Daily

daily@lists.cert.at

1 participants
3500 discussions

Tageszusammenfassung - 14.01.2026
by Daily end-of-shift report 14 Jan '26

14 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 13-01-2026 18:00 − Mittwoch 14-01-2026 18:30 Handler: Felician Fuchs Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Target employees confirm leaked source code is authentic ∗∗∗ --------------------------------------------- Multiple current and former Target employees confirmed that leaked source code samples posted by a threat actor match real internal systems. The company also rolled out an "accelerated" lockdown of its Git server, requiring VPN access, a day after being contacted by BleepingComputer. --------------------------------------------- https://www.bleepingcomputer.com/news/security/target-employees-confirm-lea… ∗∗∗ Microsoft: Windows 365 update blocks access to Cloud PC sessions ∗∗∗ --------------------------------------------- Microsoft confirmed that a recent Windows 365 update is blocking customers from accessing their Microsoft 365 Cloud PC sessions. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-365-updat… ∗∗∗ Cloud marketplace Pax8 accidentally exposes data on 1,800 MSP partners ∗∗∗ --------------------------------------------- Cloud marketplace and distributor Pax8 has confirmed that it mistakenly sent an email to fewer than 40 UK-based partners containing a spreadsheet with internal business information, including MSP customer and Microsoft licensing data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cloud-marketplace-pax8-accid… ∗∗∗ Reprompt attack let hackers hijack Microsoft Copilot sessions ∗∗∗ --------------------------------------------- Researchers identified an attack method dubbed "Reprompt" that could allow attackers to infiltrate a users Microsoft Copilot session and issue commands to exfiltrate sensitive data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/reprompt-attack-let-hackers-… ∗∗∗ ConsentFix debrief: Insights from the new OAuth phishing attack ∗∗∗ --------------------------------------------- ConsentFix is an OAuth phishing technique abusing browser-based authorization flows to hijack Microsoft accounts. Push Security shares new insights from continued tracking, community research, and evolving attacker techniques. --------------------------------------------- https://www.bleepingcomputer.com/news/security/consentfix-debrief-insights-… ∗∗∗ Microsoft updates Windows DLL that triggered security alerts ∗∗∗ --------------------------------------------- Microsoft has resolved a known issue that was causing security applications to incorrectly flag a core Windows component, the company said in a service alert posted this week. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-updates-windows-d… ∗∗∗ Ohne Authentifizierung: Broadcom-Lücke lässt Angreifer ganze WLAN-Netze lahmlegen ∗∗∗ --------------------------------------------- Zahlreiche WLAN-Netze, die auf Broadcom-Chipsätzen basieren, lassen sich mit nur einem Datenpaket lahmlegen. Angreifer brauchen dafür keinen Schlüssel. --------------------------------------------- https://www.golem.de/news/ohne-authentifizierung-broadcom-luecke-laesst-ang… ∗∗∗ Corrupting LLMs Through Weird Generalizations ∗∗∗ --------------------------------------------- Abstract LLMs are useful because they generalize so well. But can you have too much of a good thing? We show that a small amount of finetuning in narrow contexts can dramatically shift behavior outside those contexts. --------------------------------------------- https://www.schneier.com/blog/archives/2026/01/corrupting-llms-through-weir… ∗∗∗ Malware Intercepts Googlebot via IP-Verified Conditional Logic ∗∗∗ --------------------------------------------- Some attackers are increasingly moving away from simple redirects in favor of more “selective” methods of payload delivery. This approach filters out regular human visitors, allowing attackers to serve malicious content to search engine crawlers while remaining invisible to the website owner. --------------------------------------------- https://blog.sucuri.net/2026/01/malware-intercepts-googlebot-via-ip-verifie… ∗∗∗ Malicious Chrome Extension Steals MEXC API Keys by Masquerading as Trading Tool ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a malicious Google Chrome extension thats capable of stealing API keys associated with MEXC, a centralized cryptocurrency exchange (CEX) available in over 170 countries, while masquerading as a tool to automate trading on the platform. --------------------------------------------- https://thehackernews.com/2026/01/malicious-chrome-extension-steals-mexc.ht… ∗∗∗ New Research: 64% of 3rd-Party Applications Access Sensitive Data Without Justification ∗∗∗ --------------------------------------------- Research analyzing 4,700 leading websites reveals that 64% of third-party applications now access sensitive data without business justification, up from 51% in 2024. Government sector malicious activity spiked from 2% to 12.9%, while 1 in 7 Education sites show active compromise. --------------------------------------------- https://thehackernews.com/2026/01/new-research-64-of-3rd-party.html ∗∗∗ Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware ∗∗∗ --------------------------------------------- Security experts have disclosed details of an active malware campaign thats exploiting a DLL side-loading vulnerability in a legitimate binary associated with the open-source c-ares library to bypass security controls and deliver a wide range of commodity trojans and stealers. --------------------------------------------- https://thehackernews.com/2026/01/hackers-exploit-c-ares-dll-side-loading.h… ∗∗∗ Interrail meldet Datenleck: Auch Ausweisdaten betroffen ∗∗∗ --------------------------------------------- Bei Eurail flossen mutmaßlich Daten ab. Der Anbieter stellt Interrail-Pässe auch im Auftrag der deutschen, österreichischen und Schweizer Bahn aus. --------------------------------------------- https://www.heise.de/news/Interrail-meldet-Datenleck-Auch-Ausweisdaten-betr… ∗∗∗ Kritik an GnuPG und seinem Umgang mit gemeldeten Lücken ∗∗∗ --------------------------------------------- Die auf dem 39C3 demonstrierten Probleme in der PGP-Implementierung GnuPG riefen vielfältige Kritik an GnuPGs Umgang damit, aber auch an PGP insgesamt hervor. --------------------------------------------- https://www.heise.de/hintergrund/Kritik-an-GnuPG-und-seinem-Umgang-mit-geme… ∗∗∗ Malware-Masche: Jobangebote jubeln Entwicklern bösartige Repositories unter ∗∗∗ --------------------------------------------- Entwickler müssen bei Jobangeboten inzwischen aufpassen. Kriminelle versuchen, Infostealer darüber zu verteilen. --------------------------------------------- https://www.heise.de/news/Malware-Masche-Jobangebote-jubeln-Entwicklern-boe… ∗∗∗ How real software downloads can hide remote backdoors ∗∗∗ --------------------------------------------- Attackers use legitimate open-source software as cover, relying on user trust to compromise systems. We dive into an example. --------------------------------------------- https://www.malwarebytes.com/blog/threat-intel/2026/01/how-real-software-do… ∗∗∗ Instagram dementiert Hack nach massenhaften Passwort-Reset-Mails ∗∗∗ --------------------------------------------- Zuvor waren Berichte über entwendete Daten von 17 Millionen Usern kursiert. Das Unternehmen widerspricht und rät zum Ignorieren der Mails --------------------------------------------- https://www.derstandard.at/story/3000000303975/instagram-dementiert-hack-na… ∗∗∗ Ransomware: Tactical Evolution Fuels Extortion Epidemic ∗∗∗ --------------------------------------------- New whitepaper reveals record number of attacks as threat landscape evolves with new players and new tactics. --------------------------------------------- https://www.security.com/threat-intelligence/ransomware-extortion-epidemic ∗∗∗ More than 40 countries impacted by North Korea IT worker scams, crypto thefts ∗∗∗ --------------------------------------------- Eleven countries led a session at the UN headquarters in New York centered around a 140-page report released last fall that covered North Korea’s extensive cyber-focused efforts to fund its nuclear and ballistic weapons program. --------------------------------------------- https://therecord.media/40-countries-impacted-nk-it-thefts-united-nations ∗∗∗ Poland says it repelled major cyberattack on power grid, blames Russia ∗∗∗ --------------------------------------------- Poland narrowly avoided a large-scale power outage by thwarting what officials described as the most serious cyberattack on its energy infrastructure in years. --------------------------------------------- https://therecord.media/poland-cyberattack-grid-russia ∗∗∗ Western cyber agencies warn about threats to industrial operational technology ∗∗∗ --------------------------------------------- New guidance issued by Britain’s National Cyber Secure Centre (NCSC), a part of signals and cyber intelligence agency GCHQ, sets out how organizations should securely connect equipment such as industrial control systems, sensors and other critical services. --------------------------------------------- https://therecord.media/cyber-agencies-warn-of-industrial-system-threats ∗∗∗ Telegram to Add Warning for Proxy Links After IP Leak Concerns ∗∗∗ --------------------------------------------- Telegram will add a warning for proxy links after reports showed they can expose user IP addresses with a single click, bypassing VPN or privacy settings. --------------------------------------------- https://hackread.com/telegram-add-warning-proxy-links-ip-leak/ ∗∗∗ Hacker Claims Full Breach of Russia’s Max Messenger, Threatens Public Leak ∗∗∗ --------------------------------------------- A hacker claims a full breach of Russia’s Max Messenger, threatening to leak user data and backend systems if demands are not met. --------------------------------------------- https://hackread.com/hacker-russia-max-messenger-breach-data-leak/ ∗∗∗ Secure Connectivity Principles for Operational Technology (OT) ∗∗∗ --------------------------------------------- CISA and the UK National Cyber Security Centre (NCSC-UK), in collaboration with federal and international partners, have released Secure Connectivity Principles for Operational Technology (OT) guidance to help asset owners address increasing business and regulatory pressures for connectivity into operational technology (OT) networks. --------------------------------------------- https://www.cisa.gov/resources-tools/resources/secure-connectivity-principl… ∗∗∗ Unpatchable Vulnerabilities of Kubernetes: CVE-2020-8554 ∗∗∗ --------------------------------------------- This blog is the first part of a mini-series looking at the four unpatchable CVEs in every Kubernetes cluster. --------------------------------------------- https://securitylabs.datadoghq.com/articles/unpatchable-kubernetes-vulnerab… ∗∗∗ Wireless-(in)Fidelity: Pentesting Wi-Fi in 2025 ∗∗∗ --------------------------------------------- Despite the advancements that have been made in Wi-Fi security with the arrival of WPA3, some misconfigurations and legacy protocols still remain. In this blogpost, we share insights into Wi-Fi related findings encountered during penetration testing engagements. --------------------------------------------- https://www.synacktiv.com/en/publications/wireless-infidelity-pentesting-wi… ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple vulnerabilities in EATON UPS Companion ∗∗∗ --------------------------------------------- EATON UPS Companion provided by Eaton contains multiple vulnerabilities. --------------------------------------------- https://jvn.jp/en/jp/JVN48187396/ ∗∗∗ Patchday Microsoft: Attacken auf Windows und Windows Server beobachtet ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für Office, Windows & Co. erschienen. Angreifer nutzen bereits eine Lücke aus. Weitere Attacken können bevorstehen. --------------------------------------------- https://www.heise.de/news/Patchday-Microsoft-Angreifer-spionieren-Speicherb… ∗∗∗ Patchday Adobe: Schadcode-Lücken bedrohen Dreamweaver & Co. ∗∗∗ --------------------------------------------- Wichtige Sicherheitsupdates reparieren unter anderem Adobe ColdFusion und InDesign. --------------------------------------------- https://www.heise.de/news/Patchday-Adobe-Schadcode-Luecken-bedrohen-Dreamwe… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (sssd), Debian (linux-6.1 and python-parsl), Fedora (chezmoi, complyctl, composer, and firefox), Oracle (kernel), Red Hat (buildah, libpq, podman, postgresql, postgresql16, postgresql:13, postgresql:15, and postgresql:16), SUSE (avahi, curl, ffmpeg-4, ffmpeg-7, firefox, istioctl, k6, kubelogin, libmicrohttpd, libpcap-devel, libpng16, libtasn1-6-32bit, matio, ovmf, python-tornado6, python311-Authlib, and teleport), and Ubuntu (angular.js, python-urllib3, and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/1054167/ ∗∗∗ Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users ∗∗∗ --------------------------------------------- This bug highlights how deeply async_hooks has become embedded in the Node.js ecosystem. What started as a low-level debugging API is now a critical dependency for React Server Components, Next.js, every major APM tool, and any code using AsyncLocalStorage. --------------------------------------------- https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-… ∗∗∗ F5: K000159546, Python vulnerability CVE-2024-5642 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000159546 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 13.01.2026
by Daily end-of-shift report 13 Jan '26

13 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Montag 12-01-2026 18:00 − Dienstag 13-01-2026 18:00 Handler: Felician Fuchs Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Targets dev server offline after hackers claim to steal source code ∗∗∗ --------------------------------------------- Hackers are claiming to be selling internal source code belonging to Target Corporation, after publishing what appears to be a sample of stolen code repositories on a public software development platform. After BleepingComputer notified Target, the files were taken offline and the retailers developer Git server was inaccessible. --------------------------------------------- https://www.bleepingcomputer.com/news/security/targets-dev-server-offline-a… ∗∗∗ CISA orders feds to patch Gogs RCE flaw exploited in zero-day attacks ∗∗∗ --------------------------------------------- CISA has ordered government agencies to secure their systems against a high-severity Gogs vulnerability that was exploited in zero-day attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-go… ∗∗∗ Facebook login thieves now using browser-in-browser trick ∗∗∗ --------------------------------------------- Hackers over the past six months have relied increasingly more on the browser-in-the-browser (BitB) method to trick users into providing Facebook account credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/facebook-login-thieves-now-u… ∗∗∗ Convincing LinkedIn comment-reply tactic used in new phishing ∗∗∗ --------------------------------------------- Scammers are flooding LinkedIn posts with fake "reply" comments that appear to come from the platform, warning of bogus policy violations and urging users to click external links. Some even abuse LinkedIns official lnkd.in shortener, making the phishing attempts harder to spot. --------------------------------------------- https://www.bleepingcomputer.com/news/security/convincing-linkedin-comment-… ∗∗∗ What we know about Iran’s Internet shutdown ∗∗∗ --------------------------------------------- Cloudflare Radar data shows Internet traffic from Iran has effectively dropped to zero since January 8, signaling a complete shutdown in the country and disconnection from the global Internet. --------------------------------------------- https://blog.cloudflare.com/iran-protests-internet-shutdown/ ∗∗∗ GoBruteforcer Botnet Targets 50K-plus Linux Servers ∗∗∗ --------------------------------------------- Researchers detailed a souped-up version of the GoBruteforcer botnet that preys on servers with weak credentials and AI-generated configurations. --------------------------------------------- https://www.darkreading.com/threat-intelligence/gobruteforcer-botnet-target… ∗∗∗ 10-Punkte-Papier: BDEW fordert Maßnahmen zum Schutz kritischer Infrastruktur ∗∗∗ --------------------------------------------- In einem Positionspapier fordert der Bundesverband der Energie- und Wasserwirtschaft die Stärkung der Resilienz kritischer Infrastrukturen. --------------------------------------------- https://www.golem.de/news/10-punkte-papier-bdew-fordert-massnahmen-zum-schu… ∗∗∗ n8n Supply Chain Attack Abuses Community Nodes to Steal OAuth Tokens ∗∗∗ --------------------------------------------- Threat actors have been observed uploading a set of eight packages on the npm registry that masqueraded as integrations targeting the n8n workflow automation platform to steal developers OAuth credentials. --------------------------------------------- https://thehackernews.com/2026/01/n8n-supply-chain-attack-abuses.html ∗∗∗ New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a new campaign dubbed SHADOW#REACTOR that employs an evasive multi-stage attack chain to deliver a commercially available remote administration tool called Remcos RAT and establish persistent, covert remote access. --------------------------------------------- https://thehackernews.com/2026/01/new-malware-campaign-delivers-remcos.html ∗∗∗ New Advanced Linux VoidLink Malware Targets Cloud and container Environments ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a previously undocumented and feature-rich malware framework codenamed VoidLink thats specifically designed for long-term, stealthy access to Linux-based cloud environments. --------------------------------------------- https://thehackernews.com/2026/01/new-advanced-linux-voidlink-malware.html ∗∗∗ Businesses in 2026: Maybe we should finally look into that AI security stuff ∗∗∗ --------------------------------------------- Survey finds security checks nearly doubled in a year as leaders wise up. The number of organizations that have implemented methods for identifying security risks in the AI tools they use has almost doubled in the space of a year. --------------------------------------------- https://www.theregister.com/2026/01/12/ai_security_wef_survey/ ∗∗∗ Mandiant open sources tool to prevent leaky Salesforce misconfigs ∗∗∗ --------------------------------------------- AuraInspector automates the most common abuses and generates fixes for customers Mandiant has released an open source tool to help Salesforce admins detect misconfigurations that could expose sensitive data. --------------------------------------------- https://www.theregister.com/2026/01/13/mandiant_salesforce_tool/ ∗∗∗ Dutch cops cuff alleged AVCheck malware kingpin in Amsterdam ∗∗∗ --------------------------------------------- 33-year-old was under surveillance for some time before returning home from the UAE Dutch police believe they have arrested a man behind the AVCheck online platform - a service used by cybercrims that Operation Endgame shuttered in May. --------------------------------------------- https://www.theregister.com/2026/01/13/avcheck_arrest/ ∗∗∗ Start der ersten ESC-Ticketwelle: Vorsicht vor unseriösen Angeboten! ∗∗∗ --------------------------------------------- Endlich ist es so weit: Der Vorverkauf für den Eurovision Song Contest 2026 hat begonnen! Doch Fans sollten besonders vorsichtig sein, denn unseriöse Anbieter versuchen, außerhalb der offiziellen Verkaufsplattformen Profit zu schlagen. --------------------------------------------- https://www.watchlist-internet.at/news/start-der-ersten-esc-ticketwelle-vor… ∗∗∗ Neue Phishing-Welle: Ausstehende Zahlungen ans Finanzamt ∗∗∗ --------------------------------------------- Einmal mehr geben sich Kriminelle als das Bundesministerium für Finanzen aus. Aktuell nehmen sie sowohl Privatpersonen als auch Unternehmen ins Visier. In beiden Fällen sollen angeblich offene Zahlungen mit einer Überweisung beglichen werden – auf ein Konto im Ausland. --------------------------------------------- https://www.watchlist-internet.at/news/phishing-ausstehende-zahlungen-finan… ∗∗∗ Latin America Sees Sharpest Rise in Cyber Attacks in December 2025 as Ransomware Activity Accelerates ∗∗∗ --------------------------------------------- In December 2025, organizations experienced an average of 2,027 cyber attacks per organization per week. This represents a 1% month-over-month increase and a 9% year-over-year increase. While overall growth remained moderate, Latin America recorded the sharpest regional increase, with organizations experiencing an average of 3,065 attacks per week, a 26% increase year over year. --------------------------------------------- https://blog.checkpoint.com/research/latin-america-sees-sharpest-rise-in-cy… ∗∗∗ VoidLink: The Cloud-Native Malware Framework Weaponizing Linux Infrastructure ∗∗∗ --------------------------------------------- Key Points: VoidLink is a cloud-native Linux malware framework built to maintain long-term, stealthy access to cloud infrastructure rather than targeting individual endpoints. It reflects a shift in attacker focus away from Windows systems toward the Linux environments that power cloud services and critical operations. Its modular, plug-in-driven design allows threat actors to customize capabilities over time, expanding attacks quietly as objectives evolve. --------------------------------------------- https://blog.checkpoint.com/research/voidlink-the-cloud-native-malware-fram… ∗∗∗ Sweden detains ex-military IT consultant suspected of spying for Russia ∗∗∗ --------------------------------------------- A 33-year-old former IT consultant for Sweden’s Armed Forces has been detained on suspicions of spying for Russian intelligence, Swedish prosecutors said. --------------------------------------------- https://therecord.media/sweden-detains-it-consultant-russia ∗∗∗ 0patch Micropatch für CredSSP-Schwachstelle CVE-2025-47987 ∗∗∗ --------------------------------------------- Noch ein kleiner Nachtrag von letzter Woche und vor dem Januar 2026 Patchday. ACROS Security hat einen 0patch Micropatch für eine Elevation of Privilege (EoP)-Schwachstelle CVE-2025-47987 im Credential Security Support Provider Protocol (CredSSP) veröffentlicht. --------------------------------------------- https://borncity.com/blog/2026/01/13/0patch-micropatch-fuer-credssp-schwach… ∗∗∗ End of Support für Microsoft-Produkte in 2026 ∗∗∗ --------------------------------------------- Das Jahr 2026 bringt für Nutzer von Microsoft Produkten einige Termine, an denen der Support endet. Das reicht von diversen Windows-Versionen, die dann nicht mehr durch Updates unterstützt werden, bis hin zu Microsoft Office 2021. --------------------------------------------- https://borncity.com/blog/2026/01/13/end-of-support-fuer-microsoft-produkte… ∗∗∗ Russian BlueDelta (Fancy Bear) Uses PDFs to Steal Logins in Just 2 Seconds ∗∗∗ --------------------------------------------- New research from Recorded Future reveals how Russian state hackers (BlueDelta) are using fake Microsoft and Google login portals to steal credentials. The campaign involves using legitimate PDF lures from GRC and EcoClimate to trick victims. --------------------------------------------- https://hackread.com/russian-bluedelta-fancy-bear-pdfs-steal-login/ ∗∗∗ Widespread Magecart Campaign Targets Users of All Major Credit Cards ∗∗∗ --------------------------------------------- Researchers at Silent Push have exposed a global Magecart campaign stealing credit card data since 2022. Learn how this invisible web-skimming attack targets major networks like Mastercard and Amex, and how to stay safe. --------------------------------------------- https://hackread.com/magecart-targets-all-credit-cards-users/ ∗∗∗ K7 Antivirus: Named pipe abuse, registry manipulation and privilege escalation (CVE-2025-67826) ∗∗∗ --------------------------------------------- When hunting for privilege escalation vulnerabilities, named pipes are a goldmine. Antivirus products often use named pipes to allow unprivileged users to trigger privileged operations, making them especially promising targets for this class of vulnerability. --------------------------------------------- http://blog.quarkslab.com/k7-antivirus-named-pipe-abuse-registry-manipulati… ∗∗∗ How GitHub could secure npm ∗∗∗ --------------------------------------------- In 2025, npm experienced an unprecedented number of compromised packages in a series of coordinated attacks on the JavaScript open source supply chain. These packages ranged from crypto-stealing malware1 to credential-stealing exploits2. While GitHub announced changes3 to address these attacks, many maintainers (myself included) found the response insufficient. --------------------------------------------- https://humanwhocodes.com/blog/2026/01/how-github-could-secure-npm/ ∗∗∗ Shai Hulud 2.0 Campaign ∗∗∗ --------------------------------------------- Shai-Hulud 2.0 represents one of the most severe supply chain compromises observed in the modern cloud-native ecosystem. The campaign involved the manipulation of hundreds of publicly available packages and specifically targeted developer workstations, CI/CD pipelines, and cloud workloads to harvest credentials and sensitive configuration data. --------------------------------------------- https://detect.fyi/shai-hulud-2-0-campaign-be390e502f28?source=rss----d5fd8… ∗∗∗ Malicious Chrome Extension Steals MEXC API Keys for Account Takeover ∗∗∗ --------------------------------------------- Socket’s Threat Research Team identified a malicious Chrome extension, MEXC API Automator, published to the Chrome Web Store on September 1, 2025, by a threat actor under the alias jorjortan142. --------------------------------------------- https://socket.dev/blog/malicious-chrome-extension-steals-mexc-api-keys?utm… ∗∗∗ Fixing ESC1 - Enrollee supplies subject and template allows client authentication ∗∗∗ --------------------------------------------- ADCS misconfigurations are one of the most common privilege escalation vectors we encounter. This article covers steps to remediate ESC1 flaws. --------------------------------------------- https://projectblack.io/blog/fixing-esc1-enrollee-supplies-subject-and-temp… ∗∗∗ Lack of isolation in agentic browsers resurfaces old vulnerabilities ∗∗∗ --------------------------------------------- With browser-embedded AI agents, we’re essentially starting the security journey over again. We exploited a lack of isolation mechanisms in multiple agentic browsers to perform attacks ranging from the dissemination of false information to cross-site data leaks. --------------------------------------------- https://blog.trailofbits.com/2026/01/13/lack-of-isolation-in-agentic-browse… ===================== = Vulnerabilities = ===================== ∗∗∗ Unauthenticated access to local configuration ∗∗∗ --------------------------------------------- CVSSv3 Score: 9.3. An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiFone Web Portal page may allow an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-25-260 ∗∗∗ Unauthenticated remote command injection ∗∗∗ --------------------------------------------- CVSSv3 Score: 9.4. An improper neutralization of special elements used in an OS command (OS Command Injection) vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-25-772 ∗∗∗ SAP Security Patch Day January 2026 ∗∗∗ --------------------------------------------- SAP has released its January 2026 security patch package containing 17 security notes addressing critical vulnerabilities across enterprise SAP environments. This release includes four HotNews vulnerabilities with CVSS ratings up to 9.9, four High priority issues, seven Medium priority fixes, and two Low priority updates. The patches affect SAP S/4HANA, SAP HANA database, SAP NetWeaver, SAP Wily Introscope, and various application components. --------------------------------------------- https://redrays.io/blog/sap-security-patch-day-january-2026/ ∗∗∗ TinyWeb: Windows-Web-Server ermöglicht Codeschmuggel ∗∗∗ --------------------------------------------- In dem schlanken Web-Server TinyWeb für Windows können Angreifer aus dem Netz beliebigen Code einschleusen. Ein Update hilft. --------------------------------------------- https://www.heise.de/news/TinyWeb-Windows-Web-Server-ermoeglicht-Codeschmug… ∗∗∗ TYPO3-CORE-SA-2026-003: Broken Access Control in Recycler Module ∗∗∗ --------------------------------------------- It has been discovered that TYPO3 CMS is susceptible to broken access control. --------------------------------------------- https://typo3.org/security/advisory/typo3-core-sa-2026-003 ∗∗∗ ServiceNow Patches Critical AI Platform Flaw Allowing Unauthenticated User Impersonation ∗∗∗ --------------------------------------------- ServiceNow has disclosed details of a now-patched critical security flaw impacting its ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform arbitrary actions as that user. The vulnerability, tracked as CVE-2025-12420, carries a CVSS score of 9.3 out of 10.0. --------------------------------------------- https://thehackernews.com/2026/01/servicenow-patches-critical-ai-platform.h… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (mariadb10.11, mariadb:10.11, mariadb:10.3, mariadb:10.5, and tar), Debian (net-snmp), Fedora (coturn, NetworkManager-l2tp, openssh, and tuxanci), Mageia (libtasn1), Oracle (buildah, cups, httpd, kernel, libpq, libsoup, libsoup3, mariadb:10.11, mariadb:10.3, openssl, and podman), SUSE (cpp-httplib, ImageMagick, libtasn1, python-cbor2, util-linux, valkey, and wget2), and Ubuntu (google-guest-agent, linux-iot, and python-urllib3). --------------------------------------------- https://lwn.net/Articles/1053988/ ∗∗∗ Remote Code Execution With Modern AI/ML Formats and Libraries ∗∗∗ --------------------------------------------- We identified remote code execution vulnerabilities in open-source AI/ML libraries published by Apple, Salesforce and NVIDIA. --------------------------------------------- https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-librar… ∗∗∗ YoSmart YoLink Smart Hub ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-26-013-03 ∗∗∗ Rockwell Automation FactoryTalk DataMosaix Private Cloud ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-26-013-02 ∗∗∗ Rockwell Automation 432ES-IG3 Series A ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-26-013-01 ∗∗∗ Security Vulnerabilities fixed in Firefox 147 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-01/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 12.01.2026
by Daily end-of-shift report 12 Jan '26

12 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 09-01-2026 18:00 − Montag 12-01-2026 18:00 Handler: Felician Fuchs Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Max severity Ni8mare flaw impacts nearly 60,000 n8n instances ∗∗∗ --------------------------------------------- Nearly 60,000 n8n instances exposed online remain unpatched against a maximum-severity vulnerability dubbed "Ni8mare." --------------------------------------------- https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-im… ∗∗∗ Spanish energy giant Endesa discloses data breach affecting customers ∗∗∗ --------------------------------------------- Spanish energy provider Endesa and its Energía XXI operator are notifying customers that hackers accessed the companys systems and accessed contract-related information, which includes personal details. --------------------------------------------- https://www.bleepingcomputer.com/news/security/spanish-energy-giant-endesa-… ∗∗∗ Hidden Telegram proxy links can reveal your IP address in one click ∗∗∗ --------------------------------------------- A single click on what may appear to be a Telegram username or harmless link is all it takes to expose your real IP address to attackers due to how proxy links are handled. Telegram says it will add warnings to proxy links after researchers demonstrated that such one-click interactions could reveal a Telegram users real IP address. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hidden-telegram-proxy-links-… ∗∗∗ Illicit Crypto Economy Surges Amid Increased Nation-State Activity ∗∗∗ --------------------------------------------- Cybercriminal cryptocurrency transactions totaled billions in 2025, with activity from sanctioned countries like Russia and Iran causing the largest jump. --------------------------------------------- https://www.darkreading.com/cyber-risk/illicit-crypto-economy-surges-nation… ∗∗∗ Russia’s Fancy Bear APT Doubles Down on Global Secrets Theft ∗∗∗ --------------------------------------------- The notorious state-sponsored group relies on basic techniques that are highly effective, often delivering greater ROI than more complex malware-heavy operations. --------------------------------------------- https://www.darkreading.com/cyberattacks-data-breaches/russian-apt-credenti… ∗∗∗ Two Separate Campaigns Target Exposed LLM Services ∗∗∗ --------------------------------------------- A total of 91,403 sessions targeted public LLM endpoints to find leaks in organizations use of AI and map an expanding attack surface. --------------------------------------------- https://www.darkreading.com/endpoint-security/separate-campaigns-target-exp… ∗∗∗ Cybersecurity Act: EU-Kommission will hartes Verbot von Huawei ∗∗∗ --------------------------------------------- Bisher freiwillige Beschränkungen gegen chinesische Ausrüster will die EU-Kommission nun zwangsweise umsetzen. Das ist in der EU stark umstritten und erscheint aus der Zeit gefallen. --------------------------------------------- https://www.golem.de/news/cybersecurity-act-eu-kommission-will-hartes-verbo… ∗∗∗ Lohnabrechnungen falsch verschickt: DSGVO-Vorfall bei der Datev ∗∗∗ --------------------------------------------- Nach einer technischen Störung bei der Datev-Lohnabrechnung sind Kundendaten in falsche Hände gelangt. Auslöser war ausgerechnet ein Problemlösungsversuch. --------------------------------------------- https://www.golem.de/news/lohnabrechnungen-falsch-verschickt-dsgvo-vorfall-… ∗∗∗ Researchers Uncover Service Providers Fueling Industrial-Scale Pig Butchering Fraud ∗∗∗ --------------------------------------------- Cybersecurity researchers have shed light on two service providers that supply online criminal networks with the necessary tools and infrastructure to fuel the pig butchering-as-a-service (PBaaS) economy. --------------------------------------------- https://thehackernews.com/2026/01/researchers-uncover-service-providers.html ∗∗∗ GoBruteforcer Botnet Targets Crypto Project Databases by Exploiting Weak Credentials ∗∗∗ --------------------------------------------- A new wave of GoBruteforcer attacks has targeted databases of cryptocurrency and blockchain projects to co-opt them into a botnet thats capable of brute-forcing user passwords for services such as FTP, MySQL, PostgreSQL, and phpMyAdmin on Linux servers. --------------------------------------------- https://thehackernews.com/2026/01/gobruteforcer-botnet-targets-crypto.html ∗∗∗ UK government exempting itself from flagship cyber law inspires little confidence ∗∗∗ --------------------------------------------- Ministers promise equivalent standards just without the legal obligation ANALYSIS From Mays cyberattack on the Legal Aid Agency to the Foreign Office breach months later, cyber incidents have become increasingly common in UK government. --------------------------------------------- https://www.theregister.com/2026/01/10/csr_bill_analysis/ ∗∗∗ Instagram-Datenleck: Daten von 6,2 Millionen Konten bei Have-I-Been-Pwned ∗∗∗ --------------------------------------------- Daten von 6,2 Millionen Instagram-Nutzern sind beim Have-I-Been-Pwned-Projekt gelandet. --------------------------------------------- https://www.heise.de/news/Instagram-6-2-Millionen-Nutzerdaten-mittels-Scrap… ∗∗∗ ÖIAT-Schwerpunkterhebung deckt auf: Massive Präsenz von Abo-Fallen in Google-Anzeigen ∗∗∗ --------------------------------------------- Bei einer eingehenden Analyse der Google Werbebibliothek entdeckte das Österreichische Institut für angewandte Telekommunikation (ÖIAT) eine große Menge an gefährlichen Ads. Insgesamt waren es weit über 27.000 problematische Werbeanzeigen, die als Köder für Abo-Fallen dienten. Auf Beschwerden reagierte Google bisher nicht. --------------------------------------------- https://www.watchlist-internet.at/news/schwerpunkterhebung-abo-fallen-googl… ∗∗∗ Basketball player arrested for alleged ransomware ties freed in Russia-France prisoner swap ∗∗∗ --------------------------------------------- Daniil Kasatkin, 26, was seen in a video shared by Russian state news outlet TASS emerging from a plane that was then used to send French researcher Laurent Vinatier back to France. --------------------------------------------- https://therecord.media/france-frees-russian-basketball-player-ransomware-s… ∗∗∗ MC1215070: MFA für Microsoft 365 Admin Center ab Feb. 2026 Pflicht ∗∗∗ --------------------------------------------- Noch eine kurze Information für Administratoren von Microsoft 365-Tenants. Microsoft erzwingt aus Sicherheitsgründen ab dem 9. Februar 2026 eine Multifaktor-Authentifizierung (MFA) zur Administratoranmeldung am Microsoft 365 Admin Center. Ohne entsprechende Maßnahmen scheitert dann die Anmeldung. --------------------------------------------- https://borncity.com/blog/2026/01/11/mc1215070-mfa-fuer-microsoft-365-admin… ∗∗∗ Database of 323,986 BreachForums Users Leaked as Admin Disputes Scope ∗∗∗ --------------------------------------------- Database of 323,986 BreachForums users leaked online as forum admins claim the exposed data is partial and dates back to August 2025. --------------------------------------------- https://hackread.com/breachforums-database-users-leak-admin-disputes/ ∗∗∗ Everest Ransomware Claims Breach at Nissan, Says 900GB of Data Stolen ∗∗∗ --------------------------------------------- Everest ransomware claims to have breached Nissan Motor Corporation, alleging the theft of 900GB of internal data, including documents and screenshots. --------------------------------------------- https://hackread.com/everest-ransomware-nissan-data-breach/ ∗∗∗ How Safe is the Rust Ecosystem? A Deep Dive into crates.io ∗∗∗ --------------------------------------------- The relentless wave of high-impact supply chain attacks throughout 2025—most notably the major incident within npm [..] —suggests this trend is far from peaking. In fact, with the rapid adoption of AI and LLMs in development workflows, we are likely facing an acceleration of these threats rather than a decline, in my opinion. --------------------------------------------- https://mr-leshiy-blog.web.app/blog/crates_io_analysis/ ∗∗∗ Detection of Kerberos Golden Ticket Attacks via Velociraptor ∗∗∗ --------------------------------------------- Kerberos is a strange technology. Over the years, I’ve gone through its internal workings again and again, yet parts of it always seem to slip away. It has been a while since I did my OSCP, so inevitably I’ve found myself back in this topic to refresh my knowledge. --------------------------------------------- https://detect.fyi/detection-of-kerberos-golden-ticket-attacks-via-velocira… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdate: Dell-Laptops mit Adreno-GPU sind verwundbar ∗∗∗ --------------------------------------------- Der Treiber von Qualcomms Adreno GPU ist löchrig und gefährdet die Sicherheit verschiedener Dell-Laptops. Ein reparierter Treiber steht zum Download bereit. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdate-Dell-Laptops-mit-Adreno-GPU-sin… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium and sogo), Fedora (chromium, foomuuri, libpng, libsodium, mariadb10.11, musescore, nginx, python-pdfminer, python-urllib3, python3.12, seamonkey, wasmedge, and wget2), Mageia (curl, libpcap, sodium, wget2, and zlib), Slackware (lcms2), SUSE (chromedriver, chromium, noopenh264, coredns, curl, dcmtk, fontforge, gdk-pixbuf-loader-libheif, gimp, kernel, libheif, libpng16, libsoup-2_4-1, libvirt, mariadb, php8, poppler, python-filelock, python-tornado6, python311-aiohttp, qemu, sssd, and traefik), and Ubuntu (libheif, libtasn1-6, linux-azure-nvidia, linux-kvm, linux-raspi, linux-raspi-realtime, and php7.2, php7.4, php8.1, php8.3, php8.4). --------------------------------------------- https://lwn.net/Articles/1053820/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 09.01.2026
by Daily end-of-shift report 09 Jan '26

09 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 08-01-2026 18:00 − Freitag 09-01-2026 18:00 Handler: Felician Fuchs Co-Handler: n/a ===================== = News = ===================== ∗∗∗ VMware ESXi zero-days likely exploited a year before disclosure ∗∗∗ --------------------------------------------- Chinese-speaking threat actors used a compromised SonicWall VPN appliance to deliver a VMware ESXi exploit toolkit that seems to have been developed more than a year before the targeted vulnerabilities became publicly known. --------------------------------------------- https://www.bleepingcomputer.com/news/security/vmware-esxi-zero-days-likely… ∗∗∗ FBI warns about Kimsuky hackers using QR codes to phish U.S. orgs ∗∗∗ --------------------------------------------- The North Korean state-sponsored hacker group Kimsuki is using malicious QR codes in spearphishing campaigns that target U.S. organizations, the Federal Bureau of Investigation warns in a flash alert. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fbi-warns-about-kimsuky-hack… ∗∗∗ New China-linked hackers breach telcos using edge device exploits ∗∗∗ --------------------------------------------- A sophisticated threat actor that uses Linux-based malware to target telecommunications providers has recently broadened its operations to include organizations in Southeastern Europe. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-china-linked-hackers-bre… ∗∗∗ Defeating KASLR by Doing Nothing at All ∗∗∗ --------------------------------------------- I’ve recently been researching Pixel kernel exploitation and as part of this research I found myself with an excellent arbitrary write primitive…but without a KASLR leak. As necessity is the mother of all invention, on a hunch, I started researching the Linux kernel linear mapping. --------------------------------------------- https://projectzero.google/2025/11/defeating-kaslr-by-doing-nothing-at-all.… ∗∗∗ Google Sees Spam, You See Your Site: A Cloaked SEO Spam Attack ∗∗∗ --------------------------------------------- We recently handled a case where a customer reported strange SEO behavior on their website. Regular visitors saw a normal site. No popups. No redirects. No visible spam. However, when they checked their site on Google, the search results were flooded with eBay-type-looking websites and “Situs Toto” gambling spam. This is a professional-grade SEO cloaking attack. --------------------------------------------- https://blog.sucuri.net/2026/01/google-sees-spam-you-see-your-site-a-cloake… ∗∗∗ Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations ∗∗∗ --------------------------------------------- Russian state-sponsored threat actors have been linked to a fresh set of credential harvesting attacks targeting individuals associated with a Turkish energy and nuclear research agency, as well as staff affiliated with a European think tank and organizations in North Macedonia and Uzbekistan. --------------------------------------------- https://thehackernews.com/2026/01/russian-apt28-runs-credential-stealing.ht… ∗∗∗ Auslegungssache 150: Auf digitaler Spurensuche ∗∗∗ --------------------------------------------- Im ct-Datenschutz-Podcast erklärt eine IT-Forensikerin, wie sie nach Vorfällen Spuren sichert, mit Erpressern verhandelt und den Datenschutz im Blick behält. --------------------------------------------- https://www.heise.de/hintergrund/Auslegungssache-150-Auf-digitaler-Spurensu… ∗∗∗ Von München bis Sevilla: Internationaler Schlag gegen Cyber-Mafia „Black Axe“ ∗∗∗ --------------------------------------------- Ermittlern gelang in Spanien ein empfindlicher Schlag gegen die als „Black Axe“ bekannte nigerianische Cyber-Mafia. --------------------------------------------- https://www.heise.de/news/Von-Muenchen-bis-Sevilla-Internationaler-Schlag-g… ∗∗∗ Who Benefited from the Aisuru and Kimwolf Botnets? ∗∗∗ --------------------------------------------- Our first story of 2026 revealed how a destructive new botnet called Kimwolf rapidly grew to infect more than two million devices by mass-compromising a vast number of unofficial Android TV streaming boxes. Today, well dig through digital clues left behind by the hackers, network operators, and cybercrime services that appear to have benefitted from Kimwolfs spread. --------------------------------------------- https://krebsonsecurity.com/2026/01/who-benefited-from-the-aisuru-and-kimwo… ∗∗∗ CPPA fines data broker selling lists of Alzheimers patients ∗∗∗ --------------------------------------------- Datamasters bought and resold the names, addresses, phone numbers and email addresses of millions of people with Alzheimer’s disease, drug addiction, bladder incontinence and other medical conditions for targeted advertising, according to the CPPA. --------------------------------------------- https://therecord.media/ccpa-fines-data-broker-selling-lists-alzheimers ∗∗∗ Russian Hacktivists hack CCTV Cameras in Denmark ∗∗∗ --------------------------------------------- The hacktivists had recorded part of the video stream from the CCTV as proof of the hack and published it. It was reported that no individuals were identifiable on the recording. --------------------------------------------- https://www.truesec.com/hub/blog/russian-hacktivists-hack-cctv-cameras-in-d… ∗∗∗ CISCO-Switches gehen wegen DNS-Fehler in Boot-Schleifen ∗∗∗ --------------------------------------------- Weltweit kämpfen Administratoren wohl damit, dass bestimmte Switches des Herstellers CISCO in einer Neustart-Schleife (Boot-Loop) gefangen sind. Das tritt auf, nachdem die Geräte einen DNS-Client-Fehler protokolliert haben. --------------------------------------------- https://borncity.com/blog/2026/01/09/cisco-switches-gehen-wegen-dns-fehler-… ∗∗∗ Hacker Behind Wired.com Leak Now Selling Full 40M Condé Nast Records ∗∗∗ --------------------------------------------- A hacker claims to be selling nearly 40 million Condé Nast user records after leaking Wired.com data, with multiple major brands allegedly affected. --------------------------------------------- https://hackread.com/wired-com-hacker-data-leak-conde-nast-records/ ∗∗∗ Threat Actors Actively Targeting LLMs ∗∗∗ --------------------------------------------- Our Ollama honeypot infrastructure captured 91,403 attack sessions between October 2025 and January 2026. Buried in that data: two distinct campaigns that reveal how threat actors are systematically mapping the expanding surface area of AI deployments. --------------------------------------------- https://www.greynoise.io/blog/threat-actors-actively-targeting-llms ∗∗∗ Do Smart People Ever Say They’re Smart? (SmarterTools SmarterMail Pre-Auth RCE CVE-2025-52691) ∗∗∗ --------------------------------------------- Welcome to 2026! While we are all waiting for the scheduled SSLVPN ITW exploitation programming that occurs every January, we’re back from Christmas and idle hands, idle minds, yada yada. In December, we were alerted to a vulnerability in SmarterTools’ SmarterMail solution, accompanied by an advisory from Singapore’s Cyber Security Agency (CSA) - CVE-2025-52691, a pre-auth RCE that obtained full marks (10/10) on the industry’s scale. --------------------------------------------- https://labs.watchtowr.com/do-smart-people-ever-say-theyre-smart-smartertoo… ∗∗∗ Fake Windows Update and BSOD Alerts Used in a Tech Support Scam ∗∗∗ --------------------------------------------- While reviewing submissions received through the WordPress feedback form on my website, I came across a URL that initially appeared unremarkable. Such submissions are common and often contain benign questions or comments, but this particular link stood out enough to warrant closer inspection. --------------------------------------------- https://malwr-analysis.com/2026/01/09/fake-windows-update-and-bsod-alerts-u… ===================== = Vulnerabilities = ===================== ∗∗∗ VU#361400: BeeS Software Solutions BeeS Examination Tool (BET) portal contains SQL injection vulnerability ∗∗∗ --------------------------------------------- The BeeS Examination Tool (BET) portal from BeeS Software Solutions contains an SQL injection vulnerability in its website login functionality. More than 100 universities use the BET portal for test administration and other academic tasks. --------------------------------------------- https://kb.cert.org/vuls/id/361400 ∗∗∗ RICOH Streamline NX vulnerable to improper authorization ∗∗∗ --------------------------------------------- RICOH Streamline NX provided by Ricoh Company, Ltd. contains an improper authorization vulnerability. --------------------------------------------- https://jvn.jp/en/jp/JVN12770174/ ∗∗∗ Trend Micro Apex Central RCE Flaw Scores 9.8 CVSS in On-Prem Windows Versions ∗∗∗ --------------------------------------------- Trend Micro has released security updates to address multiple security vulnerabilities impacting on-premise versions of Apex Central for Windows, including a critical bug that could result in arbitrary code execution. The vulnerability, tracked as CVE-2025-69258, carries a CVSS score of 9.8 out of a maximum of 10.0. --------------------------------------------- https://thehackernews.com/2026/01/trend-micro-apex-central-rce-flaw.html ∗∗∗ Mediaplayer VLC: Aktualisierte Version stopft zahlreiche Lücken ∗∗∗ --------------------------------------------- Die Version 3.0.23 des VLC Media Player bessert diverse Schwachstellen aus, die möglicherweise Unterschieben von Schadcode erlauben. --------------------------------------------- https://www.heise.de/news/VLC-stopft-diverse-Sicherheitslecks-11135921.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (pdfminer and vlc), Red Hat (kernel, kernel-rt, and microcode_ctl), Slackware (libtasn1), SUSE (apptainer, curl, ImageMagick, libpcap, libvirt, libwget4, php8, podman, python311-cbor2, qemu, and rsync), and Ubuntu (gnupg, gnupg2, gpsd, libsodium, and python-tornado). --------------------------------------------- https://lwn.net/Articles/1053492/ ∗∗∗ Hitachi Energy Asset Suite ∗∗∗ --------------------------------------------- Hitachi Energy is aware of a Jasper Report vulnerability that affects the Asset Suite product versions mentioned in this document below. This vulnerability can be exploited to carry out remote code execution (RCE) attack on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-26-008-01 ∗∗∗ K000159018: Linux kernel vulnerability CVE-2023-53178 ∗∗∗ --------------------------------------------- A local unprivileged user may exploit this vulnerability and cause data integrity issues or system instability under specific conditions. --------------------------------------------- https://my.f5.com/manage/s/article/K000159018 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 08.01.2026
by Daily end-of-shift report 08 Jan '26

08 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 07-01-2026 18:00 − Donnerstag 08-01-2026 18:00 Handler: Felician Fuchs Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New GoBruteforcer attack wave targets crypto, blockchain projects ∗∗∗ --------------------------------------------- A new wave of GoBruteforcer botnet malware attacks is targeting databases of cryptocurrency and blockchain projects on exposed servers believed to be configured using AI-generated examples. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-gobruteforcer-attack-wav… ∗∗∗ Cisco warns of Identity Service Engine flaw with exploit code ∗∗∗ --------------------------------------------- Cisco has patched an ISE vulnerability with public proof-of-concept exploit code that can be abused by attackers with admin privileges. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-serv… ∗∗∗ Dringend MFA aktivieren: Massenhaft Daten aus Cloud-Instanzen abgeflossen ∗∗∗ --------------------------------------------- Betroffen sind self-hosted Instanzen von Owncloud, Nextcloud und Sharefile. Daten von 50 Organisationen stehen zum Verkauf, weil die MFA nicht aktiv war. --------------------------------------------- https://www.golem.de/news/dringend-mfa-aktivieren-massenhaft-daten-aus-clou… ∗∗∗ NIS-2-Umsetzung: BSI schaltet Meldeportal auf Amazon-Servern frei ∗∗∗ --------------------------------------------- Fast 30.000 Firmen und Behörden der kritischen Infrastruktur müssen sich beim BSI registrieren. Das Portal läuft auf Clouddiensten von AWS. --------------------------------------------- https://www.golem.de/news/nis-2-umsetzung-bsi-schaltet-meldeportal-auf-amaz… ∗∗∗ BSI warnt: 40 Prozent der deutschen Zimbra-Server sind angreifbar ∗∗∗ --------------------------------------------- Ein Großteil aller Zimbra-Server in Deutschland basiert noch auf einer veralteten Version, die anfällig für gefährliche Sicherheitslücken ist. --------------------------------------------- https://www.golem.de/news/bsi-warnt-40-prozent-der-deutschen-zimbra-server-… ∗∗∗ Fake Browser Updates Targeting WordPress Administrators via Malicious Plugin ∗∗∗ --------------------------------------------- We recently investigated a case involving a WordPress website where a customer reported persistent fake pop-up notifications appearing on their site. The warnings were urging them to update their browser (Chrome or Firefox), even though their software was already fully up-to-date. --------------------------------------------- https://blog.sucuri.net/2026/01/fake-browser-updates-targeting-wordpress-ad… ∗∗∗ CISA Flags Microsoft Office and HPE OneView Bugs as Actively Exploited ∗∗∗ --------------------------------------------- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added two security flaws impacting Microsoft Office and Hewlett Packard Enterprise (HPE) OneView to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. --------------------------------------------- https://thehackernews.com/2026/01/cisa-flags-microsoft-office-and-hpe.html ∗∗∗ Researchers Uncover NodeCordRAT Hidden in npm Bitcoin-Themed Packages ∗∗∗ --------------------------------------------- Cybersecurity researchers have discovered three malicious npm packages that are designed to deliver a previously undocumented malware called NodeCordRAT. --------------------------------------------- https://thehackernews.com/2026/01/researchers-uncover-nodecordrat-hidden.ht… ∗∗∗ IBMs AI agent Bob easily duped to run malware, researchers show ∗∗∗ --------------------------------------------- Prompt injection lets risky commands slip past guardrails IBM describes its coding agent thus: "Bob is your AI software development partner that understands your intent, repo, and security standards." Unfortunately, Bob doesnt always follow those security standards. --------------------------------------------- https://www.theregister.com/2026/01/07/ibm_bob_vulnerability/ ∗∗∗ Gemeinsam gegen Cyber-Kriminalität: Info-Offensive zum ESC-Ticketkauf ∗∗∗ --------------------------------------------- Vor dem Start der ersten Ticket-Verkaufswelle am 13. Jänner sensibilisieren ORF, EBU, BMI, Stadt Wien, Polizei und „Watchlist Internet“ für Cyber-Gefahren und richten eine zentrale Meldestelle für Betrugsversuche ein. --------------------------------------------- https://www.watchlist-internet.at/news/gemeinsam-gegen-cyber-kriminalitaet-… ∗∗∗ Stalkerware operator pleads guilty in rare prosecution ∗∗∗ --------------------------------------------- The owner of a Michigan-based stalkerware company pleaded guilty to federal charges for selling a product designed to spy on people without their consent. --------------------------------------------- https://therecord.media/stalkerware-guilty-plea-fleming ∗∗∗ Fake ChatGPT and DeepSeek Extensions Spied on Over 1 Million Chrome Users ∗∗∗ --------------------------------------------- Security researchers have identified two malicious Chrome extensions recording AI chats. Learn how to identify and remove these tools to protect your privacy. --------------------------------------------- https://hackread.com/fake-chatgpt-deepseek-extensions-spy-chrome-users/ ∗∗∗ Discord Controlled NodeCordRAT Steals Chrome Data via NPM Packages ∗∗∗ --------------------------------------------- Zscaler ThreatLabz identifies three malicious NPM packages mimicking Bitcoin libraries. The NodeCordRAT virus uses Discord commands to exfiltrate MetaMask data and Chrome passwords. --------------------------------------------- https://hackread.com/discord-nodecordrat-steal-chrome-data-npm-packages/ ∗∗∗ The Ransomware Ground Game: How A Christmas Scanning Campaign Will Fuel 2026 Attacks ∗∗∗ --------------------------------------------- Over four days in December, one operator scanned the internet with 240+ exploits, logging confirmed vulnerabilities that could power targeted intrusions in 2026. --------------------------------------------- https://www.greynoise.io/blog/christmas-scanning-campaign-fuel-2026-attacks ∗∗∗ Decoding the GitHub recommendations for npm maintainers ∗∗∗ --------------------------------------------- This blog post explores the rationale and implementation behind GitHubs security recommendations for npm maintainers following numerous high-profile supply-chain incidents. It details how hardening publishing infrastructure through trusted publishing, enforced two-factor authentication, and WebAuthn-based protocols can meaningfully increase the resilience of the ecosystem. --------------------------------------------- https://securitylabs.datadoghq.com/articles/decoding-the-recommendations-fo… ∗∗∗ Abusing ROPC to Bypass MFA — and How I Built a Detection for It in Microsoft Sentinel ∗∗∗ --------------------------------------------- Among all the OAuth2 grant types available in Azure AD (now Microsoft Entra ID), the Resource Owner Password Credential (ROPC) flow remains one of the most misunderstood — and most abused. --------------------------------------------- https://detect.fyi/abusing-ropc-to-bypass-mfa-and-how-i-built-a-detection-f… ∗∗∗ Preparing for Post-Quantum Cryptography ∗∗∗ --------------------------------------------- Learn what you can do today to prepare for Q-Day. --------------------------------------------- https://www.wiz.io/blog/preparing-for-post-quantum-cryptography ∗∗∗ npm to Implement Staged Publishing After Turbulent Shift Off Classic Tokens ∗∗∗ --------------------------------------------- The JavaScript ecosystem spent much of 2025 responding to a sustained run of supply chain attacks, but it was the multi-wave Shai-Hulud campaign that ultimately reset expectations for what large-scale, automated compromise looks like. By the end of the year, organizations with JavaScript-heavy infrastructure were no longer treating supply chain malware as an edge case, but as an operational risk that could spread faster than human review. Now, npm says it is preparing its next major response. --------------------------------------------- https://socket.dev/blog/npm-to-implement-staged-publishing ∗∗∗ Crimson Collective Claims to Disconnect Brightspeed Internet Users After Hack ∗∗∗ --------------------------------------------- The hacking group Crimson Collective claims to have access to Brightspeed’s infrastructure and is disconnecting users from the company’s home internet services. The group made its latest claims in a post on Telegram yesterday. “Hey BrightSpeed, we disconnected alot of your users home internet.. they might be complaining you should check,” the Telegram post says. --------------------------------------------- https://thecyberexpress.com/crimson-collective-disconnects-brightspeed/ ∗∗∗ Trump Orders US Exit from Global Cyber and Hybrid Threat Coalitions ∗∗∗ --------------------------------------------- President Donald Trump has ordered the immediate withdrawal of the United States from several premier international bodies dedicated to cybersecurity, digital human rights, and countering hybrid warfare, as part of a major restructuring of American defense and diplomatic posture. --------------------------------------------- https://thecyberexpress.com/trump-orders-us-exit-from-cyber-coalitions/ ∗∗∗ UK Moves to Close Public Sector Cyber Gaps With Government Cyber Action Plan ∗∗∗ --------------------------------------------- The UK government has revealed the Government Cyber Action Plan as a renewed effort to close the growing gap between escalating cyber threats and the public sector’s ability to respond effectively. The move comes amid a series of cyberattacks targeting UK retail and manufacturing sectors, incidents that have underscored broader vulnerabilities affecting critical services and government operations. --------------------------------------------- https://thecyberexpress.com/uk-government-cyber-action-plan/ ===================== = Vulnerabilities = ===================== ∗∗∗ Max severity Ni8mare flaw lets hackers hijack n8n servers ∗∗∗ --------------------------------------------- A maximum severity vulnerability dubbed "Ni8mare" allows remote, unauthenticated attackers to take control over locally deployed instances of the N8N workflow automation platform. --------------------------------------------- https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-le… ∗∗∗ Critical jsPDF flaw lets hackers steal secrets via generated PDFs ∗∗∗ --------------------------------------------- The jsPDF library for generating PDF documents in JavaScript applications is vulnerable to a critical vulnerability that allows an attacker to steal sensitive data from the local filesystem by including it in generated files. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-jspdf-flaw-lets-hac… ∗∗∗ The installers for multiple PIONEER products may insecurely load Dynamic Link Libraries ∗∗∗ --------------------------------------------- The installers for multiple products provided by PIONEER CORPORATION may insecurely load Dynamic Link Libraries. Arbitrary code may be executed with the privileges of the running installer. --------------------------------------------- https://jvn.jp/en/jp/JVN17956874/ ∗∗∗ zlib: Kritische Sicherheitslücke ermöglicht Codeschmuggel – noch kein Update ∗∗∗ --------------------------------------------- In einem Werkzeug der Kompressionsbibliothek zlib, die in zahlreichen Programmen und Betriebssystemen enthalten ist, haben IT-Forscher eine kritische Sicherheitslücke entdeckt. Sie ermöglicht unter Umständen das Einschleusen und Ausführen von Schadcode. Ein Update zum Stopfen des Sicherheitslecks gibt es bislang noch nicht. --------------------------------------------- https://www.heise.de/news/zlib-Kritische-Sicherheitsluecke-ermoeglicht-Code… ∗∗∗ Sieben kritische Sicherheitslücken mit Höchstwertung bedrohen Coolify ∗∗∗ --------------------------------------------- Admins von Platform-as-a-Service-Umgebungen auf der Basis von Coolify sollten ihre Instanzen zügig auf den aktuellen Stand bringen. Geschieht das nicht, können Angreifer unter anderem an sieben „kritischen“ Sicherheitslücken mit Höchstwertung (CVSS Score 10 von 10) ansetzen, um Server vollständig zu kompromittieren. --------------------------------------------- https://www.heise.de/news/Sieben-kritische-Sicherheitsluecken-mit-Hoechstwe… ∗∗∗ Kanboard-Sicherheitslücke ermöglicht Anmeldung als beliebiger User ∗∗∗ --------------------------------------------- Das Open-Source-Kanban Kanboard ist von drei Schwachstellen betroffen. Eine davon gilt den Entwicklern als kritisches Risiko und ermöglicht die Anmeldung als beliebiger User – sofern eine bestimmte Konfigurationsoption gesetzt ist. --------------------------------------------- https://www.heise.de/news/Kanboard-Sicherheitsluecke-ermoeglicht-Anmeldung-… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (gcc-toolset-14-binutils, gcc-toolset-15-binutils, httpd, kernel, libpng, mariadb, mingw-libpng, poppler, python3.12, and ruby:3.3), Debian (foomuuri and libsodium), Fedora (python-pdfminer and wget2), Oracle (audiofile, bind, gcc-toolset-15-binutils, libpng, mariadb, mariadb10.11, mariadb:10.11, mariadb:10.5, mingw-libpng, poppler, and python3.12), Red Hat (git-lfs, kernel, libpng, libpq, mariadb:10.3, osbuild-composer, postgresql, postgresql:13, and postgresql:15), Slackware (curl), SUSE (c-ares-devel, capstone, curl, gpsd, ImageMagick, libpcap, log4j, python311-filelock, and python314), and Ubuntu (libcaca, libxslt, and net-snmp). --------------------------------------------- https://lwn.net/Articles/1053277/ ∗∗∗ [R1] Nessus Agent Versions 11.0.3 and 10.9.3 Fix One Vulnerability ∗∗∗ --------------------------------------------- A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows Hosts which could lead to escalation of privileges. Tenable has released Nessus Agent 11.0.3 and Nessus Agent 10.9.3 to address these issues. --------------------------------------------- https://www.tenable.com/security/tns-2026-01 ∗∗∗ CVE-2025-42877: Memory Corruption in SAP Web Dispatcher ∗∗∗ --------------------------------------------- SAP Web Dispatcher and Internet Communication Manager (ICM) contain a critical memory corruption vulnerability in the HTTP header parsing function. The vulnerability allows an unauthenticated attacker to cause heap corruption and lead to Denial of Service through specially crafted HTTP requests. --------------------------------------------- https://redrays.io/blog/cve-2025-42877-sap-web-dispatcher-memory-corruption… ∗∗∗ Case opened: DIVD-2025-00011 - Severe vulnerabilities in Growatt portal ∗∗∗ --------------------------------------------- https://csirt.divd.nl/cases/DIVD-2025-00011/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 07.01.2026
by Daily end-of-shift report 07 Jan '26

07 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Montag 05-01-2026 18:00 − Mittwoch 07-01-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New D-Link flaw in legacy DSL routers actively exploited in attacks ∗∗∗ --------------------------------------------- Threat actors are exploiting a recently discovered command injection vulnerability that affects multiple D-Link DSL gateway routers that went out of support years ago. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-d-link-flaw-in-legacy-ds… ∗∗∗ ownCloud urges users to enable MFA after credential theft reports ∗∗∗ --------------------------------------------- File-sharing platform ownCloud warned users today to enable multi-factor authentication (MFA) to block attackers using compromised credentials from stealing their data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/owncloud-urges-users-to-enab… ∗∗∗ Microsoft: Classic Outlook bug prevents opening encrypted emails ∗∗∗ --------------------------------------------- Microsoft has confirmed a known issue that prevents recipients from opening encrypted emails in classic Outlook. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-classic-outlook-b… ∗∗∗ Founder of Spyware Maker PcTattletale Pleads Guilty To Hacking, Advertising Surveillance Software ∗∗∗ --------------------------------------------- An anonymous reader quotes a report from TechCrunch: The founder of a U.S.-based spyware company, whose surveillance products allowed customers to spy on the phones and computers of unsuspecting victims, pleaded guilty to federal charges linked to his long-running operation. pcTattletale founder Bryan Fleming entered a guilty plea in a San Diego federal .. --------------------------------------------- https://yro.slashdot.org/story/26/01/07/0033238/founder-of-spyware-maker-pc… ∗∗∗ UK injects just £210M into cyber plan to stop Whitehall getting pwnd ∗∗∗ --------------------------------------------- Central government will supposedly be as secure as energy facilities and datacenters under new proposals The UK today launches its Government Cyber Action Plan, committing £210 million ($282 million) to strengthen defenses across digital public services and hold itself to the same cybersecurity standards its imposing on critical infrastructure operators. --------------------------------------------- https://www.theregister.com/2026/01/06/government_cyber_action_plan/ ∗∗∗ Malicious NPM Packages Deliver NodeCordRAT ∗∗∗ --------------------------------------------- Zscaler ThreatLabz regularly monitors the npm database for suspicious packages. In November 2025, ThreatLabz identified three malicious packages: bitcoin-main-lib, bitcoin-lib-js, and bip40. The bitcoin-main-lib and bitcoin-lib-js packages execute a postinstall.cjs script during installation, which installs bip40, the package that contains the .. --------------------------------------------- https://www.zscaler.com/blogs/security-research/malicious-npm-packages-deli… ∗∗∗ CISA-Katalog attackierter Schwachstellen wuchs 2025 um 20 Prozent ∗∗∗ --------------------------------------------- Die US-amerikanische IT-Sicherheitsbehörde CISA pflegt einen Katalog angegriffener Schwachstellen. Der wuchs 2025 etwas schneller. --------------------------------------------- https://www.heise.de/news/CISA-Katalog-attackierter-Schwachstellen-wuchs-20… ∗∗∗ Patchday: Dolby-Digital-Sicherheitslücke in Android geschlossen ∗∗∗ --------------------------------------------- Androidgeräte sind für eine Zero-Click-Attacke anfällig. Dieses Sicherheitsproblem wurde nun gelöst. --------------------------------------------- https://www.heise.de/news/Patchday-Dolby-Digital-Sicherheitsluecke-in-Andro… ∗∗∗ Ubiquiti UniFi Protect: Sicherheitslücke ermöglicht Zugriff auf Kameras ∗∗∗ --------------------------------------------- In der UniFi Protect Application können Angreifer Schwachstellen für unbefugten Zugriff auf Kameras und DoS-Attacken missbrauchen. --------------------------------------------- https://www.heise.de/news/Ubiquiti-UniFi-Protect-Sicherheitsluecke-ermoegli… ∗∗∗ Mehrere Sicherheitslücken bedrohen Veeam Back & Replication ∗∗∗ --------------------------------------------- Ein wichtiges Sicherheitsupdate schließt mehrere Schwachstellen in Veeam Back & Replication. Bislang sind keine Attacken bekannt. --------------------------------------------- https://www.heise.de/news/Mehrere-Sicherheitsluecken-bedrohen-Veeam-Back-Re… ∗∗∗ Krypto-Phishing mit angeblicher Mail des Bundeszentralamts für Steuern ∗∗∗ --------------------------------------------- Eine aktuelle Phishing-Welle behauptet Abweichungen bei „Krypto-Angaben“ beim Bundeszentralamt für Steuern. --------------------------------------------- https://www.heise.de/news/Krypto-Phishing-mit-angeblicher-Mail-des-Bundesze… ∗∗∗ 2025, the year of the Infostealer ∗∗∗ --------------------------------------------- TL;DR Introduction Infostealers are not new malware. They have been around for decades. What has changed is how effective they have become, and how easily they blend into normal user behaviour. In 2025, infostealers became the fastest growing malware category, overtaking ransomware in terms of deployment and spread. The H1 2025 reports highlighted a sharp rise in simple .. --------------------------------------------- https://www.pentestpartners.com/security-blog/2025-the-year-of-the-infostea… ∗∗∗ Russian hackers target European hospitality industry with ‘blue screen of death’ malware ∗∗∗ --------------------------------------------- The scheme starts with a fake reservation cancellation that impersonates a popular booking site, and eventually prompts victims with an error message and “Blue Screen of Death” page. --------------------------------------------- https://therecord.media/russian-hackers-europe-hospitality-blue-screen ∗∗∗ Alleged cyber scam kingpin arrested, extradited to China ∗∗∗ --------------------------------------------- Chen Zhi’s arrest is the latest chapter in the remarkable downfall of one of the country’s most prominent businesses, with holdings in the real estate, banking, entertainment and airline industries. --------------------------------------------- https://therecord.media/alleged-cyber-scam-kingpin-cambodia-arrested-extrad… ∗∗∗ Analysis of a Fake Cloudflare Turnstile Used as a Traffic Filtering Gate ∗∗∗ --------------------------------------------- During analysis of a phishing URL chain, I observed a fake Cloudflare Turnstile verification page acting as an intelligent traffic filtering gate. Rather than protecting a website, this page selectively blocks, redirects, or allows access based on geolocation, proxy usage, and browser fingerprinting. This phishing infrastructure demonstrates Traffic Distribution System like behavior .. --------------------------------------------- https://malwr-analysis.com/2026/01/07/analysis-of-a-fake-cloudflare-turnsti… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Identity Services Engine XML External Entity Processing Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to gain access to sensitive information.  This vulnerability is due to improper parsing of XML that is processed by the web-based management interface of Cisco ISE and Cisco ISE-PIC. An attacker could exploit this vulnerability by uploading a malicious file to .. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Multiple Cisco Products Snort 3 Distributed Computing Environment/Remote Procedure Call Vulnerabilities ∗∗∗ --------------------------------------------- Multiple Cisco products are affected by vulnerabilities in the processing of Distributed Computing Environment Remote Procedure Call (DCE/RPC) requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restart, which would result in an interruption of packet inspection. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address .. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ [20260101] - Core - Inadequate content filtering for data URLs ∗∗∗ --------------------------------------------- https://developer.joomla.org/security-centre/1016-20260101-core-inadequate-… ∗∗∗ [20260102] - Core - XSS vector in the pagebreak plugin ∗∗∗ --------------------------------------------- https://developer.joomla.org/security-centre/1017-20260102-core-xss-vector-… ∗∗∗ [20260102] - Core - XSS vectors in the pagebreak and pagenavigation plugins ∗∗∗ --------------------------------------------- https://developer.joomla.org/security-centre/1017-20260102-core-xss-vector-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 05.01.2026
by Daily end-of-shift report 05 Jan '26

05 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 02-01-2026 18:00 − Montag 05-01-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Hackers claim to hack Resecurity, firm says it was a honeypot ∗∗∗ --------------------------------------------- The ShinyHunters hacking group claims it breached the systems of cybersecurity firm Resecurity and stole internal data, while Resecurity says the attackers only accessed a deliberately deployed honeypot containing fake information used to monitor their activity. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-claim-resecurity-hac… ∗∗∗ How to Protect Your iPhone or Android Device From Spyware ∗∗∗ --------------------------------------------- Being targeted by sophisticated spyware is relatively rare, but experts say that everyone needs to stay vigilant as this dangerous malware continues to proliferate worldwide. --------------------------------------------- https://www.wired.com/story/how-to-protect-your-iphone-or-android-device-fr… ∗∗∗ Plex Media Server: Noch ungepatchte Zugriffsschwachstellen ∗∗∗ --------------------------------------------- Im Plex Media Server klaffen Sicherheitslecks, durch die Angreifer sich unbefugt Zugriff verschaffen können. Updates stehen aus. --------------------------------------------- https://www.heise.de/news/Plex-Media-Server-Noch-ungepatchte-Zugriffsschwac… ∗∗∗ MongoBleed-Scanner für Admins ∗∗∗ --------------------------------------------- Viele MongoDB-Instanzen sind oder waren potenziell für MongoBleed anfällig. Ein Tool hilft bei der Server-Analyse auf Angriffsspuren. --------------------------------------------- https://www.heise.de/news/MongoBleed-Scanner-fuer-Admins-11129291.html ∗∗∗ Taiwan: 2,6 Millionen Cyberangriffe Chinas pro Tag ∗∗∗ --------------------------------------------- Die Angriffe haben laut Taiwan in zeitlicher Nähe zu Militärübungen stattgefunden. China dementiert --------------------------------------------- https://www.derstandard.at/story/3000000302832/taiwan-26-millionen-cyberang… ∗∗∗ Aktuelle Angriffe gegen alte Sicherheitslücke in Fortinet-Geräten (CVE-2020-12812) ∗∗∗ --------------------------------------------- Eine bereits seit Juli 2020 bekannte Sicherheitslücke in Fortinet-Firewalls, CVE-2020-12812, wird aktuell aktiv ausgenutzt. Durch Ausnutzung der Schwachstelle können Angreifer:innen durch eine simple Manipulation von Groß- und Kleinbuchstaben in Benutzernamen (z. B. "Mmueller" statt "mmueller") die Zwei-Faktor-Authentifizierung (2FA) über Fortitoken umgehen. Besonders gefährdet sind Systeme, die lokale Nutzer:innen über einen .. --------------------------------------------- https://www.cert.at/de/aktuelles/2026/1/aktuelle-angriffe-gegen-alte-sicher… ∗∗∗ Nearly 480,000 impacted by Covenant Health data breach ∗∗∗ --------------------------------------------- A cyberattack last year against the Catholic healthcare organization Covenant Health exposed the sensitive information of more than 478,000 people. --------------------------------------------- https://therecord.media/covenant-health-breach-qilin ∗∗∗ NordVPN Denies Breach After Hacker Claims Access to Salesforce Dev Data ∗∗∗ --------------------------------------------- A hacker using the alias 1011 has claimed to breach a NordVPN development server, posting what appears to… --------------------------------------------- https://hackread.com/nordvpn-denies-breach-hacker-salesforce-dev-data/ ∗∗∗ Schlappe für Softwarebauer: BSI darf Sicherheitskonzept als „auffällig“ rügen ∗∗∗ --------------------------------------------- Das Verwaltungsgericht Köln hat den Eilantrag eines Herstellers gegen eine drohende behördliche Warnung abgewiesen und die BSI-Informationsbefugnisse gestärkt. --------------------------------------------- https://heise.de/-11127661 ∗∗∗ Sicherheitsupdates: Verschiedene Attacken auf Qnap-NAS möglich ∗∗∗ --------------------------------------------- Stimmten die Voraussetzungen, können Angreifer Netzwerkspeicher von Qnap mit weitreichenden Folgen attackieren. --------------------------------------------- https://heise.de/-11129647 ∗∗∗ The Kimwolf Botnet is Stalking Your Local Network ∗∗∗ --------------------------------------------- The story you are reading is a series of scoops nestled inside a far more urgent Internet-wide security advisory. The vulnerability at issue has been exploited for months already, and it’s time for a broader awareness of the threat. The short version is that everything you thought you knew about the security of the internal network behind your Internet router probably is now dangerously out of date. --------------------------------------------- https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-loc… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (tar), Debian (curl and gimp), Fedora (doctl, gitleaks, gnupg2, grpcurl, nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, and usd), Mageia (cups), Red Hat (container-tools:rhel8, go-toolset:rhel8, grafana, and skopeo), and SUSE (dirmngr, fluidsynth, gnu-recutils, libmatio-devel, python311-marshmallow, python312-Django6, rsync, and thunderbird). --------------------------------------------- https://lwn.net/Articles/1052795/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 02.01.2026
by Daily end-of-shift report 02 Jan '26

02 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 30-12-2025 18:00 − Freitag 02-01-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Over 10K Fortinet firewalls exposed to actively exploited 2FA bypass ∗∗∗ --------------------------------------------- Fortinet released FortiOS versions 6.4.1, 6.2.4, and 6.0.10 in July 2020 to address this flaw (tracked as CVE-2020-12812) and advised admins who couldn't immediately patch to turn off username-case-sensitivity to block 2FA bypass attempts targeting their devices. [..] On Friday, Internet security watchdog Shadowserver revealed that it currently tracks over 10,000 Fortinet firewalls still exposed on the Internet that are unpatched against CVE-2020-12812 and vulnerable to these ongoing attacks ... --------------------------------------------- https://www.bleepingcomputer.com/news/security/over-10-000-fortinet-firewal… ∗∗∗ The Kimwolf Botnet is Stalking Your Local Network ∗∗∗ --------------------------------------------- The story you are reading is a series of scoops nestled inside a far more urgent Internet-wide security advisory. The vulnerability at issue has been exploited for months already, and its time for a broader awareness of the threat. The short version is that everything you thought you knew about the security of the internal network behind your Internet router probably is now dangerously out of date. --------------------------------------------- https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-loc… ∗∗∗ Everest Ransomware Leaks 1TB of Stolen ASUS Data ∗∗∗ --------------------------------------------- On December 2, 2025, Hackread.com exclusively reported that the Everest ransomware group claimed to have stolen 1TB of sensitive ASUS data, including information related to the company’s AI models, memory dumps, and calibration files. [..] Everest has now leaked the entire dataset online. --------------------------------------------- https://hackread.com/everest-ransomware-asus-data-leak/ ∗∗∗ RondoDox botnet exploits React2Shell flaw to breach Next.js servers ∗∗∗ --------------------------------------------- The RondoDox botnet has been observed exploiting the critical React2Shell flaw (CVE-2025-55182) to infect vulnerable Next.js servers with malware and cryptominers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/rondodox-botnet-exploits-rea… ∗∗∗ The biggest cybersecurity and cyberattack stories of 2025 ∗∗∗ --------------------------------------------- 2025 was a big year for cybersecurity, with cyberattacks, data breaches, threat groups reaching new notoriety levels, and, of course, zero-day flaws exploited in breaches. Some stories, though, were more impactful or popular with our readers than others. This article explores 15 of the biggest cybersecurity stories of 2025. --------------------------------------------- https://www.bleepingcomputer.com/news/security/the-biggest-cybersecurity-an… ∗∗∗ Hong Kong’s newest anti-scam technology is over-the-counter banking ∗∗∗ --------------------------------------------- Hong Kong’s banks have a new weapon against scams: Accounts that require customers to visit a branch to access their funds. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/12/31/hong_kong_an… ∗∗∗ How AI made scams more convincing in 2025 ∗∗∗ --------------------------------------------- Several AI-related stories in 2025 highlighted how quickly AI systems can move beyond meaningful human control. --------------------------------------------- https://www.malwarebytes.com/blog/news/2026/01/how-ai-made-scams-more-convi… ∗∗∗ VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion ∗∗∗ --------------------------------------------- Discord is a social messaging and communications platform that has become a popular target for malware, like VVS stealer. VVS stealer is designed to steal a victim's Discord information and browser data. [..] The stealer also achieves persistence by automatically installing itself on startup. It operates stealthily by displaying fake error messages and capturing screenshots. --------------------------------------------- https://unit42.paloaltonetworks.com/vvs-stealer/ ∗∗∗ Snipping the Long Tail of Shai-Hulud 2.0 ∗∗∗ --------------------------------------------- Wiz Research reveals the data behind Shai-Huluds 2.0 long tail, the massive gap in cloud credential rotation, a potential link to the Trust Wallet incident, and how we finally "snipped the tail" on a month of ongoing infections. --------------------------------------------- https://www.wiz.io/blog/snipping-the-long-tail-of-shai-hulud-2-0 ∗∗∗ RMM Abuse in a Crypto Wallet Distribution Campaign ∗∗∗ --------------------------------------------- A professionally written announcement email titled “Eternl Desktop Is Live — Secure Execution for Atrium & Diffusion Participants” is currently circulating within the Cardano community. [..] This campaign exhibits multiple overlapping indicators consistent with supply-chain abuse and trojanized wallet distribution, combined with pre positioning techniques that leverage RMM tools to establish persistent access. --------------------------------------------- https://malwr-analysis.com/2025/12/31/rmm-abuse-in-a-crypto-wallet-distribu… ===================== = Vulnerabilities = ===================== ∗∗∗ Gambio: Wichtiges Security Update 2025-12 v1.0.0 für alle Versionen bis GX5 v5.0.1.0 ∗∗∗ --------------------------------------------- Wir haben soeben ein neues Security Update Paket veröffentlicht, dessen Installation wir allen Shopbetreibern dringend empfehlen. Wichtig: Nutzer der Gambio Cloud müssen nichts unternehmen, alle Shops wurden bereits vollständig von uns abgesichert! [..] Bitte versteht, dass wir keine Details beschreiben werden, die Angreifern als Blaupause für einen Angriff dienen könnten. --------------------------------------------- https://www.gambio.de/forum/threads/wichtiges-security-update-2025-12-v1-0-… ∗∗∗ QNAP Security Advisories 3. Jan ∗∗∗ --------------------------------------------- QNAP has released 7 new security advisories. --------------------------------------------- https://www.qnap.com/en-us/security-advisories ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (smb4k), Fedora (direwolf, gh, usd, and webkitgtk), Slackware (libpcap and seamonkey), and SUSE (kepler). --------------------------------------------- https://lwn.net/Articles/1052600/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 30.12.2025
by Daily end-of-shift report 30 Dec '25

30 Dec '25

===================== = End-of-Day report = ===================== Timeframe: Montag 29-12-2025 18:00 − Dienstag 30-12-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ European Space Agency confirms breach of "external servers" ∗∗∗ --------------------------------------------- The European Space Agency (ESA) confirmed that attackers recently breached servers outside its corporate network, which contained what it described as "unclassified" information on collaborative engineering activities. --------------------------------------------- https://www.bleepingcomputer.com/news/security/european-space-agency-confir… ∗∗∗ Zoom Stealer browser extensions harvest corporate meeting intelligence ∗∗∗ --------------------------------------------- A newly discovered campaign, which researchers call Zoom Stealer, is affecting 2.2 million Chrome, Firefox, and Microsoft Edge users through 18 extensions that collect online meeting-related data like URLs, IDs, topics, descriptions, and embedded passwords. [..] Because many of these extensions operated innocuously for extended periods, users should carefully review the permissions the extensions require and limit their number to the necessary minimum. Koi Security reported the offending extensions, but many are still present on the Chrome Web Store. The researchers published the complete list of active DarkSpectre extensions. --------------------------------------------- https://www.bleepingcomputer.com/news/security/zoom-stealer-browser-extensi… ∗∗∗ Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor ∗∗∗ --------------------------------------------- The Chinese hacking group known as Mustang Panda has leveraged a previously undocumented kernel-mode rootkit driver to deliver a new variant of backdoor dubbed TONESHELL in a cyber attack detected in mid-2025 targeting an unspecified entity in Asia. The findings come from Kaspersky, which observed the new backdoor variant in cyber espionage campaigns mounted by the hacking group targeting government organizations in Southeast and East Asia, primarily Myanmar and Thailand. --------------------------------------------- https://thehackernews.com/2025/12/mustang-panda-uses-signed-kernel-driver.h… ∗∗∗ Trends, Highlights und Skurrilitäten: Das Jahr 2025 aus Sicht der Watchlist Internet ∗∗∗ --------------------------------------------- Welche Entwicklungen brachte 2025 im Bereich des Online-Betrugs? Welche Artikel waren bei unseren Leser:innen besonders beliebt? Und mit welchen skurrilen Schmankerln hatte es die Redaktion in den vergangenen 12 Monaten zu tun? Ein Rückblick zum Jahreswechsel! --------------------------------------------- https://www.watchlist-internet.at/news/jahresrueckblick-watchlist-2025/ ∗∗∗ 39C3: Schwachstellen in Xplora-Smartwatches gefährdeten Millionen Kinder ∗∗∗ --------------------------------------------- Forscher konnten Nachrichten mitlesen, Standorte fälschen und beliebige Uhren übernehmen – demonstriert aus der Perspektive einer kinderfressenden Waldhexe. --------------------------------------------- https://heise.de/-11126122 ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (openjpeg2, osslsigncode, php-dompdf, and python-django), Fedora (fluidsynth, golang-github-alecthomas-chroma-2, golang-github-evanw-esbuild, golang-github-jwt-5, and opentofu), Mageia (ceph and ruby-rack), and SUSE (anubis, apache2-mod_auth_openidc, dpdk22, kernel, libpng16, and python311-openapi-core). --------------------------------------------- https://lwn.net/Articles/1052327/ ∗∗∗ ZDI-25-1195: (0Day) FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-1195/ ∗∗∗ ZDI-25-1184: (0Day) FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-1184/ ∗∗∗ ZDI-25-1201: (0Day) Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-1201/ ∗∗∗ ZDI-25-1199: (0Day) Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-1199/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 29.12.2025
by Daily end-of-shift report 29 Dec '25

29 Dec '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 23-12-2025 18:00 − Montag 29-12-2025 18:00 Handler: Alexander Riepl Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ Schwerwiegende Sicherheitslücke in MongoDB ("MongoBleed") ∗∗∗ --------------------------------------------- In MongoDB wurde um Weihnachten eine schwerwiegende Sicherheitslücke entdeckt. Die Schwachstelle, CVE-2025-14847 (auch bekannt als "MongoBleed") erlaubt es unauthentifizierten Angreifer:innen durch manipulierte, zlib-kompromierte Anfragen Teile des Heap-Speichers auszulesen und damit potentiell sensible Daten (wie beispielsweise Passwörter oder API-Schlüssel) zu stehlen. --------------------------------------------- https://www.cert.at/de/aktuelles/2025/12/schwerwiegende-sicherheitslucke-in… ∗∗∗ WebRAT malware spread via fake vulnerability exploits on GitHub ∗∗∗ --------------------------------------------- The WebRAT malware is now being distributed through GitHub repositories that claim to host proof-of-concept exploits for recently disclosed vulnerabilities. --------------------------------------------- https://www.bleepingcomputer.com/news/security/webrat-malware-spread-via-fa… ∗∗∗ Microsoft Teams to let admins block external users via Defender portal ∗∗∗ --------------------------------------------- Microsoft announced that security administrators will soon be able to block external users from sending messages, calls, or meeting invitations to members of their organization via Teams. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-let-admi… ∗∗∗ Romanian energy provider hit by Gentlemen ransomware attack ∗∗∗ --------------------------------------------- A ransomware attack hit Oltenia Energy Complex, Romanias largest coal-based energy producer, on the second day of Christmas, taking down its IT infrastructure. --------------------------------------------- https://www.bleepingcomputer.com/news/security/romanian-energy-provider-hit… ∗∗∗ Ubisoft: Rainbow-Six-Siege-Server wegen Hack heruntergefahren ∗∗∗ --------------------------------------------- Hacker erlangten Zugriff auf die Server von Rainbow Six Siege. Nach Bannwellen und Credit-Regen hat Ubisoft mit einem Systemstopp reagiert. --------------------------------------------- https://www.golem.de/news/ubisoft-rainbow-six-siege-server-wegen-hack-herun… ∗∗∗ Evasive Panda APT poisons DNS requests to deliver MgBot ∗∗∗ --------------------------------------------- Kaspersky GReAT experts analyze the Evasive Panda APTs infection chain, including shellcode encrypted with DPAPI and RC5, as well as the MgBot implant. --------------------------------------------- https://securelist.com/evasive-panda-apt/118576/ ∗∗∗ Are We Ready to Be Governed by Artificial Intelligence? ∗∗∗ --------------------------------------------- Artificial Intelligence (AI) overlords are a common trope in science-fiction dystopias, but the reality looks much more prosaic. The technologies of artificial intelligence are already pervading many aspects of democratic government, affecting our lives in ways both large and small. This has occurred largely without our notice or consent. The result is a government incrementally transformed by AI rather than the singular technological overlord of the big screen. --------------------------------------------- https://www.schneier.com/blog/archives/2025/12/are-we-ready-to-be-governed-… ∗∗∗ Fake MAS Windows Activation Domain Used To Spread PowerShell Malware ∗∗∗ --------------------------------------------- An anonymous reader shares a report: A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious PowerShell scripts that infect Windows systems with the Cosmali Loader. BleepingComputer has found that multiple MAS users began reporting on Reddit yesterday that they received pop-up warnings on their systems about a Cosmali Loader infection. --------------------------------------------- https://it.slashdot.org/story/25/12/25/2058205/fake-mas-windows-activation-… ∗∗∗ New MacSync macOS Stealer Uses Signed App to Bypass Apple Gatekeeper ∗∗∗ --------------------------------------------- Cybersecurity researchers have discovered a new variant of a macOS information stealer called MacSync thats delivered by means of a digitally signed, notarized Swift application masquerading as a messaging app installer to bypass Apples Gatekeeper checks. --------------------------------------------- https://thehackernews.com/2025/12/new-macsync-macos-stealer-uses-signed.html ∗∗∗ Traditional Security Frameworks Leave Organizations Exposed to AI-Specific Attack Vectors ∗∗∗ --------------------------------------------- In December 2024, the popular Ultralytics AI library was compromised, installing malicious code that hijacked system resources for cryptocurrency mining. In August 2025, malicious Nx packages leaked 2,349 GitHub, cloud, and AI credentials. Throughout 2024, ChatGPT vulnerabilities allowed unauthorized extraction of user data from AI memory. --------------------------------------------- https://thehackernews.com/2025/12/traditional-security-frameworks-leave.html ∗∗∗ 27 Malicious npm Packages Used as Phishing Infrastructure to Steal Login Credentials ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of what has been described as a "sustained and targeted" spear-phishing campaign that has published over two dozen packages to the npm registry to facilitate credential theft. --------------------------------------------- https://thehackernews.com/2025/12/27-malicious-npm-packages-used-as.html ∗∗∗ Death, torture, and amputation: How cybercrime shook the world in 2025 ∗∗∗ --------------------------------------------- The human harms of cyberattacks piled up this year, and violence expected to increase The knock-on, and often unintentional, impacts of a cyberattack are so rarely discussed. As an industry, the focus is almost always placed on the economic damage: the ransom payment; the cost of business downtime; and goodness, dont forget those poor shareholders. --------------------------------------------- https://www.theregister.com/2025/12/28/death_torture_and_amputation_how/ ∗∗∗ The Age of the All-Access AI Agent Is Here ∗∗∗ --------------------------------------------- Big AI companies courted controversy by scraping wide swaths of the public internet. With the rise of AI agents, the next data grab is far more private. --------------------------------------------- https://www.wired.com/story/expired-tired-wired-all-access-ai-agents/ ∗∗∗ The Worst Hacks of 2025 ∗∗∗ --------------------------------------------- >From university breaches to cyberattacks that shut down whole supply chains, these were the worst cybersecurity incidents of the year. --------------------------------------------- https://www.wired.com/story/worst-hacks-of-2025/ ∗∗∗ Samsung: Ausbleibende Google-Play-Dienstupdates sind Absicht ∗∗∗ --------------------------------------------- Seit einigen Wochen gibt es Verwunderung über ausbleibende Google-Play-Dienstupdates auf Samsung-Smartphones. Jetzt erklärt Samsung das. --------------------------------------------- https://www.heise.de/news/Samsung-erklaert-ausbleibende-Google-Play-Dienstu… ∗∗∗ 39C3: Wie ein Forscher das sichere Mail-Netz der Medizin erneut überlistete ∗∗∗ --------------------------------------------- Ein Sicherheitsexperte zeigte auf dem 39C3, wie sich bei der E-Ärztepost KIM Nachrichten fälschen, Identitäten stehlen und sensible Metadaten abgreifen lassen. --------------------------------------------- https://www.heise.de/news/39C3-Wie-ein-Forscher-das-sichere-Mail-Netz-der-M… ∗∗∗ 39C3: Diverse Lücken in GnuPG und anderen kryptografischen Werkzeugen ∗∗∗ --------------------------------------------- Sicherheitsforscher haben diverse sicherheitsrelevante Fehler in GnuPG und ähnlichen Programmen gefunden. Viele der Lücken sind (noch) nicht behoben. --------------------------------------------- https://www.heise.de/news/39C3-Diverse-Luecken-in-GnuPG-und-anderen-kryptog… ∗∗∗ Notepad++: Update entrümpelt Self-Signed-Zertifikatreste ∗∗∗ --------------------------------------------- In Notepad++ konnten Angreifer dem Updater Malware unterschieben. Ein weiteres Update verbessert die Sicherheit und korrigiert Regressionen. --------------------------------------------- https://www.heise.de/news/Notepad-Update-zum-Aufraeumen-von-Self-Signed-Zer… ∗∗∗ Millionen Kundendaten vom Wired-Magazin im Netz – Diebstahl bei Condé Nast? ∗∗∗ --------------------------------------------- Have I been Pwned listet einen Data Breach für Wired, der sensible Daten von 2,3 Millionen Nutzern umfasst. Mutmaßlich könnten weitere Millionen folgen. --------------------------------------------- https://www.heise.de/news/Millionen-Kundendaten-vom-Wired-Magazin-im-Netz-D… ∗∗∗ 39C3: Skynet Starter Kit – Forscher übernehmen humanoide Roboter per Funk und KI ∗∗∗ --------------------------------------------- Auf dem 39C3 demonstrieren Experten, wie schlecht es um die Security humanoider Roboter steht. Die Angriffspalette reicht bis zum Jailbreak der integrierten KI. --------------------------------------------- https://www.heise.de/hintergrund/39C3-Skynet-Starter-Kit-Forscher-uebernehm… ∗∗∗ 39C3: Sicherheitsforscher kapert KI-Coding-Assistenten mit Prompt Injection ∗∗∗ --------------------------------------------- Auf dem 39C3 zeigte Johann Rehberger, wie leicht sich KI-Coding-Assistenten kapern lassen. Viele Lücken wurden gefixt, doch das Grundproblem bleibt. --------------------------------------------- https://www.heise.de/news/39C3-Sicherheitsforscher-kapert-KI-Coding-Assiste… ∗∗∗ 1800 Nordkoreaner versuchten, sich bei Amazon einzuschleusen ∗∗∗ --------------------------------------------- Es ist nicht das erste Mal, dass Unternehmen von nordkoreanischen Agenten berichten, die gezielt versuchen, sich in ihre Betriebe einzuschleusen. Das Ausmaß der Versuche scheint sich jedoch noch einmal vergrößert zu haben. --------------------------------------------- https://www.derstandard.at/story/3000000302007/1800-nordkoreaner-versuchten… ∗∗∗ A brush with online fraud: What are brushing scams and how do I stay safe? ∗∗∗ --------------------------------------------- Have you ever received a package you never ordered? It could be a warning sign that your data has been compromised, with more fraud to follow. --------------------------------------------- https://www.welivesecurity.com/en/scams/brush-online-fraud-what-are-brushin… ∗∗∗ Cyber volunteer effort for small water utilities announces new MSSP effort ∗∗∗ --------------------------------------------- An organization is looking to develop a first-of-its-kind managed security service provider (MSSP) model tailored specifically for rural water utilities. --------------------------------------------- https://therecord.media/cyber-volunteer-water-utility-mssp ∗∗∗ Georgia arrests ex-spy chief over alleged protection of scam call centers ∗∗∗ --------------------------------------------- Grigol Liluashvili, who ran the Republic of Georgias state security service from 2020 until April of this year, is facing allegations that he protected scam call centers that defrauded victims around the world. --------------------------------------------- https://therecord.media/republic-of-georgia-former-spy-chief-arrested-scam-… ∗∗∗ Eurostar Accused Researchers of Blackmail for Reporting AI Chatbot Flaws ∗∗∗ --------------------------------------------- Researchers discovered critical flaws in Eurostar’s AI chatbot including prompt injection, HTML injection, guardrail bypass, and unverified chat IDs - Eurostar later accused them of blackmail. --------------------------------------------- https://hackread.com/eurostar-blackmail-research-report-ai-chatbot-flaw/ ∗∗∗ Hacker Leaks 2.3M Wired.com Records, Claims 40M-User Condé Nast Breach ∗∗∗ --------------------------------------------- A hacker using the alias “Lovely” has leaked what they claim is the personal data of over 2.3 million Wired.com users, a prominent American magazine and website. The leak was posted on December 20, 2025, on a newly launched hacking forum called Breach Stars. --------------------------------------------- https://hackread.com/hacker-leak-wired-com-records-conde-nast-breach/ ∗∗∗ Bitlocker bekommt Verschlüsselung per Hardware zurück ∗∗∗ --------------------------------------------- Mehr Tempo und mehr Sicherheit – nach dem Aus 2019 setzt die Windows-Verschlüsselung bald wieder auf Crypto-Hardware statt CPUs. --------------------------------------------- https://heise.de/-11124708 ∗∗∗ Microsoft Is Finally Killing RC4 ∗∗∗ --------------------------------------------- After twenty-six years, Microsoft is finally upgrading the last remaining instance of the encryption algorithm RC4 in Windows. --------------------------------------------- https://www.schneier.com/blog/archives/2025/12/microsoft-is-finally-killing… ∗∗∗ Strengthening supply chain security: Preparing for the next malware campaign ∗∗∗ --------------------------------------------- Security advice for users and maintainers to help reduce the impact of the next supply chain malware attack. --------------------------------------------- https://github.blog/security/supply-chain-security/strengthening-supply-cha… ∗∗∗ Forensic Insights into an EDR Freeze Attack ∗∗∗ --------------------------------------------- I have analyzed EDR-Freeze.exe, which puts EDR processes into a suspended “coma” state. Unlike typical EDR attacks (BYOVD etc.) techniques, this approach is more subtle and abuses legitimate Windows functionality. --------------------------------------------- https://detect.fyi/forensic-insights-into-an-edr-freeze-attack-e559b0e50a91 ∗∗∗ 2025 Report: Destructive Malware in Open Source Packages ∗∗∗ --------------------------------------------- Over the past year, the Socket Threat Research Team observed a steady rise in destructive and sabotage-oriented malware embedded in open source packages across multiple ecosystems. Unlike financially motivated campaigns that focus on credential theft, cryptomining, or wallet draining, these incidents were built to damage developer environments directly, deleting source code, breaking builds, or wiping repositories outright. --------------------------------------------- https://socket.dev/blog/2025-report-destructive-malware-in-open-source-pack… ∗∗∗ Demand Without Development ∗∗∗ --------------------------------------------- The cybersecurity talent shortage is not just a problem of numbers, but of structure. By systematically avoiding the hiring and training of true junior staff, the industry is reinforcing a feedback loop that shrinks its own future workforce. --------------------------------------------- https://bytesandborscht.com/demand-without-development/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (kodi, pgbouncer, and rails), Fedora (duc, fluidsynth, gdu, singularity-ce, and tkimg), Slackware (vim), and SUSE (buildah, duc, gnutls, python39, qemu, and webkit2gtk3). --------------------------------------------- https://lwn.net/Articles/1052236/ ∗∗∗ Critical 0day flaw Exposes 70k XSpeeder Devices as Vendor Ignores Alert ∗∗∗ --------------------------------------------- Researchers reveal CVE-2025-54322, a critical unpatched flaw in XSpeeder networking gear found by AI agents. 70,000 industrial and branch devices are exposed. --------------------------------------------- https://hackread.com/xspeeder-0day-flaw-devices-vendor-ignores-alert/ ∗∗∗ Product Security Advisory and Analysis: Observed Abuse of FG-IR-19-283 ∗∗∗ --------------------------------------------- Fortinet has observed recent abuse of the July 2020 vulnerability FG-IR-19-283 / CVE-2020-12812 in the wild based on specific configurations. This blog analysis describes the observed abuse and provides additional context so that administrators can confirm that they are not impacted and guidance based on Fortinet observations to prevent FG-IR-19-283 from being exploited. --------------------------------------------- https://www.fortinet.com/blog/psirt-blogs/product-security-advisory-and-ana… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily