Daily

daily@lists.cert.at

1 participants
3525 discussions

Tageszusammenfassung - 21.10.2026
by Daily end-of-shift report 21 Oct '26

21 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 20-10-2026 18:00 − Mittwoch 21-10-2026 18:00 Handler: Katharina Siess Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Multiple Lenovo Tablets shipped with a known private test key for Android Verified Boot ∗∗∗ --------------------------------------------- Multiple Tablets provided by Lenovo are shipped with a known private test key for Android Verified Boot. --------------------------------------------- https://jvn.jp/en/jp/JVN33436631/ ∗∗∗ Operation FlashHole: Lazarus breaks security, defies control ∗∗∗ --------------------------------------------- Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security software. --------------------------------------------- https://securelist.com/lazarus-operation-flashhole/121541/ ∗∗∗ Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections ∗∗∗ --------------------------------------------- Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. --------------------------------------------- https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html ∗∗∗ Windows-Update-Nebenwirkungen: Probleme mit OWA, RDP und Smart App Control ∗∗∗ --------------------------------------------- Microsoft bestätigt einige Probleme, die durch Windows-Updates ausgelöst werden. Sie betreffen OWA, RDP und Smart App Control. --------------------------------------------- https://www.heise.de/news/Windows-Update-Nebenwirkungen-Probleme-mit-OWA-RD… ∗∗∗ Lieferkettenangriff auf Backup-Dienst trifft Hunderte M365-Tenants ∗∗∗ --------------------------------------------- Nutzer des Cloud Backups von ConnectWise müssen dringend ihre Systeme prüfen, da Angreifer diese möglicherweise bereits kompromittiert haben. --------------------------------------------- https://heise.de/-11495835 ∗∗∗ From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage ∗∗∗ --------------------------------------------- How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage. --------------------------------------------- https://www.wiz.io/blog/from-phishing-to-llmjacking ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücken in PHP - Updates verfügbar ∗∗∗ --------------------------------------------- In PHP existieren zwei kritische Sicherheitslücken, deren Ausnutzung es nicht authentifizierten Angreifer:innen ermöglichen kann, aus der Ferne beliebigen Code auszuführen. Betroffen sind laut PHP-Projekt alle PHP-Installationen, die Web-Anfragen verarbeiten, darunter PHP-FPM, Apache mit mod_php, php-cgi, FrankenPHP und LiteSpeed. [...] Das PHP-Projekt stellt mit den Versionen 8.5.12, 8.4.27, 8.3.36 und 8.2.35 Updates bereit, welche die Schwachstellen beheben. --------------------------------------------- https://www.cert.at/de/warnungen/2026/10/kritische-sicherheitslucken-in-php… ∗∗∗ Webbrowser: Chrome-Update schließt 353 Sicherheitslücken ∗∗∗ --------------------------------------------- Google hat den Webbrowser Chrome auf eine neue Hauptversion aktualisiert. Integriert sind Patches gegen Hunderte Sicherheitslücken. --------------------------------------------- https://www.golem.de/news/webbrowser-chrome-156-schliesst-353-sicherheitslu… ∗∗∗ Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator ∗∗∗ --------------------------------------------- Wordfence Argus helped uncover CVE-2026-82814, a high-severity unauthenticated PHP object injection in Duplicator and Duplicator Pro. Update to version 5.0.0 or newer. --------------------------------------------- https://www.wordfence.com/blog/2026/10/wordfence-argus-discovers-high-sever… ∗∗∗ Node.js fixt eigene und geerbte Sicherheitslücken ∗∗∗ --------------------------------------------- Neue Versionen für Node.js 22.x, 24.x und 26.x fixen hochriskante Sicherheitslücken und schützen vor kompromittierten Zertifikaten von eMudhra. --------------------------------------------- https://heise.de/-11495996 ∗∗∗ LWN Security updates for Wednesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1102005/ ∗∗∗ Kestra OSS Authentication Bypass Remote Code Execution v1.3.20 ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2026100006 ∗∗∗ Oracle Critical Security Patch Update Advisory - October 2026 ∗∗∗ --------------------------------------------- https://www.oracle.com/security-alerts/cpuoct2026.html ∗∗∗ Four stable kernels for Wednesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1101758/ ∗∗∗ Fortinet Releases Security Hardening Release for Multiple Products ∗∗∗ --------------------------------------------- https://feeds.fortinet.com/~/971845082/0/fortinet/blogs~Fortinet-Releases-S… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 20.10.2026
by Daily end-of-shift report 20 Oct '26

20 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Montag 19-10-2026 18:00 − Dienstag 20-10-2026 18:00 Handler: Katharina Siess Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ TeamUpdraft security incident: What customers need to know ∗∗∗ --------------------------------------------- Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website. Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected. This page explains what happened, what we have already done to protect you, and the steps to take for each of our products. --------------------------------------------- https://teamupdraft.com/blog/security-incident-october-2026/ ∗∗∗ Die Testphase für Amazon-Prime endet in 72 Stunden? Vorsicht, Phishing-Falle! ∗∗∗ --------------------------------------------- Der Absendername wirkt vertrauenswürdig, die Grafik höchst offiziell, der Ton ist freundlich. Angeblich endet die Testphase für ein Amazon-Prime-Abo in 72 Stunden, danach erfolgt die automatische Umwandlung in ein Zwei-Jahres-Abo. Will man diese verhindern, müsse man aktiv kündigen. Das Problem: Das Abo gibt es gar nicht. Die E-Mail und die dazugehörige Website wurden als Phishing-Falle konzipiert, die Kreditkartendaten abgreifen soll. --------------------------------------------- https://www.watchlist-internet.at/news/testphase-amazon-prime-phishing/ ∗∗∗ OVHcloud CLI releases backdoored on GitHub to steal developer secrets ∗∗∗ --------------------------------------------- French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdo… ∗∗∗ Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. --------------------------------------------- https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.ht… ∗∗∗ ICANN testing tech to let law enforcement access non-public WHOIS info ∗∗∗ --------------------------------------------- Single sign-on to help address imminent threats to life, critical infrastructure, or kids. --------------------------------------------- https://www.theregister.com/networks/2026/10/20/icann-testing-tech-to-let-l… ∗∗∗ PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites ∗∗∗ --------------------------------------------- TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information. The post PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites appeared first on Wordfence. --------------------------------------------- https://www.wordfence.com/blog/2026/10/updraftcentral-connection-key-compro… ∗∗∗ Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) ∗∗∗ --------------------------------------------- October 19 Update: Unit 42 continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc). We’re also aware of public reporting attributing exploitation to threat actors using Settra ransomware. --------------------------------------------- https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-… ∗∗∗ subfinder – Passive Subdomain Enumeration Tool ∗∗∗ --------------------------------------------- Point subfinder at a domain and it asks dozens of online sources which hostnames they have seen under it, without sending a packet to the target itself. I ran the new 2.17.0 release against this site with no API keys. It returned 17 subdomains in 14 seconds, and when I looked them up in DNS on 13 October, only one resolved. --------------------------------------------- https://www.darknet.org.uk/2026/10/subfinder-passive-subdomain-enumeration-… ∗∗∗ MacOS Infostealer “adapts” to new Keychain Protection ∗∗∗ --------------------------------------------- A recent sample I’ve analyzed changed it’s behaviour depending on the macOS version it is running on. --------------------------------------------- https://pberba.github.io/security/2026/10/20/amos-keychain/ ∗∗∗ Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns ∗∗∗ --------------------------------------------- Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys. --------------------------------------------- https://thehackernews.com/2026/10/go-issues-emergency-update-blocking.html ∗∗∗ WordPress SEO plugin Rank Math compromised to backdoor websites ∗∗∗ --------------------------------------------- Some downloads of the Rank Math PRO WordPress plugin from the vendors official website carried malware that planted hidden backdoors in a supply-chain attack last week. --------------------------------------------- https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-ma… ===================== = Vulnerabilities = ===================== ∗∗∗ Werbeblocker Pi-hole: Update stopft Befehlsschmuggel-Lücke und mehr ∗∗∗ --------------------------------------------- Der Werbeblocker Pi-hole bessert mit einem Update zahlreiche Schwachstellen aus. Nutzerinnen und Nutzer sollten es rasch anwenden. --------------------------------------------- https://www.heise.de/news/Werbeblocker-Pi-hole-Update-stopft-Befehlsschmugg… ∗∗∗ Schwachstelle CVE-2026-109390 (CVSS v3.1 9.8) im AnyDesk-Client für Linux ∗∗∗ --------------------------------------------- Ich stelle mal eine Information hier ein, auf die ich nun von zwei Blog-Lesern hingewiesen wurde. Im AnyDesk-Client für Linux gibt es eine kritischen Schwachstelle CVE-2026-109390, die mit einem CVSS 3.1 Base Score von 9.8 bewertet wurde. --------------------------------------------- https://borncity.com/blog/2026/10/20/schwachstelle-cve-2026-109390-cvss-v3-… ∗∗∗ eMudhra Intermediate CA Compromise ∗∗∗ --------------------------------------------- The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores. Users should update their browsers and operating systems to the latest versions as soon as possible. --------------------------------------------- https://emudhra.we-have-a-problem.com/ ∗∗∗ ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan ∗∗∗ --------------------------------------------- "The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path," Siemens said in an advisory. "This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application." The issue has been patched in version 4.0.9.8. Huntress Labs researcher Jose Oregon has been credited with discovering and reporting the shortcoming. --------------------------------------------- https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html ∗∗∗ LWN Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1101617/ ∗∗∗ TYPO3 Security Advisories 20.10.2026 ∗∗∗ --------------------------------------------- https://news.typo3.com/security/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 115.43.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-113/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 153.5.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-112/ ∗∗∗ Security Vulnerabilities fixed in Firefox 158.0.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/ ∗∗∗ Zyxel security advisory for incorrect authorization vulnerability in the DAL of certain 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 19.10.2026
by Daily end-of-shift report 19 Oct '26

19 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 16-10-2026 18:00 − Montag 19-10-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack ∗∗∗ --------------------------------------------- ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365… ∗∗∗ Exploit-Code geleakt: Plex-Server werden attackiert ∗∗∗ --------------------------------------------- Anfang September hatte Plex vor gefährlichen Sicherheitslücken in seiner Media-Server-Software gewarnt und schützende Updates bereitgestellt. Inzwischen liegen weitere Informationen zu den Lücken vor. Zudem hat ein Sicherheitsforscher bereits laufende Angriffe festgestellt. Überraschend ist das nicht, denn der dafür nötige Exploit-Code liegt seit dem vergangenen Wochenende öffentlich auf Github. --------------------------------------------- https://www.golem.de/news/exploit-code-geleakt-angreifer-schleusen-malware-… ∗∗∗ Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers ∗∗∗ --------------------------------------------- A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. [..] The flaw is in Broadcom's version of Wi-Fi Protected Setup (WPS), the feature that lets a device join a Wi-Fi network without the password being typed in. Broadcom's code mishandles the reassembly of fragmented WPS setup messages, so an attacker in range can send crafted messages that corrupt the router's memory. --------------------------------------------- https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html ∗∗∗ GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories ∗∗∗ --------------------------------------------- The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. [..] According to the threat intelligence platform, the threat actor registered the domain "my-github[.]com" and pointed it at "193.32.204[.]199," the same IP address that's used as an exfiltration endpoint for data harvested from running the malicious workflow. --------------------------------------------- https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.ht… ∗∗∗ CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability ∗∗∗ --------------------------------------------- On September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The vulnerability carries a CVSS v3.1 score of 9.8 according to NVD and a CVSS v4.0 score of 9.5 according to the Citrix security bulletin CTX697096. The vulnerability allows unauthenticated attackers to execute arbitrary commands on affected appliances. [..] The analysis in this blog focuses on the exploitation of CVE-2026-88771. --------------------------------------------- https://www.zscaler.com/blogs/security-research/cve-2026-88771-inside-explo… ∗∗∗ AOMEI Backupper update servers hijacked to push malware: Check your PC ∗∗∗ --------------------------------------------- Attackers tampered with AOMEI Backupper’s update system to deliver malware that could give them remote access to users’ PCs. --------------------------------------------- https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-serve… ∗∗∗ Klimabonus-Köder und trügerische Sicherheit: Phishing-Welle rollt durch Österreich ∗∗∗ --------------------------------------------- Hohe Betrugsraten bei Österreichs Online-Banking-Nutzer. Aktuell warnt das Finanzministerium zusätzlich vor einer massiven Welle an Fake-Nachrichten. --------------------------------------------- https://www.derstandard.at/story/3000000344738/klimabonus-koeder-und-truege… ∗∗∗ Keystrokes in Disguise: Forensic Analysis of a Digispark HID Device ∗∗∗ --------------------------------------------- A Digispark may look like a harmless USB development board, but it can easily be turned into a keystroke injection device that behaves like a USB Rubber Ducky. [..] he key difference between a USB Rubber Ducky and a Digispark is where the payload is stored. On a USB Rubber Ducky, it is located on removable storage, such as an SD card. On a Digispark, however, the logic is stored directly on the ATtiny85 microcontroller. From a forensic perspective, this makes analysis more difficult, as there is no easily accessible script file to review. [..] In this article, we show how such a device can be set up, used, and forensically analyzed, from payload execution on a target system to firmware extraction from the ATtiny85 microcontroller. --------------------------------------------- https://blog.nviso.eu/2026/10/16/keystrokes-in-disguise-forensic-analysis-o… ∗∗∗ Claude Code Desktop Flaw Let Malicious HTML Steal Developer Credentials ∗∗∗ --------------------------------------------- Noma Labs found a high-severity Claude Code Desktop flaw that let malicious HTML files steal local credentials and private keys through the preview pane. --------------------------------------------- https://hackread.com/claude-code-desktop-flaw-html-steal-credentials/ ===================== = Vulnerabilities = ===================== ∗∗∗ Roundcube: Security updates 1.6.20 and 1.7.5 released ∗∗∗ --------------------------------------------- We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities. --------------------------------------------- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 ∗∗∗ LWN: Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1101421/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 16.10.2026
by Daily end-of-shift report 16 Oct '26

16 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 15-10-2026 18:00 − Freitag 16-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Targeted ads delivered 0-click exploits to install mercenary malware ∗∗∗ --------------------------------------------- Researchers say that mercenary hackers laced ads with zero-click exploits that installed sophisticated malware on the devices of targeted individuals when they did nothing other than load a website or open an installed app. --------------------------------------------- https://arstechnica.com/security/2026/10/targeted-ads-delivered-0-click-exp… ∗∗∗ Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth ∗∗∗ --------------------------------------------- A proxyjacking campaign has impacted devices in 34 countries, monetizing victims’ internet connections through a commercial residential proxy network. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiqui… ∗∗∗ Schluss mit „digitalen Inseln“: Bund und Gemeinden starten neue Datenplattform ∗∗∗ --------------------------------------------- Staatssekretär Pröll und Gemeindebund-Präsident Pressl präsentierten am Freitagmorgen die neue „Gemeindedatenplattform“. --------------------------------------------- https://www.derstandard.at/story/3000000344526/schluss-mit-digitalen-inseln… ∗∗∗ AI-Powered Espionage Campaign Targets Government Linux Infrastructure ∗∗∗ --------------------------------------------- Unit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211. --------------------------------------------- https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructur… ∗∗∗ Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign ∗∗∗ --------------------------------------------- A calendar invite is one of the most routine messages in the modern workplace. It lands in the inbox, asks for a few seconds of attention, and is rarely questioned. Attackers know this, and they are now using fake meeting invitations to steal Microsoft account credentials. --------------------------------------------- https://blog.checkpoint.com/securing-user-and-access/fake-calendar-invites-… ∗∗∗ User refused to change her password because everyone already knew it ∗∗∗ --------------------------------------------- School staff seemed to be trying to get ransomware – for a second time. --------------------------------------------- https://www.theregister.com/security/2026/10/16/user-refused-to-change-her-… ∗∗∗ Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials ∗∗∗ --------------------------------------------- CISA and the Federal Bureau of Investigation (FBI) released a Public Service Announcement (PSA) warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. Malicious cyber actors may use phishing and smishing techniques to steal login credentials and other sensitive information or install malware on targeted devices. Election officials, candidates, and political organizations may be attractive targets because of their access to voter registration data, current government officials, and sensitive campaign information. --------------------------------------------- https://www.cisa.gov/resources-tools/resources/cyber-threat-actors-use-vari… ∗∗∗ EuGH: Banken müssen Phishing-Schaden erst einmal erstatten ∗∗∗ --------------------------------------------- In einem Fall von Phishing-Betrug stellt der EuGH klar, dass Banken den Schaden grundsätzlich erst einmal ersetzen müssen – mit nur einer Ausnahme. --------------------------------------------- https://heise.de/-11489842 ∗∗∗ Fake Arch Linux packages push malware with root privileges ∗∗∗ --------------------------------------------- A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-pus… ===================== = Vulnerabilities = ===================== ∗∗∗ BeyondTrust patches zero-day exploited in attacks since August ∗∗∗ --------------------------------------------- Tracked as CVE-2026-102764, this actively exploited authentication bypass vulnerability lets unprivileged remote attackers perform file operations on unpatched appliances and affects RS 26.2.3 or earlier. BeyondTrust patched the security issue for all Remote Support and Privileged Remote Access SaaS customers on October 8, but self-hosted installations must be patched manually if automatic updates are not enabled. --------------------------------------------- https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day… ∗∗∗ Zweites Update in einer Woche: Google schließt erneut kritische Lücke in Chrome ∗∗∗ --------------------------------------------- Google hat in dieser Woche ein zweites Sicherheitsupdate für seinen Browser Chrome veröffentlicht. Es schließt wieder eine kritische Lücke, die Nutzer unter Windows, MacOS, Linux und Android betrifft. Aufgrund des hohen Schweregrads ist es möglich, aus der Ferne Schadcode in den Browser einzuschleusen und außerhalb seiner Sandbox auszuführen. --------------------------------------------- https://www.golem.de/news/zweites-update-in-einer-woche-google-schliesst-er… ∗∗∗ LWN Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1101015/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 15.10.2026
by Daily end-of-shift report 15 Oct '26

15 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 14-10-2026 18:00 − Donnerstag 15-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks ∗∗∗ --------------------------------------------- Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. --------------------------------------------- https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-… ∗∗∗ Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App ∗∗∗ --------------------------------------------- Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. [..] The flaw allows an unauthenticated request to run a command on the server, but only when the app's local document server is not running, such as during a restart or upgrade, or after a crash. Collabora fixed it in version 26.4.303 on September 11 and on October 14 published an advisory with the identifier CVE-2026-110447, warning that turning off the app does not help: it must be updated or removed. --------------------------------------------- https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html ∗∗∗ AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches ∗∗∗ --------------------------------------------- Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems. [..] Although the vulnerabilities were initially assumed to be addressed in AhsayCBS versions 9.15.2.59 and 10.3.4.0 released in August 2026, the software company has now confirmed that the patches did not completely plug them. --------------------------------------------- https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.ht… ∗∗∗ Sextortion “help” firm took $60 million from victims, FTC alleges ∗∗∗ --------------------------------------------- The FTC accuses Digital Forensics Corporation and affiliated companies of exploiting people seeking help with intimate-image blackmail. --------------------------------------------- https://www.malwarebytes.com/blog/news/2026/10/sextortion-help-firm-took-60… ∗∗∗ Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant ∗∗∗ --------------------------------------------- We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. --------------------------------------------- https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-… ∗∗∗ Researchers Uncover Thousands of Phishing Domains Hiding Behind Inactive Pages ∗∗∗ --------------------------------------------- A domain returns a blank page. Maybe a generic “Not Found” message. There is no login form, suspicious branding, or obvious phishing content to investigate. Yet the phishing site may still be there. Check Point Exposure Management researchers uncovered a large scale, multi region phishing infrastructure designed to conceal active campaigns behind seemingly inactive domains. --------------------------------------------- https://blog.checkpoint.com/security/researchers-uncover-thousands-of-phish… ∗∗∗ Verwanzte Krypto-Wallets von Ledger: Problem größer als gedacht ∗∗∗ --------------------------------------------- Jemand baut heimlich LTE-Modems in neue Kryptowallets ein. Käufer haben über 100 Millionen Dollar verloren. Hersteller Ledger kommuniziert wenig. --------------------------------------------- https://heise.de/-11488785 ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücke in Cisco Secure Email Gateway - aktiv ausgenutzt - Updates verfügbar - CVE-2026-76519 ∗∗∗ --------------------------------------------- In der Funktion Advanced Malware Protection (AMP) von Cisco Secure Email Gateway existiert eine kritische Sicherheitslücke. Laut Cisco wird die Sicherheitslücke bereits aktiv ausgenutzt. [..] Nicht authentifizierte Angreifer:innen können aus der Ferne durch das Versenden einer E-Mail mit einem präparierten Anhang über ein betroffenes Gerät beliebige Dateien auf dem zugrundeliegenden Betriebssystem schreiben und Befehle mit root-Rechten ausführen. --------------------------------------------- https://www.cert.at/de/warnungen/2026/10/kritische-sicherheitslucke-in-cisc… ∗∗∗ Next.js Security Update for Upstream Vulnerabilities ∗∗∗ --------------------------------------------- Last week we announced an upcoming out-of-band security update for Next.js, including two fixes postponed from the September security release due to upstream dependency delays. Updates are now available in v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS) to address these issues. [..] Unauthenticated Remote Code Execution in use cache functions returning typed arrays (Critical Severity) [..] Unauthenticated Remote Code Execution in the Image Optimization API when using SVG (Critical Severity) --------------------------------------------- https://nextjs.org/blog/nextjs-security-update-october-14-2026 ∗∗∗ Juniper Security Advisories 14.10.2026 ∗∗∗ --------------------------------------------- Juniper has released 17 new security advisories. (6x critical) --------------------------------------------- https://supportportal.juniper.net/s/global-search/%40uri#sortCriteria=date%… ∗∗∗ Palo Alto Networks Security Advisories 14.10.2026 ∗∗∗ --------------------------------------------- Palo Alto has released 12 new security advisories. (2x high) --------------------------------------------- https://security.paloaltonetworks.com/ ∗∗∗ NGINX Security Advisories ∗∗∗ --------------------------------------------- https://nginx.org/en/security_advisories.html ∗∗∗ Drupal core - Critical - Remote code execution - SA-CORE-2026-014 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-core-2026-014 ∗∗∗ LWN Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1100785/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 14.10.2026
by Daily end-of-shift report 14 Oct '26

14 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 13-10-2026 18:00 − Mittwoch 14-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Trezor Wallets Also Compromised with Implants ∗∗∗ --------------------------------------------- Despite claims by Trezor today that none of its devices have been compromised -- unlike the devices of its competitor, Ledger -- hardware hacker Joe Grand says he found implants in two Trezor devices and reported this to the company in August. --------------------------------------------- https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implant… ∗∗∗ GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking ∗∗∗ --------------------------------------------- GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. --------------------------------------------- https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html ∗∗∗ Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave ∗∗∗ --------------------------------------------- Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. --------------------------------------------- https://thehackernews.com/2026/10/four-byte-write-and-timing-bug-let.html ∗∗∗ Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days ∗∗∗ --------------------------------------------- A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. --------------------------------------------- https://thehackernews.com/2026/10/researchers-used-public-openai-model-to.h… ∗∗∗ GhostScript-Schwachstelle CVE-2026-39919 wird angegriffen ∗∗∗ --------------------------------------------- Kurze Erinnerung für Nutzer, die GhostScript verwenden (ist in vielen Software-Paketen zur PDF-Erzeugung enthalten). Es gibt eine (gefixte) kritische Schwachstelle CVE-2026-39919 in GhostScript vor der Version 10.08.0, die nun wohl angegriffen wird. Angreifer können PDF-Server übernehmen. --------------------------------------------- https://borncity.com/blog/2026/10/14/ghostscript-schwachstelle-cve-2026-399… ∗∗∗ Passkeys Are Not a Trap ∗∗∗ --------------------------------------------- A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this true?' kind of vibe. It's written for "non-technical citizens of the web", and the headline advice is to stop using passkeys and go back to TOTP codes and passwords. --------------------------------------------- https://scotthelme.co.uk/passkeys-are-not-a-trap/ ===================== = Vulnerabilities = ===================== ∗∗∗ Chrome 155: Google stopft sieben kritische Löcher ∗∗∗ --------------------------------------------- Google hat ein Sicherheitsupdate für Chrome 155 veröffentlicht. Es beseitigt 37 Anfälligkeiten, von denen sieben als kritisch eingestuft sind. Angreifer können unter Umständen aus der Ferne Schadcode einschleusen und außerhalb der Sandbox des Browsers ausführen. Betroffen sind Chrome für Windows, MacOS und Linux. --------------------------------------------- https://www.golem.de/news/chrome-155-google-stopft-sieben-kritische-loecher… ∗∗∗ Neue curl-Version entfernt SMB-Unterstützung und behebt 24 Sicherheitslücken ∗∗∗ --------------------------------------------- Die neueste Version von curl behebt eine schwere und dreiundzwanzig leichte Sicherheitslücken und verabschiedet sich von der Unterstützung für das SMB-Protokoll. Die Open-Source-Bibliothek zum Aufruf von URLs ist praktisch auf jedem vernetzten Gerät weltweit installiert – das Update betrifft also Milliarden Installationen. --------------------------------------------- https://www.heise.de/news/Neue-curl-Version-entfernt-SMB-Unterstuetzung-und… ∗∗∗ Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities ∗∗∗ --------------------------------------------- Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical." --------------------------------------------- https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/ ∗∗∗ Patchday: Sicherheitslücken mit Höchstwertung gefährden Adobe-Anwendungen ∗∗∗ --------------------------------------------- Adobe hat wichtige Sicherheitsupdates unter anderem für ColdFusion, Commerce und Experience Manager veröffentlicht. --------------------------------------------- https://heise.de/-11487282 ∗∗∗ DNSSEC-Schlüsseltausch: Updates für Secunet- und RISE-Konnektoren verfügbar ∗∗∗ --------------------------------------------- Secunet- und RISE-Konnektoren verlieren nach einem DNSSEC-Schlüsselwechsel die Verbindung zur Telematikinfrastruktur. Jetzt stehen Updates bereit. --------------------------------------------- https://heise.de/-11477109 ∗∗∗ LWN Security updates for Wednesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1100426/ ∗∗∗ VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/382143 ∗∗∗ VU#166125: Bisheng has authentication bypass vulnerabilities ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/166125 ∗∗∗ Improper access control and session management in the web management interface ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-26-185 ∗∗∗ Multiple Arbitrary File Read/Write via SQL Injection ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-26-178 ∗∗∗ SQL command injection in webmail ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-26-184 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 13.10.2026
by Daily end-of-shift report 13 Oct '26

13 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Montag 12-10-2026 18:00 − Dienstag 13-10-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control ∗∗∗ --------------------------------------------- Two of 31 newly disclosed flaws in Progress Softwares MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0. --------------------------------------------- https://thehackernews.com/2026/10/two-critical-marklogic-flaws-could-give.h… ∗∗∗ Docker Hub flaw let attackers impersonate users, tamper with images ∗∗∗ --------------------------------------------- Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another users container repositories using a personal access token (PAT). [..] On September 30, 2026, Docker received a vulnerability report describing the issue, confirmed it, and deployed a fix to production less than four hours later. Docker says it found no evidence of exploitation after examining 304,000 pushes made with transferred tokens and analyzing high-risk public images. --------------------------------------------- https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attacker… ∗∗∗ LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network ∗∗∗ --------------------------------------------- Three vulnerabilities in LGs webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. --------------------------------------------- https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html ∗∗∗ A quick note on incident classification ∗∗∗ --------------------------------------------- Right now, there is ongoing work on EU level to harmonize how we classify incidents. This stems from multiple legal backgrounds, including the NIS2 directive and it’s reporting requirements and the Blueprint for cyber crisis management. I’ve tried to give input to most of these initiatives, and in most of these cases, we’ve been moving in the right direction. Not everything is perfect, thus I’d like to write a couple of lines on how I think the whole topic should be. --------------------------------------------- https://www.cert.at/en/blog/2026/10/a-quick-note-on-incident-classification ∗∗∗ In Frankreich wurden Kühlanlagen manipuliert – geht das auch bei uns? ∗∗∗ --------------------------------------------- In der Nacht von Sonntag auf Montag (11./12. Oktober) wurden in Frankreich die Kühlanlagen diverser Einzelhandelsketten so manipuliert, dass das Gefriergut aufgeheizt und damit unbrauchbar gemacht wurde. Meine erste Reaktion drauf war, dass da wohl jemand in die Netze eingestiegen war, und von innen heraus die ICS-Komponenten umkonfiguriert hat. Weil so unvorsichtig, diese Systeme offen ins Internet zu hängen, sollten diese Firmen ja doch nicht gewesen sein. Ich habe schon oft gescherzt, dass „sollte“ das gefährlichste Wort in der Cybersecurity ist. --------------------------------------------- https://www.cert.at/de/blog/2026/10/in-frankreich-wurden-kuhlanlagen-manipu… ∗∗∗ Sicherheitslücke in Flugbuchungssystem: Passagierdaten im Klartext einsehbar ∗∗∗ --------------------------------------------- Ein Datenleck bei Amadeus legte Passagierdaten offen. Über einen ungeschützten Heap-Dump waren Zugangsdaten im Klartext einsehbar. --------------------------------------------- https://heise.de/-11479912 ∗∗∗ Jetzt patchen! SonicWall SMA1000 im Fokus von Angreifern ∗∗∗ --------------------------------------------- Derzeit nutzen Angreifer eine kritische Lücke in der Fernzugriffslösung SonicWall SMA1000 aus. Sicherheitsupdates sind verfügbar. --------------------------------------------- https://heise.de/-11485407 ===================== = Vulnerabilities = ===================== ∗∗∗ Ivanti: October 2026 Security Update ∗∗∗ --------------------------------------------- Ivanti Connect Secure (CVE-2026-104935): Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. Ivanti Neurons Patch for Intune October 2026 (CVE-2026-109412): An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information. Ivanti Xtraction (Multiple CVEs): A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site. --------------------------------------------- https://www.ivanti.com/blog/october-2026-security-update ∗∗∗ SAP warns of maximum severity OAuth2 SSRF security flaw ∗∗∗ --------------------------------------------- SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. [..] Tracked as CVE-2026-89111, the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severit… ∗∗∗ Xen Advisories 13.10.2026 ∗∗∗ --------------------------------------------- Xen.org has released 8 new security advisories. --------------------------------------------- https://xenbits.xen.org/xsa/ ∗∗∗ Mozilla Foundation Security Advisories October 13, 2026 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/ ∗∗∗ LWN: Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1100181/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 12.10.2026
by Daily end-of-shift report 12 Oct '26

12 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 09-10-2026 18:00 − Montag 12-10-2026 18:00 Handler: Guenes Holler Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Cyberattack shuts down refrigerators at French supermarkets ∗∗∗ --------------------------------------------- Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refri… ∗∗∗ Japan reagiert auf Welle von Cyberangriffen ∗∗∗ --------------------------------------------- Etliche wichtige Unternehmen in Japan haben Cyberangriffe gemeldet. Japans Digitalminister spricht von einem Notstand. --------------------------------------------- https://heise.de/-11483276 ∗∗∗ Alte Lücken etwa in Apache Struts, BIND und ProFTPD im Visier von Angreifern ∗∗∗ --------------------------------------------- Die US-amerikanische IT-Sicherheitsbehörde CISA hat Ende vergangener Woche fünf Sicherheitslücken neu in den „Known-Exploited-Vulnerabilities“-Katalog (KEV) aufgenommen. Es handelt sich um teils sehr alte Schwachstellen, die Angreifer aktuell im Visier haben. --------------------------------------------- https://heise.de/-11483781 ∗∗∗ Angriff auf dänisches Melderegister: Zugangspasswort war offenbar 123456 ∗∗∗ --------------------------------------------- Über einen IT-Dienstleister bekamen Angreifer Zugang zu Dänemarks zentralem Personenregister. Mehrere Konten der Firma waren offenbar nur mit 123456 gesichert. --------------------------------------------- https://www.golem.de/news/daenemark-hacker-hatten-wochenlang-zugriff-auf-ze… ∗∗∗ Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws ∗∗∗ --------------------------------------------- Anthropic on Friday said it's cutting off live internet access for all its internal evaluations until further notice following the discovery of new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior and targeted real websites. --------------------------------------------- https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.h… ∗∗∗ Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch ∗∗∗ --------------------------------------------- Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. --------------------------------------------- https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html ∗∗∗ FBI Arrests Executive at Ransomware Negotiation Firm ∗∗∗ --------------------------------------------- Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. --------------------------------------------- https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negot… ∗∗∗ Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) ∗∗∗ --------------------------------------------- We have to admit it - so much is happening right now (F1, GTA6, breakfast) that we barely have time to lovingly tease our most favoritest vendors. --------------------------------------------- https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-… ∗∗∗ A Practical Guide to “Plug&Pwn” for Pentesters and Defenders ∗∗∗ --------------------------------------------- We’re in 2026 and it is entirely possible for an attacker to hack into a Windows computer using a “simple” USB device. Hollywood screenwriters were right from the start, but we never listened. --------------------------------------------- https://blog.scrt.ch/2026/10/06/a-practical-guide-to-plugpwn-for-pentesters… ∗∗∗ 1-click MMI execution in Android ∗∗∗ --------------------------------------------- This article describes how vulnerable dialer applications can be exploited to achieve 1-click MMI execution in Android. --------------------------------------------- https://karansaini.com/mmi-android/ ∗∗∗ PETKIT: Gaining remote access to smart pet devices/cameras and virtually kidnapping pets through simple API requests ∗∗∗ --------------------------------------------- PETKIT products were vulnerable to device takeovers by hackers through simple API requests. This writeup explains the exploit. --------------------------------------------- https://blog.mgdproductions.com/petkit-vulnerabilities/ ∗∗∗ Why TLP should not replace your internal information classification, (Sat, Oct 10th) ∗∗∗ --------------------------------------------- The Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate whether information may be shared further (and if so, how far). --------------------------------------------- https://isc.sans.edu/diary/rss/33414 ===================== = Vulnerabilities = ===================== ∗∗∗ 7-Zip 26.04: Sicherheitslücken geschlossen ∗∗∗ --------------------------------------------- Das populäre Archivtool 7-Zip ist in der neuen Version 26.04 erschienen. Sie schließt Sicherheitslecks und korrigiert Fehler. --------------------------------------------- https://www.heise.de/news/7-Zip-Update-stopft-Sicherheitsluecken-11483182.h… ∗∗∗ GitLab warns of max severity code execution vulnerability ∗∗∗ --------------------------------------------- GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. --------------------------------------------- https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity… ∗∗∗ Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE ∗∗∗ --------------------------------------------- A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The security flaw impacts Bricksforge versions up to and including 3.1.8.9. Patches have been released in version 3.1.8.10. --------------------------------------------- https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.ht… ∗∗∗ LWN Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1099949/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 09.10.2026
by Daily end-of-shift report 09 Oct '26

09 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 08-10-2026 18:00 − Freitag 09-10-2026 18:00 Handler: Guenes Holler Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Microsoft: Outdated Windows devices will stop receiving security updates ∗∗∗ --------------------------------------------- Microsoft says devices running unsupported versions of Windows will stop receiving security updates after next year's Windows Update certificate rotation. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-outdated-windows-… ∗∗∗ Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data ∗∗∗ --------------------------------------------- Advisory at a Glance Title Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data Original Publication October 8, 2026 Executive Summary Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a ∗∗∗ Low-cost Android phones ship with residential proxy malware ∗∗∗ --------------------------------------------- A malware campaign dubbed Midnight Mimosa has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. --------------------------------------------- https://www.bleepingcomputer.com/news/security/low-cost-android-phones-ship… ∗∗∗ Cyberangriffe auf Banken: Hacker nutzt KI und hinterlässt Accountdaten ∗∗∗ --------------------------------------------- Der Angreifer ist aufgeflogen, weil er offene und ungesicherte Webverzeichnisse auf seiner Server-Infrastruktur betrieb. --------------------------------------------- https://www.golem.de/news/cyberangriffe-auf-banken-hacker-nutzt-ki-und-hint… ∗∗∗ Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access ∗∗∗ --------------------------------------------- Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection. AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as "fixed a bug that could lead to a crash," with no CVE assigned and no security advisory. --------------------------------------------- https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.h… ∗∗∗ Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware ∗∗∗ --------------------------------------------- IntroductionIn July 2026, Zscaler ThreatLabz uncovered a campaign linked to TraderTraitor (also tracked as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces), an advanced persistent threat actor backed by the North Korean government that has targeted the cryptocurrency industry for years. This campaign also significantly overlaps with the previously reported KelpDAO incident, the analysis of which discussed both FLATROOF and ROOFDECK, two malware families also observed in this campaign. --------------------------------------------- https://www.zscaler.com/blogs/security-research/suspected-tradertraitor-gro… ∗∗∗ Aktion gegen Phishing: Heuer bereits 19 Millionen Euro Schaden ∗∗∗ --------------------------------------------- 5000 Fälle hat das Bundeskriminalamt bereits gezählt. Die Aktion "10 Tage gegen Phishing" ist am Freitag gestartet. --------------------------------------------- https://www.derstandard.at/story/3000000343493/aktion-gegen-phishing-heuer-… ∗∗∗ New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials ∗∗∗ --------------------------------------------- A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history. --------------------------------------------- https://socket.dev/blog/ghostaction-cloud-credentials?utm_medium=feed ∗∗∗ Datenleck: 9 GByte Redaktions- und Nutzerdaten von Nius frei zugänglich ∗∗∗ --------------------------------------------- Unbekannte stellen die Nius-Daten nach einem Hackerangriff ins Netz. Sie enthalten auch Informationen über Gesprächspartner der Redaktion. --------------------------------------------- https://www.golem.de/news/datenleck-9-gbyte-redaktions-und-nutzerdaten-von-… ∗∗∗ Kostenlose TLS-Zertifikate: Lets Encrypt verkürzt Gültigkeit auf 64 Tage ∗∗∗ --------------------------------------------- Ab 2028 sinkt die Gültigkeitsdauer auf 45 Tage. Lets Encrypt will so das Risko von Schlüsselkompromittierungen reduzieren. --------------------------------------------- https://www.golem.de/news/kostenlose-tls-zertifikate-let-s-encrypt-verkuerz… ===================== = Vulnerabilities = ===================== ∗∗∗ Weitere kritische Sicherheitslücke in Citrix NetScaler ADC und NetScaler Gateway - Updates verfügbar ∗∗∗ --------------------------------------------- Citrix hat ein Security Bulletin zu einer kritischen Sicherheitslücke in Citrix NetScaler ADC und Citrix NetScaler Gateway veröffentlicht. Es handelt sich um einen Speicherüberlauf, der zur Ausführung von beliebigem Code aus der Ferne (Remote Code Execution) oder zu einem Denial-of-Service (DoS) führen kann. Voraussetzung ist, dass das Gerät als SAML Service Provider (SP) oder SAML Identity Provider (IdP) konfiguriert ist. --------------------------------------------- https://www.cert.at/de/warnungen/2026/10/weitere-kritische-sicherheitslucke… ∗∗∗ Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge ∗∗∗ --------------------------------------------- Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. --------------------------------------------- https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html ∗∗∗ High-severity Nvidia bug could crash GPU monitoring on exposed servers ∗∗∗ --------------------------------------------- The GPU giant released a fix for the flaw, tracked as CVE-2026-47483. --------------------------------------------- https://www.theregister.com/security/2026/10/08/high-severity-nvidia-bug-co… ∗∗∗ Angreifer können Systeme mit IBM Verify Identity Access übernehmen ∗∗∗ --------------------------------------------- Angreifer können an insgesamt 22 Sicherheitslücken in IBM Verify Identity Access (IVIA) und IBM Security Verify Access ansetzen und Systeme im schlimmsten Fall vollständig kompromittieren. Sicherheitspatches stehen zu Download bereit. --------------------------------------------- https://www.heise.de/news/Angreifer-koennen-Systeme-mit-IBM-Verify-Identity… ∗∗∗ Splunk Patches 22 Vulnerabilities, Including Critical Flaw With CVSS 9.8 ∗∗∗ --------------------------------------------- Splunk has patched a large set of Splunk vulnerabilities in Splunk Enterprise, the most severe of which carries a CVSSv3.1 score of 9.8. The fixes are described in two advisories, SVD-2026-1001 and SVD-2026-1002, both published on October 7, 2026, and together they cover 22 CVE identifiers, CVE-2026-76264 through CVE-2026-76285. --------------------------------------------- https://thecyberexpress.com/splunk-enterprise-critical-flaws/ ∗∗∗ LWN Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1099587/ ∗∗∗ [R1] Tenable Identity Exposure Version 3.126.0 (SaaS) Fixes One Vulnerability ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2026-27 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 08.10.2026
by Daily end-of-shift report 08 Oct '26

08 Oct '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 07-10-2026 18:00 − Donnerstag 08-10-2026 18:00 Handler: Guenes Holler Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Pensionsleistung genehmigt: 723-Euro-Versprechen ist Phishing ∗∗∗ --------------------------------------------- Betrügerische Nachrichten im Namen der Pensionsversicherung gab es schon vor einiger Zeit per SMS, jetzt landen sie auch im E-Mail-Postfach. Die Masche: Eine angebliche Auszahlung soll Empfänger:innen zur Preisgabe ihrer Bankdaten bringen. --------------------------------------------- https://www.watchlist-internet.at/news/pensionsleistung-genehmigt-723-euro/ ∗∗∗ Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia ∗∗∗ --------------------------------------------- Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself. --------------------------------------------- https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html ∗∗∗ Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers ∗∗∗ --------------------------------------------- Quoth the LLM, More and more. --------------------------------------------- https://www.theregister.com/security/2026/10/07/poetry-is-the-new-ai-securi… ∗∗∗ 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials ∗∗∗ --------------------------------------------- Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces. --------------------------------------------- https://socket.dev/blog/firefox-crypto-wallet-stealers?utm_medium=feed ∗∗∗ TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack ∗∗∗ --------------------------------------------- Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware. --------------------------------------------- https://socket.dev/blog/tensorlake-compromise?utm_medium=feed ∗∗∗ Chinesische Wechselrichter: Nur ein Hack bis zum Blackout ∗∗∗ --------------------------------------------- 250.000 Solaranlagen in Deutschland nutzen Wechselrichter mit einer kritischen Sicherheitslücke. Ein Kollaps des Stromnetzes wäre einfach. --------------------------------------------- https://www.golem.de/news/chinesische-wechselrichter-nur-ein-hack-bis-zum-b… ∗∗∗ Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely ∗∗∗ --------------------------------------------- A critical vulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version is available. --------------------------------------------- https://thehackernews.com/2026/10/unpatched-critical-lmcache-flaw-lets.html ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco warns of critical flaws allowing Nexus switch takeover ∗∗∗ --------------------------------------------- Cisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary code with root privileges on Nexus switches. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-flaw… ∗∗∗ Veeam stopft Schadcode-Lücke in Backup & Replication ∗∗∗ --------------------------------------------- Veeam hat Backup & Replication aktualisiert und dabei vier Sicherheitslücken geschlossen. Schmuggeln von Schadcode auf den Server ist möglich. --------------------------------------------- https://www.heise.de/news/Veeam-stopft-Schadcode-Luecke-in-Backup-Replicati… ∗∗∗ Microsoft, Adobe, Apple, and Foxit vulnerabilities ∗∗∗ --------------------------------------------- Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. --------------------------------------------- https://blog.talosintelligence.com/microsoft-adobe-apple-and-foxit-vulnerab… ∗∗∗ LWN Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1099388/ ∗∗∗ Zahlreiche kritische Schwachstellen in mehreren TP-Link Geräteserien ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/zahlreiche-kritische-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily