Android, and provide you with proven methods to safeguard your application data. Furthermore, we’ll cover common misconceptions and misunderstandings with a focus on Android, including Google’s current stance that unencrypted internal app storage is not a concern due to reliance on OS protections such as device encryption and sandboxing, alongside recommended alternatives such as Jetpack DataStore coupled with Google Tink for encryption. --------------------------------------------- https://blog.includesecurity.com/2026/08/encryptedsharedpreferences-is-dead… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates für Hoymiles-Wechselrichter (30.8. 2026) ∗∗∗ --------------------------------------------- Im Juli 2026 hatte der Chaos Computer Club (CCC) vor gravierenden Schwachstellen im DTU-Protokoll des Herstellers Hoymiles gewarnt. Nun hat der Anbieter Firmware-Updates für verschiedene Modelle bereitgestellt, die die Schwachstellen schließen. --------------------------------------------- https://borncity.com/blog/2026/09/01/sicherheitsupdates-fuer-hoymiles-wechs… ∗∗∗ VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/456290 ∗∗∗ Mozilla Security Advisories September 1, 2026 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/ ∗∗∗ LWN: Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1091919/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily September 2026