Daily

daily@lists.cert.at

1 participants
3531 discussions

Tageszusammenfassung - 25.06.2026
by Daily end-of-shift report 25 Jun '26

25 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 24-06-2026 18:00 − Donnerstag 25-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Malicious Edge extension abuses Native Messaging as bridge to malware ∗∗∗ --------------------------------------------- A malicious Microsoft Edge extension dubbed Edgecution has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-edge-extension-abu… ∗∗∗ Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access ∗∗∗ --------------------------------------------- New details have been revealed on how hackers exploited a Cisco Catalyst SD-WAN vulnerability tracked as CVE-2026-20245 in zero-day attacks to create rogue root accounts on targeted devices. --------------------------------------------- https://www.bleepingcomputer.com/news/security/mandiant-reveals-how-cisco-s… ∗∗∗ Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools ∗∗∗ --------------------------------------------- In the first four months of 2026, Kaspersky solutions detected over 33,300 cyberattacks on SMBs masquerading as popular artificial intelligence (AI) tools – almost five times more than in 2025 and 39% more than the number of attacks disguised as the office and collaboration tools that Kaspersky’s research focuses on. --------------------------------------------- https://securelist.com/smb-threat-report-2026/120357/ ∗∗∗ What do Ports Hear When Nobodys Listening? An Assessment of Automated Cybercrime [Guest Diary], (Wed, Jun 24th) ∗∗∗ --------------------------------------------- For network defenders and analysts, it's important to understand the depth of the noise and how it should be treated. Observing patterns and structural shifts within the static is essential for keeping pace with an automated, multi-directional threat that never stops running. The infrastructure persists, campaigns evolve, payloads update, and the ports keep listening. --------------------------------------------- https://isc.sans.edu/diary/rss/33104 ∗∗∗ StealC Historical Bot Infection Special Report ∗∗∗ --------------------------------------------- On Wednesday 24th June 2026, international law enforcement partners announced additional successful cyber crime disruption actions as part of the ongoing Operation Endgame initiative. This time the StealC infostealer and Amadey malware-as-a-service families were targeted. --------------------------------------------- https://www.shadowserver.org/news/stealc-historical-bot-infection-special-r… ∗∗∗ Verfassungsschutz zu Spionage: Unis sollen wachsamer sein ∗∗∗ --------------------------------------------- Sicherheitsbehörden warnen vor chinesischer Wissenschaftsspionage an deutschen Hochschulen. Sind die Forschungseinrichtungen wachsam genug? --------------------------------------------- https://www.heise.de/news/Verfassungsschutz-zu-Spionage-Unis-sollen-wachsam… ∗∗∗ Raiffeisen Phishingmail fordert zur pushTAN-Aktivierung auf ∗∗∗ --------------------------------------------- Aktuell versenden Kriminelle betrügerische E-Mails im Namen der Raiffeisen Bank. Die Nachrichten fordern Kund:innen auf, über einen Link den pushTAN-Dienst zu aktivieren und führen dabei auf eine gefälschte Website, die Kontodaten abgreift. --------------------------------------------- https://www.watchlist-internet.at/news/raiffeisen-phishingmail-fordert-push… ∗∗∗ Introduction to COM usage by Windows threats ∗∗∗ --------------------------------------------- Component Object Model (COM) is a fundamental Windows technology used by legitimate applications for object activation, inter-process communication, automation and language-independent component reuse. Those same qualities make it useful to threat actors. --------------------------------------------- https://blog.talosintelligence.com/introduction-to-com-usage-by-windows-thr… ∗∗∗ Windows 10: Sicherheitsupdates für Privatkunden jetzt doch noch bis Oktober 2027 ∗∗∗ --------------------------------------------- Microsoft hat das ESU-Programm für Privatkunden ohne große Vorankündigung um ein weiteres Jahr verlängert. --------------------------------------------- https://heise.de/-11344923 ∗∗∗ Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond ∗∗∗ --------------------------------------------- Datadog Security Research investigates a June 2026 adversary-in-the-middle phishing campaign that cloned the AWS console login page to harvest victim credentials and multi-factor authentication codes. --------------------------------------------- https://securitylabs.datadoghq.com/articles/behind-the-console-aws-aitm-phi… ∗∗∗ Ignore DNSSEC if you like MITM attacks ∗∗∗ --------------------------------------------- It really bothers me that almost all distributions and operating systems don’t validate DNSSEC by default. The above attacks are feasible on almost anyone, purely because of lousy defaults. --------------------------------------------- https://whynothugo.nl/journal/2026/06/24/ignore-dnssec-if-you-like-mitm-att… ===================== = Vulnerabilities = ===================== ∗∗∗ LWN: Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1079551/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 24.06.2026
by Daily end-of-shift report 24 Jun '26

24 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 23-06-2026 18:00 − Mittwoch 24-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ New macOS ClickFix attack silently mounts DMGs to push infostealer ∗∗∗ --------------------------------------------- A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-si… ∗∗∗ Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks ∗∗∗ --------------------------------------------- A high-severity SSRF vulnerability, tracked as CVE-2026-20230, in Cisco Unified Communications Manager Server is now being exploited in attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cv… ∗∗∗ Stealthy Mistic backdoor linked to ransomware access broker KongTuke ∗∗∗ --------------------------------------------- A new backdoor dubbed Mistic has been observed in financially motivated attacks targeting organizations in the insurance, education, IT, and professional services sectors. --------------------------------------------- https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-lin… ∗∗∗ Sicherheitslücke: Millionen von Samsung-Smartphones durch Kernel-Bug gefährdet ∗∗∗ --------------------------------------------- Forscher haben einen gefährlichen Bug im Android-Kernel von Samsung entdeckt, der unzählige Smartphones zwischen Galaxy S9 und S25 betrifft. --------------------------------------------- https://www.golem.de/news/sicherheitsluecke-acht-jahre-alter-kernel-bug-gef… ∗∗∗ Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root ∗∗∗ --------------------------------------------- Threat actors have begun to exploit a recently disclosed critical security flaw impacting Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME).The vulnerability, tracked as CVE-2026-20230 (CVSS score: 8.6), is a case of improper input validation for specific HTTP requests that could allow an unauthenticated, .. --------------------------------------------- https://thehackernews.com/2026/06/cisco-unified-cm-flaw-exploited-after.html ∗∗∗ Home Assistant: Update stopft Informationsleck ∗∗∗ --------------------------------------------- Die jüngeren Home-Assistant-Updates stopfen unter anderem Informationslecks. Zudem gibt es das Home Assistant OS in neuer Version. --------------------------------------------- https://www.heise.de/news/Home-Assistant-Update-stopft-Informationsleck-113… ∗∗∗ Ubiquiti UniFi OS-Sicherheitslücken werden angegriffen ∗∗∗ --------------------------------------------- Ende Mai wurden kritische Sicherheitslücken in Ubiquiti UniFi OS bekannt. Inzwischen haben Angreifer diese im Visier. --------------------------------------------- https://www.heise.de/news/Ubiquiti-UniFi-OS-Sicherheitsluecken-werden-angeg… ∗∗∗ Cyberkriminelle: Die „Wirtschaftsprüfer“, die Sie nie beauftragt haben ∗∗∗ --------------------------------------------- Jede Organisation wird geprüft. Die Frage ist, wer die Prüfung durchführt. --------------------------------------------- https://www.welivesecurity.com/de/business-security/cyberkriminelle-die-wir… ∗∗∗ Hackergruppe will den Flughafen Wien angegriffen haben ∗∗∗ --------------------------------------------- Als Beweis wurden Frachtpapiere mit Waffenlieferungen veröffentlicht. Laut dem Flughafen Wien sind keine personenbezogenen Daten darunter --------------------------------------------- https://www.derstandard.at/story/3000000328608/hackergruppe-will-den-flugha… ∗∗∗ Zoho Corp. ManageEngine: Kritische SSO-Lücke ermöglicht Kontenübernahme ∗∗∗ --------------------------------------------- Angreifer können eine kritische Sicherheitslücke in mehreren Zoho Corp. ManageEngine-Produkten missbrauchen, um Konten zu übernehmen. --------------------------------------------- https://heise.de/-11342888 ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (corosync, firefox, kernel, kernel-rt, libpq, memcached, postgresql, postgresql16, postgresql:13, postgresql:16, python-urllib3, python3.14-urllib3, redis:6, skopeo, and vim), Debian (beets, gst-plugins-bad1.0, imagemagick, libmatio, python-urllib3, and u-boot), Fedora (chromium, coturn, frr, grout, materialx, perl-Crypt-DSA, and yt-dlp), Mageia (opensc, perl-Archive-Tar, and podofo), Oracle (fence-agents, libpq, mysql:8.4, and postgresql:16), .. --------------------------------------------- https://lwn.net/Articles/1079365/ ∗∗∗ [R1] Tenable Identity Exposure Version 3.93.5 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2026-16 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 23.06.2026
by Daily end-of-shift report 23 Jun '26

23 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Montag 22-06-2026 18:00 − Dienstag 23-06-2026 18:00 Handler: Guenes Holler Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Auswirkungen auf die Cybersicherheit von Organisationen durch die Entwicklung im Bereich Künstlicher Intelligenz ∗∗∗ --------------------------------------------- Künstliche Intelligenz verändert die Cybersicherheitslage grundlegend und erfordert neue Maßstäbe in der Reaktionsgeschwindigkeit. Während böswillige Akteure in der Vergangenheit bereits arbeitsteilig auf Künstliche Intelligenz gesetzt hatten – beispielsweise um Phishing-Mails zu verfassen – sind aktuelle KI-Systeme derart leistungsfähig, dass Schwachstellen in Software innerhalb kurzer Zeit sowohl umfassend als auch teilweise autonom erkannt, analysiert und in verwertbare Angriffspfade überführt können. Daraus kann eine Lage entstehen, die Organisationen mit einer erheblich steigenden Zahl neu entdeckter Schwachstellen, Exploits, Patches und Folgevorfällen konfrontiert. --------------------------------------------- https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-2… ∗∗∗ WhatsApp phishing attack uses fake business docs to hack PCs ∗∗∗ --------------------------------------------- An ongoing malware campaign is targeting WhatsApp users in multiple countries with deceptive messages that push VBScript files, leading to remote system access. --------------------------------------------- https://www.bleepingcomputer.com/news/security/whatsapp-phishing-attack-use… ∗∗∗ Nearly Half of LG Smart TV Apps Are Laced with Proxies ∗∗∗ --------------------------------------------- Everyone worries about the apps on their phone. Almost no one looks at the ones on their TV. We scanned 6,038 of them across LG and Samsung; 2,058 were selling your IP address. On screen, its a relaxing fish tank. Or a clock. Or solitaire. Or puppies. Under the hood, it is a residential proxy: software that can send other peoples internet traffic out through your living room. And we found it everywhere. --------------------------------------------- https://spur.us/blog/smart-tv-apps-residential-proxy-sdks ∗∗∗ Nach Protesten: AMD bringt RAM-Verschlüsselung TSME zurück ∗∗∗ --------------------------------------------- Ohne Ankündigung hat AMD das Sicherheitsmerkmal TSME bei bestimmten Ryzen-Prozessoren deaktiviert. Kunden protestierten, AMD reagiert. --------------------------------------------- https://www.heise.de/news/Nach-Protesten-AMD-bringt-RAM-Verschluesselung-TS… ∗∗∗ Secure-Boot: Zertifikatablauf steht an, Microsoft gibt weitere Hilfestellung ∗∗∗ --------------------------------------------- Die ersten Secure-Boot-Zertifikate laufen in diesen Tagen ab. Microsoft legt noch mal Handreichungen nach, für Linux auf Azure-VMs. --------------------------------------------- https://www.heise.de/news/Secure-Boot-Zertifikate-Ablauf-startet-weitere-Ha… ∗∗∗ The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration ∗∗∗ --------------------------------------------- We recently identified a bucket hijacking technique impacting multiple services across major cloud service providers (CSPs). The attack technique exploits a fundamental architectural flaw that is common across cloud providers and could potentially affect other cloud providers as well. --------------------------------------------- https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ ∗∗∗ Detecting the Klue supply chain attack in Salesforce instances ∗∗∗ --------------------------------------------- We summarize the Klue supply chain attack and provide detection guidance for Salesforce environments monitored by Datadog Cloud SIEM. --------------------------------------------- https://securitylabs.datadoghq.com/articles/detecting-the-klue-supply-chain… ∗∗∗ Fake-Shops, Abo-Fallen, Phishing-Gewinnspiele: Wie Kriminelle das Fußball-Fieber nutzen ∗∗∗ --------------------------------------------- Die Weltmeisterschaft in den USA, Mexiko und Kanada ist in vollem Gange. Dass Betrüger:innen von diesem Hype profitieren möchten, überrascht nicht. Dieser Artikel zeigt, welche Strategien und Mechanismen sie für ihre Fallen nutzen. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shops-abofallen-fussball/ ∗∗∗ Introducing Patch the Planet ∗∗∗ --------------------------------------------- What happens when you clear dozens of Trail of Bits engineers’ schedules, pair them with every open-source maintainer they can contact, and unleash the latest frontier models like GPT-5.5-Cyber on critical open-source targets? Thanks to our partnership with OpenAI and its Daybreak initiative, we can report that the impact is hundreds of discovered bugs, 64 pull requests, and 51 issues filed across 19 projects (with many more still undergoing coordinated disclosure). That was just the first week of Patch the Planet. --------------------------------------------- https://blog.trailofbits.com/2026/06/22/introducing-patch-the-planet/ ===================== = Vulnerabilities = ===================== ∗∗∗ Pixelsmash: Lücke in FFmpeg-Decoder gefährdet unzählige Systeme ∗∗∗ --------------------------------------------- Sicherheitsforscher von JFrog haben eine gefährliche Sicherheitslücke in dem weitverbreiteten freien Multimedia-Framework FFmpeg aufgedeckt. Wie die Forscher in einem Blogbeitrag schildern, können Angreifer damit zahlreiche auf FFmpeg angewiesene Softwarelösungen zum Absturz bringen. In einigen Fällen, etwa bei Jellyfin und Nextcloud, soll sogar eine Schadcodeausführung möglich sein. --------------------------------------------- https://www.golem.de/news/pixelsmash-luecke-in-ffmpeg-decoder-gefaehrdet-un… ∗∗∗ LWN Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1079083/ ∗∗∗ NCSC-2026-0209 [1.00] [M/H] Kwetsbaarheden verholpen in MongoDB Server ∗∗∗ --------------------------------------------- https://advisories.ncsc.nl/advisory?id=NCSC-2026-0209 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 22.06.2026
by Daily end-of-shift report 22 Jun '26

22 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 19-06-2026 18:00 − Montag 22-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Angriffswelle gegen FortiGate Devices - "FortiBleed" ∗∗∗ --------------------------------------------- Fortinet hat letzten Freitag, am 19.5.2026, nun auch ein offizielles Statement zu "FortiBleed" veröffentlicht. Wir hatten zuvor in einem Blog-Artikel unseren aktuellen Wissensstand beschrieben. Bei dieser Angriffswelle handelt es sich nicht um die Ausnutzung einer neuen Schwachstelle. Die Angreifer:innen verwenden stattdessen Zugangsdaten, die bei früheren Sicherheitsvorfällen (u. a. im Zusammenhang mit CVE-2025-59718, CVE-2025-59719 und CVE-2026-24858) erlangt wurden, sowie Brute-Force-Methoden gegen Geräte mit schwacher Passworthygiene und ohne Multi-Faktor-Authentifizierung (MFA). --------------------------------------------- https://www.cert.at/de/warnungen/2026/6/angriffswelle-gegen-fortigate-devic… ∗∗∗ New Prinz Eugen ransomware prioritizes recent files for encryption ∗∗∗ --------------------------------------------- A new ransomware operation named Prinz Eugen prioritizes recently modified files for encryption and leaves no ransom note on the system. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-prinz-eugen-ransomware-p… ∗∗∗ Squidbleed: 29 Jahre alte Lücke in populärer Proxy-Software entdeckt ∗∗∗ --------------------------------------------- Die zuletzt unter anderem durch die Entdeckung von HTTP/2 Bomb aufgefallenen Sicherheitsforscher von Calif haben mithilfe von Claude Mythos eine Sicherheitslücke in der weitverbreiteten freien Proxyserver-Software Squid entdeckt. Angreifer können damit Speicherinhalte leaken und Daten aus von Squid verarbeiteten HTTP-Requests abgreifen. Die Besonderheit dabei: Die Lücke wurde 1997 eingeführt und blieb damit fast drei Jahrzehnte unentdeckt. --------------------------------------------- https://www.golem.de/news/squidbleed-29-jahre-alte-luecke-in-populaerer-pro… ∗∗∗ AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network ∗∗∗ --------------------------------------------- A new malware family is turning forgotten home routers into a distributed reconnaissance and proxy network, not the DDoS botnet these devices usually end up in. [..] The campaign goes after routers built on Realtek's RTL819X chips, hardware that was current around 2012 to 2015. XLab first saw it on March 12, 2026, spreading from a single IP, 107.150.106.14. [..] The infected pool is mostly D-Link, with the DIR-850L alone making up about 75 percent. --------------------------------------------- https://thehackernews.com/2026/06/arystinger-malware-infects-4300-legacy.ht… ∗∗∗ New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported malware loader dubbed OXLOADER. According to Elastic Security Labs, the campaign leverages malicious Google Ads as a starting point to distribute the malware. --------------------------------------------- https://thehackernews.com/2026/06/new-oxloader-loader-uses-malicious.html ∗∗∗ Anlagebetrug mit Promi-Namen: Gefälschter oe24-Artikel lockt in die Falle ∗∗∗ --------------------------------------------- Angebliche Anlagetipps von Prominenten sind oft Teil einer Betrugsmasche. Aktuell missbrauchen Kriminelle den Namen von Armin Wolf und der Raiffeisen Bank für eine gefälschte Berichterstattung im Design von oe24. Das Ziel besteht darin, Leser:innen auf eine betrügerische Anlageplattform zu locken. --------------------------------------------- https://www.watchlist-internet.at/news/anlagebetrug-mit-promi-namen-gefaels… ∗∗∗ Popa Botnetz kapert Smart TVs für Web-Scraping ∗∗∗ --------------------------------------------- icherheitsforscher haben ein Botnetz enttarnt, welches Millionen Smart TVs gekapert hat. Die Millionen Android Smart TV-Geräte, die Teil des Popa-Botnets sind, leiteten Webverkehr (Web-Scaping) an dessen Betreiber weiter. --------------------------------------------- https://borncity.com/blog/2026/06/22/popa-botnetz-kapert-smart-tvs-fuer-web… ∗∗∗ Mark-of-the-web and pinning installers to sites ∗∗∗ --------------------------------------------- While MoTW is intended for the operating system and other origin-aware applications such as MSFT Office to make security decisions, an executable can also access its own MoTW. This is the basis for a proof-of-concept with a simple Win32 GUI application ... --------------------------------------------- https://blog.randomoracle.io/2026/06/20/mark-of-the-web-and-pinning-install… ===================== = Vulnerabilities = ===================== ∗∗∗ libssh2: Teils kritische Lücken in populärer SSH-Bibliothek ∗∗∗ --------------------------------------------- Angreifer können CVE-2026-55200 ausnutzen, indem sie speziell gestaltete SSH-Pakete mit übermäßig großen package_length-Werten übermitteln und dadurch Schreibvorgänge außerhalb vorgesehener Grenzen auslösen. Die Folge ist eine Korruption des Heap-Speichers, wodurch im schlimmsten Fall Schadcode eingeschleust und zur Ausführung gebracht werden kann. [..] Alle Versionen von libssh2 bis einschließlich der seit Oktober 2024 als aktuell geltenden Version 1.11.1 sollen anfällig für CVE-2026-55199 und CVE-2026-55200 sein. Korrekturen wurden mit den Commits 1762685 und 97acf3d bereitgestellt. Wann ein neues Release mit den beiden Patches erscheint, ist noch unklar. --------------------------------------------- https://www.golem.de/news/libssh2-teils-kritische-luecken-in-populaerer-ssh… ∗∗∗ Bamboo, Confluence & Co.: Atlassian schließt 100 Sicherheitslücken ∗∗∗ --------------------------------------------- Wie aus dem Sicherheitsbereich der Atlassian-Website hervorgeht, haben die Entwickler in aktuellen Versionen insgesamt 100 Lücken geschlossen. Davon sind neben dem eigenen Code auch Abhängigkeiten zu etwa Apache Tomcat betroffen. --------------------------------------------- https://www.heise.de/news/Bamboo-Confluence-Co-Atlassian-schliesst-100-Sich… ∗∗∗ LWN: Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1078922/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 19.06.2026
by Daily end-of-shift report 19 Jun '26

19 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 18-06-2026 18:00 − Freitag 19-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ USB worm spreads crypto-stealing malware via Windows shortcut files ∗∗∗ --------------------------------------------- Threat actors targeting cryptocurrency wallets have been distributing clipboard-stealing malware with self-spreading capabilities and using the Tor network to conceal communication. --------------------------------------------- https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stea… ∗∗∗ Jailbreak möglich: Wohl unpatchbarer Hardware-Bug gefährdet iPhones ∗∗∗ --------------------------------------------- Forscher haben einen offenbar unpatchbaren Bug entdeckt, der Jailbreaks für mehrere iPhone-, iPad- und Apple-Watch-Modelle ermöglichen könnte. --------------------------------------------- https://www.golem.de/news/jailbreak-moeglich-wohl-unpatchbarer-hardware-bug… ∗∗∗ Warnung vor Fake-Rechnungen von Sixt Server ∗∗∗ --------------------------------------------- Derzeit melden sich zahlreiche Unternehmen bei uns, die Rechnungen für angebliche Cloud-Dienstleistungen erhalten haben. Tatsächlich handelt es sich dabei um einen Betrugsversuch: Die gefälschten Rechnungen sollen Unternehmen zu einer unberechtigten Zahlung verleiten. --------------------------------------------- https://www.watchlist-internet.at/news/fake-rechnungen-von-sixt-server/ ∗∗∗ Killing me gently: Inside Gentlemen’s EDR killer framework ∗∗∗ --------------------------------------------- ESET Research shares the results of a months-long investigation into the suite of EDR killers maintained by the RaaS gang Gentlemen. --------------------------------------------- https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-ge… ∗∗∗ Brand der Floridsdorfer Brücke: Glasfaserausfälle in Wien ∗∗∗ --------------------------------------------- Heute hat es auf der Floridsdorfer Brücke gebrannt. Was der ORF nicht meldet ist, dass über diese Brücke auch Glasfasertrassen geführt werden, und dass durch den Brand einige dieser Leitungen ausgefallen sind. Wenn man die Standorte der relevanten Rechenzentren in Wien kennt, dann ist sofort klar, dass das sehr relevant ist. Bei uns ging bis jetzt eine formelle NIS Meldung ein, weiters haben wir informell von anderen Organisationen gehört, dass sie betroffen sind. --------------------------------------------- https://www.cert.at/de/aktuelles/2026/6/brand-der-floridsdorfer-brucke-glas… ∗∗∗ Bulgaria allowed surveillance tech firm to sell products to repressive regimes, report says ∗∗∗ --------------------------------------------- The nonprofit Human Rights Watch obtained export licensing records covering 2018 through 2023, which show the Bulgarian government allowed the surveillance firm Circles to peddle the tech to law enforcement and intelligence agencies in several countries known for human rights abuses. --------------------------------------------- https://therecord.media/bulgaria-allowed-surveillance-tech-firm-to-sell-to-… ∗∗∗ PeopleSoft PeopleTools Pre-Authentication RCE: A PSIGW SSRF Chain That Executes Inside the JVM ∗∗∗ --------------------------------------------- A pre-authentication remote code execution (RCE) chain in Oracle PeopleSoft PeopleTools reaches an internal-only management servlet through a server-side request forgery (SSRF) in the PSIGW gateway, then gains code execution through Java XMLDecoder deserialization. Oracle assigned CVE-2026-35273 (CVSS 9.8) and released an out-of-band patch on June 10, 2026. [..] Our researchers discovered new information about this vulnerability, which was responsibly disclosed to Oracle as part of our investigation. --------------------------------------------- https://www.trendmicro.com/en_us/research/26/f/PeopleTools.html ∗∗∗ Anthropics KI Mythos: Unternehmen haben weiter Zugriff auf Preview-Version ∗∗∗ --------------------------------------------- Trotz US-Anordnung haben manche Unternehmen weiterhin Zugriff auf eine Preview-Version von Anthropics KI-Modell Mythos. --------------------------------------------- https://heise.de/-11338742 ∗∗∗ I discovered a large-scale malware distribution on GitHub ∗∗∗ --------------------------------------------- This is the story of how I found 10,000 repositories on GitHub that distribute Trojan malware. They are all from different contributors, have different names, and are not forks of other repositories. But they share a common pattern, which is what allowed me to write a script to find such repositories. --------------------------------------------- https://orchidfiles.com/github-repositories-distributing-malware/ ===================== = Vulnerabilities = ===================== ∗∗∗ Windows 10/11: Rechteausweitung in AMD-RAID-Treiber ∗∗∗ --------------------------------------------- Im AMD RAID-Treiber für Windows 10 und Windows 11 ist ein gravierender Bug bekannt geworden, der die Sicherheit des Systems gefährdet. Die Schwachstelle CVE-2024-21962, hat einen CVSS-Score von 8.6. AMD und auch der Hersteller HP haben Sicherheitshinweise sowie eine neue Treiberversion veröffentlicht. --------------------------------------------- https://borncity.com/blog/2026/06/19/windows-10-11-rechteausweitung-in-amd-… ∗∗∗ LWN: Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1078662/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 18.06.2026
by Daily end-of-shift report 18 Jun '26

18 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 17-06-2026 18:00 − Donnerstag 18-06-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Rogueplanet-Exploit: Microsoft verspricht ein "High-Quality-Sicherheitsupdate" ∗∗∗ --------------------------------------------- Microsoft will mit einem Update die Ausnutzung des Rogueplanet-Exploits auf Windows-Geräten unterbinden. Wann das passiert, bleibt aber ein Rätsel. --------------------------------------------- https://www.golem.de/news/rogueplanet-exploit-microsoft-verspricht-ein-high… ∗∗∗ Jetzt patchen: Nginx-Webserver durch kritische Lücken angreifbar ∗∗∗ --------------------------------------------- Angreifer können aufgrund von Sicherheitslücken in drei Nginx-Modulen Webserver lahmlegen oder Schadcode einschleusen. Patches verhindern das. --------------------------------------------- https://www.golem.de/news/jetzt-patchen-nginx-webserver-durch-kritische-lue… ∗∗∗ Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline ∗∗∗ --------------------------------------------- A French-speaking attacker broke into a small French automotive business, planted a keylogger, and stole banking and email credentials.Ordinary stuff, until one move near the end.Before his command-and-control server went dark, he installed OpenSSH and Tailscale on a victims machine, building a way back in that did not run through the C2 at all. When the Havoc server went .. --------------------------------------------- https://thehackernews.com/2026/06/junior-hacker-used-tailscale-and.html ∗∗∗ Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments ∗∗∗ --------------------------------------------- An unknown threat actor has been observed leveraging paid or promoted posts on legitimate news websites to drum up buzz for their warez, according to new findings from Check Point Research.The threat actor also has at their disposal a dedicated WordPress .. --------------------------------------------- https://thehackernews.com/2026/06/crypto-clipper-campaign-abuses-fake.html ∗∗∗ Operation Endgame: Ermittler säubern tausende Blogs von SocGholish ∗∗∗ --------------------------------------------- Strafverfolger aus vier Ländern zerschlugen ein Botnet und Wordpress-Blogs, die Kriminelle als Verteilstationen für Schadsoftware mißbrauchten. --------------------------------------------- https://www.heise.de/news/Operation-Endgame-Ermittler-saeubern-tausende-Blo… ∗∗∗ Auslaufende Secure Boot-Zertifikate - was war, was ist, was kommt ∗∗∗ --------------------------------------------- Zwei völlig unterschiedliche Technologien, eine sehr ähnliche Problematik - DNS und Secure Boot sind beides Technologien die (idealerweise) problemfrei im Hintergrund laufen .. bis sie dann plötzlich zum Thema werden. Genau das könnte im Laufe dieses Jahres bei Secure Boot der Fall sein - die kryptographischen Vertrauensanker, auf denen UEFI Secure Boot beruht, stammen größtenteils aus dem Jahr 2011. Und das Ende fünfzehnjährigen .. --------------------------------------------- https://www.cert.at/de/blog/2026/6/auslaufende-secure-boot-zertifikate-was-… ∗∗∗ Aktueller Stand rund um "FortiBleed" ∗∗∗ --------------------------------------------- Vergangenes Wochenende entdeckte ein Sicherheitsforscher im Rahmen seiner Arbeit eine ungewöhnlich strukturierte Sammlung gestohlener Daten, welche sich nach weiterer Analyse als kompromittierte Zugangsdaten für zehntausende Fortinet-Systeme weltweit herausstellten. Die Echtheit der Daten wurden in weiterer Folge sowohl durch unabhängige Sicherheitsexperten als auch das Sicherheitsunternehmen Hudson Rock bestätigt. Die rund 75.000 betroffenen Fortinet-Systeme .. --------------------------------------------- https://www.cert.at/de/blog/2026/6/aktueller-stand-rund-um-fortibleed ∗∗∗ EU grants Ukraine access to cybersecurity reserve for major attacks ∗∗∗ --------------------------------------------- As Kyiv takes steps toward formal accession to the EU, the bloc is integrating Ukraine with its pool of pre-approved cybersecurity incident response companies. --------------------------------------------- https://therecord.media/ukraine-access-eu-cybersecurity-reserve ∗∗∗ Von Blaster bis BlueHammer: Wiederholt sich die Geschichte bei Microsoft? ∗∗∗ --------------------------------------------- Seit einigen Wochen gibt es ja einen ziemlichen Disput zwischen einem Sicherheitsforscher mit dem Alias Nightmare Eclipse und dem Microsoft Security Response Center-Team (MSRC-Team). Es geht um die Art, wie Sicherheitslücken gemeldet, .. --------------------------------------------- https://borncity.com/blog/2026/06/18/von-blaster-bis-bluehammer-wiederholt-… ∗∗∗ The Road to Post-Quantum Readiness Part 1 of 2: Understanding the Risk ∗∗∗ --------------------------------------------- Post-Quantum Cryptography is no longer a future-only concern. Standards are final, major providers have already deployed hybrid protection, and the real risk now is data captured today and decrypted later. Part 1 explains the fundamentals, the threat, and why organizations can no longer afford to wait. --------------------------------------------- https://blog.nviso.eu/2026/06/18/the-road-to-post-quantum-readiness-part-1/ ∗∗∗ Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign ∗∗∗ --------------------------------------------- Cybercriminals hijacked Google Ads searches for popular AI developer tools to funnel over 2,000 victims toward malicious download pages before quietly moving their operation onto claude.ais own platform, turning the trusted domain into a delivery mechanism for credential-stealing malware. --------------------------------------------- https://www.trendmicro.com/en_us/research/26/f/claudeai-shared-chat-abused-… ===================== = Vulnerabilities = ===================== ∗∗∗ Drupal core - Critical - PHP object injection - SA-CORE-2026-005 ∗∗∗ --------------------------------------------- Project: Drupal coreDate: 2026-June-05Security risk: Critical 18 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: PHP object injectionAffected versions: =10.6.0 =11.2.0 =11.3.0 CVE IDs: CVE-2026-55803Description: SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web .. --------------------------------------------- https://www.drupal.org/sa-core-2026-005 ∗∗∗ Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050 ∗∗∗ --------------------------------------------- Project: Plotly.js GraphingDate: 2026-June-17Security risk: Critical 19 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: PHP object injectionAffected versions: CVE IDs: .. --------------------------------------------- https://www.drupal.org/sa-contrib-2026-050 ∗∗∗ Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049 ∗∗∗ --------------------------------------------- Project: Flag attendance fieldDate: 2026-June-17Security risk: Critical 19 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: PHP object injectionAffected versions: CVE IDs: CVE-2026-55809Description: The Flag attendance field module gives you the ability to add attendance by depending on Flag module.flag_attendance_field stores .. --------------------------------------------- https://www.drupal.org/sa-contrib-2026-049 ∗∗∗ Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048 ∗∗∗ --------------------------------------------- Project: Formatter FieldDate: 2026-June-17Security risk: Critical 19 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: PHP object injectionAffected versions: CVE IDs: CVE-2026-12535Description: The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a .. --------------------------------------------- https://www.drupal.org/sa-contrib-2026-048 ∗∗∗ SVD-2026-0614: OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit ∗∗∗ --------------------------------------------- In Splunk AI Toolkit versions below 5.7.4, a user who holds the “admin” Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance.The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation. --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2026-0614 ∗∗∗ Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Crosswork Network Controller Server-Side Template Injection Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Webex App Open Redirect Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Hardcoded Root Cloud Credentials in Application Binaries in Silver Leaf Technologies Worksnaps ∗∗∗ --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/hardcoded-root-cloud-cre… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 17.06.2026
by Daily end-of-shift report 17 Jun '26

17 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 16-06-2026 18:00 − Mittwoch 17-06-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Kodak confirms data breach claimed by ShinyHunters extortion gang ∗∗∗ --------------------------------------------- Kodak has confirmed that its working with external cybersecurity experts to investigate a security breach after hackers gained access to some of the companys data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/kodak-confirms-data-breach-c… ∗∗∗ Historischer Anstieg: KI lässt Anzahl gemeldeter Sicherheitslücken explodieren ∗∗∗ --------------------------------------------- Neuen Hochrechnungen zufolge könnten 2026 etwa 66.000 neue Sicherheitslücken registriert werden. Im Vorjahr waren es noch deutlich weniger. --------------------------------------------- https://www.golem.de/news/historischer-anstieg-ki-laesst-anzahl-gemeldeter-… ∗∗∗ Fußball-WM: Offizielles Streamingportal der Fifa gehackt ∗∗∗ --------------------------------------------- Eine Forscherin hat eine unzureichende Sicherheitsprüfung bei Systemen der Fifa entdeckt. Angreifer hätten Streams der laufenden WM sabotieren können. --------------------------------------------- https://www.golem.de/news/fussball-wm-offizielles-streamingportal-der-fifa-… ∗∗∗ France To Stop Certifying Products Without Quantum-Safe Encryption ∗∗∗ --------------------------------------------- Starting in 2027, Frances cybersecurity agency ANSSI will stop certifying security products that lack quantum-resistant encryption, effectively forcing government agencies and critical infrastructure operators to phase out older cryptographic systems. Reuters reports: Samih Souissi, ANSSIs chief of staff, said at the France Quantum conference that .. --------------------------------------------- https://it.slashdot.org/story/26/06/16/181236/france-to-stop-certifying-pro… ∗∗∗ WordPress PBN Plugin Drops Dual Webshells via Database Injection ∗∗∗ --------------------------------------------- During a recent incident response engagement, our team uncovered a multi-stage WordPress infection that goes beyond the usual file-based malware. The attacker combined a fake plugin, a remote command-and-control server, and two PHP web shells stored directly inside the WordPress database.The campaign is operated by a Turkish-speaking threat actor .. --------------------------------------------- https://blog.sucuri.net/2026/06/wordpress-pbn-plugin-drops-dual-webshells-v… ∗∗∗ CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution ∗∗∗ --------------------------------------------- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting Widget Factory Joomla Content Editor (JCE) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. --------------------------------------------- https://thehackernews.com/2026/06/cisa-warns-of-actively-exploited-joomla.h… ∗∗∗ Three critical Fortinet sandbox bugs splattered by unknown attackers ∗∗∗ --------------------------------------------- All have patches, so make sure you upgrade to a fixed version --------------------------------------------- https://www.theregister.com/security/2026/06/16/three-critical-fortinet-san… ∗∗∗ ‘Dangerous’ AI Models Are Coming No Matter What ∗∗∗ --------------------------------------------- The US government crackdown on Anthropic’s Claude Fable 5 and Mythos 5 hides a glaring truth: AI models with advanced hacking capabilities will soon be the norm. --------------------------------------------- https://www.wired.com/story/dangerous-ai-models-are-coming-no-matter-what/ ∗∗∗ Mehrere Plug-ins für JetBrains-IDEs stehlen API-Keys für OpenAI, DeepSeek & Co. ∗∗∗ --------------------------------------------- Mindestens 15 Plug-ins für JetBrains-IDEs übermitteln API-Keys an einen externen Server. Dabei bieten sie ansonsten die versprochenen Funktionen. --------------------------------------------- https://www.heise.de/news/Mehrere-Plug-ins-fuer-JetBrains-IDEs-stehlen-API-… ∗∗∗ Android 17 hat direkt Sicherheitspatches mit an Bord ∗∗∗ --------------------------------------------- Googles Entwickler haben in der Launchversion von Android 17 diverse Sicherheitslücken geschlossen. --------------------------------------------- https://www.heise.de/news/Android-17-hat-direkt-Sicherheitspatches-mit-an-B… ∗∗∗ Angriffe auf FortiSandbox-Schwachstellen ∗∗∗ --------------------------------------------- Schwachstellen in FortiSandbox sind derzeit Ziel von Angriffen im Internet. Patches zum Absichern stehen seit April bereit. --------------------------------------------- https://www.heise.de/news/Angriffe-auf-FortiSandbox-Schwachstellen-11335667… ∗∗∗ NIS2-Mahnung: BSI setzt neue Frist zur Registrierung bis Ende Juli ∗∗∗ --------------------------------------------- Die Registrierungszahlen zum IT-Sicherheitsgesetz enttäuschen. Das BSI mahnt Firmen, NIS2-Vorgaben einzuhalten, und gibt eine neue Deadline vor. --------------------------------------------- https://www.heise.de/news/NIS2-Mahnung-BSI-setzt-neue-Frist-zur-Registrieru… ∗∗∗ GitHub dismissed security reports on flaws now exploited by supply-chain worm, researchers say ∗∗∗ --------------------------------------------- GitHub rejected two formal vulnerability reports identifying design flaws that researchers say are enabling variants of the Shai-Hulud supply-chain worm to infect and compromise hundreds of software packages and developer accounts worldwide. --------------------------------------------- https://therecord.media/github-dismissed-reports-shai-hulud-deep-specter ∗∗∗ Reducing Microsoft Sentinel Costs Without Compromising Detection – Part 1: The Summary Rules Quest ∗∗∗ --------------------------------------------- This blog is the first in a series exploring how Summary Rules, together with Auxiliary or Data Lake storage, can help organizations optimize SIEM costs without compromising core threat detection and monitoring capabilities. --------------------------------------------- https://blog.nviso.eu/2026/06/17/reducing-microsoft-sentinel-costs-without-… ∗∗∗ FortiBleed — 75k Fortinet firewalls have admin passwords cracked ∗∗∗ --------------------------------------------- An interesting post popped up on LinkedIn at the weekend from Voldymyr Diachenko saying plain text passwords were found in the wild by Hunt Intelligence Inc for Fortinet firewalls .. --------------------------------------------- https://doublepulsar.com/fortibleed-75k-fortinet-firewalls-have-admin-passw… ∗∗∗ Threat tactic spotlight: Subdomain takeover ∗∗∗ --------------------------------------------- In this blog post you’ll learn how to detect and prevent subdomain takeover – a tactic where threat actors exploit dangling DNS records to redirect traffic to attacker-controlled resources. We’ll explain the issue, how the situation arises, and how you can use various AWS features and services to help mitigate the impact of this tactic. --------------------------------------------- https://aws.amazon.com/blogs/security/threat-tactic-spotlight-subdomain-tak… ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Security Patch Update Advisory - June 2026 ∗∗∗ --------------------------------------------- https://www.oracle.com/security-alerts/cspujun2026.html ∗∗∗ Multiple Vulnerabilities in Quanos Content Solutions SCHEMA ST4 ∗∗∗ --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities… ∗∗∗ A 27-Year-Old Authentication Bypass in OpenBSDs PPP Stack ∗∗∗ --------------------------------------------- https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 16.06.2026
by Daily end-of-shift report 16 Jun '26

16 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Montag 15-06-2026 18:00 − Dienstag 16-06-2026 18:00 Handler: Guenes Holler Co-Handler: n/a ===================== = News = ===================== ∗∗∗ ÖIAT-Studie: Über 600.000 betrügerische und problematische Werbeanzeigen auf Facebook und Instagram ∗∗∗ --------------------------------------------- Eine „Analyse des Betrugsökosystems Online-Werbung auf Meta-Plattformen“ hat erstaunliche Ergebnisse geliefert. Über einen Zeitraum von drei Monaten entdeckte die Forschungsabteilung des ÖIAT über 600.000 betrügerische bzw. problematische Werbeanzeigen auf Meta-Plattformen. EU-weit wurden diese über 1 Milliarde Mal ausgespielt, davon 123 Millionen Mal allein in Österreich. --------------------------------------------- https://www.watchlist-internet.at/news/betruegerische-problematische-werbea… ∗∗∗ Mit Malware erbeutet: 124 Millionen neue Passwörter bei HaveIBeenPwned ∗∗∗ --------------------------------------------- Cyberkriminelle greifen mit Infostealer-Malware häufig Zugangsdaten ab. HaveIBeenPwned hat seine Datenbank um eine große Sammlung davon erweitert. --------------------------------------------- https://www.golem.de/news/mit-malware-erbeutet-124-millionen-neue-passwoert… ∗∗∗ Windows version of SprySOCKS Linux malware used to attack govt orgs ∗∗∗ --------------------------------------------- Windows variants for the SprySOCKS Linux malware have been used in attacks targeting government organizations in at least four countries. --------------------------------------------- https://www.bleepingcomputer.com/news/security/windows-version-of-sprysocks… ∗∗∗ Ransomware gang abuses Microsoft Teams relays to hide malicious traffic ∗∗∗ --------------------------------------------- DragonForce ransomware used a custom malware named 'Backdoor.Turn' to hide command-and-control traffic inside Microsoft Teams relay infrastructure. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ransomware-gang-abuses-micro… ∗∗∗ North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels ∗∗∗ --------------------------------------------- Cybersecurity researchers have flagged two malicious cyber campaigns that exhibit similarities with a persistent North Korean threat cluster known as Contagious Interview (aka Famous Chollima, HexagonalRodent, and Void Dokkaebi). According to a report published by Proofpoint, the threat actor has been found orchestrating phishing campaigns using developer role recruitment or code review themes to target nearly 100 organizations in finance, cryptocurrency, education, technology, and several other sectors. The activity has been codenamed UNK_DeadDrop. --------------------------------------------- https://thehackernews.com/2026/06/north-korean-hackers-are-turning.html ∗∗∗ EvilTokens: Neue Phishing-Kampagne verschafft sich Zugriff mit legitimen Mitteln ∗∗∗ --------------------------------------------- Was passiert, wenn bei einem Phishing-Angriff offizielle Infrastruktur genutzt wird, anstatt diese zu fälschen? EvilTokens markiert eine Weiterentwicklung des Phishing: Es werden nicht mehr Anmeldedaten gestohlen, sondern die Opfer dazu verleitet, legitime Sitzungen zu autorisieren. --------------------------------------------- https://www.welivesecurity.com/de/cybercrime/eviltokens-neue-phishing-kampa… ∗∗∗ Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE ∗∗∗ --------------------------------------------- We discovered a vulnerability in the Google Cloud Vertex AI software development kit (SDK) for Python, and responsibly disclosed it to Google. Before Google’s fix, the vulnerability would have allowed an attacker operating entirely from their own Google Cloud project to hijack a victim's model upload and poison it. By exploiting this flaw in vulnerable versions of the SDK, an attacker can achieve remote code execution (RCE) within a target’s Vertex AI serving infrastructure, with zero initial access to the victim's project. --------------------------------------------- https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/ ∗∗∗ Viel Geduld: Chinesische IT-Spione lauerten lange in Forschungseinrichtungen ∗∗∗ --------------------------------------------- Viel Geduld haben chinesische Angreifer bewiesen: Sie nisteten sich in Redcap-Servern ein, nutzten das aber erst mehr als ein Jahr später voll aus. --------------------------------------------- https://heise.de/-11333355 ∗∗∗ GlassWASM: WebAssembly Malware Found in Trojanized Open VSX Extensions ∗∗∗ --------------------------------------------- The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure. --------------------------------------------- https://socket.dev/blog/glasswasm-malware-open-vsx-extensions?utm_medium=fe… ∗∗∗ A backdoor in a LinkedIn job offer ∗∗∗ --------------------------------------------- Last week, I got a LinkedIn message from a recruiter at a small crypto startup. We exchanged a few messages over a couple of days, she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” It’s not uncommon to ask for a review of an existing codebase, but something felt off and raised an alarm in my head, so I decided to get a bit extra paranoid. --------------------------------------------- https://roman.pt/posts/linkedin-backdoor/ ∗∗∗ Critical Fortinet FortiSandbox flaws now exploited in attacks ∗∗∗ --------------------------------------------- Attackers are now exploiting several critical vulnerabilities in Fortinet's FortiSandbox cyber threat detection platform, according to threat intelligence company Defused. Fortinet released security updates for these three critical-severity security flaws (tracked as CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089) on April 14. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-fortinet-fortisandb… ===================== = Vulnerabilities = ===================== ∗∗∗ Root-Attacken auf Cisco Catalyst SD-WAN Manager und cPanel-Plug-in LiteSpeed ∗∗∗ --------------------------------------------- Admins, die Cisco Catalyst SD-WAN Manager oder cPanel mit LiteSpeed-Plug-in verwalten, sollten aufgrund von laufenden Angriffen umgehend die verfügbaren Sicherheitsupdates installieren. Im schlimmsten Fall können Angreifer als root-Nutzer auf Systeme zugreifen. Damit das klappt, müssen sie aber zuerst einige Hürden überwinden. --------------------------------------------- https://www.heise.de/news/Root-Attacken-auf-Cisco-Catalyst-SD-WAN-Manager-u… ∗∗∗ LWN Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1078158/ ∗∗∗ Broken Access Control in syracom AG Secure Login (2FA) for Atlassian Jira / Confluence / Bitbucket ∗∗∗ --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in… ∗∗∗ Zyxel security advisory for stack-based buffer overflow vulnerability in GS1900 series switches ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 15.06.2026
by Daily end-of-shift report 15 Jun '26

15 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 12-06-2026 18:00 − Montag 15-06-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ New attack turned Microsoft 365 Copilot into 1-click data theft tool ∗∗∗ --------------------------------------------- A critical vulnerability chain dubbed SearchLeak in Microsoft 365 Copilot Enterprise could allow attackers to steal sensitive data from a targets mailbox, OneDrive, or SharePoint account through a specially crafted URL. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-attack-turned-microsoft-… ∗∗∗ Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites ∗∗∗ --------------------------------------------- An attacker tampered with trusted JavaScript files used by WordPress sites running PushEngage, OptinMonster, and TrustPulse, turning those files into a way to break into the sites.When a site administrator was logged in as the file loaded, the code created an admin account under the attackers control and installed a hidden plugin that opened a way back in. --------------------------------------------- https://thehackernews.com/2026/06/popular-wordpress-plugin-scripts.html ∗∗∗ „Sommer der Glückseligkeit“: curl nimmt einen Monat lang keine Bug-Reports an ∗∗∗ --------------------------------------------- Seit Wochen kämpft der Maintainer von curl mit der Arbeitslast durch die Flut an KI-generierten Bug-Reports. Im Juli soll deshalb keiner angenommen werden. --------------------------------------------- https://www.heise.de/news/Sommer-der-Glueckseligkeit-curl-nimmt-einen-Monat… ∗∗∗ WKO-Phishing: Betrugsmail fordert Datenaktualisierung ∗∗∗ --------------------------------------------- Aktuell behauptet eine E-Mail im Namen der Wirtschaftskammer Österreich (WKO), dass Unternehmensdaten nicht aktualisiert wurden. Wer den enthaltenen Link nicht ausfüllt, dem werden umfassende Strafen angedroht. Tatsächlich haben es Kriminelle auf sensible Unternehmens- und Personendaten abgesehen. --------------------------------------------- https://www.watchlist-internet.at/news/wko-phishing-betrugsmail-fordert-dat… ∗∗∗ FortiNet SSO Vulnerability CVE-2025-59718 and CVE-2025-59719 Leading to Full System Compromise ∗∗∗ --------------------------------------------- Earlier this year, Truesec CSIRT responded to multiple incidents related to the two FortiCloud single-sign-on (SSO) vulnerabilities from December 2025 (tracked as CVE-2025-59718 and CVE-2025-59719). In this blog post, we share our insights into threat actors’ activities and methods for compromising an environment. --------------------------------------------- https://www.truesec.com/hub/blog/vulnerability-cve-2025-59718-and-cve-2025-… ∗∗∗ Routerhersteller fordern Kontrolle importierter Geräte ∗∗∗ --------------------------------------------- EU-Sicherheitsvorschriften für 5G-Mobilfunk sollen Spionage vorbeugen. Für Heimnetzwerke gibt es keine entsprechenden Regeln, kritisieren nun Hersteller. --------------------------------------------- https://heise.de/-11331799 ∗∗∗ 152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Faked Google Search Traffic ∗∗∗ --------------------------------------------- Sockets Threat Research Team identified a family of 152 Chrome Web Store new-tab "live wallpaper" extensions, built from one shared codebase but distributed across 38 separate Chrome Web Store publisher accounts and three brand backends, carrying a combined total of approximately 105,000 reported installs. --------------------------------------------- https://socket.dev/blog/152-chrome-live-wallpaper-extensions-hid-ad-tracking ∗∗∗ Präparierte PDF-Datei kann Avira Antivirus gefährlich werden ∗∗∗ --------------------------------------------- In einer Schwachstellendatenbank sind Lücken in Avira Antivirus aufgetaucht. Bislang listet der Softwarehersteller die Lücken nicht auf. Sie sind aber gepatcht. --------------------------------------------- https://www.heise.de/news/Praeparierte-PDF-Datei-kann-Avira-Antivirus-gefae… ∗∗∗ LibreNMS Authenticated RCE (< 26.5.0) ∗∗∗ --------------------------------------------- When theres one, theres normally more. This is a part 2 to our previous post on LibreNMS. This vulnerability allows an admin user to inject commands that are passed to the exec function, which will then be executed as the user running the poller. --------------------------------------------- https://projectblack.io/blog/librenms-authenticated-rce-26-5-0/ ∗∗∗ Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE) ∗∗∗ --------------------------------------------- On June 10th, Splunk published this CVE-2026-20253 advisory [..] It has everything that we love: No authentication requirements, An almost full-mark CVSS score, Claims to be a security product, Vulnerability name longer than the average piece of spaghetti. --------------------------------------------- https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-a… ===================== = Vulnerabilities = ===================== ∗∗∗ Splunk: SVD-2026-0603: Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise ∗∗∗ --------------------------------------------- In Splunk Enterprise versions below 10.2.4 and 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2026-0603 ∗∗∗ phpBB: Kritische Sicherheitslücke ermöglicht Kompromittierung ∗∗∗ --------------------------------------------- In der Forensoftware phpBB haben IT-Forscher eine kritische Sicherheitslücke entdeckt, die Zugang mit jedem angelegten Konto ermöglicht. --------------------------------------------- https://www.heise.de/news/phpBB-Kritische-Sicherheitsluecke-ermoeglicht-Kom… ∗∗∗ LWN: Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1077945/ ∗∗∗ Zahlreiche kritische Schwachstellen in Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/zahlreiche-kritische-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 12.06.2026
by Daily end-of-shift report 12 Jun '26

12 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 11-06-2026 18:00 − Freitag 12-06-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Pharma giant Novo Nordisk discloses breach of clinical trials data ∗∗∗ --------------------------------------------- Danish pharmaceutical giant Novo Nordisk, the worlds largest producer of insulin, disclosed a data breach affecting patient information from some clinical trials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/pharmaceutical-giant-novo-no… ∗∗∗ 336 Millionen Euro in Bitcoin gewaschen: Geldwäschedienst AudiA6 zerschlagen ∗∗∗ --------------------------------------------- Ein AudiA6 genannter Geldwäschedienst ließ Hacker und Betrüger Bitcoin-Transaktionen in Millionenhöhe verschleiern. Doch damit ist jetzt Schluss. --------------------------------------------- https://www.golem.de/news/336-millionen-euro-in-bitcoin-gewaschen-geldwaesc… ∗∗∗ Kernel-Bug: FreeBSD-Exploit "Bumsrakete" verleiht Root-Zugriff ∗∗∗ --------------------------------------------- Ein Exploit namens Bumsrakete gefährdet alle FreeBSD-Versionen der letzten fünf Jahre. Die Entdecker nehmen es mit reichlich Humor. --------------------------------------------- https://www.golem.de/news/kernel-bug-freebsd-exploit-bumsrakete-verleiht-ro… ∗∗∗ LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of three now-patched security flaws impacting LangGraph, including a critical vulnerability chain that could result in remote code execution.LangGraph is an open-source framework created by LangChain to .. --------------------------------------------- https://thehackernews.com/2026/06/langgraph-flaw-chain-exposes-self.html ∗∗∗ INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator ∗∗∗ --------------------------------------------- An INTERPOL-led operation last month resulted in the disruption of Sniper Dz, a decade-long phishing-as-a-service (PhaaS) platform, Group-IB said Thursday.The effort, codenamed Operation Ramz, took place between October 2025 and February .. --------------------------------------------- https://thehackernews.com/2026/06/interpol-takes-down-sniper-dz-phishing.ht… ∗∗∗ Drug Sites Hijacked Spotify’s Search Ranking Through Fake Podcasts ∗∗∗ --------------------------------------------- A joint congressional report describes a spam operation that turned tens of thousands of fake podcasts into search-engine bait for illegal pharmacy and scam sites. --------------------------------------------- https://www.wired.com/story/drug-sites-hijacked-spotifys-search-ranking-thr… ∗∗∗ Ivanti Sentry: Verwirrung um Status von kritischem Befehlsschmuggel-Leck ∗∗∗ --------------------------------------------- Ivanti warnt aktuell vor kritischen Sicherheitslücken in Sentry. Die CISA warnt vor Angriffen, Ivanti wiegelt jedoch ab. --------------------------------------------- https://www.heise.de/news/Ivanti-Sentry-Wirrwar-um-Missbrauch-kritischer-Be… ∗∗∗ Ubiquiti UniFi OS: Kritische Lücken erlauben Codeschmuggel ∗∗∗ --------------------------------------------- Ubiquiti warnt vor teils kritischen Sicherheitslücken in UniFi OS. Aktualisierte Software steht bereit, um sie zu schließen. --------------------------------------------- https://www.heise.de/news/Ubiquiti-UniFi-OS-Kritische-Luecken-erlauben-Code… ∗∗∗ Fake verification pages are stealing Steam accounts from players ∗∗∗ --------------------------------------------- A convincing fake FACEIT verification page is stealing Steam accounts by using a fake login window that looks completely legitimate. --------------------------------------------- https://www.malwarebytes.com/blog/threat-intel/2026/06/fake-verification-pa… ∗∗∗ Hundreds of AUR packages compromised ∗∗∗ --------------------------------------------- Hundreds of orphaned packages hosted by the Arch User Repository (AUR) have been compromised by an attacker who has added a malicious npm package (atomic-lockfile) that can exfiltrate sensitive data. The project is currently working on cleaning up the mess. There is a list of affected packages and post (possibly NSFW domain) by"sodiboo" with additional information .. --------------------------------------------- https://lwn.net/Articles/1077718/ ∗∗∗ Decade-Long SniperDz Phishing Network Disrupted in Operation Ramz ∗∗∗ --------------------------------------------- Group-IB, INTERPOL and Algerian Police dismantle decade-old SniperDZ phishing network used to steal credentials, with its alleged developer arrested. --------------------------------------------- https://hackread.com/authorities-dismantle-sniperdz-phishing-network/ ∗∗∗ Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751) ∗∗∗ --------------------------------------------- It is yet another day in this parallel universe of security, where the devices we bolt onto the edge of our networks to keep the bad people out are, with remarkable consistency, the exact thing that let the bad .. --------------------------------------------- https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-acc… ===================== = Vulnerabilities = ===================== ∗∗∗ CVE-2026-45257: LPE in FreeBSD via kTLS-RX ∗∗∗ --------------------------------------------- https://bumsrake.de -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

← Newer
1
...
7
8
9
10
11
12
13
...
354
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily