Daily

daily@lists.cert.at

1 participants
3526 discussions

Tageszusammenfassung - 22.01.2026
by Daily end-of-shift report 22 Jan '26

22 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 21-01-2026 18:00 − Donnerstag 22-01-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ A patch for the NIS2 Directive ∗∗∗ --------------------------------------------- On January 20th, 2026 the EU Commission presented a package of legislative proposals, including an update to the NIS2 directive. --------------------------------------------- https://www.cert.at/en/blog/2026/1/a-patch-for-the-nis2-directive ∗∗∗ Look at FortiCloud SSO Bypass Exploitation (CVE-2025-59718/59719) ∗∗∗ --------------------------------------------- In December last year, Fortinet disclosed [1] a vulnerability in SAML processing, which allowed full bypass of authentication to management interfaces with FortiCloud SSO enabled. According to new, still not officially confirmed reports, the vulnerability may not have been fully patched [10]. As affected devices are represented in my small high-interactive honeypots network, we have an opportunity to take a look at what the attackers do. --------------------------------------------- https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitati… ∗∗∗ New Android malware uses AI to click on hidden browser ads ∗∗∗ --------------------------------------------- A new family of Android click-fraud trojans leverages TensorFlow machine learning models to automatically detect and interact with specific advertisement elements. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-android-malware-uses-ai-… ∗∗∗ Chainlit AI framework bugs let hackers breach cloud environments ∗∗∗ --------------------------------------------- Two high-severity vulnerabilities in Chainlit, a popular open-source framework for building conversational AI applications, allow reading any file on the server and leaking sensitive information. --------------------------------------------- https://www.bleepingcomputer.com/news/security/chainlit-ai-framework-bugs-l… ∗∗∗ Is AI-Generated Code Secure?, (Thu, Jan 22nd) ∗∗∗ --------------------------------------------- The title of this diary is perhaps a bit catchy but the question is important. I don’t consider myself as a good developer. That’s not my day job and I’m writing code to improve my daily tasks. I like to say “I’m writing sh*ty code! It works for me, no warranty that it will for for you”. Today, most of my code (the skeleton of the program) is generated by AI, probably like most of you. --------------------------------------------- https://isc.sans.edu/diary/rss/32648 ∗∗∗ Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts ∗∗∗ --------------------------------------------- A new malicious package discovered in the Python Package Index (PyPI) has been found to impersonate a popular library for symbolic mathematics to deploy malicious payloads, including a cryptocurrency miner, on Linux hosts. --------------------------------------------- https://thehackernews.com/2026/01/malicious-pypi-package-impersonates.html ∗∗∗ Preparing for the EU Cyber Resilience Act (CRA) ∗∗∗ --------------------------------------------- Product security has matured significantly over the last decade. Secure defaults, defined ownership of security risk, reliable update mechanisms, and structured vulnerability handling are now mainstream and well understood by experienced engineering and security teams. These practices are no longer aspirational. They are now the minimum required to build and operate digital products responsibly. --------------------------------------------- https://www.pentestpartners.com/security-blog/preparing-for-the-eu-cyber-re… ∗∗∗ Phishing-Falle: Verlust des Zugriffs auf ChatGPT ∗∗∗ --------------------------------------------- Eine aktuell kursierende Phishing-Mail warnt vor einer Kündigung des ChatGPT-Kontos. Schuld sei eine ausgebliebene Zahlung. Das Problem ließe sich aber mit einer Aktualisierung der notwendigen Daten aus der Welt schaffen. Wer dem entsprechenden Pfad folgt, übermittelt den Kriminellen allerdings Kreditkarten- und Kontaktinformationen. --------------------------------------------- https://www.watchlist-internet.at/news/phishing-falle-chatgpt/ ∗∗∗ European Space Agency’s cybersecurity in freefall as yet another breach exposes spacecraft and mission data ∗∗∗ --------------------------------------------- It has just been a few weeks since reports emerged of the Christmas cyber attack suffered by the European Space Agency (ESA), and the situation has already become worse. --------------------------------------------- https://www.bitdefender.com/en-us/blog/hotforsecurity/european-space-agency… ∗∗∗ The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time ∗∗∗ --------------------------------------------- Imagine visiting a webpage that looks perfectly safe. It has no malicious code, no suspicious links. Yet, within seconds, it transforms into a personalized phishing page. --------------------------------------------- https://unit42.paloaltonetworks.com/real-time-malicious-javascript-through-… ∗∗∗ Osiris: New Ransomware, Experienced Attackers? ∗∗∗ --------------------------------------------- Poortry driver and modified Rustdesk tool used in recent attack campaign, which bears similarities to previous Inc ransomware attacks. --------------------------------------------- https://www.security.com/threat-intelligence/new-ransomware-osiris ∗∗∗ Watering Hole Attack Targets EmEditor Users with Information-Stealing Malware ∗∗∗ --------------------------------------------- TrendAI™ Research provides a technical analysis of a compromised EmEditor installer used to deliver multistage malware that performs a range of malicious actions. --------------------------------------------- https://www.trendmicro.com/en_us/research/26/a/watering-hole-attack-targets… ∗∗∗ Cyber Is What We Make of It ∗∗∗ --------------------------------------------- Cyber Is What We Make of It "Its not what happens to you, but how you react to it that matters." — EpictetusNot long ago an Atlantic Council op-ed in CyberScoop outlined ten key reforms to close Americas cybersecurity gaps. The recommendations are sensible: migrate to memory-safe languages, apply formal verification to critical systems, establish zero trust architectures, build data resilience, conduct proactive threat hunting. Laudable, uncontroversial, and comprehensive; --------------------------------------------- https://buttondown.com/grugq/archive/cyber-is-what-we-make-of-it/ ===================== = Vulnerabilities = ===================== ∗∗∗ SmarterMail Auth Bypass Exploited in the Wild Two Days After Patch Release ∗∗∗ --------------------------------------------- A new security flaw in SmarterTools SmarterMail email software has come under active exploitation in the wild, two days after the release of a patch. --------------------------------------------- https://thehackernews.com/2026/01/smartermail-auth-bypass-exploited-in.html ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (gpsd), Debian (inetutils and modsecurity-crs), Fedora (cpp-httplib, curl, mariadb11.8, mingw-libtasn1, mingw-libxslt, mingw-python3, rclone, and rpki-client), Oracle (gimp, glib2, go-toolset:rhel8, golang, kernel, mariadb-devel:10.3, and thunderbird), Red Hat (buildah, go-toolset:rhel8, golang, grafana, kernel, kernel-rt, multiple packages, openssl, osbuild-composer, podman, and skopeo), Slackware (bind), SUSE (ffmpeg-4, libsodium, libvirt, net-snmp, open-vm-tools, ovmf, postgresql17, postgresql18, python-FontTools, python-weasyprint, and webkit2gtk3), and Ubuntu (glib2.0 and opencc). --------------------------------------------- https://lwn.net/Articles/1055484/ ∗∗∗ Jetzt handeln! Angreifer umgehen offenbar Fortinet-Sicherheitspatch ∗∗∗ --------------------------------------------- Medienberichten zufolge ist ein Sicherheitspatch für diverse Fortinet-Produkte defekt. Admins können Instanzen aber trotzdem schützen. --------------------------------------------- https://heise.de/-11149777 ∗∗∗ Updaten! Angriffsversuche auf Sicherheitslücken in Cisco Unified Communications ∗∗∗ --------------------------------------------- In mehreren Unified-Communications-Produkten von Cisco klafft eine Sicherheitslücke, die Angreifern ohne Anmeldung das Einschleusen von Schadcode aus dem Netz und dessen Ausführung mit Root-Rechten ermöglicht. Admins sollten die bereitstehenden Aktualisierungen zügig anwenden, da Cisco bereits Angriffsversuche aus dem Netz auf die Schwachstelle beobachtet hat. --------------------------------------------- https://heise.de/-11149877 ∗∗∗ Dell Data Protection Advisor über unzählige Sicherheitslücken angreifbar ∗∗∗ --------------------------------------------- Dell schließt teilweise sechzehn Jahre alte Schwachstellen in Data Protection Advisor, über die Angreifer Systeme kompromittieren können. --------------------------------------------- https://heise.de/-11150421 ∗∗∗ SSA-864900 V1.6 (Last Update: 2026-01-22): Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-864900.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 21.01.2026
by Daily end-of-shift report 21 Jan '26

21 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 20-01-2026 18:00 − Mittwoch 21-01-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ EU plans cybersecurity overhaul to block foreign high-risk suppliers ∗∗∗ --------------------------------------------- The European Commission has proposed new cybersecurity legislation mandating the removal of high-risk suppliers to secure telecommunications networks and strengthening defenses against state-backed and cybercrime groups targeting critical infrastructure. --------------------------------------------- https://www.bleepingcomputer.com/news/security/eu-plans-cybersecurity-overh… ∗∗∗ VoidLink cloud malware shows clear signs of being AI-generated ∗∗∗ --------------------------------------------- The recently discovered cloud-focused VoidLink malware framework is believed to have been developed by a single person with the help of an artificial intelligence model. --------------------------------------------- https://www.bleepingcomputer.com/news/security/voidlink-cloud-malware-shows… ∗∗∗ Hackers exploit security testing apps to breach Fortune 500 firms ∗∗∗ --------------------------------------------- Threat actors are exploiting misconfigured web applications used for security training and internal penetration testing, such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP, to gain access to cloud environments of Fortune 500 companies and security vendors. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-exploit-security-tes… ∗∗∗ Mass Spam Attacks Leverage Zendesk Instances ∗∗∗ --------------------------------------------- The CRM vendor advised ignoring or deleting suspicious emails and said the attacks were not tied to any breach or software vulnerability. --------------------------------------------- https://www.darkreading.com/threat-intelligence/mass-spam-attacks-zendesk-i… ∗∗∗ Jetzt abschalten: Zehn Jahre alte Telnetd-Lücke macht jeden Client zum Root ∗∗∗ --------------------------------------------- Seit 2015 kann sich über Telnetd jeder Client einen Root-Zugriff verschaffen. Einen Patch gibt es zwar, empfohlen wird jedoch die Abschaltung. --------------------------------------------- https://www.golem.de/news/jetzt-abschalten-zehn-jahre-alte-telnetd-luecke-m… ∗∗∗ LastPass Warns of Fake Maintenance Messages Targeting Users’ Master Passwords ∗∗∗ --------------------------------------------- LastPass is alerting users to a new active phishing campaign that's impersonating the password management service, which aims to trick users into giving up their master passwords. --------------------------------------------- https://thehackernews.com/2026/01/lastpass-warns-of-fake-maintenance.html ∗∗∗ Curl shutters bug bounty program to remove incentive for submitting AI slop ∗∗∗ --------------------------------------------- The maintainer of popular open-source data transfer tool cURL has ended the project’s bug bounty program after maintainers struggled to assess a flood of AI-generated contributions. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2026/01/21/curl_ends_bu… ∗∗∗ Einschränkung der Anzeigenauslieferung auf Facebook? Unternehmens-Profile im Visier von Kriminellen ∗∗∗ --------------------------------------------- Mit vermeintlich vom Meta-Konzern stammenden E-Mails versuchen Betrüger:innen, sich Zugang zu Unternehmens-Accounts zu erschleichen. Dafür haben sie eine gefälschte Login-Seite gebaut. Wie läuft die Masche konkret ab? Woran ist die Betrugsabsicht zu erkennen? Dieser Artikel liefert Antworten. --------------------------------------------- https://www.watchlist-internet.at/news/einschraenkung-der-anzeigenausliefer… ∗∗∗ DNS OverDoS: Are Private Endpoints Too Private? ∗∗∗ --------------------------------------------- We discovered an aspect of Azure’s Private Endpoint architecture that could expose Azure resources to denial of service (DoS) attacks. In this article, we explore how both intentional and inadvertent acts could result in limited access to Azure resources through the Azure Private Link mechanism. We uncovered this issue while investigating irregular behavior in Azure test environments. --------------------------------------------- https://unit42.paloaltonetworks.com/dos-attacks-and-azure-private-endpoint/ ∗∗∗ IT-Sicherheit: Roter Draht zwischen Peking und London ∗∗∗ --------------------------------------------- Ein neues, geheimes Forum soll die Kommunikation zwischen britischen und chinesischen Diensten verbessern. Es könnte das erste seiner Art sein. --------------------------------------------- https://heise.de/-11148209 ∗∗∗ Introducing > PowerShell.Exposed ∗∗∗ --------------------------------------------- PowerShell (PS) isn’t just a “Windows admin tool.” Once shell access is established, this is the cheapest and most powerful hands-on-keyboard control an attacker can have. --------------------------------------------- https://detect.fyi/introducing-powershell-exposed-4974fe712117?source=rss--… ∗∗∗ New EU Vulnerability Platform GCVE Goes Live, Reducing Reliance on Global Systems ∗∗∗ --------------------------------------------- Europe’s long-running conversation about digital autonomy quietly crossed a milestone with the launch of a new public vulnerability platform. The EU Vulnerability Database, created under the GCVE initiative, is now live. This signals a deliberate shift in how software weaknesses are identified, cataloged, and shared across Europe. --------------------------------------------- https://thecyberexpress.com/eu-launches-gcve-vulnerability-database/ ∗∗∗ Critical Vulnerability in Advanced Custom Fields: Extended Plugin Puts 100,000 WordPress Sites at Risk ∗∗∗ --------------------------------------------- A critical security flaw has been discovered in a widely used ACF add-on plugin for WordPress, placing up to 100,000 websites at risk of a full site takeover. The vulnerability affects the Advanced Custom Fields: Extended plugin, an add-on designed to extend the functionality of the popular Advanced Custom Fields ecosystem. An advisory issued about the flaw assigns a severity rating of 9.8, emphasizing the serious impact it can have if exploited. --------------------------------------------- https://thecyberexpress.com/acf-add-on-vulnerability-wordpress/ ===================== = Vulnerabilities = ===================== ∗∗∗ Aktuelle Angriffswelle gegen CVE-2025-59718, Patches unzureichend ∗∗∗ --------------------------------------------- Im Dezember des vergangenen Jahres hat Fortinet Informationen über einen Login Bypass in mehreren Produkten des Unternehmens veröffentlicht (siehe dazu auch unser Warning vom 19.12.2025) und gleichzeitig Patches zur Verfügung gestellt welche das Problem beheben sollten. --------------------------------------------- https://www.cert.at/de/aktuelles/2026/1/aktuelle-angriffswelle-gegen-cve-20… ∗∗∗ GitLab Patch Release: 18.8.2, 18.7.2, 18.6.4 ∗∗∗ --------------------------------------------- Learn more about GitLab Patch Release: 18.8.2, 18.7.2, 18.6.4 for GitLab Community Edition (CE) and Enterprise Edition (EE). --------------------------------------------- https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-re… ∗∗∗ Sicherheitslücken: Nvidia CUDA Toolkit lässt Schadcode passieren ∗∗∗ --------------------------------------------- Nvidias Programmierschnittstelle CUDA weist Sicherheitslücken auf, wodurch unter anderem Schadcode auf Systeme gelangen kann. Davon sind je nach Sicherheitslücke Linux und Windows bedroht. Eine reparierte Ausgabe von CUDA Toolkit schafft Abhilfe. --------------------------------------------- https://www.heise.de/news/Sicherheitsluecken-Nvidia-CUDA-Toolkit-laesst-Sch… ∗∗∗ Sicherheitspatches: Atlassian sichert Confluence & Co. gegen mögliche Attacken ∗∗∗ --------------------------------------------- Atlassian hat für Bamboo, Bitbucket, Confluence, Crowd, Jira und Jira Service Management Data Center und Server wichtige Sicherheitsupdates veröffentlicht. Nach erfolgreichen Attacken können Angreifer in erster Linie DoS-Zustände und somit Abstürze auslösen. --------------------------------------------- https://www.heise.de/news/Sicherheitspatches-Atlassian-sichert-Confluence-C… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (brotli and container-tools:rhel8), Debian (python-keystonemiddleware and python3.9), Fedora (cef, freerdp, golang-github-tetratelabs-wazero, and libpcap), Oracle (brotli, gpsd, kernel, and transfig), Red Hat (freerdp, golang, java-11-openjdk with Extended Lifecycle Support, libpng, libssh, mingw-libpng, and runc), SUSE (abseil-cpp, alloy, apache2, bind, cpp-httplib, curl, erlang, firefox, gpg2, grafana, haproxy, hauler, hawk2, libblkid-devel, libpng16, libraylib550, python-keystonemiddleware-doc, python-uv, python-weasyprint, squid, and tomcat), and Ubuntu (crawl and iperf3). --------------------------------------------- https://lwn.net/Articles/1055322/ ∗∗∗ VU#458022: Open5GS WebUI uses a hard-coded secrets including JSON Web Token signing key ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/458022 ∗∗∗ VU#102648: Code Injection Vulnerability in binary-parser library ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/102648 ∗∗∗ VU#481830: libheif Uncompressed Codec Lacks Bounds Check Leading to Application Crash ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/481830 ∗∗∗ Oracle Critical Patch Update Advisory - January 2026 ∗∗∗ --------------------------------------------- https://www.oracle.com/security-alerts/cpujan2026.html ∗∗∗ Cisco Unified Communications Products Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Schneider Electric EcoStruxure Foxboro DCS ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-26-020-01 ∗∗∗ Rockwell Automation Verve Asset Manager ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-26-020-03 ∗∗∗ Schneider Electric devices using CODESYS Runtime ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-26-020-02 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 20.01.2026
by Daily end-of-shift report 20 Jan '26

20 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Montag 19-01-2026 18:00 − Dienstag 20-01-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Google Gemini Prompt Injection Flaw Exposed Private Calendar Data via Malicious Invites ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a security flaw that leverages indirect prompt injection targeting Google Gemini as a way to bypass authorization guardrails and use Google Calendar as a data extraction mechanism. --------------------------------------------- https://thehackernews.com/2026/01/google-gemini-prompt-injection-flaw.html ∗∗∗ Cloudflare Fixes ACME Validation Bug Allowing WAF Bypass to Origin Servers ∗∗∗ --------------------------------------------- Cloudflare has addressed a security vulnerability impacting its Automatic Certificate Management Environment (ACME) validation logic that made it possible to bypass security controls and access origin servers. [..] The web infrastructure company said it found no evidence that the vulnerability was ever exploited in a malicious context. [..] The vulnerability was addressed by Cloudflare on October 27, 2025, with a code change that serves the response and disables WAF features only when the request matches a valid ACME HTTP-01 challenge token for that hostname. --------------------------------------------- https://thehackernews.com/2026/01/cloudflare-fixes-acme-validation-bug.html ∗∗∗ Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading ∗∗∗ --------------------------------------------- Cybersecurity researchers have uncovered a new phishing campaign that exploits social media private messages to propagate malicious payloads, likely with the intent to deploy a remote access trojan (RAT). --------------------------------------------- https://thehackernews.com/2026/01/hackers-use-linkedin-messages-to-spread.h… ∗∗∗ EU-Kommission arbeitet an Open-Source-Strategie und fragt Community nach Feedback ∗∗∗ --------------------------------------------- Einzelpersonen und Gruppen haben bis zum 3. Februar Zeit, um Hinweise einzureichen. --------------------------------------------- https://www.derstandard.at/story/3000000304870/eu-kommission-arbeitet-an-op… ∗∗∗ Microsoft & Anthropic MCP Servers At Risk of RCE, Cloud Takeovers ∗∗∗ --------------------------------------------- Researchers found the popular model context protocol (MCP) servers, which are integral components of AI services, carry serious vulnerabilities. [..] When they analyzed more than 7,000 MCP servers, they found that the same SSRF exposure might be latent in around 36.7% of all MCP servers on the Web today. [..] The company reported its findings to Anthropic last June. Half a year later, in December, Anthropic released the 2025.12.18 version of the Git MCP server, which better enforced path validation (in response to CVE-2025-68145), addressed argument handling (CVE-2025-68144), and completely removed the git_init tool (CVE-2025-68143). --------------------------------------------- https://www.darkreading.com/application-security/microsoft-anthropic-mcp-se… ∗∗∗ Inside a Multi-Stage Windows Malware Campaign ∗∗∗ --------------------------------------------- The attack begins with social engineering lures delivered via business-themed documents crafted to appear routine and benign. These documents and accompanying scripts serve as visual distractions, diverting victims to fake tasks or status messages while malicious activity runs silently in the background. --------------------------------------------- https://feeds.fortinet.com/~/940900697/0/fortinet/blogs~Inside-a-MultiStage… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitslücke bei TP-Link: Überwachungskameras per Passwort-Reset knackbar ∗∗∗ --------------------------------------------- Der Netzwerkgerätehersteller TP-Link warnt vor einer gefährlichen Sicherheitslücke in seinen Vigi-Überwachungskameras. [..] Laut Schwachstellenbeschreibung basiert die Lücke auf einem Bug in der Passwortwiederherstellungsfunktion der Webschnittstelle betroffener Kameras. [..] Angreifer können mittels CVE-2026-0629 das Admin-Passwort zurücksetzen, ohne dass eine Überprüfung erfolgt. [..] Angreifer brauchen für die Ausnutzung von CVE-2026-0629 zwar einen Zugriff auf das lokale Netzwerk, mit dem die anvisierte Kamera verbunden ist. --------------------------------------------- https://www.golem.de/news/tp-link-admin-konten-zahlloser-ueberwachungskamer… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (gpsd-minimal, jmc, kernel, kernel-rt, and net-snmp), Debian (apache-log4j2 and dcmtk), Fedora (exim, gpsd, mysql8.0, mysql8.4, python-biopython, and rust-lru), Mageia (firefox, nss and thunderbird), Oracle (container-tools:rhel8, gpsd-minimal, jmc, kernel, net-snmp, and uek-kernel), Red Hat (net-snmp), SUSE (chromium, go, harfbuzz-devel, kernel, libsoup, rust1.91, rust1.92, and thunderbird), and Ubuntu (apache2, avahi, and python-urllib3). --------------------------------------------- https://lwn.net/Articles/1055152/ ∗∗∗ VU#244846: Server-Side Template Injection (SSTI) vulnerability exist in Genshi ∗∗∗ --------------------------------------------- A Server-Side Template Injection (SSTI) vulnerability exists in the Genshi template engine due to unsafe evaluation of template expressions. [..] Genshi is a Python library developed by Edgewall, it provides an integrated set of components for parsing, generating, and processing HTML, XML, or other textual content for output generation on the web. [..] If an attacker can influence or inject template expressions, this vulnerability allows arbitrary code execution with the privileges of the running application. [..] At the time of publication, Genshi has not released an update addressing this issue. --------------------------------------------- https://kb.cert.org/vuls/id/244846 ∗∗∗ VU#271649: Stack-based buffer overflow in libtasn1 versions v4.20.0 and earlier ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/271649 ∗∗∗ Beckhoff Security Advisory 2025-002 ∗∗∗ --------------------------------------------- https://download.beckhoff.com/download/document/product-security/Advisories… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 19.01.2026
by Daily end-of-shift report 19 Jan '26

19 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 16-01-2026 18:00 − Montag 19-01-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ StealC hackers hacked as researchers hijack malware control panels ∗∗∗ --------------------------------------------- A cross-site scripting (XSS) flaw in the web-based control panel used by operators of the StealC info-stealing malware allowed researchers to observe active sessions and gather intelligence on the attackers’ hardware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/stealc-hackers-hacked-as-res… ∗∗∗ Autotype: Windows-11-Update macht beliebte Keepass-Funktion kaputt ∗∗∗ --------------------------------------------- Seit dem Januar-Patchday kann Keepass in einigen Windows-Dialogen keine Zugangsdaten mehr per Autotype einfügen. Ein Fix ist nicht zu erwarten. --------------------------------------------- https://www.golem.de/news/autotype-windows-11-update-macht-beliebte-keepass… ∗∗∗ What Happened After Security Researchers Found 60 Flock Cameras Livestreaming to the Internet ∗∗∗ --------------------------------------------- A couple months ago, YouTuber Benn Jordan "found vulnerabilities in some of Flock's license plate reader cameras," reports 404 Media's Jason Koebler. "He reached out to me to tell me he had learned that some of Flock's Condor cameras were left live-streaming to the open internet." --------------------------------------------- https://yro.slashdot.org/story/26/01/17/0718211/what-happened-after-securit… ∗∗∗ China-Linked APT Exploited Sitecore Zero-Day in Critical Infrastructure Intrusions ∗∗∗ --------------------------------------------- A threat actor likely aligned with China has been observed targeting critical infrastructure sectors in North America since at least last year. --------------------------------------------- https://thehackernews.com/2026/01/china-linked-apt-exploits-sitecore-zero.h… ∗∗∗ CrashFix Chrome Extension Delivers ModeloRAT Using ClickFix-Style Browser Crash Lures ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of an ongoing campaign dubbed KongTuke that used a malicious Google Chrome extension masquerading as an ad blocker to deliberately crash the web browser and trick victims into running arbitrary commands using ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) dubbed ModeloRAT. --------------------------------------------- https://thehackernews.com/2026/01/crashfix-chrome-extension-delivers.html ∗∗∗ Fehlende Postleitzahl? Nachricht von DPD ist eine Phishing-Falle ∗∗∗ --------------------------------------------- Ein Klassiker des Online-Betrugs. Ein Paketdienstleister meldet sich aus heiterem Himmel. Angeblich war ein Zustellversuch aufgrund einer fehlenden Postleitzahl nicht erfolgreich. Tatsächlich versuchen Kriminelle über ein gefälschtes Portal an Kreditkartendaten zu kommen. --------------------------------------------- https://www.watchlist-internet.at/news/dpd-phishing-falle/ ∗∗∗ Windows Januar 2026 Update tauscht Secure Boot Zertifikate ∗∗∗ --------------------------------------------- Im Juni 2026 laufen UEFI Secure Boot-Zertifikate für Windows ab. Im Oktober 2026 trifft es dann das nächste ablaufende UEFI-Zertifikat für den Secure Boot. Microsoft hat zum 13. Januar 2026 im Rahmen des Patchday erneut den Ansatz unternommen, das Secure Boot-Zertifikat im UEFI auszutauschen. Hier eine kurze Nachlese zum Sachstand. --------------------------------------------- https://borncity.com/blog/2026/01/17/windows-januar-2026-update-tauscht-sec… ∗∗∗ From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers ∗∗∗ --------------------------------------------- This blog entry provides an in-depth analysis of the multistage delivery of the Evelyn information stealer, which was used in a campaign targeting software developers. --------------------------------------------- https://www.trendmicro.com/en_us/research/26/a/analysis-of-the-evelyn-steal… ∗∗∗ Hackers Exploiting PDF24 App to Deploy Stealthy PDFSIDER Backdoor ∗∗∗ --------------------------------------------- Resecurity has identified PDFSIDER malware that exploits the legitimate PDF24 App to covertly steal data and allow remote access. Learn how this APT-level campaign targets corporate networks through spear-phishing and encrypted communications. --------------------------------------------- https://hackread.com/hackers-exploit-pdf24-app-pdfsider-backdoor/ ∗∗∗ Blink and youll miss them: 6-day certificates are here! ∗∗∗ --------------------------------------------- What a great way to start 2026! Let's Encrypt have now made their short-lived certificates available, so you can go and start using them right away. --------------------------------------------- https://scotthelme.ghost.io/blink-and-youll-miss-them-6-day-certificates-ar… ∗∗∗ Microsoft startet mit Identifizierung von unsicherer RC4-Verschlüsselung ∗∗∗ --------------------------------------------- Die Windows-Sicherheitsupdates aus dem Januar läuten den Rauswurf unsicherer RC4-Verschlüsselung ein. Eine Lücke erfordert Maßnahmen. --------------------------------------------- https://heise.de/-11145332 ∗∗∗ Malware Peddlers Are Now Hijacking Snap Publisher Domains ∗∗∗ --------------------------------------------- tl;dr: There’s a relentless campaign by scammers to publish malware in the Canonical Snap Store. Some gets caught by automated filters, but plenty slips through. Recently, these miscreants have changed tactics - they’re now registering expired domains belonging to legitimate snap publishers, taking over their accounts, and pushing malicious updates to previously trustworthy applications. This is a significant escalation. --------------------------------------------- https://blog.popey.com/2026/01/malware-purveyors-taking-over-published-snap… ∗∗∗ TPM on Embedded Systems: Pitfalls and Caveats ∗∗∗ --------------------------------------------- Trusted Platform Module (TPM) chips have been around since the release of the TPM 1.2 specification more than 20 years ago, and the TPM 2.0 specification1 was released in 2014. The technology is now seeing widespread adoption in various computing sectors. TPMs have been a standard feature in PCs, particularly notebooks, for some time. With integration into tools like systemd’s tooling for LUKS/dm-crypt and legal requirements like EU’s CRA, TPM functionality is also now making its way into the embedded Linux sector. In this post, we’ll highlight common pitfalls and considerations for using TPM chips on embedded devices. --------------------------------------------- https://sigma-star.at/blog/2026/01/tpm-on-embedded-systems-pitfalls-and-cav… ∗∗∗ How to Remove Saved Passwords From Google Chrome (And Why You Should) ∗∗∗ --------------------------------------------- It usually starts with a small convenience. You log into a site once, Chrome offers to remember the password, and you click “Save” without thinking twice. Weeks turn into months, devices multiply, and before you know it, your browser knows more about your digital life than you do. This is exactly how many users end up relying on Chrome’s built-in tools without ever learning how to delete passwords from Chrome when it actually matters. --------------------------------------------- https://thecyberexpress.com/how-to-delete-saved-passwords-in-google-chrome/ ∗∗∗ All In One SEO Plugin Flaw Exposes AI Token to Low-Privilege WordPress Users ∗∗∗ --------------------------------------------- A newly disclosed security vulnerability in the All In One SEO ecosystem has drawn attention across the WordPress community due to its potential reach and impact. The flaw affects the widely used AIOSEO plugin, which is active on more than 3 million WordPress websites. It allows low-privileged users to access a site-wide AI access token tied to the plugin’s artificial intelligence features. --------------------------------------------- https://thecyberexpress.com/all-in-one-seo-wordpress-ai-token/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (cups, libpq, libsoup3, podman, and postgresql16), Debian (ffmpeg, gpsd, python-urllib3, and thunderbird), Fedora (chromium, foomuuri, forgejo, freerdp, harfbuzz, libtpms, musescore, python-biopython, and python3.12), Mageia (gimp, libpng, nodejs, and python-urllib3), and SUSE (alloy, avahi, bind, chromedriver, chromium, cpp-httplib, docker, erlang, fluidsynth, freerdp, go-sendxmpp, govulncheck-vulndb, kernel, libwireshark19, NetworkManager-applet-l2tp, python, python311-virtualenv, thunderbird, and zk). --------------------------------------------- https://lwn.net/Articles/1054992/ ∗∗∗ Unberechtigte Zugriffe möglich: Lücken in Dells OneFS-NAS-Betriebssystem ∗∗∗ --------------------------------------------- Dells NAS-Betriebssystem PowerScale OneFS ist über mehrere Sicherheitslücken angreifbar. Dagegen stehen abgesicherte Ausgaben zum Download bereit. --------------------------------------------- https://heise.de/-11145497 ∗∗∗ Wireshark 4.6.3 Released, (Sat, Jan 17th) ∗∗∗ --------------------------------------------- https://isc.sans.edu/diary/rss/32636 ∗∗∗ K000159600: Rack vulnerability CVE-2022-30123 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000159600 ∗∗∗ K000159077: GNU Tar vulnerability CVE-2019-9923 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000159077 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 16.01.2026
by Daily end-of-shift report 16 Jan '26

16 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 15-01-2026 18:00 − Freitag 16-01-2026 18:00 Handler: Alexander Riepl Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ Per Bitflip zum Root-Zugriff: Lücke in AMD-CPUs ermöglicht Einbruch in Cloud-VMs ∗∗∗ --------------------------------------------- Eine neue Angriffstechnik namens Stackwarp lässt Angreifer über AMD-CPUs virtuelle Maschinen kapern. Vor allem Cloud-Umgebungen sind gefährdet. --------------------------------------------- https://www.golem.de/news/per-bitflip-zum-root-zugriff-luecke-in-amd-cpus-e… ∗∗∗ AWS CodeBuild Misconfiguration Exposed GitHub Repos to Potential Supply Chain Attacks ∗∗∗ --------------------------------------------- A critical misconfiguration in Amazon Web Services (AWS) CodeBuild could have allowed complete takeover of the cloud service providers own GitHub repositories, including its AWS JavaScript SDK, putting every AWS environment at risk. --------------------------------------------- https://thehackernews.com/2026/01/aws-codebuild-misconfiguration-exposed.ht… ∗∗∗ Five Malicious Chrome Extensions Impersonate Workday and NetSuite to Hijack Accounts ∗∗∗ --------------------------------------------- Cybersecurity researchers have discovered five new malicious Google Chrome web browser extensions that masquerade as human resources (HR) and enterprise resource planning (ERP) platforms like Workday, NetSuite, and SuccessFactors to take control of victim accounts. --------------------------------------------- https://thehackernews.com/2026/01/five-malicious-chrome-extensions.html ∗∗∗ Chinese spies used Maduros capture as a lure to phish US govt agencies ∗∗∗ --------------------------------------------- Whats next for Venezuela? Click on the file and see What policy wonk wouldnt want to click on an attachment promising to unveil US plans for Venezuela? Chinese cyberspies used just such a lure to target US government agencies and policy-related organizations in a phishing campaign that began just days after an American military operation captured Venezuelan President Nicolás Maduro. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2026/01/15/chinese_spie… ∗∗∗ Bankrupt scooter startup left one private key to rule them all ∗∗∗ --------------------------------------------- An Estonian e-scooter owner locked out of his own ride after the manufacturer went bust did what any determined engineer might do. He reverse-engineered it, and claims he ended up discovering the master key that unlocks every scooter the company ever sold. --------------------------------------------- https://www.theregister.com/2026/01/16/bankrupt_scooter_startup_key/ ∗∗∗ RondoDox botnet linked to large-scale exploit of critical HPE OneView bug ∗∗∗ --------------------------------------------- Check Point observes 40K+ attack attempts in our hours, with government organizations under fire A critical HPE OneView flaw is now being exploited at scale, with Check Point tying mass, automated attacks to the RondoDox botnet. --------------------------------------------- https://www.theregister.com/2026/01/16/rondodox_botnet_hpe_oneview/ ∗∗∗ German cops add Black Basta boss to EU most-wanted list ∗∗∗ --------------------------------------------- Ransomware kingpin who escaped Armenian custody is believed to be lying low back home German cops have added Russian national Oleg Evgenievich Nefekov to their list of most-wanted criminals for his services to ransomware. --------------------------------------------- https://www.theregister.com/2026/01/16/black_basta_boss_wanted/ ∗∗∗ Jetzt patchen! Kritische Cisco-Lücke seit Dezember 2025 ausgenutzt ∗∗∗ --------------------------------------------- Angreifer kompromittieren Cisco Secure Email Gateway und Secure Email und Web Manager über eine Root-Schwachstelle. Nun gibt es Sicherheitsupdates. --------------------------------------------- https://www.heise.de/news/Jetzt-patchen-Kritische-Cisco-Luecke-seit-Dezembe… ∗∗∗ Die lernende Bedrohung: Predator-Spyware ist raffinierter als gedacht ∗∗∗ --------------------------------------------- Die Spähsoftware Predator von Intellexa gewinnt selbst aus gescheiterten Infektionsversuchen wertvolle Daten und macht gezielt Jagd auf IT-Sicherheitsforscher. --------------------------------------------- https://www.heise.de/news/Die-lernende-Bedrohung-Predator-Spyware-ist-raffi… ∗∗∗ Chinese hackers targeting ‘high value’ North American critical infrastructure, Cisco says ∗∗∗ --------------------------------------------- Chinese hackers successfully breached multiple critical infrastructure organizations in North America over the last year using a combination of compromised credentials and exploitable servers, researchers at Cisco Talos found. --------------------------------------------- https://therecord.media/china-hackers-apt-cisco-talos ∗∗∗ Canadian investment regulator confirms hackers hit 750,000 investors ∗∗∗ --------------------------------------------- The nongovernmental Canadian Investment Regulatory Organization, which oversees the countrys debt and equity marketplaces as well as some financial institutions, released details about an August 2025 data breach. --------------------------------------------- https://therecord.media/canada-ciro-investing-regulator-confirms-data-breach ∗∗∗ CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation ∗∗∗ --------------------------------------------- CVE-2025-55182 is a CVSS 10.0 pre-authentication RCE affecting React Server Components. Amid the flood of fake proof-of-concept exploits, scanners, exploits, and widespread misconceptions, this technical analysis intends to cut through the noise. --------------------------------------------- https://www.trendmicro.com/en_us/research/25/l/CVE-2025-55182-analysis-poc-… ∗∗∗ New PayPal Scam Sends Verified Invoices With Fake Support Numbers ∗∗∗ --------------------------------------------- Scammers are using verified PayPal invoices to launch callback phishing attacks. Learn how the "Alexzander" invoice bypasses Google filters. --------------------------------------------- https://hackread.com/paypal-scam-verified-invoices-fake-support-numbers/ ∗∗∗ Operation Endgame: Dutch Police Arrest Alleged AVCheck Operator ∗∗∗ --------------------------------------------- Dutch police arrest the alleged AVCheck operator at Schiphol as part of Operation Endgame, a global effort targeting malware services and cybercrime. --------------------------------------------- https://hackread.com/operation-endgame-dutch-police-arrest-avcheck-operator/ ∗∗∗ Closing the Door on Net-NTLMv1: Releasing Rainbow Tables to Accelerate Protocol Deprecation ∗∗∗ --------------------------------------------- Mandiant is publicly releasing a comprehensive dataset of Net-NTLMv1 rainbow tables to underscore the urgency of migrating away from this outdated protocol. Despite Net-NTLMv1 being deprecated and known to be insecure for over two decades—with cryptanalysis dating back to 1999—Mandiant consultants continue to identify its use in active environments. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/net-ntlmv1-depreca… ∗∗∗ Das Meldeportal in der AWS-Cloud: Warum nur, BSI? ∗∗∗ --------------------------------------------- Schön, dass das BSI ein neues Portal für IT-Sicherheit bietet. Aber muss das unbedingt über die AWS-Cloud laufen, fragt sich Tobias Glemser. --------------------------------------------- https://heise.de/-11142071 ∗∗∗ How to Use Pareto Principle to Fine-Tune Alerts and Reduce False Positives Wisely ∗∗∗ --------------------------------------------- False positives were not only consuming analyst time — they were also diluting attention and slowing response on the few alerts that actually mattered. --------------------------------------------- https://detect.fyi/how-to-use-pareto-principle-to-fine-tune-alerts-and-redu… ===================== = Vulnerabilities = ===================== ∗∗∗ Hackers exploit Modular DS WordPress plugin flaw for admin access ∗∗∗ --------------------------------------------- Hackers are actively exploiting a maximum severity flaw in the Modular DS WordPress plugin that allows them to bypass authentication remotely and access the vulnerable sites with admin-level privileges. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-exploit-modular-ds-w… ∗∗∗ Critical flaw lets hackers track, eavesdrop via Bluetooth audio devices ∗∗∗ --------------------------------------------- A critical vulnerability in Googles Fast Pair protocol can allow attackers to hijack Bluetooth audio accessories like wireless headphones and earbuds, track users, and eavesdrop on their conversations. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-whisperpair-flaw-le… ∗∗∗ VU#383552: thelibrarian does not secure its interface, allowing for access to internal system data ∗∗∗ --------------------------------------------- Multiple vulnerabilities were discovered in The Librarian, an AI-powered personal assistant tool provided by the company TheLibrarian.io. The Librarian can be used to manage personal email, calendar, documents, and other information through external services, such as Gmail and Google Drive, and also summarize meetings and schedule emails. --------------------------------------------- https://kb.cert.org/vuls/id/383552 ∗∗∗ VU#650657: Livewire Filemanager contains an insecure .php component that allows for unauthenticated RCE in Laravel Products ∗∗∗ --------------------------------------------- A vulnerability, tracked as CVE-2025-14894, has been discovered within Livewire Filemanager, a tool designed for usage within Laravel applications. The Livewire Filemanager tool allows for users to upload various files, including PHP files, and host them within the Laravel application. --------------------------------------------- https://kb.cert.org/vuls/id/650657 ∗∗∗ Juniper Networks: Zahlreiche Sicherheitsupdates für diverse Produkte ∗∗∗ --------------------------------------------- Juniper Networks hat Sicherheitsaktualisierungen für zahlreiche Produkte veröffentlicht. IT-Admins sollten sie rasch anwenden. --------------------------------------------- https://www.heise.de/news/Juniper-Networks-Zahlreiche-Sicherheitsupdates-fu… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (gnupg2), Debian (firefox-esr), Oracle (cups, gnupg2, libpq, net-snmp, postgresql, postgresql:15, postgresql:16, transfig, and vsftpd), Red Hat (firefox), SUSE (apache2, curl, firefox, gpg2, hawk2, libcryptopp-devel, openCryptoki, python310, python311-urllib3, rke2, squid, and tomcat), and Ubuntu (cpp-httplib, git, python-apt, and simgear). --------------------------------------------- https://lwn.net/Articles/1054683/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 15.01.2026
by Daily end-of-shift report 15 Jan '26

15 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 14-01-2026 18:00 − Donnerstag 15-01-2026 18:00 Handler: Alexander Riepl Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ Exploit code public for critical FortiSIEM command injection flaw ∗∗∗ --------------------------------------------- Technical details and a public exploit have been published for a critical vulnerability affecting Fortinets Security Information and Event Management (SIEM) solution that could be leveraged by a remote, unauthenticated attacker to execute commands or code. --------------------------------------------- https://www.bleepingcomputer.com/news/security/exploit-code-public-for-crit… ∗∗∗ Critical flaw lets hackers track, eavesdrop via Bluetooth audio devices ∗∗∗ --------------------------------------------- A critical vulnerability in Googles Fast Pair protocol can allow attackers to hijack Bluetooth audio accessories like wireless headphones and earbuds, track users, and eavesdrop on their conversations. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-flaw-lets-hackers-t… ∗∗∗ Most Severe AI Vulnerability to Date Hits ServiceNow ∗∗∗ --------------------------------------------- The ITSM giant tacked agentic AI onto a largely unguarded legacy chatbot, exposing customers data and connected systems. --------------------------------------------- https://www.darkreading.com/remote-workforce/ai-vulnerability-servicenow ∗∗∗ Januar-Patchday: Windows-Updates machen Remote-Anmeldung kaputt ∗∗∗ --------------------------------------------- Einige Anwender haben neuerdings Probleme, sich mit der Windows-App bei Azure Virtual Desktop oder Windows 365 anzumelden. Ein Fix ist in Arbeit. --------------------------------------------- https://www.golem.de/news/januar-patchday-windows-updates-machen-windows-ap… ∗∗∗ Ransomware-Boss gesucht: Dieser Mann soll der Anführer von Black Basta sein ∗∗∗ --------------------------------------------- Interpol, Europol und das BKA fahnden nach dem Boss der Ransomware-Gruppe Black Basta, die allein in Deutschland über 100 Organisationen geschädigt hat. --------------------------------------------- https://www.golem.de/news/ransomware-boss-gesucht-dieser-mann-soll-der-anfu… ∗∗∗ A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby ∗∗∗ --------------------------------------------- Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user. One such feature is audio transcription. --------------------------------------------- https://projectzero.google/2026/01/pixel-0-click-part-1.html ∗∗∗ A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave ∗∗∗ --------------------------------------------- With the advent of a potential Dolby Unified Decoder RCE exploit, it seemed prudent to see what kind of Linux kernel drivers might be accessible from the resulting userland context, the mediacodec context. --------------------------------------------- https://projectzero.google/2026/01/pixel-0-click-part-2.html ∗∗∗ A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here? ∗∗∗ --------------------------------------------- While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some broader issues in the Android ecosystem. This post describes the problems we encountered and recommendations for improvement. --------------------------------------------- https://projectzero.google/2026/01/pixel-0-click-part-3.html ∗∗∗ Researchers Null-Route Over 550 Kimwolf and Aisuru Botnet Command Servers ∗∗∗ --------------------------------------------- The Black Lotus Labs team at Lumen Technologies said it null-routed traffic to more than 550 command-and-control (C2) nodes associated with the AISURU/Kimwolf botnet since early October 2025. --------------------------------------------- https://thehackernews.com/2026/01/kimwolf-botnet-infected-over-2-million.ht… ∗∗∗ Verizon Outage Knocks Out US Mobile Service, Including Some 911 Calls ∗∗∗ --------------------------------------------- A major Verizon outage appeared to impact customers across the United States starting around noon ET on Wednesday. Calls to Verizon customers from other carriers may also be impacted. --------------------------------------------- https://www.wired.com/story/verizon-outage-knocks-out-us-mobile-service-inc… ∗∗∗ Razzia in Deutschland: Behörden machen Cybercrime-Hoster RedVDS dicht ∗∗∗ --------------------------------------------- Internationalen Ermittlern und Microsoft ist ein Schlag gegen die Infrastruktur des Cybercrime-Hosters RedVDS gelungen. Die Server standen auch in Deutschland. --------------------------------------------- https://www.heise.de/news/Razzia-in-Deutschland-Behoerden-machen-Cybercrime… ∗∗∗ Chrome: Google kappt Support für älteres macOS ∗∗∗ --------------------------------------------- Das vor weniger als fünf Jahren erschienene macOS 12 alias Monterey ist bei Googles Browser bald raus. Sicherheitslücken bleiben bestehen. --------------------------------------------- https://www.heise.de/news/Chrome-Google-kappt-Support-fuer-aelteres-macOS-1… ∗∗∗ curl: Projekt beendet Bug-Bounty-Programm ∗∗∗ --------------------------------------------- curl-Maintainer Daniel Stenberg hat das Ende des Bug-Bounty-Programms angekündigt. Unbrauchbare KI-Meldungen nahmen wohl überhand. --------------------------------------------- https://www.heise.de/news/curl-Projekt-beendet-Bug-Bounty-Programm-11142345… ∗∗∗ Kriminelle imitieren Banknummern: Vorsicht vor Spoofing ∗∗∗ --------------------------------------------- Kriminelle suchen ständig nach neuen Methoden, um an Kontodaten zu gelangen. Leider sind sie fündig geworden: Mit Spoofing täuschen sie die Nummer von Banken vor und erschleichen so das Vertrauen ihrer Opfer. --------------------------------------------- https://www.watchlist-internet.at/news/kriminelle-imitieren-banknummern-spo… ∗∗∗ Microsoft disrupts RedVDS cybercrime platform behind $40 million in scam losses ∗∗∗ --------------------------------------------- Microsoft and law enforcement partners took down a popular cybercriminal subscription service called RedVDS that was used to enable more than $40 million in fraud losses in the United States alone. --------------------------------------------- https://therecord.media/microsoft-redvds-cybercrime-scam ∗∗∗ UAT-8837 targets critical infrastructure sectors in North America ∗∗∗ --------------------------------------------- Cisco Talos is closely tracking UAT-8837, a threat actor we assess with medium confidence is a China-nexus advanced persistent threat (APT) actor. --------------------------------------------- https://blog.talosintelligence.com/uat-8837/ ∗∗∗ GhostPoster Browser Malware Hid for 5 Years With 840,000 Installs ∗∗∗ --------------------------------------------- Researchers uncover a 5-year malware campaign using browser extensions on Chrome, Firefox and Edge, relying on hidden payloads and shared infrastructure. --------------------------------------------- https://hackread.com/ghostposter-browser-malware-840000-installs/ ∗∗∗ Closing the Door on Net-NTLMv1: Releasing Rainbow Tables to Accelerate Protocol Deprecation ∗∗∗ --------------------------------------------- Mandiant is publicly releasing a comprehensive dataset of Net-NTLMv1 rainbow tables to underscore the urgency of migrating away from this outdated protocol. Despite Net-NTLMv1 being deprecated and known to be insecure for over two decades—with cryptanalysis dating back to 1999—Mandiant consultants continue to identify its use in active environments. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/net-ntlmv1-depreca… ∗∗∗ New Remcos Campaign Distributed Through Fake Shipping Document ∗∗∗ --------------------------------------------- FortiGuard Labs discovered a new phishing campaign in the wild. The campaign delivers a new variant of Remcos, a commercial lightweight remote access tool (RAT) with a wide range of capabilities, including system resource management, remote surveillance, network management, and Remcos agent management. --------------------------------------------- https://feeds.fortinet.com/~/940295429/0/fortinet/blogs~New-Remcos-Campaign… ∗∗∗ I’m The Captain Now: Hijacking a global ocean supply chain network ∗∗∗ --------------------------------------------- There’s a good chance you have never heard of BLUVOYIX or Bluspark Global, and that’s ok! Not every company that powers global commerce is a household name. Despite their low profile, companies like these have an important role to play in keeping the global supply chain running in the background. Breaches at companies you haven’t heard of can often have the worst impacts. --------------------------------------------- https://eaton-works.com/2026/01/14/bluspark-bluvoyix-hack/ ∗∗∗ Malicious Chrome Extension Steals MEXC API Keys for Account Takeover ∗∗∗ --------------------------------------------- A malicious Chrome extension steals newly created MEXC API keys, exfiltrates them to Telegram, and enables full account takeover with trading and withdrawal rights. --------------------------------------------- https://socket.dev/blog/malicious-chrome-extension-steals-mexc-api-keys ===================== = Vulnerabilities = ===================== ∗∗∗ Critical WordPress Modular DS Plugin Flaw Actively Exploited to Gain Admin Access ∗∗∗ --------------------------------------------- A maximum-severity security flaw in a WordPress plugin called Modular DS has come under active exploitation in the wild, according to Patchstack. The vulnerability, tracked as CVE-2026-23550 (CVSS score: 10.0), has been described as a case of unauthenticated privilege escalation impacting all versions of the plugin prior to and including 2.5.1. It has been patched in version 2.5.2. --------------------------------------------- https://thehackernews.com/2026/01/critical-wordpress-modular-ds-plugin.html ∗∗∗ Role Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002 ∗∗∗ --------------------------------------------- This module allows site administrators to grant specific roles the authority to assign selected roles to users, without them needing the "administer permissions" permission. The module contains an access bypass vulnerability when used in combination with the Views Bulk Operations module. A user with the ability to delegate a role is also able to assign the administrator role, including to their own user. --------------------------------------------- https://www.drupal.org/sa-contrib-2026-002 ∗∗∗ Group invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001 ∗∗∗ --------------------------------------------- This module enables allows group managers to invite people into their group. The module doesn't sufficiently check access under certain circumstances, allowing unauthorized users to access the group's content. --------------------------------------------- https://www.drupal.org/sa-contrib-2026-001 ∗∗∗ Microsoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005 ∗∗∗ --------------------------------------------- This module enables Drupal sites to authenticate users via Microsoft Entra ID (formerly Azure AD) using OAuth 2.0. The module doesn't sufficiently validate API responses from Microsoft allowing complete account takeover of any user, including site administrators, without requiring any credentials or access to the target's email account. --------------------------------------------- https://www.drupal.org/sa-contrib-2026-005 ∗∗∗ Fortinet: Heap-based buffer overflow in cw_acd daemon (FortiOS, FortiSASE, FortiSwitchManager) ∗∗∗ --------------------------------------------- A heap-based buffer overflow vulnerability [CWE-122] in FortiOS and FortiSwitchManager cw_acd daemon may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. CVE-2025-25249 / CVSSv3 Score 7.4 --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-25-084 ∗∗∗ Angreifer können Palo-Alto-Firewalls in Wartungsmodus zwingen ∗∗∗ --------------------------------------------- Unter bestimmten Bedingungen können Angreifer an einer Sicherheitslücke in PAN-OS ansetzen und so Firewalls von Palo Alto Networks attackieren. Bislang gibt es dem IT-Sicherheitsunternehmen zufolge keine Hinweise auf Attacken. --------------------------------------------- https://www.heise.de/news/Angreifer-koennen-Palo-Alto-Firewalls-in-Wartungs… ∗∗∗ CVE-2026-0227 PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal (Severity: HIGH) ∗∗∗ --------------------------------------------- A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts to trigger this issue results in the firewall entering into maintenance mode. --------------------------------------------- https://security.paloaltonetworks.com/CVE-2026-0227 ∗∗∗ Security Vulnerabilities fixed in Thunderbird 140.7 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-05/ ∗∗∗ Security Vulnerabilities fixed in Thunderbird 147 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-04/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 14.01.2026
by Daily end-of-shift report 14 Jan '26

14 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 13-01-2026 18:00 − Mittwoch 14-01-2026 18:30 Handler: Felician Fuchs Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Target employees confirm leaked source code is authentic ∗∗∗ --------------------------------------------- Multiple current and former Target employees confirmed that leaked source code samples posted by a threat actor match real internal systems. The company also rolled out an "accelerated" lockdown of its Git server, requiring VPN access, a day after being contacted by BleepingComputer. --------------------------------------------- https://www.bleepingcomputer.com/news/security/target-employees-confirm-lea… ∗∗∗ Microsoft: Windows 365 update blocks access to Cloud PC sessions ∗∗∗ --------------------------------------------- Microsoft confirmed that a recent Windows 365 update is blocking customers from accessing their Microsoft 365 Cloud PC sessions. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-365-updat… ∗∗∗ Cloud marketplace Pax8 accidentally exposes data on 1,800 MSP partners ∗∗∗ --------------------------------------------- Cloud marketplace and distributor Pax8 has confirmed that it mistakenly sent an email to fewer than 40 UK-based partners containing a spreadsheet with internal business information, including MSP customer and Microsoft licensing data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cloud-marketplace-pax8-accid… ∗∗∗ Reprompt attack let hackers hijack Microsoft Copilot sessions ∗∗∗ --------------------------------------------- Researchers identified an attack method dubbed "Reprompt" that could allow attackers to infiltrate a users Microsoft Copilot session and issue commands to exfiltrate sensitive data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/reprompt-attack-let-hackers-… ∗∗∗ ConsentFix debrief: Insights from the new OAuth phishing attack ∗∗∗ --------------------------------------------- ConsentFix is an OAuth phishing technique abusing browser-based authorization flows to hijack Microsoft accounts. Push Security shares new insights from continued tracking, community research, and evolving attacker techniques. --------------------------------------------- https://www.bleepingcomputer.com/news/security/consentfix-debrief-insights-… ∗∗∗ Microsoft updates Windows DLL that triggered security alerts ∗∗∗ --------------------------------------------- Microsoft has resolved a known issue that was causing security applications to incorrectly flag a core Windows component, the company said in a service alert posted this week. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-updates-windows-d… ∗∗∗ Ohne Authentifizierung: Broadcom-Lücke lässt Angreifer ganze WLAN-Netze lahmlegen ∗∗∗ --------------------------------------------- Zahlreiche WLAN-Netze, die auf Broadcom-Chipsätzen basieren, lassen sich mit nur einem Datenpaket lahmlegen. Angreifer brauchen dafür keinen Schlüssel. --------------------------------------------- https://www.golem.de/news/ohne-authentifizierung-broadcom-luecke-laesst-ang… ∗∗∗ Corrupting LLMs Through Weird Generalizations ∗∗∗ --------------------------------------------- Abstract LLMs are useful because they generalize so well. But can you have too much of a good thing? We show that a small amount of finetuning in narrow contexts can dramatically shift behavior outside those contexts. --------------------------------------------- https://www.schneier.com/blog/archives/2026/01/corrupting-llms-through-weir… ∗∗∗ Malware Intercepts Googlebot via IP-Verified Conditional Logic ∗∗∗ --------------------------------------------- Some attackers are increasingly moving away from simple redirects in favor of more “selective” methods of payload delivery. This approach filters out regular human visitors, allowing attackers to serve malicious content to search engine crawlers while remaining invisible to the website owner. --------------------------------------------- https://blog.sucuri.net/2026/01/malware-intercepts-googlebot-via-ip-verifie… ∗∗∗ Malicious Chrome Extension Steals MEXC API Keys by Masquerading as Trading Tool ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a malicious Google Chrome extension thats capable of stealing API keys associated with MEXC, a centralized cryptocurrency exchange (CEX) available in over 170 countries, while masquerading as a tool to automate trading on the platform. --------------------------------------------- https://thehackernews.com/2026/01/malicious-chrome-extension-steals-mexc.ht… ∗∗∗ New Research: 64% of 3rd-Party Applications Access Sensitive Data Without Justification ∗∗∗ --------------------------------------------- Research analyzing 4,700 leading websites reveals that 64% of third-party applications now access sensitive data without business justification, up from 51% in 2024. Government sector malicious activity spiked from 2% to 12.9%, while 1 in 7 Education sites show active compromise. --------------------------------------------- https://thehackernews.com/2026/01/new-research-64-of-3rd-party.html ∗∗∗ Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware ∗∗∗ --------------------------------------------- Security experts have disclosed details of an active malware campaign thats exploiting a DLL side-loading vulnerability in a legitimate binary associated with the open-source c-ares library to bypass security controls and deliver a wide range of commodity trojans and stealers. --------------------------------------------- https://thehackernews.com/2026/01/hackers-exploit-c-ares-dll-side-loading.h… ∗∗∗ Interrail meldet Datenleck: Auch Ausweisdaten betroffen ∗∗∗ --------------------------------------------- Bei Eurail flossen mutmaßlich Daten ab. Der Anbieter stellt Interrail-Pässe auch im Auftrag der deutschen, österreichischen und Schweizer Bahn aus. --------------------------------------------- https://www.heise.de/news/Interrail-meldet-Datenleck-Auch-Ausweisdaten-betr… ∗∗∗ Kritik an GnuPG und seinem Umgang mit gemeldeten Lücken ∗∗∗ --------------------------------------------- Die auf dem 39C3 demonstrierten Probleme in der PGP-Implementierung GnuPG riefen vielfältige Kritik an GnuPGs Umgang damit, aber auch an PGP insgesamt hervor. --------------------------------------------- https://www.heise.de/hintergrund/Kritik-an-GnuPG-und-seinem-Umgang-mit-geme… ∗∗∗ Malware-Masche: Jobangebote jubeln Entwicklern bösartige Repositories unter ∗∗∗ --------------------------------------------- Entwickler müssen bei Jobangeboten inzwischen aufpassen. Kriminelle versuchen, Infostealer darüber zu verteilen. --------------------------------------------- https://www.heise.de/news/Malware-Masche-Jobangebote-jubeln-Entwicklern-boe… ∗∗∗ How real software downloads can hide remote backdoors ∗∗∗ --------------------------------------------- Attackers use legitimate open-source software as cover, relying on user trust to compromise systems. We dive into an example. --------------------------------------------- https://www.malwarebytes.com/blog/threat-intel/2026/01/how-real-software-do… ∗∗∗ Instagram dementiert Hack nach massenhaften Passwort-Reset-Mails ∗∗∗ --------------------------------------------- Zuvor waren Berichte über entwendete Daten von 17 Millionen Usern kursiert. Das Unternehmen widerspricht und rät zum Ignorieren der Mails --------------------------------------------- https://www.derstandard.at/story/3000000303975/instagram-dementiert-hack-na… ∗∗∗ Ransomware: Tactical Evolution Fuels Extortion Epidemic ∗∗∗ --------------------------------------------- New whitepaper reveals record number of attacks as threat landscape evolves with new players and new tactics. --------------------------------------------- https://www.security.com/threat-intelligence/ransomware-extortion-epidemic ∗∗∗ More than 40 countries impacted by North Korea IT worker scams, crypto thefts ∗∗∗ --------------------------------------------- Eleven countries led a session at the UN headquarters in New York centered around a 140-page report released last fall that covered North Korea’s extensive cyber-focused efforts to fund its nuclear and ballistic weapons program. --------------------------------------------- https://therecord.media/40-countries-impacted-nk-it-thefts-united-nations ∗∗∗ Poland says it repelled major cyberattack on power grid, blames Russia ∗∗∗ --------------------------------------------- Poland narrowly avoided a large-scale power outage by thwarting what officials described as the most serious cyberattack on its energy infrastructure in years. --------------------------------------------- https://therecord.media/poland-cyberattack-grid-russia ∗∗∗ Western cyber agencies warn about threats to industrial operational technology ∗∗∗ --------------------------------------------- New guidance issued by Britain’s National Cyber Secure Centre (NCSC), a part of signals and cyber intelligence agency GCHQ, sets out how organizations should securely connect equipment such as industrial control systems, sensors and other critical services. --------------------------------------------- https://therecord.media/cyber-agencies-warn-of-industrial-system-threats ∗∗∗ Telegram to Add Warning for Proxy Links After IP Leak Concerns ∗∗∗ --------------------------------------------- Telegram will add a warning for proxy links after reports showed they can expose user IP addresses with a single click, bypassing VPN or privacy settings. --------------------------------------------- https://hackread.com/telegram-add-warning-proxy-links-ip-leak/ ∗∗∗ Hacker Claims Full Breach of Russia’s Max Messenger, Threatens Public Leak ∗∗∗ --------------------------------------------- A hacker claims a full breach of Russia’s Max Messenger, threatening to leak user data and backend systems if demands are not met. --------------------------------------------- https://hackread.com/hacker-russia-max-messenger-breach-data-leak/ ∗∗∗ Secure Connectivity Principles for Operational Technology (OT) ∗∗∗ --------------------------------------------- CISA and the UK National Cyber Security Centre (NCSC-UK), in collaboration with federal and international partners, have released Secure Connectivity Principles for Operational Technology (OT) guidance to help asset owners address increasing business and regulatory pressures for connectivity into operational technology (OT) networks. --------------------------------------------- https://www.cisa.gov/resources-tools/resources/secure-connectivity-principl… ∗∗∗ Unpatchable Vulnerabilities of Kubernetes: CVE-2020-8554 ∗∗∗ --------------------------------------------- This blog is the first part of a mini-series looking at the four unpatchable CVEs in every Kubernetes cluster. --------------------------------------------- https://securitylabs.datadoghq.com/articles/unpatchable-kubernetes-vulnerab… ∗∗∗ Wireless-(in)Fidelity: Pentesting Wi-Fi in 2025 ∗∗∗ --------------------------------------------- Despite the advancements that have been made in Wi-Fi security with the arrival of WPA3, some misconfigurations and legacy protocols still remain. In this blogpost, we share insights into Wi-Fi related findings encountered during penetration testing engagements. --------------------------------------------- https://www.synacktiv.com/en/publications/wireless-infidelity-pentesting-wi… ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple vulnerabilities in EATON UPS Companion ∗∗∗ --------------------------------------------- EATON UPS Companion provided by Eaton contains multiple vulnerabilities. --------------------------------------------- https://jvn.jp/en/jp/JVN48187396/ ∗∗∗ Patchday Microsoft: Attacken auf Windows und Windows Server beobachtet ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für Office, Windows & Co. erschienen. Angreifer nutzen bereits eine Lücke aus. Weitere Attacken können bevorstehen. --------------------------------------------- https://www.heise.de/news/Patchday-Microsoft-Angreifer-spionieren-Speicherb… ∗∗∗ Patchday Adobe: Schadcode-Lücken bedrohen Dreamweaver & Co. ∗∗∗ --------------------------------------------- Wichtige Sicherheitsupdates reparieren unter anderem Adobe ColdFusion und InDesign. --------------------------------------------- https://www.heise.de/news/Patchday-Adobe-Schadcode-Luecken-bedrohen-Dreamwe… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (sssd), Debian (linux-6.1 and python-parsl), Fedora (chezmoi, complyctl, composer, and firefox), Oracle (kernel), Red Hat (buildah, libpq, podman, postgresql, postgresql16, postgresql:13, postgresql:15, and postgresql:16), SUSE (avahi, curl, ffmpeg-4, ffmpeg-7, firefox, istioctl, k6, kubelogin, libmicrohttpd, libpcap-devel, libpng16, libtasn1-6-32bit, matio, ovmf, python-tornado6, python311-Authlib, and teleport), and Ubuntu (angular.js, python-urllib3, and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/1054167/ ∗∗∗ Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users ∗∗∗ --------------------------------------------- This bug highlights how deeply async_hooks has become embedded in the Node.js ecosystem. What started as a low-level debugging API is now a critical dependency for React Server Components, Next.js, every major APM tool, and any code using AsyncLocalStorage. --------------------------------------------- https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-… ∗∗∗ F5: K000159546, Python vulnerability CVE-2024-5642 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000159546 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 13.01.2026
by Daily end-of-shift report 13 Jan '26

13 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Montag 12-01-2026 18:00 − Dienstag 13-01-2026 18:00 Handler: Felician Fuchs Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Targets dev server offline after hackers claim to steal source code ∗∗∗ --------------------------------------------- Hackers are claiming to be selling internal source code belonging to Target Corporation, after publishing what appears to be a sample of stolen code repositories on a public software development platform. After BleepingComputer notified Target, the files were taken offline and the retailers developer Git server was inaccessible. --------------------------------------------- https://www.bleepingcomputer.com/news/security/targets-dev-server-offline-a… ∗∗∗ CISA orders feds to patch Gogs RCE flaw exploited in zero-day attacks ∗∗∗ --------------------------------------------- CISA has ordered government agencies to secure their systems against a high-severity Gogs vulnerability that was exploited in zero-day attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-go… ∗∗∗ Facebook login thieves now using browser-in-browser trick ∗∗∗ --------------------------------------------- Hackers over the past six months have relied increasingly more on the browser-in-the-browser (BitB) method to trick users into providing Facebook account credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/facebook-login-thieves-now-u… ∗∗∗ Convincing LinkedIn comment-reply tactic used in new phishing ∗∗∗ --------------------------------------------- Scammers are flooding LinkedIn posts with fake "reply" comments that appear to come from the platform, warning of bogus policy violations and urging users to click external links. Some even abuse LinkedIns official lnkd.in shortener, making the phishing attempts harder to spot. --------------------------------------------- https://www.bleepingcomputer.com/news/security/convincing-linkedin-comment-… ∗∗∗ What we know about Iran’s Internet shutdown ∗∗∗ --------------------------------------------- Cloudflare Radar data shows Internet traffic from Iran has effectively dropped to zero since January 8, signaling a complete shutdown in the country and disconnection from the global Internet. --------------------------------------------- https://blog.cloudflare.com/iran-protests-internet-shutdown/ ∗∗∗ GoBruteforcer Botnet Targets 50K-plus Linux Servers ∗∗∗ --------------------------------------------- Researchers detailed a souped-up version of the GoBruteforcer botnet that preys on servers with weak credentials and AI-generated configurations. --------------------------------------------- https://www.darkreading.com/threat-intelligence/gobruteforcer-botnet-target… ∗∗∗ 10-Punkte-Papier: BDEW fordert Maßnahmen zum Schutz kritischer Infrastruktur ∗∗∗ --------------------------------------------- In einem Positionspapier fordert der Bundesverband der Energie- und Wasserwirtschaft die Stärkung der Resilienz kritischer Infrastrukturen. --------------------------------------------- https://www.golem.de/news/10-punkte-papier-bdew-fordert-massnahmen-zum-schu… ∗∗∗ n8n Supply Chain Attack Abuses Community Nodes to Steal OAuth Tokens ∗∗∗ --------------------------------------------- Threat actors have been observed uploading a set of eight packages on the npm registry that masqueraded as integrations targeting the n8n workflow automation platform to steal developers OAuth credentials. --------------------------------------------- https://thehackernews.com/2026/01/n8n-supply-chain-attack-abuses.html ∗∗∗ New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a new campaign dubbed SHADOW#REACTOR that employs an evasive multi-stage attack chain to deliver a commercially available remote administration tool called Remcos RAT and establish persistent, covert remote access. --------------------------------------------- https://thehackernews.com/2026/01/new-malware-campaign-delivers-remcos.html ∗∗∗ New Advanced Linux VoidLink Malware Targets Cloud and container Environments ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a previously undocumented and feature-rich malware framework codenamed VoidLink thats specifically designed for long-term, stealthy access to Linux-based cloud environments. --------------------------------------------- https://thehackernews.com/2026/01/new-advanced-linux-voidlink-malware.html ∗∗∗ Businesses in 2026: Maybe we should finally look into that AI security stuff ∗∗∗ --------------------------------------------- Survey finds security checks nearly doubled in a year as leaders wise up. The number of organizations that have implemented methods for identifying security risks in the AI tools they use has almost doubled in the space of a year. --------------------------------------------- https://www.theregister.com/2026/01/12/ai_security_wef_survey/ ∗∗∗ Mandiant open sources tool to prevent leaky Salesforce misconfigs ∗∗∗ --------------------------------------------- AuraInspector automates the most common abuses and generates fixes for customers Mandiant has released an open source tool to help Salesforce admins detect misconfigurations that could expose sensitive data. --------------------------------------------- https://www.theregister.com/2026/01/13/mandiant_salesforce_tool/ ∗∗∗ Dutch cops cuff alleged AVCheck malware kingpin in Amsterdam ∗∗∗ --------------------------------------------- 33-year-old was under surveillance for some time before returning home from the UAE Dutch police believe they have arrested a man behind the AVCheck online platform - a service used by cybercrims that Operation Endgame shuttered in May. --------------------------------------------- https://www.theregister.com/2026/01/13/avcheck_arrest/ ∗∗∗ Start der ersten ESC-Ticketwelle: Vorsicht vor unseriösen Angeboten! ∗∗∗ --------------------------------------------- Endlich ist es so weit: Der Vorverkauf für den Eurovision Song Contest 2026 hat begonnen! Doch Fans sollten besonders vorsichtig sein, denn unseriöse Anbieter versuchen, außerhalb der offiziellen Verkaufsplattformen Profit zu schlagen. --------------------------------------------- https://www.watchlist-internet.at/news/start-der-ersten-esc-ticketwelle-vor… ∗∗∗ Neue Phishing-Welle: Ausstehende Zahlungen ans Finanzamt ∗∗∗ --------------------------------------------- Einmal mehr geben sich Kriminelle als das Bundesministerium für Finanzen aus. Aktuell nehmen sie sowohl Privatpersonen als auch Unternehmen ins Visier. In beiden Fällen sollen angeblich offene Zahlungen mit einer Überweisung beglichen werden – auf ein Konto im Ausland. --------------------------------------------- https://www.watchlist-internet.at/news/phishing-ausstehende-zahlungen-finan… ∗∗∗ Latin America Sees Sharpest Rise in Cyber Attacks in December 2025 as Ransomware Activity Accelerates ∗∗∗ --------------------------------------------- In December 2025, organizations experienced an average of 2,027 cyber attacks per organization per week. This represents a 1% month-over-month increase and a 9% year-over-year increase. While overall growth remained moderate, Latin America recorded the sharpest regional increase, with organizations experiencing an average of 3,065 attacks per week, a 26% increase year over year. --------------------------------------------- https://blog.checkpoint.com/research/latin-america-sees-sharpest-rise-in-cy… ∗∗∗ VoidLink: The Cloud-Native Malware Framework Weaponizing Linux Infrastructure ∗∗∗ --------------------------------------------- Key Points: VoidLink is a cloud-native Linux malware framework built to maintain long-term, stealthy access to cloud infrastructure rather than targeting individual endpoints. It reflects a shift in attacker focus away from Windows systems toward the Linux environments that power cloud services and critical operations. Its modular, plug-in-driven design allows threat actors to customize capabilities over time, expanding attacks quietly as objectives evolve. --------------------------------------------- https://blog.checkpoint.com/research/voidlink-the-cloud-native-malware-fram… ∗∗∗ Sweden detains ex-military IT consultant suspected of spying for Russia ∗∗∗ --------------------------------------------- A 33-year-old former IT consultant for Sweden’s Armed Forces has been detained on suspicions of spying for Russian intelligence, Swedish prosecutors said. --------------------------------------------- https://therecord.media/sweden-detains-it-consultant-russia ∗∗∗ 0patch Micropatch für CredSSP-Schwachstelle CVE-2025-47987 ∗∗∗ --------------------------------------------- Noch ein kleiner Nachtrag von letzter Woche und vor dem Januar 2026 Patchday. ACROS Security hat einen 0patch Micropatch für eine Elevation of Privilege (EoP)-Schwachstelle CVE-2025-47987 im Credential Security Support Provider Protocol (CredSSP) veröffentlicht. --------------------------------------------- https://borncity.com/blog/2026/01/13/0patch-micropatch-fuer-credssp-schwach… ∗∗∗ End of Support für Microsoft-Produkte in 2026 ∗∗∗ --------------------------------------------- Das Jahr 2026 bringt für Nutzer von Microsoft Produkten einige Termine, an denen der Support endet. Das reicht von diversen Windows-Versionen, die dann nicht mehr durch Updates unterstützt werden, bis hin zu Microsoft Office 2021. --------------------------------------------- https://borncity.com/blog/2026/01/13/end-of-support-fuer-microsoft-produkte… ∗∗∗ Russian BlueDelta (Fancy Bear) Uses PDFs to Steal Logins in Just 2 Seconds ∗∗∗ --------------------------------------------- New research from Recorded Future reveals how Russian state hackers (BlueDelta) are using fake Microsoft and Google login portals to steal credentials. The campaign involves using legitimate PDF lures from GRC and EcoClimate to trick victims. --------------------------------------------- https://hackread.com/russian-bluedelta-fancy-bear-pdfs-steal-login/ ∗∗∗ Widespread Magecart Campaign Targets Users of All Major Credit Cards ∗∗∗ --------------------------------------------- Researchers at Silent Push have exposed a global Magecart campaign stealing credit card data since 2022. Learn how this invisible web-skimming attack targets major networks like Mastercard and Amex, and how to stay safe. --------------------------------------------- https://hackread.com/magecart-targets-all-credit-cards-users/ ∗∗∗ K7 Antivirus: Named pipe abuse, registry manipulation and privilege escalation (CVE-2025-67826) ∗∗∗ --------------------------------------------- When hunting for privilege escalation vulnerabilities, named pipes are a goldmine. Antivirus products often use named pipes to allow unprivileged users to trigger privileged operations, making them especially promising targets for this class of vulnerability. --------------------------------------------- http://blog.quarkslab.com/k7-antivirus-named-pipe-abuse-registry-manipulati… ∗∗∗ How GitHub could secure npm ∗∗∗ --------------------------------------------- In 2025, npm experienced an unprecedented number of compromised packages in a series of coordinated attacks on the JavaScript open source supply chain. These packages ranged from crypto-stealing malware1 to credential-stealing exploits2. While GitHub announced changes3 to address these attacks, many maintainers (myself included) found the response insufficient. --------------------------------------------- https://humanwhocodes.com/blog/2026/01/how-github-could-secure-npm/ ∗∗∗ Shai Hulud 2.0 Campaign ∗∗∗ --------------------------------------------- Shai-Hulud 2.0 represents one of the most severe supply chain compromises observed in the modern cloud-native ecosystem. The campaign involved the manipulation of hundreds of publicly available packages and specifically targeted developer workstations, CI/CD pipelines, and cloud workloads to harvest credentials and sensitive configuration data. --------------------------------------------- https://detect.fyi/shai-hulud-2-0-campaign-be390e502f28?source=rss----d5fd8… ∗∗∗ Malicious Chrome Extension Steals MEXC API Keys for Account Takeover ∗∗∗ --------------------------------------------- Socket’s Threat Research Team identified a malicious Chrome extension, MEXC API Automator, published to the Chrome Web Store on September 1, 2025, by a threat actor under the alias jorjortan142. --------------------------------------------- https://socket.dev/blog/malicious-chrome-extension-steals-mexc-api-keys?utm… ∗∗∗ Fixing ESC1 - Enrollee supplies subject and template allows client authentication ∗∗∗ --------------------------------------------- ADCS misconfigurations are one of the most common privilege escalation vectors we encounter. This article covers steps to remediate ESC1 flaws. --------------------------------------------- https://projectblack.io/blog/fixing-esc1-enrollee-supplies-subject-and-temp… ∗∗∗ Lack of isolation in agentic browsers resurfaces old vulnerabilities ∗∗∗ --------------------------------------------- With browser-embedded AI agents, we’re essentially starting the security journey over again. We exploited a lack of isolation mechanisms in multiple agentic browsers to perform attacks ranging from the dissemination of false information to cross-site data leaks. --------------------------------------------- https://blog.trailofbits.com/2026/01/13/lack-of-isolation-in-agentic-browse… ===================== = Vulnerabilities = ===================== ∗∗∗ Unauthenticated access to local configuration ∗∗∗ --------------------------------------------- CVSSv3 Score: 9.3. An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiFone Web Portal page may allow an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-25-260 ∗∗∗ Unauthenticated remote command injection ∗∗∗ --------------------------------------------- CVSSv3 Score: 9.4. An improper neutralization of special elements used in an OS command (OS Command Injection) vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-25-772 ∗∗∗ SAP Security Patch Day January 2026 ∗∗∗ --------------------------------------------- SAP has released its January 2026 security patch package containing 17 security notes addressing critical vulnerabilities across enterprise SAP environments. This release includes four HotNews vulnerabilities with CVSS ratings up to 9.9, four High priority issues, seven Medium priority fixes, and two Low priority updates. The patches affect SAP S/4HANA, SAP HANA database, SAP NetWeaver, SAP Wily Introscope, and various application components. --------------------------------------------- https://redrays.io/blog/sap-security-patch-day-january-2026/ ∗∗∗ TinyWeb: Windows-Web-Server ermöglicht Codeschmuggel ∗∗∗ --------------------------------------------- In dem schlanken Web-Server TinyWeb für Windows können Angreifer aus dem Netz beliebigen Code einschleusen. Ein Update hilft. --------------------------------------------- https://www.heise.de/news/TinyWeb-Windows-Web-Server-ermoeglicht-Codeschmug… ∗∗∗ TYPO3-CORE-SA-2026-003: Broken Access Control in Recycler Module ∗∗∗ --------------------------------------------- It has been discovered that TYPO3 CMS is susceptible to broken access control. --------------------------------------------- https://typo3.org/security/advisory/typo3-core-sa-2026-003 ∗∗∗ ServiceNow Patches Critical AI Platform Flaw Allowing Unauthenticated User Impersonation ∗∗∗ --------------------------------------------- ServiceNow has disclosed details of a now-patched critical security flaw impacting its ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform arbitrary actions as that user. The vulnerability, tracked as CVE-2025-12420, carries a CVSS score of 9.3 out of 10.0. --------------------------------------------- https://thehackernews.com/2026/01/servicenow-patches-critical-ai-platform.h… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (mariadb10.11, mariadb:10.11, mariadb:10.3, mariadb:10.5, and tar), Debian (net-snmp), Fedora (coturn, NetworkManager-l2tp, openssh, and tuxanci), Mageia (libtasn1), Oracle (buildah, cups, httpd, kernel, libpq, libsoup, libsoup3, mariadb:10.11, mariadb:10.3, openssl, and podman), SUSE (cpp-httplib, ImageMagick, libtasn1, python-cbor2, util-linux, valkey, and wget2), and Ubuntu (google-guest-agent, linux-iot, and python-urllib3). --------------------------------------------- https://lwn.net/Articles/1053988/ ∗∗∗ Remote Code Execution With Modern AI/ML Formats and Libraries ∗∗∗ --------------------------------------------- We identified remote code execution vulnerabilities in open-source AI/ML libraries published by Apple, Salesforce and NVIDIA. --------------------------------------------- https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-librar… ∗∗∗ YoSmart YoLink Smart Hub ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-26-013-03 ∗∗∗ Rockwell Automation FactoryTalk DataMosaix Private Cloud ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-26-013-02 ∗∗∗ Rockwell Automation 432ES-IG3 Series A ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-26-013-01 ∗∗∗ Security Vulnerabilities fixed in Firefox 147 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-01/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 12.01.2026
by Daily end-of-shift report 12 Jan '26

12 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 09-01-2026 18:00 − Montag 12-01-2026 18:00 Handler: Felician Fuchs Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Max severity Ni8mare flaw impacts nearly 60,000 n8n instances ∗∗∗ --------------------------------------------- Nearly 60,000 n8n instances exposed online remain unpatched against a maximum-severity vulnerability dubbed "Ni8mare." --------------------------------------------- https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-im… ∗∗∗ Spanish energy giant Endesa discloses data breach affecting customers ∗∗∗ --------------------------------------------- Spanish energy provider Endesa and its Energía XXI operator are notifying customers that hackers accessed the companys systems and accessed contract-related information, which includes personal details. --------------------------------------------- https://www.bleepingcomputer.com/news/security/spanish-energy-giant-endesa-… ∗∗∗ Hidden Telegram proxy links can reveal your IP address in one click ∗∗∗ --------------------------------------------- A single click on what may appear to be a Telegram username or harmless link is all it takes to expose your real IP address to attackers due to how proxy links are handled. Telegram says it will add warnings to proxy links after researchers demonstrated that such one-click interactions could reveal a Telegram users real IP address. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hidden-telegram-proxy-links-… ∗∗∗ Illicit Crypto Economy Surges Amid Increased Nation-State Activity ∗∗∗ --------------------------------------------- Cybercriminal cryptocurrency transactions totaled billions in 2025, with activity from sanctioned countries like Russia and Iran causing the largest jump. --------------------------------------------- https://www.darkreading.com/cyber-risk/illicit-crypto-economy-surges-nation… ∗∗∗ Russia’s Fancy Bear APT Doubles Down on Global Secrets Theft ∗∗∗ --------------------------------------------- The notorious state-sponsored group relies on basic techniques that are highly effective, often delivering greater ROI than more complex malware-heavy operations. --------------------------------------------- https://www.darkreading.com/cyberattacks-data-breaches/russian-apt-credenti… ∗∗∗ Two Separate Campaigns Target Exposed LLM Services ∗∗∗ --------------------------------------------- A total of 91,403 sessions targeted public LLM endpoints to find leaks in organizations use of AI and map an expanding attack surface. --------------------------------------------- https://www.darkreading.com/endpoint-security/separate-campaigns-target-exp… ∗∗∗ Cybersecurity Act: EU-Kommission will hartes Verbot von Huawei ∗∗∗ --------------------------------------------- Bisher freiwillige Beschränkungen gegen chinesische Ausrüster will die EU-Kommission nun zwangsweise umsetzen. Das ist in der EU stark umstritten und erscheint aus der Zeit gefallen. --------------------------------------------- https://www.golem.de/news/cybersecurity-act-eu-kommission-will-hartes-verbo… ∗∗∗ Lohnabrechnungen falsch verschickt: DSGVO-Vorfall bei der Datev ∗∗∗ --------------------------------------------- Nach einer technischen Störung bei der Datev-Lohnabrechnung sind Kundendaten in falsche Hände gelangt. Auslöser war ausgerechnet ein Problemlösungsversuch. --------------------------------------------- https://www.golem.de/news/lohnabrechnungen-falsch-verschickt-dsgvo-vorfall-… ∗∗∗ Researchers Uncover Service Providers Fueling Industrial-Scale Pig Butchering Fraud ∗∗∗ --------------------------------------------- Cybersecurity researchers have shed light on two service providers that supply online criminal networks with the necessary tools and infrastructure to fuel the pig butchering-as-a-service (PBaaS) economy. --------------------------------------------- https://thehackernews.com/2026/01/researchers-uncover-service-providers.html ∗∗∗ GoBruteforcer Botnet Targets Crypto Project Databases by Exploiting Weak Credentials ∗∗∗ --------------------------------------------- A new wave of GoBruteforcer attacks has targeted databases of cryptocurrency and blockchain projects to co-opt them into a botnet thats capable of brute-forcing user passwords for services such as FTP, MySQL, PostgreSQL, and phpMyAdmin on Linux servers. --------------------------------------------- https://thehackernews.com/2026/01/gobruteforcer-botnet-targets-crypto.html ∗∗∗ UK government exempting itself from flagship cyber law inspires little confidence ∗∗∗ --------------------------------------------- Ministers promise equivalent standards just without the legal obligation ANALYSIS From Mays cyberattack on the Legal Aid Agency to the Foreign Office breach months later, cyber incidents have become increasingly common in UK government. --------------------------------------------- https://www.theregister.com/2026/01/10/csr_bill_analysis/ ∗∗∗ Instagram-Datenleck: Daten von 6,2 Millionen Konten bei Have-I-Been-Pwned ∗∗∗ --------------------------------------------- Daten von 6,2 Millionen Instagram-Nutzern sind beim Have-I-Been-Pwned-Projekt gelandet. --------------------------------------------- https://www.heise.de/news/Instagram-6-2-Millionen-Nutzerdaten-mittels-Scrap… ∗∗∗ ÖIAT-Schwerpunkterhebung deckt auf: Massive Präsenz von Abo-Fallen in Google-Anzeigen ∗∗∗ --------------------------------------------- Bei einer eingehenden Analyse der Google Werbebibliothek entdeckte das Österreichische Institut für angewandte Telekommunikation (ÖIAT) eine große Menge an gefährlichen Ads. Insgesamt waren es weit über 27.000 problematische Werbeanzeigen, die als Köder für Abo-Fallen dienten. Auf Beschwerden reagierte Google bisher nicht. --------------------------------------------- https://www.watchlist-internet.at/news/schwerpunkterhebung-abo-fallen-googl… ∗∗∗ Basketball player arrested for alleged ransomware ties freed in Russia-France prisoner swap ∗∗∗ --------------------------------------------- Daniil Kasatkin, 26, was seen in a video shared by Russian state news outlet TASS emerging from a plane that was then used to send French researcher Laurent Vinatier back to France. --------------------------------------------- https://therecord.media/france-frees-russian-basketball-player-ransomware-s… ∗∗∗ MC1215070: MFA für Microsoft 365 Admin Center ab Feb. 2026 Pflicht ∗∗∗ --------------------------------------------- Noch eine kurze Information für Administratoren von Microsoft 365-Tenants. Microsoft erzwingt aus Sicherheitsgründen ab dem 9. Februar 2026 eine Multifaktor-Authentifizierung (MFA) zur Administratoranmeldung am Microsoft 365 Admin Center. Ohne entsprechende Maßnahmen scheitert dann die Anmeldung. --------------------------------------------- https://borncity.com/blog/2026/01/11/mc1215070-mfa-fuer-microsoft-365-admin… ∗∗∗ Database of 323,986 BreachForums Users Leaked as Admin Disputes Scope ∗∗∗ --------------------------------------------- Database of 323,986 BreachForums users leaked online as forum admins claim the exposed data is partial and dates back to August 2025. --------------------------------------------- https://hackread.com/breachforums-database-users-leak-admin-disputes/ ∗∗∗ Everest Ransomware Claims Breach at Nissan, Says 900GB of Data Stolen ∗∗∗ --------------------------------------------- Everest ransomware claims to have breached Nissan Motor Corporation, alleging the theft of 900GB of internal data, including documents and screenshots. --------------------------------------------- https://hackread.com/everest-ransomware-nissan-data-breach/ ∗∗∗ How Safe is the Rust Ecosystem? A Deep Dive into crates.io ∗∗∗ --------------------------------------------- The relentless wave of high-impact supply chain attacks throughout 2025—most notably the major incident within npm [..] —suggests this trend is far from peaking. In fact, with the rapid adoption of AI and LLMs in development workflows, we are likely facing an acceleration of these threats rather than a decline, in my opinion. --------------------------------------------- https://mr-leshiy-blog.web.app/blog/crates_io_analysis/ ∗∗∗ Detection of Kerberos Golden Ticket Attacks via Velociraptor ∗∗∗ --------------------------------------------- Kerberos is a strange technology. Over the years, I’ve gone through its internal workings again and again, yet parts of it always seem to slip away. It has been a while since I did my OSCP, so inevitably I’ve found myself back in this topic to refresh my knowledge. --------------------------------------------- https://detect.fyi/detection-of-kerberos-golden-ticket-attacks-via-velocira… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdate: Dell-Laptops mit Adreno-GPU sind verwundbar ∗∗∗ --------------------------------------------- Der Treiber von Qualcomms Adreno GPU ist löchrig und gefährdet die Sicherheit verschiedener Dell-Laptops. Ein reparierter Treiber steht zum Download bereit. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdate-Dell-Laptops-mit-Adreno-GPU-sin… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium and sogo), Fedora (chromium, foomuuri, libpng, libsodium, mariadb10.11, musescore, nginx, python-pdfminer, python-urllib3, python3.12, seamonkey, wasmedge, and wget2), Mageia (curl, libpcap, sodium, wget2, and zlib), Slackware (lcms2), SUSE (chromedriver, chromium, noopenh264, coredns, curl, dcmtk, fontforge, gdk-pixbuf-loader-libheif, gimp, kernel, libheif, libpng16, libsoup-2_4-1, libvirt, mariadb, php8, poppler, python-filelock, python-tornado6, python311-aiohttp, qemu, sssd, and traefik), and Ubuntu (libheif, libtasn1-6, linux-azure-nvidia, linux-kvm, linux-raspi, linux-raspi-realtime, and php7.2, php7.4, php8.1, php8.3, php8.4). --------------------------------------------- https://lwn.net/Articles/1053820/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 09.01.2026
by Daily end-of-shift report 09 Jan '26

09 Jan '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 08-01-2026 18:00 − Freitag 09-01-2026 18:00 Handler: Felician Fuchs Co-Handler: n/a ===================== = News = ===================== ∗∗∗ VMware ESXi zero-days likely exploited a year before disclosure ∗∗∗ --------------------------------------------- Chinese-speaking threat actors used a compromised SonicWall VPN appliance to deliver a VMware ESXi exploit toolkit that seems to have been developed more than a year before the targeted vulnerabilities became publicly known. --------------------------------------------- https://www.bleepingcomputer.com/news/security/vmware-esxi-zero-days-likely… ∗∗∗ FBI warns about Kimsuky hackers using QR codes to phish U.S. orgs ∗∗∗ --------------------------------------------- The North Korean state-sponsored hacker group Kimsuki is using malicious QR codes in spearphishing campaigns that target U.S. organizations, the Federal Bureau of Investigation warns in a flash alert. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fbi-warns-about-kimsuky-hack… ∗∗∗ New China-linked hackers breach telcos using edge device exploits ∗∗∗ --------------------------------------------- A sophisticated threat actor that uses Linux-based malware to target telecommunications providers has recently broadened its operations to include organizations in Southeastern Europe. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-china-linked-hackers-bre… ∗∗∗ Defeating KASLR by Doing Nothing at All ∗∗∗ --------------------------------------------- I’ve recently been researching Pixel kernel exploitation and as part of this research I found myself with an excellent arbitrary write primitive…but without a KASLR leak. As necessity is the mother of all invention, on a hunch, I started researching the Linux kernel linear mapping. --------------------------------------------- https://projectzero.google/2025/11/defeating-kaslr-by-doing-nothing-at-all.… ∗∗∗ Google Sees Spam, You See Your Site: A Cloaked SEO Spam Attack ∗∗∗ --------------------------------------------- We recently handled a case where a customer reported strange SEO behavior on their website. Regular visitors saw a normal site. No popups. No redirects. No visible spam. However, when they checked their site on Google, the search results were flooded with eBay-type-looking websites and “Situs Toto” gambling spam. This is a professional-grade SEO cloaking attack. --------------------------------------------- https://blog.sucuri.net/2026/01/google-sees-spam-you-see-your-site-a-cloake… ∗∗∗ Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations ∗∗∗ --------------------------------------------- Russian state-sponsored threat actors have been linked to a fresh set of credential harvesting attacks targeting individuals associated with a Turkish energy and nuclear research agency, as well as staff affiliated with a European think tank and organizations in North Macedonia and Uzbekistan. --------------------------------------------- https://thehackernews.com/2026/01/russian-apt28-runs-credential-stealing.ht… ∗∗∗ Auslegungssache 150: Auf digitaler Spurensuche ∗∗∗ --------------------------------------------- Im ct-Datenschutz-Podcast erklärt eine IT-Forensikerin, wie sie nach Vorfällen Spuren sichert, mit Erpressern verhandelt und den Datenschutz im Blick behält. --------------------------------------------- https://www.heise.de/hintergrund/Auslegungssache-150-Auf-digitaler-Spurensu… ∗∗∗ Von München bis Sevilla: Internationaler Schlag gegen Cyber-Mafia „Black Axe“ ∗∗∗ --------------------------------------------- Ermittlern gelang in Spanien ein empfindlicher Schlag gegen die als „Black Axe“ bekannte nigerianische Cyber-Mafia. --------------------------------------------- https://www.heise.de/news/Von-Muenchen-bis-Sevilla-Internationaler-Schlag-g… ∗∗∗ Who Benefited from the Aisuru and Kimwolf Botnets? ∗∗∗ --------------------------------------------- Our first story of 2026 revealed how a destructive new botnet called Kimwolf rapidly grew to infect more than two million devices by mass-compromising a vast number of unofficial Android TV streaming boxes. Today, well dig through digital clues left behind by the hackers, network operators, and cybercrime services that appear to have benefitted from Kimwolfs spread. --------------------------------------------- https://krebsonsecurity.com/2026/01/who-benefited-from-the-aisuru-and-kimwo… ∗∗∗ CPPA fines data broker selling lists of Alzheimers patients ∗∗∗ --------------------------------------------- Datamasters bought and resold the names, addresses, phone numbers and email addresses of millions of people with Alzheimer’s disease, drug addiction, bladder incontinence and other medical conditions for targeted advertising, according to the CPPA. --------------------------------------------- https://therecord.media/ccpa-fines-data-broker-selling-lists-alzheimers ∗∗∗ Russian Hacktivists hack CCTV Cameras in Denmark ∗∗∗ --------------------------------------------- The hacktivists had recorded part of the video stream from the CCTV as proof of the hack and published it. It was reported that no individuals were identifiable on the recording. --------------------------------------------- https://www.truesec.com/hub/blog/russian-hacktivists-hack-cctv-cameras-in-d… ∗∗∗ CISCO-Switches gehen wegen DNS-Fehler in Boot-Schleifen ∗∗∗ --------------------------------------------- Weltweit kämpfen Administratoren wohl damit, dass bestimmte Switches des Herstellers CISCO in einer Neustart-Schleife (Boot-Loop) gefangen sind. Das tritt auf, nachdem die Geräte einen DNS-Client-Fehler protokolliert haben. --------------------------------------------- https://borncity.com/blog/2026/01/09/cisco-switches-gehen-wegen-dns-fehler-… ∗∗∗ Hacker Behind Wired.com Leak Now Selling Full 40M Condé Nast Records ∗∗∗ --------------------------------------------- A hacker claims to be selling nearly 40 million Condé Nast user records after leaking Wired.com data, with multiple major brands allegedly affected. --------------------------------------------- https://hackread.com/wired-com-hacker-data-leak-conde-nast-records/ ∗∗∗ Threat Actors Actively Targeting LLMs ∗∗∗ --------------------------------------------- Our Ollama honeypot infrastructure captured 91,403 attack sessions between October 2025 and January 2026. Buried in that data: two distinct campaigns that reveal how threat actors are systematically mapping the expanding surface area of AI deployments. --------------------------------------------- https://www.greynoise.io/blog/threat-actors-actively-targeting-llms ∗∗∗ Do Smart People Ever Say They’re Smart? (SmarterTools SmarterMail Pre-Auth RCE CVE-2025-52691) ∗∗∗ --------------------------------------------- Welcome to 2026! While we are all waiting for the scheduled SSLVPN ITW exploitation programming that occurs every January, we’re back from Christmas and idle hands, idle minds, yada yada. In December, we were alerted to a vulnerability in SmarterTools’ SmarterMail solution, accompanied by an advisory from Singapore’s Cyber Security Agency (CSA) - CVE-2025-52691, a pre-auth RCE that obtained full marks (10/10) on the industry’s scale. --------------------------------------------- https://labs.watchtowr.com/do-smart-people-ever-say-theyre-smart-smartertoo… ∗∗∗ Fake Windows Update and BSOD Alerts Used in a Tech Support Scam ∗∗∗ --------------------------------------------- While reviewing submissions received through the WordPress feedback form on my website, I came across a URL that initially appeared unremarkable. Such submissions are common and often contain benign questions or comments, but this particular link stood out enough to warrant closer inspection. --------------------------------------------- https://malwr-analysis.com/2026/01/09/fake-windows-update-and-bsod-alerts-u… ===================== = Vulnerabilities = ===================== ∗∗∗ VU#361400: BeeS Software Solutions BeeS Examination Tool (BET) portal contains SQL injection vulnerability ∗∗∗ --------------------------------------------- The BeeS Examination Tool (BET) portal from BeeS Software Solutions contains an SQL injection vulnerability in its website login functionality. More than 100 universities use the BET portal for test administration and other academic tasks. --------------------------------------------- https://kb.cert.org/vuls/id/361400 ∗∗∗ RICOH Streamline NX vulnerable to improper authorization ∗∗∗ --------------------------------------------- RICOH Streamline NX provided by Ricoh Company, Ltd. contains an improper authorization vulnerability. --------------------------------------------- https://jvn.jp/en/jp/JVN12770174/ ∗∗∗ Trend Micro Apex Central RCE Flaw Scores 9.8 CVSS in On-Prem Windows Versions ∗∗∗ --------------------------------------------- Trend Micro has released security updates to address multiple security vulnerabilities impacting on-premise versions of Apex Central for Windows, including a critical bug that could result in arbitrary code execution. The vulnerability, tracked as CVE-2025-69258, carries a CVSS score of 9.8 out of a maximum of 10.0. --------------------------------------------- https://thehackernews.com/2026/01/trend-micro-apex-central-rce-flaw.html ∗∗∗ Mediaplayer VLC: Aktualisierte Version stopft zahlreiche Lücken ∗∗∗ --------------------------------------------- Die Version 3.0.23 des VLC Media Player bessert diverse Schwachstellen aus, die möglicherweise Unterschieben von Schadcode erlauben. --------------------------------------------- https://www.heise.de/news/VLC-stopft-diverse-Sicherheitslecks-11135921.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (pdfminer and vlc), Red Hat (kernel, kernel-rt, and microcode_ctl), Slackware (libtasn1), SUSE (apptainer, curl, ImageMagick, libpcap, libvirt, libwget4, php8, podman, python311-cbor2, qemu, and rsync), and Ubuntu (gnupg, gnupg2, gpsd, libsodium, and python-tornado). --------------------------------------------- https://lwn.net/Articles/1053492/ ∗∗∗ Hitachi Energy Asset Suite ∗∗∗ --------------------------------------------- Hitachi Energy is aware of a Jasper Report vulnerability that affects the Asset Suite product versions mentioned in this document below. This vulnerability can be exploited to carry out remote code execution (RCE) attack on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-26-008-01 ∗∗∗ K000159018: Linux kernel vulnerability CVE-2023-53178 ∗∗∗ --------------------------------------------- A local unprivileged user may exploit this vulnerability and cause data integrity issues or system instability under specific conditions. --------------------------------------------- https://my.f5.com/manage/s/article/K000159018 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily