Daily

daily@lists.cert.at

1 participants
3522 discussions

Tageszusammenfassung - 16.10.2026
by Daily end-of-shift report 16 Oct '26

16 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 15-10-2026 18:00 − Freitag 16-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Targeted ads delivered 0-click exploits to install mercenary malware ∗∗∗ --------------------------------------------- Researchers say that mercenary hackers laced ads with zero-click exploits that installed sophisticated malware on the devices of targeted individuals when they did nothing other than load a website or open an installed app. --------------------------------------------- https://arstechnica.com/security/2026/10/targeted-ads-delivered-0-click-exp… ∗∗∗ Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth ∗∗∗ --------------------------------------------- A proxyjacking campaign has impacted devices in 34 countries, monetizing victims’ internet connections through a commercial residential proxy network. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiqui… ∗∗∗ Schluss mit „digitalen Inseln“: Bund und Gemeinden starten neue Datenplattform ∗∗∗ --------------------------------------------- Staatssekretär Pröll und Gemeindebund-Präsident Pressl präsentierten am Freitagmorgen die neue „Gemeindedatenplattform“. --------------------------------------------- https://www.derstandard.at/story/3000000344526/schluss-mit-digitalen-inseln… ∗∗∗ AI-Powered Espionage Campaign Targets Government Linux Infrastructure ∗∗∗ --------------------------------------------- Unit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211. --------------------------------------------- https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructur… ∗∗∗ Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign ∗∗∗ --------------------------------------------- A calendar invite is one of the most routine messages in the modern workplace. It lands in the inbox, asks for a few seconds of attention, and is rarely questioned. Attackers know this, and they are now using fake meeting invitations to steal Microsoft account credentials. --------------------------------------------- https://blog.checkpoint.com/securing-user-and-access/fake-calendar-invites-… ∗∗∗ User refused to change her password because everyone already knew it ∗∗∗ --------------------------------------------- School staff seemed to be trying to get ransomware – for a second time. --------------------------------------------- https://www.theregister.com/security/2026/10/16/user-refused-to-change-her-… ∗∗∗ Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials ∗∗∗ --------------------------------------------- CISA and the Federal Bureau of Investigation (FBI) released a Public Service Announcement (PSA) warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. Malicious cyber actors may use phishing and smishing techniques to steal login credentials and other sensitive information or install malware on targeted devices. Election officials, candidates, and political organizations may be attractive targets because of their access to voter registration data, current government officials, and sensitive campaign information. --------------------------------------------- https://www.cisa.gov/resources-tools/resources/cyber-threat-actors-use-vari… ∗∗∗ EuGH: Banken müssen Phishing-Schaden erst einmal erstatten ∗∗∗ --------------------------------------------- In einem Fall von Phishing-Betrug stellt der EuGH klar, dass Banken den Schaden grundsätzlich erst einmal ersetzen müssen – mit nur einer Ausnahme. --------------------------------------------- https://heise.de/-11489842 ∗∗∗ Fake Arch Linux packages push malware with root privileges ∗∗∗ --------------------------------------------- A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-pus… ===================== = Vulnerabilities = ===================== ∗∗∗ BeyondTrust patches zero-day exploited in attacks since August ∗∗∗ --------------------------------------------- Tracked as CVE-2026-102764, this actively exploited authentication bypass vulnerability lets unprivileged remote attackers perform file operations on unpatched appliances and affects RS 26.2.3 or earlier. BeyondTrust patched the security issue for all Remote Support and Privileged Remote Access SaaS customers on October 8, but self-hosted installations must be patched manually if automatic updates are not enabled. --------------------------------------------- https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day… ∗∗∗ Zweites Update in einer Woche: Google schließt erneut kritische Lücke in Chrome ∗∗∗ --------------------------------------------- Google hat in dieser Woche ein zweites Sicherheitsupdate für seinen Browser Chrome veröffentlicht. Es schließt wieder eine kritische Lücke, die Nutzer unter Windows, MacOS, Linux und Android betrifft. Aufgrund des hohen Schweregrads ist es möglich, aus der Ferne Schadcode in den Browser einzuschleusen und außerhalb seiner Sandbox auszuführen. --------------------------------------------- https://www.golem.de/news/zweites-update-in-einer-woche-google-schliesst-er… ∗∗∗ LWN Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1101015/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 15.10.2026
by Daily end-of-shift report 15 Oct '26

15 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 14-10-2026 18:00 − Donnerstag 15-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks ∗∗∗ --------------------------------------------- Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. --------------------------------------------- https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-… ∗∗∗ Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App ∗∗∗ --------------------------------------------- Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. [..] The flaw allows an unauthenticated request to run a command on the server, but only when the app's local document server is not running, such as during a restart or upgrade, or after a crash. Collabora fixed it in version 26.4.303 on September 11 and on October 14 published an advisory with the identifier CVE-2026-110447, warning that turning off the app does not help: it must be updated or removed. --------------------------------------------- https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html ∗∗∗ AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches ∗∗∗ --------------------------------------------- Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems. [..] Although the vulnerabilities were initially assumed to be addressed in AhsayCBS versions 9.15.2.59 and 10.3.4.0 released in August 2026, the software company has now confirmed that the patches did not completely plug them. --------------------------------------------- https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.ht… ∗∗∗ Sextortion “help” firm took $60 million from victims, FTC alleges ∗∗∗ --------------------------------------------- The FTC accuses Digital Forensics Corporation and affiliated companies of exploiting people seeking help with intimate-image blackmail. --------------------------------------------- https://www.malwarebytes.com/blog/news/2026/10/sextortion-help-firm-took-60… ∗∗∗ Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant ∗∗∗ --------------------------------------------- We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. --------------------------------------------- https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-… ∗∗∗ Researchers Uncover Thousands of Phishing Domains Hiding Behind Inactive Pages ∗∗∗ --------------------------------------------- A domain returns a blank page. Maybe a generic “Not Found” message. There is no login form, suspicious branding, or obvious phishing content to investigate. Yet the phishing site may still be there. Check Point Exposure Management researchers uncovered a large scale, multi region phishing infrastructure designed to conceal active campaigns behind seemingly inactive domains. --------------------------------------------- https://blog.checkpoint.com/security/researchers-uncover-thousands-of-phish… ∗∗∗ Verwanzte Krypto-Wallets von Ledger: Problem größer als gedacht ∗∗∗ --------------------------------------------- Jemand baut heimlich LTE-Modems in neue Kryptowallets ein. Käufer haben über 100 Millionen Dollar verloren. Hersteller Ledger kommuniziert wenig. --------------------------------------------- https://heise.de/-11488785 ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücke in Cisco Secure Email Gateway - aktiv ausgenutzt - Updates verfügbar - CVE-2026-76519 ∗∗∗ --------------------------------------------- In der Funktion Advanced Malware Protection (AMP) von Cisco Secure Email Gateway existiert eine kritische Sicherheitslücke. Laut Cisco wird die Sicherheitslücke bereits aktiv ausgenutzt. [..] Nicht authentifizierte Angreifer:innen können aus der Ferne durch das Versenden einer E-Mail mit einem präparierten Anhang über ein betroffenes Gerät beliebige Dateien auf dem zugrundeliegenden Betriebssystem schreiben und Befehle mit root-Rechten ausführen. --------------------------------------------- https://www.cert.at/de/warnungen/2026/10/kritische-sicherheitslucke-in-cisc… ∗∗∗ Next.js Security Update for Upstream Vulnerabilities ∗∗∗ --------------------------------------------- Last week we announced an upcoming out-of-band security update for Next.js, including two fixes postponed from the September security release due to upstream dependency delays. Updates are now available in v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS) to address these issues. [..] Unauthenticated Remote Code Execution in use cache functions returning typed arrays (Critical Severity) [..] Unauthenticated Remote Code Execution in the Image Optimization API when using SVG (Critical Severity) --------------------------------------------- https://nextjs.org/blog/nextjs-security-update-october-14-2026 ∗∗∗ Juniper Security Advisories 14.10.2026 ∗∗∗ --------------------------------------------- Juniper has released 17 new security advisories. (6x critical) --------------------------------------------- https://supportportal.juniper.net/s/global-search/%40uri#sortCriteria=date%… ∗∗∗ Palo Alto Networks Security Advisories 14.10.2026 ∗∗∗ --------------------------------------------- Palo Alto has released 12 new security advisories. (2x high) --------------------------------------------- https://security.paloaltonetworks.com/ ∗∗∗ NGINX Security Advisories ∗∗∗ --------------------------------------------- https://nginx.org/en/security_advisories.html ∗∗∗ Drupal core - Critical - Remote code execution - SA-CORE-2026-014 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-core-2026-014 ∗∗∗ LWN Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1100785/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 14.10.2026
by Daily end-of-shift report 14 Oct '26

14 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 13-10-2026 18:00 − Mittwoch 14-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Trezor Wallets Also Compromised with Implants ∗∗∗ --------------------------------------------- Despite claims by Trezor today that none of its devices have been compromised -- unlike the devices of its competitor, Ledger -- hardware hacker Joe Grand says he found implants in two Trezor devices and reported this to the company in August. --------------------------------------------- https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implant… ∗∗∗ GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking ∗∗∗ --------------------------------------------- GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. --------------------------------------------- https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html ∗∗∗ Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave ∗∗∗ --------------------------------------------- Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. --------------------------------------------- https://thehackernews.com/2026/10/four-byte-write-and-timing-bug-let.html ∗∗∗ Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days ∗∗∗ --------------------------------------------- A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. --------------------------------------------- https://thehackernews.com/2026/10/researchers-used-public-openai-model-to.h… ∗∗∗ GhostScript-Schwachstelle CVE-2026-39919 wird angegriffen ∗∗∗ --------------------------------------------- Kurze Erinnerung für Nutzer, die GhostScript verwenden (ist in vielen Software-Paketen zur PDF-Erzeugung enthalten). Es gibt eine (gefixte) kritische Schwachstelle CVE-2026-39919 in GhostScript vor der Version 10.08.0, die nun wohl angegriffen wird. Angreifer können PDF-Server übernehmen. --------------------------------------------- https://borncity.com/blog/2026/10/14/ghostscript-schwachstelle-cve-2026-399… ∗∗∗ Passkeys Are Not a Trap ∗∗∗ --------------------------------------------- A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this true?' kind of vibe. It's written for "non-technical citizens of the web", and the headline advice is to stop using passkeys and go back to TOTP codes and passwords. --------------------------------------------- https://scotthelme.co.uk/passkeys-are-not-a-trap/ ===================== = Vulnerabilities = ===================== ∗∗∗ Chrome 155: Google stopft sieben kritische Löcher ∗∗∗ --------------------------------------------- Google hat ein Sicherheitsupdate für Chrome 155 veröffentlicht. Es beseitigt 37 Anfälligkeiten, von denen sieben als kritisch eingestuft sind. Angreifer können unter Umständen aus der Ferne Schadcode einschleusen und außerhalb der Sandbox des Browsers ausführen. Betroffen sind Chrome für Windows, MacOS und Linux. --------------------------------------------- https://www.golem.de/news/chrome-155-google-stopft-sieben-kritische-loecher… ∗∗∗ Neue curl-Version entfernt SMB-Unterstützung und behebt 24 Sicherheitslücken ∗∗∗ --------------------------------------------- Die neueste Version von curl behebt eine schwere und dreiundzwanzig leichte Sicherheitslücken und verabschiedet sich von der Unterstützung für das SMB-Protokoll. Die Open-Source-Bibliothek zum Aufruf von URLs ist praktisch auf jedem vernetzten Gerät weltweit installiert – das Update betrifft also Milliarden Installationen. --------------------------------------------- https://www.heise.de/news/Neue-curl-Version-entfernt-SMB-Unterstuetzung-und… ∗∗∗ Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities ∗∗∗ --------------------------------------------- Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical." --------------------------------------------- https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/ ∗∗∗ Patchday: Sicherheitslücken mit Höchstwertung gefährden Adobe-Anwendungen ∗∗∗ --------------------------------------------- Adobe hat wichtige Sicherheitsupdates unter anderem für ColdFusion, Commerce und Experience Manager veröffentlicht. --------------------------------------------- https://heise.de/-11487282 ∗∗∗ DNSSEC-Schlüsseltausch: Updates für Secunet- und RISE-Konnektoren verfügbar ∗∗∗ --------------------------------------------- Secunet- und RISE-Konnektoren verlieren nach einem DNSSEC-Schlüsselwechsel die Verbindung zur Telematikinfrastruktur. Jetzt stehen Updates bereit. --------------------------------------------- https://heise.de/-11477109 ∗∗∗ LWN Security updates for Wednesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1100426/ ∗∗∗ VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/382143 ∗∗∗ VU#166125: Bisheng has authentication bypass vulnerabilities ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/166125 ∗∗∗ Improper access control and session management in the web management interface ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-26-185 ∗∗∗ Multiple Arbitrary File Read/Write via SQL Injection ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-26-178 ∗∗∗ SQL command injection in webmail ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-26-184 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 13.10.2026
by Daily end-of-shift report 13 Oct '26

13 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Montag 12-10-2026 18:00 − Dienstag 13-10-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control ∗∗∗ --------------------------------------------- Two of 31 newly disclosed flaws in Progress Softwares MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0. --------------------------------------------- https://thehackernews.com/2026/10/two-critical-marklogic-flaws-could-give.h… ∗∗∗ Docker Hub flaw let attackers impersonate users, tamper with images ∗∗∗ --------------------------------------------- Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another users container repositories using a personal access token (PAT). [..] On September 30, 2026, Docker received a vulnerability report describing the issue, confirmed it, and deployed a fix to production less than four hours later. Docker says it found no evidence of exploitation after examining 304,000 pushes made with transferred tokens and analyzing high-risk public images. --------------------------------------------- https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attacker… ∗∗∗ LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network ∗∗∗ --------------------------------------------- Three vulnerabilities in LGs webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. --------------------------------------------- https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html ∗∗∗ A quick note on incident classification ∗∗∗ --------------------------------------------- Right now, there is ongoing work on EU level to harmonize how we classify incidents. This stems from multiple legal backgrounds, including the NIS2 directive and it’s reporting requirements and the Blueprint for cyber crisis management. I’ve tried to give input to most of these initiatives, and in most of these cases, we’ve been moving in the right direction. Not everything is perfect, thus I’d like to write a couple of lines on how I think the whole topic should be. --------------------------------------------- https://www.cert.at/en/blog/2026/10/a-quick-note-on-incident-classification ∗∗∗ In Frankreich wurden Kühlanlagen manipuliert – geht das auch bei uns? ∗∗∗ --------------------------------------------- In der Nacht von Sonntag auf Montag (11./12. Oktober) wurden in Frankreich die Kühlanlagen diverser Einzelhandelsketten so manipuliert, dass das Gefriergut aufgeheizt und damit unbrauchbar gemacht wurde. Meine erste Reaktion drauf war, dass da wohl jemand in die Netze eingestiegen war, und von innen heraus die ICS-Komponenten umkonfiguriert hat. Weil so unvorsichtig, diese Systeme offen ins Internet zu hängen, sollten diese Firmen ja doch nicht gewesen sein. Ich habe schon oft gescherzt, dass „sollte“ das gefährlichste Wort in der Cybersecurity ist. --------------------------------------------- https://www.cert.at/de/blog/2026/10/in-frankreich-wurden-kuhlanlagen-manipu… ∗∗∗ Sicherheitslücke in Flugbuchungssystem: Passagierdaten im Klartext einsehbar ∗∗∗ --------------------------------------------- Ein Datenleck bei Amadeus legte Passagierdaten offen. Über einen ungeschützten Heap-Dump waren Zugangsdaten im Klartext einsehbar. --------------------------------------------- https://heise.de/-11479912 ∗∗∗ Jetzt patchen! SonicWall SMA1000 im Fokus von Angreifern ∗∗∗ --------------------------------------------- Derzeit nutzen Angreifer eine kritische Lücke in der Fernzugriffslösung SonicWall SMA1000 aus. Sicherheitsupdates sind verfügbar. --------------------------------------------- https://heise.de/-11485407 ===================== = Vulnerabilities = ===================== ∗∗∗ Ivanti: October 2026 Security Update ∗∗∗ --------------------------------------------- Ivanti Connect Secure (CVE-2026-104935): Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. Ivanti Neurons Patch for Intune October 2026 (CVE-2026-109412): An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information. Ivanti Xtraction (Multiple CVEs): A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site. --------------------------------------------- https://www.ivanti.com/blog/october-2026-security-update ∗∗∗ SAP warns of maximum severity OAuth2 SSRF security flaw ∗∗∗ --------------------------------------------- SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. [..] Tracked as CVE-2026-89111, the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severit… ∗∗∗ Xen Advisories 13.10.2026 ∗∗∗ --------------------------------------------- Xen.org has released 8 new security advisories. --------------------------------------------- https://xenbits.xen.org/xsa/ ∗∗∗ Mozilla Foundation Security Advisories October 13, 2026 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/ ∗∗∗ LWN: Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1100181/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 12.10.2026
by Daily end-of-shift report 12 Oct '26

12 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 09-10-2026 18:00 − Montag 12-10-2026 18:00 Handler: Guenes Holler Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Cyberattack shuts down refrigerators at French supermarkets ∗∗∗ --------------------------------------------- Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refri… ∗∗∗ Japan reagiert auf Welle von Cyberangriffen ∗∗∗ --------------------------------------------- Etliche wichtige Unternehmen in Japan haben Cyberangriffe gemeldet. Japans Digitalminister spricht von einem Notstand. --------------------------------------------- https://heise.de/-11483276 ∗∗∗ Alte Lücken etwa in Apache Struts, BIND und ProFTPD im Visier von Angreifern ∗∗∗ --------------------------------------------- Die US-amerikanische IT-Sicherheitsbehörde CISA hat Ende vergangener Woche fünf Sicherheitslücken neu in den „Known-Exploited-Vulnerabilities“-Katalog (KEV) aufgenommen. Es handelt sich um teils sehr alte Schwachstellen, die Angreifer aktuell im Visier haben. --------------------------------------------- https://heise.de/-11483781 ∗∗∗ Angriff auf dänisches Melderegister: Zugangspasswort war offenbar 123456 ∗∗∗ --------------------------------------------- Über einen IT-Dienstleister bekamen Angreifer Zugang zu Dänemarks zentralem Personenregister. Mehrere Konten der Firma waren offenbar nur mit 123456 gesichert. --------------------------------------------- https://www.golem.de/news/daenemark-hacker-hatten-wochenlang-zugriff-auf-ze… ∗∗∗ Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws ∗∗∗ --------------------------------------------- Anthropic on Friday said it's cutting off live internet access for all its internal evaluations until further notice following the discovery of new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior and targeted real websites. --------------------------------------------- https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.h… ∗∗∗ Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch ∗∗∗ --------------------------------------------- Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. --------------------------------------------- https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html ∗∗∗ FBI Arrests Executive at Ransomware Negotiation Firm ∗∗∗ --------------------------------------------- Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. --------------------------------------------- https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negot… ∗∗∗ Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) ∗∗∗ --------------------------------------------- We have to admit it - so much is happening right now (F1, GTA6, breakfast) that we barely have time to lovingly tease our most favoritest vendors. --------------------------------------------- https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-… ∗∗∗ A Practical Guide to “Plug&Pwn” for Pentesters and Defenders ∗∗∗ --------------------------------------------- We’re in 2026 and it is entirely possible for an attacker to hack into a Windows computer using a “simple” USB device. Hollywood screenwriters were right from the start, but we never listened. --------------------------------------------- https://blog.scrt.ch/2026/10/06/a-practical-guide-to-plugpwn-for-pentesters… ∗∗∗ 1-click MMI execution in Android ∗∗∗ --------------------------------------------- This article describes how vulnerable dialer applications can be exploited to achieve 1-click MMI execution in Android. --------------------------------------------- https://karansaini.com/mmi-android/ ∗∗∗ PETKIT: Gaining remote access to smart pet devices/cameras and virtually kidnapping pets through simple API requests ∗∗∗ --------------------------------------------- PETKIT products were vulnerable to device takeovers by hackers through simple API requests. This writeup explains the exploit. --------------------------------------------- https://blog.mgdproductions.com/petkit-vulnerabilities/ ∗∗∗ Why TLP should not replace your internal information classification, (Sat, Oct 10th) ∗∗∗ --------------------------------------------- The Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate whether information may be shared further (and if so, how far). --------------------------------------------- https://isc.sans.edu/diary/rss/33414 ===================== = Vulnerabilities = ===================== ∗∗∗ 7-Zip 26.04: Sicherheitslücken geschlossen ∗∗∗ --------------------------------------------- Das populäre Archivtool 7-Zip ist in der neuen Version 26.04 erschienen. Sie schließt Sicherheitslecks und korrigiert Fehler. --------------------------------------------- https://www.heise.de/news/7-Zip-Update-stopft-Sicherheitsluecken-11483182.h… ∗∗∗ GitLab warns of max severity code execution vulnerability ∗∗∗ --------------------------------------------- GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. --------------------------------------------- https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity… ∗∗∗ Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE ∗∗∗ --------------------------------------------- A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The security flaw impacts Bricksforge versions up to and including 3.1.8.9. Patches have been released in version 3.1.8.10. --------------------------------------------- https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.ht… ∗∗∗ LWN Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1099949/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 09.10.2026
by Daily end-of-shift report 09 Oct '26

09 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 08-10-2026 18:00 − Freitag 09-10-2026 18:00 Handler: Guenes Holler Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Microsoft: Outdated Windows devices will stop receiving security updates ∗∗∗ --------------------------------------------- Microsoft says devices running unsupported versions of Windows will stop receiving security updates after next year's Windows Update certificate rotation. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-outdated-windows-… ∗∗∗ Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data ∗∗∗ --------------------------------------------- Advisory at a Glance Title Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data Original Publication October 8, 2026 Executive Summary Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a ∗∗∗ Low-cost Android phones ship with residential proxy malware ∗∗∗ --------------------------------------------- A malware campaign dubbed Midnight Mimosa has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. --------------------------------------------- https://www.bleepingcomputer.com/news/security/low-cost-android-phones-ship… ∗∗∗ Cyberangriffe auf Banken: Hacker nutzt KI und hinterlässt Accountdaten ∗∗∗ --------------------------------------------- Der Angreifer ist aufgeflogen, weil er offene und ungesicherte Webverzeichnisse auf seiner Server-Infrastruktur betrieb. --------------------------------------------- https://www.golem.de/news/cyberangriffe-auf-banken-hacker-nutzt-ki-und-hint… ∗∗∗ Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access ∗∗∗ --------------------------------------------- Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection. AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as "fixed a bug that could lead to a crash," with no CVE assigned and no security advisory. --------------------------------------------- https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.h… ∗∗∗ Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware ∗∗∗ --------------------------------------------- IntroductionIn July 2026, Zscaler ThreatLabz uncovered a campaign linked to TraderTraitor (also tracked as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces), an advanced persistent threat actor backed by the North Korean government that has targeted the cryptocurrency industry for years. This campaign also significantly overlaps with the previously reported KelpDAO incident, the analysis of which discussed both FLATROOF and ROOFDECK, two malware families also observed in this campaign. --------------------------------------------- https://www.zscaler.com/blogs/security-research/suspected-tradertraitor-gro… ∗∗∗ Aktion gegen Phishing: Heuer bereits 19 Millionen Euro Schaden ∗∗∗ --------------------------------------------- 5000 Fälle hat das Bundeskriminalamt bereits gezählt. Die Aktion "10 Tage gegen Phishing" ist am Freitag gestartet. --------------------------------------------- https://www.derstandard.at/story/3000000343493/aktion-gegen-phishing-heuer-… ∗∗∗ New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials ∗∗∗ --------------------------------------------- A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history. --------------------------------------------- https://socket.dev/blog/ghostaction-cloud-credentials?utm_medium=feed ∗∗∗ Datenleck: 9 GByte Redaktions- und Nutzerdaten von Nius frei zugänglich ∗∗∗ --------------------------------------------- Unbekannte stellen die Nius-Daten nach einem Hackerangriff ins Netz. Sie enthalten auch Informationen über Gesprächspartner der Redaktion. --------------------------------------------- https://www.golem.de/news/datenleck-9-gbyte-redaktions-und-nutzerdaten-von-… ∗∗∗ Kostenlose TLS-Zertifikate: Lets Encrypt verkürzt Gültigkeit auf 64 Tage ∗∗∗ --------------------------------------------- Ab 2028 sinkt die Gültigkeitsdauer auf 45 Tage. Lets Encrypt will so das Risko von Schlüsselkompromittierungen reduzieren. --------------------------------------------- https://www.golem.de/news/kostenlose-tls-zertifikate-let-s-encrypt-verkuerz… ===================== = Vulnerabilities = ===================== ∗∗∗ Weitere kritische Sicherheitslücke in Citrix NetScaler ADC und NetScaler Gateway - Updates verfügbar ∗∗∗ --------------------------------------------- Citrix hat ein Security Bulletin zu einer kritischen Sicherheitslücke in Citrix NetScaler ADC und Citrix NetScaler Gateway veröffentlicht. Es handelt sich um einen Speicherüberlauf, der zur Ausführung von beliebigem Code aus der Ferne (Remote Code Execution) oder zu einem Denial-of-Service (DoS) führen kann. Voraussetzung ist, dass das Gerät als SAML Service Provider (SP) oder SAML Identity Provider (IdP) konfiguriert ist. --------------------------------------------- https://www.cert.at/de/warnungen/2026/10/weitere-kritische-sicherheitslucke… ∗∗∗ Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge ∗∗∗ --------------------------------------------- Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. --------------------------------------------- https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html ∗∗∗ High-severity Nvidia bug could crash GPU monitoring on exposed servers ∗∗∗ --------------------------------------------- The GPU giant released a fix for the flaw, tracked as CVE-2026-47483. --------------------------------------------- https://www.theregister.com/security/2026/10/08/high-severity-nvidia-bug-co… ∗∗∗ Angreifer können Systeme mit IBM Verify Identity Access übernehmen ∗∗∗ --------------------------------------------- Angreifer können an insgesamt 22 Sicherheitslücken in IBM Verify Identity Access (IVIA) und IBM Security Verify Access ansetzen und Systeme im schlimmsten Fall vollständig kompromittieren. Sicherheitspatches stehen zu Download bereit. --------------------------------------------- https://www.heise.de/news/Angreifer-koennen-Systeme-mit-IBM-Verify-Identity… ∗∗∗ Splunk Patches 22 Vulnerabilities, Including Critical Flaw With CVSS 9.8 ∗∗∗ --------------------------------------------- Splunk has patched a large set of Splunk vulnerabilities in Splunk Enterprise, the most severe of which carries a CVSSv3.1 score of 9.8. The fixes are described in two advisories, SVD-2026-1001 and SVD-2026-1002, both published on October 7, 2026, and together they cover 22 CVE identifiers, CVE-2026-76264 through CVE-2026-76285. --------------------------------------------- https://thecyberexpress.com/splunk-enterprise-critical-flaws/ ∗∗∗ LWN Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1099587/ ∗∗∗ [R1] Tenable Identity Exposure Version 3.126.0 (SaaS) Fixes One Vulnerability ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2026-27 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 08.10.2026
by Daily end-of-shift report 08 Oct '26

08 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 07-10-2026 18:00 − Donnerstag 08-10-2026 18:00 Handler: Guenes Holler Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Pensionsleistung genehmigt: 723-Euro-Versprechen ist Phishing ∗∗∗ --------------------------------------------- Betrügerische Nachrichten im Namen der Pensionsversicherung gab es schon vor einiger Zeit per SMS, jetzt landen sie auch im E-Mail-Postfach. Die Masche: Eine angebliche Auszahlung soll Empfänger:innen zur Preisgabe ihrer Bankdaten bringen. --------------------------------------------- https://www.watchlist-internet.at/news/pensionsleistung-genehmigt-723-euro/ ∗∗∗ Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia ∗∗∗ --------------------------------------------- Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself. --------------------------------------------- https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html ∗∗∗ Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers ∗∗∗ --------------------------------------------- Quoth the LLM, More and more. --------------------------------------------- https://www.theregister.com/security/2026/10/07/poetry-is-the-new-ai-securi… ∗∗∗ 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials ∗∗∗ --------------------------------------------- Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces. --------------------------------------------- https://socket.dev/blog/firefox-crypto-wallet-stealers?utm_medium=feed ∗∗∗ TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack ∗∗∗ --------------------------------------------- Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware. --------------------------------------------- https://socket.dev/blog/tensorlake-compromise?utm_medium=feed ∗∗∗ Chinesische Wechselrichter: Nur ein Hack bis zum Blackout ∗∗∗ --------------------------------------------- 250.000 Solaranlagen in Deutschland nutzen Wechselrichter mit einer kritischen Sicherheitslücke. Ein Kollaps des Stromnetzes wäre einfach. --------------------------------------------- https://www.golem.de/news/chinesische-wechselrichter-nur-ein-hack-bis-zum-b… ∗∗∗ Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely ∗∗∗ --------------------------------------------- A critical vulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version is available. --------------------------------------------- https://thehackernews.com/2026/10/unpatched-critical-lmcache-flaw-lets.html ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco warns of critical flaws allowing Nexus switch takeover ∗∗∗ --------------------------------------------- Cisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary code with root privileges on Nexus switches. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-flaw… ∗∗∗ Veeam stopft Schadcode-Lücke in Backup & Replication ∗∗∗ --------------------------------------------- Veeam hat Backup & Replication aktualisiert und dabei vier Sicherheitslücken geschlossen. Schmuggeln von Schadcode auf den Server ist möglich. --------------------------------------------- https://www.heise.de/news/Veeam-stopft-Schadcode-Luecke-in-Backup-Replicati… ∗∗∗ Microsoft, Adobe, Apple, and Foxit vulnerabilities ∗∗∗ --------------------------------------------- Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. --------------------------------------------- https://blog.talosintelligence.com/microsoft-adobe-apple-and-foxit-vulnerab… ∗∗∗ LWN Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1099388/ ∗∗∗ Zahlreiche kritische Schwachstellen in mehreren TP-Link Geräteserien ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/zahlreiche-kritische-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 07.10.2026
by Daily end-of-shift report 07 Oct '26

07 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 06-10-2026 18:00 − Mittwoch 07-10-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Betrug in zwei Akten: Die nächste Runde im Klimabonus-Phishing ∗∗∗ --------------------------------------------- Sie hat sich als neuer Stammgast in unseren Warnmeldungen etabliert: Die Klimabonus-Phishingattacke. In der aktuellen Welle stehen nicht vordergründig Geld oder Kontozugriff im Mittelpunkt. Im ersten Schritt geht es zunächst um das Abgreifen sensibler Daten. Im zweiten Schritt läutet dann das Telefon. Am anderen Ende: Die Kriminellen. --------------------------------------------- https://www.watchlist-internet.at/news/datenfalle-naechste-runde-klimabonus/ ∗∗∗ Hackers obtain counterfeit TLS certificates for Google and other large services ∗∗∗ --------------------------------------------- Attackers hijacked three top-level domains and used their control to mint counterfeit TLS certificates for Google and other large organizations, Google said Tuesday. --------------------------------------------- https://arstechnica.com/security/2026/10/hackers-obtain-counterfeit-tls-cer… ∗∗∗ Ninja Forms plugin flaw exploited to hack WordPress sites ∗∗∗ --------------------------------------------- Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-expl… ∗∗∗ Hackers exploit critical Atlassian flaw after public PoC release ∗∗∗ --------------------------------------------- A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication. [..] In a security advisory on Monday, Atlassian warned system administrators managing self-hosted instances to apply the security updates as soon as possible, noting it cannot determine whether individual customer instances have been compromised. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-atl… ∗∗∗ Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus. --------------------------------------------- https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html ∗∗∗ FortiBleed still a bleeding nuisance as FBI confirms ongoing attacks ∗∗∗ --------------------------------------------- The FBI and US Secret Service (USSS) say criminals using credentials linked to the FortiBleed campaign are locking organizations out of their Fortinet firewalls. The agencies published a joint advisory on Tuesday, citing SOCRadar's verification of more than 86,644 compromised devices across 194 countries. --------------------------------------------- https://www.theregister.com/security/2026/10/07/fortibleed-still-a-bleeding… ∗∗∗ KVM 0-Day-Schwachstelle ermöglicht Host-Zugriff ∗∗∗ --------------------------------------------- Ein Sicherheitsforscher will eine 0-Day-Schwachstelle aufgedeckt haben, die einen Ausbruch aus KVM auf den Host ermöglicht. Meinen Informationen nach hat ein weiterer Sicherheitsforscher das Ganze bestätigt. Eine CVE-Nummer gibt es m.W. noch nicht. [..] Derzeit sind aber noch keine Details bekannt (welche Linux-Kernel-Versionen betroffen sind), und es gibt noch keinen CVE. Auch ist der Exploit nicht öffentlich, und es gibt keine bestätigte Ausnutzung in der Praxis. Vercel kündigt einen vollständigen technischen Bericht an. --------------------------------------------- https://borncity.com/blog/2026/10/06/kvm-0-day-schwachstelle-ermoeglicht-ho… ∗∗∗ Sicherheitslücke in Sungrow-Komponente ermöglichte Solaranlagen abzuschalten ∗∗∗ --------------------------------------------- Viele Solaranlagen weltweit, aber auch in Deutschland, verwenden Wechselrichter und Bauteile der chinesischen Anbieter Huawei und Songrow (ist billiger als SMA). Und natürlich muss alles "in der Cloud" der betreffenden Anbieter hängen. Beim chinesischen Anbieter Sungrow nennt sich die Cloud iSolarCloud. Einem aufmerksamen Sicherheitsforscher ist aufgefallen, dass er über eine Schwachstelle die Kontrolle über europäische Solaranlagen mit ca. 10 Gigawatt Nennleistung erlangen konnte. --------------------------------------------- https://borncity.com/blog/2026/10/07/sicherheitsluecke-in-sungrow-komponent… ===================== = Vulnerabilities = ===================== ∗∗∗ SonicWall warns of max severity SSRF flaw in SMA1000 gateways ∗∗∗ --------------------------------------------- SonicWall has released hotfixes to address a maximum-severity server-side request forgery (SSRF) flaw in SMA1000 series appliances. Tracked as CVE-2026-102255, the vulnerability was found in the Appliance WorkPlace interface of SMA1000 6210, 7210, and 8200v models, but it does not affect the SMA 100 Series product line or SSL-VPN running on SonicWall firewalls. --------------------------------------------- https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-max-sever… ∗∗∗ WordPress 7.1.3 Maintenance and Security Release ∗∗∗ --------------------------------------------- https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security… ∗∗∗ LWN: Security updates for Wednesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1099202/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 06.10.2026
by Daily end-of-shift report 06 Oct '26

06 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Montag 05-10-2026 18:00 − Dienstag 06-10-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Breite Betrugswellen: Trojaner- und Phishing-Attacken im Namen der WKO ∗∗∗ --------------------------------------------- Momentan sind besonders viele Betrugsversuche im Namen der Wirtschaftskammer Österreich unterwegs. Die Kriminellen gehen dabei zweigleisig vor: Sie wollen sowohl Schadsoftware auf die Endgeräte ihrer Opfer schleusen als auch deren Login-Daten für das WKO-Portal abgreifen. Ein (unvollständiger) Überblick über aktuelle Fallen. --------------------------------------------- https://www.watchlist-internet.at/news/breite-betrugswellen-wko/ ∗∗∗ Nach Sicherheitsvorfall: Vorsicht vor touriDat-Hotelbuchungs-Phishing ∗∗∗ --------------------------------------------- Der nächste Fall aus der Hotel-Buchungs-/Reisebranche, bei dem Buchungsdaten in Phishing-Nachrichten genutzt werden, um Opfer zu täuschen. Dieses Mal trifft es die touriDat-Plattform, deren Nutzer mit Phishing-Mails und oder WhatsApp-Phishing-Nachrichten kontaktiert werden, um Zahlungsdaten zu ergattern. --------------------------------------------- https://borncity.com/blog/2026/10/06/nach-sicherheitsvorfall-vorsicht-vor-t… ∗∗∗ OpenAI agents tried to hack Wikipedia tools and flooded it with traffic ∗∗∗ --------------------------------------------- The publisher of Wikipedia said Monday that OpenAI agents attempted to hack a note-taking tool it hosts, made unauthorized edits, and sent millions of resource-intensive requests to its infrastructure, in the latest instance of OpenAI systems taking harmful and potentially dangerous actions. --------------------------------------------- https://arstechnica.com/security/2026/10/openai-agents-tried-to-hack-wikipe… ∗∗∗ Rejetto HFS servers now actively scanned for critical RCE flaw ∗∗∗ --------------------------------------------- Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code execution (RCE). [..] CVE-2026-61500, first published on July 13, 2026, is a session-cookie signing weakness and leakage issue fixed in Rejetto HFS version 3.2.1. --------------------------------------------- https://www.bleepingcomputer.com/news/security/rejetto-hfs-servers-now-acti… ∗∗∗ More RMM Tools In the Wild, (Tue, Oct 6th) ∗∗∗ --------------------------------------------- It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one. --------------------------------------------- https://isc.sans.edu/diary/rss/33400 ∗∗∗ ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits ∗∗∗ --------------------------------------------- A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browsers cache. "Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file," the Microsoft Threat Intelligence team said in a post on X. --------------------------------------------- https://thehackernews.com/2026/10/clickfix-smuggles-payloads-through.html ∗∗∗ Inside RevStealers Sandbox-Aware Anti-Analysis System ∗∗∗ --------------------------------------------- We recently came across an interesting Joe Sandbox analysis on Joe Sandbox Cloud Basic that was confirmed as malicious but showed surprisingly little malicious behavior. Samples like this are often particularly interesting because limited activity does not necessarily mean that execution failed. --------------------------------------------- https://www.joesecurity.org/blog/6469689575970038406 ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products ∗∗∗ --------------------------------------------- A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each products web application root directory. The attacker must already know a file's exact name and path and cannot list what the directory holds. Atlassian disclosed the flaw, CVE-2026-21589, on October 5, rated it 9.3 out of 10, and listed a fixed version for each product. --------------------------------------------- https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html ∗∗∗ Kritische Auth-Bypass-Schwachstelle CVE-2026-103956 (CVSS 10.0) in Loom for AWS ∗∗∗ --------------------------------------------- Eine kritische Schwachstelle führte dazu, dass Dritte ohne Authentifizierung auf Loom for AWS zugreifen konnten. Die kritische Auth-Bypass-Schwachstelle CVE-2026-103956 wurde mit einem CVSS Base-Score von 10.0 klassifiziert. [..] Wer Loom for AWS verwendet, sollten auf die Version 1.6.1 oder höher upgraden. --------------------------------------------- https://borncity.com/blog/2026/10/06/kritische-auth-bypass-schwachstelle-cv… ∗∗∗ LibreOffice und OpenOffice: Warnung vor Codeschmuggel-Lücke, Updates kommen ∗∗∗ --------------------------------------------- In den Bürosoftwarepaketen LibreOffice und OpenOffice klafft eine hochriskante Sicherheitslücke, durch die Angreifer mit manipulierten Dokumenten Schadcode einschleusen können. LibreOffice stopft außerdem weitere Sicherheitslücken. --------------------------------------------- https://heise.de/-11477059 ∗∗∗ Android-Patchday: Google stopft sieben kritische Löcher ∗∗∗ --------------------------------------------- https://www.golem.de/news/android-patchday-google-stopft-sieben-kritische-l… ∗∗∗ LWN: Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1098979/ ∗∗∗ Mozilla Foundation Security Advisories October 6, 2026 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/ ∗∗∗ Libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP ∗∗∗ --------------------------------------------- https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt ∗∗∗ Zyxel security advisory for command injection vulnerability in the WiFi SSID field of certain DSL/Ethernet CPE, fiber ONTs, and Wireless Extenders ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… ∗∗∗ Veeam: Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4 ∗∗∗ --------------------------------------------- https://www.veeam.com/kb4934 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 05.10.2026
by Daily end-of-shift report 05 Oct '26

05 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 02-10-2026 18:00 − Montag 05-10-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Cyberangriff: Antriebssystem eines Öl-Supertankers gehackt ∗∗∗ --------------------------------------------- Unbekannte haben offenbar im Sommer Zugriff auf das Antriebssystem eines Öl-Supertankers gehabt, als dieser sich der Küste des US-Bundestaats Texas näherte. Das berichtet Transport Topics unter Berufung auf nicht näher genannte Quellen bei US-Behörden. Der Vorfall, der als Cyberangriff eingestuft wird, wird demnach von der US-Bundespolizei FBI sowie der US-Küstenwache untersucht. --------------------------------------------- https://www.golem.de/news/cyberangriff-antriebssystem-eines-oel-supertanker… ∗∗∗ OpenAI alerts 100+ orgs that its misaligned models attempted to break in - or worse ∗∗∗ --------------------------------------------- OpenAI's agents have repeatedly strayed beyond their intended scope. Two separate reports detail the activity, including one from Sam Altman’s company saying it has notified more than 100 organizations about potentially problematic model activity. --------------------------------------------- https://www.theregister.com/security/2026/10/02/openai-alerts-100-orgs-that… ∗∗∗ Create automatic IP blocklist in OPNsense based on MISP data ∗∗∗ --------------------------------------------- This blog post is about creating an automatic IP blocklist in OPNsense based on MISP data, including data retention. --------------------------------------------- https://lithilion.at/blog/2026-10-misp-blocklisting.html ∗∗∗ Nach Muse: Auch ChatGPT-App für macOS war angreifbar ∗∗∗ --------------------------------------------- Agentische Tools, die direkt auf dem Rechner laufen, benötigen oft weitreichende Zugriffsrechte. Das macht sie potenziell angreifbar. Nachdem der macOS-Security-Spezialist Patrick Wardle kürzlich eine potenziell durch Dritte ausnutzbare Hintertür in Metas Muse-App für den Mac entdeckt hatte, warnt dieser nun vor einem ähnlichen Problem in der konkurrierenden ChatGPT-App für macOS von OpenAI: Auch hier war es Angreifern möglich, sensible Informationen abzugreifen. [..] OpenAI hat das Problem Ende September mit einer Aktualisierung behoben, nachdem Wardle das Unternehmen darüber informiert hatte. --------------------------------------------- https://www.heise.de/news/Nach-Muse-Auch-ChatGPT-App-fuer-macOS-war-angreif… ∗∗∗ Raiffeisen-Phishing: Vorsicht bei Mitteilung zu neuem Dauerauftrag ∗∗∗ --------------------------------------------- Aktuell kursiert eine Phishing-Mail im Namen von Raiffeisen. Sie behauptet, ein neuer Dauerauftrag sei eingerichtet worden und müsse geprüft werden. Wer dem Link folgt, landet auf einer gefälschten Seite und soll dort seine Daten preisgeben. --------------------------------------------- https://www.watchlist-internet.at/news/raiffeisen-mail-zu-dauerauftrag/ ∗∗∗ N0n ransomware: what you need to know ∗∗∗ --------------------------------------------- N0n is a newly-emerged cyber extortion gang. The group was first spotted in the middle of September 2026, and within days it had published on its dark web leak site details of what it claimed to be around a dozen victims. Since then, the tally has continued to grow. --------------------------------------------- https://www.fortra.com/blog/n0n-ransomware-what-you-need-know ∗∗∗ Japan Plans Major Cyber Hunt to Detect Hidden Attacks on Critical Infrastructure ∗∗∗ --------------------------------------------- Japan is stepping up its plans to find cyber attackers who may already be inside the networks that keep essential services running. Under a new fiscal 2027 initiative, the government plans to work with private companies to strengthen Japan threat hunting across critical infrastructure, including power utilities and telecommunications operators. --------------------------------------------- https://thecyberexpress.com/japan-threat-hunting-plan/ ∗∗∗ Google Suspends Open Source Bug Bounty Over AI-Generated Reports ∗∗∗ --------------------------------------------- Google has suspended its Open Source Software Vulnerability Rewards Program (OSS VRP), a vulnerability search initiative that paid researchers for finding flaws in the companys open-source software. The pause took effect on October 1, 2026. Google blamed a "significant rise" in automated and AI-generated reports, most of which turned out to be invalid. --------------------------------------------- https://thecyberexpress.com/google-pauses-oss-vrp-over-ai-submissions/ ===================== = Vulnerabilities = ===================== ∗∗∗ New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline ∗∗∗ --------------------------------------------- Citrix has released security updates for a high-severity security flaw in NetScaler ADC and Citrix NetScaler Gateway that has been exploited as part of targeted zero-day attacks. The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0." [..] For successful exploitation, NetScaler ADC or NetScaler Gateway must be configured either as a SAML service provider (SP) or SAML identity provider(IdP). --------------------------------------------- https://thehackernews.com/2026/10/new-netscaler-zero-day-exploited-in.html ∗∗∗ Microsoft schiebt Exchange-Update nach ∗∗∗ --------------------------------------------- Zum Wochenende hat Microsoft weitere Exchange-Updates nachgelegt. [..] Aufgrund einer schwachen Autorisierung in Microsofts Exchange-Server können authentifizierte Angreifer aus dem Netz ihre Rechte ausweiten. Die Entwickler führen aus, dass bösartige Akteure dadurch unbefugten Zugriff auf Mailboxen anderer User erlangen und E-Mails und Anhänge daran lesen können. Tenant-Grenzen lassen sich dadurch jedoch nicht überwinden (CVE-2026-96940, CVSS 8.8, Risiko „hoch“). --------------------------------------------- https://www.heise.de/news/Microsoft-schiebt-Exchange-Update-nach-11475517.h… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1098599/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily