Daily

daily@lists.cert.at

1 participants
3516 discussions

Tageszusammenfassung - 02.07.2026
by Daily end-of-shift report 02 Jul '26

02 Jul '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 01-07-2026 18:00 − Donnerstag 02-07-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Cisco finally confirms attackers exploiting Unified CM flaw ∗∗∗ --------------------------------------------- Cisco confirmed that attackers are now exploiting a Unified Communications Manager (Unified CM) vulnerability patched in early June. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisco-finally-confirms-attac… ∗∗∗ 6 security settings every GitHub maintainer should enable this week ∗∗∗ --------------------------------------------- These six free settings will not make your project unhackable. Nothing will. What they will do is close the easy doors. Turn these on, and your project will be meaningfully harder to attack than it was before. --------------------------------------------- https://github.blog/security/6-security-settings-every-github-maintainer-sh… ∗∗∗ Ransomware im Anmarsch: Hacker greifen mit fieser Interpol-Masche an ∗∗∗ --------------------------------------------- Angreifer geben sich bei Unternehmen als Personal von Interpol aus und ködern mit angeblichen Beweismitteln. Doch stattdessen gibt es Ransomware. --------------------------------------------- https://www.golem.de/news/ransomware-im-anmarsch-hacker-greifen-mit-fieser-… ∗∗∗ Falsche Rechnungen und Chatpartner bei ZumDaten, MichVerlieben & Co. ∗∗∗ --------------------------------------------- Eine Rechnung über mehrere hundert Euro von einer Datingplattform, bei der Sie nie ein Konto angelegt haben? Genau das berichten derzeit zahlreiche Betroffene. Doch nicht nur Menschen, die sich nie angemeldet haben, geraten ins Visier: Auch Registrierte können durch fragwürdige Praktiken viel Geld verlieren. Was hinter den Maschen von michverlieben.com, zumdaten.com und Co. steckt – und wie Sie sich dagegen wehren können. --------------------------------------------- https://www.watchlist-internet.at/news/falsche-zahlungsaufforderungen-von-d… ∗∗∗ New ChocoPoC malware targets researchers via trojanized PoC exploits ∗∗∗ --------------------------------------------- Multiple weaponized proof-of-concept (PoC) exploits on GitHub were found delivering a Python-based remote access trojan (RAT) named ChocoPoC that can execute commands and steal sensitive data in a campaign believed to target cybersecurity researchers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets… ∗∗∗ Medtronic notifies customers impacted by ShinyHunters data breach ∗∗∗ --------------------------------------------- Healthcare device firm Medtronic is notifying affected customers about a data breach that exposed their personal data to an unauthorized third party. --------------------------------------------- https://www.bleepingcomputer.com/news/security/medtronic-notifies-customers… ∗∗∗ Opera rolls out Paste Protect feature to fight ClickFix attacks ∗∗∗ --------------------------------------------- Opera has introduced Paste Protect, a security feature designed to block ClickFix-style attacks that trick users into executing malicious commands through social engineering. --------------------------------------------- https://www.bleepingcomputer.com/news/security/opera-rolls-out-paste-protec… ∗∗∗ VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer ∗∗∗ --------------------------------------------- Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to deliver an information stealer called PureLogs. --------------------------------------------- https://thehackernews.com/2026/07/veildrop-malware-chain-uses-blogger.html ∗∗∗ Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters ∗∗∗ --------------------------------------------- Argo CD, a widely used tool for deploying software to Kubernetes, has an unpatched flaw in its repo-server component that lets an unauthenticated attacker run code, provided they can reach the component's internal network port. Synacktiv, which found the bug, says it can lead to a full cluster takeover. There is no fix and no CVE. The firm says it reported the flaw to Argo CD's maintainers in January 2025; roughly eighteen months later, it remains unpatched, so it published the details to warn users. --------------------------------------------- https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html ∗∗∗ FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations ∗∗∗ --------------------------------------------- The recently discovered financially-motivated FortiBleed campaign has been attributed to INC and Lynx ransomware operations, indicating that the verified, stolen credentials were intended for follow-on intrusions. --------------------------------------------- https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html ∗∗∗ Fehler in „E-Mail-Adresse verbergen“ von Apple weiter ohne Fix ∗∗∗ --------------------------------------------- „Hide my E-Mail“ oder „E-Mail-Adresse verbergen“ soll eigentlich User vor Spam und Co. schützen. Es gibt aber eine Lücke. Die Entdecker warten weiter auf Apple. --------------------------------------------- https://heise.de/-11351055 ∗∗∗ PamStealer: a Rust-based macOS infostealer that validates credentials through PAM ∗∗∗ --------------------------------------------- Jamf Threat Labs investigates PamStealer, a macOS infostealer disguised as the legitimate Maccy clipboard manager that uses a two-stage attack chain to silently harvest data and clipboard contents while evading detection. --------------------------------------------- https://www.jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/ ===================== = Vulnerabilities = ===================== ∗∗∗ WinRAR flaw could allow attackers to take control of your computer ∗∗∗ --------------------------------------------- A new WinRAR update fixes a serious security flaw, but without automatic updates many users could miss the patch. --------------------------------------------- https://www.malwarebytes.com/blog/news/2026/07/winrar-flaw-could-allow-atta… ∗∗∗ Schwachstellen in Synology MailPlus Server lassen Angreifer passieren ∗∗∗ --------------------------------------------- Netzwerkspeicher von Synology mit MailPlus Server sind attackierbar. Ein Sicherheitspatch schafft Abhilfe. --------------------------------------------- https://heise.de/-11351331 ∗∗∗ ClamAV Vulnerabilities Affecting Cisco Products: July 2026 ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Catalyst Center Arbitrary File Read Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Drupal Security Advisories 2026-July-01 ∗∗∗ --------------------------------------------- https://www.drupal.org/security ∗∗∗ SVD-2026-0701: Third-Party Package Updates in Python for Scientific Computing - July 2026 ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2026-0701 ∗∗∗ LWN Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1080956/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 01.07.2026
by Daily end-of-shift report 01 Jul '26

01 Jul '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 30-06-2026 18:00 − Mittwoch 01-07-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451) ∗∗∗ --------------------------------------------- For those that don’t start violently wretching when the phrase “Citrix NetScaler” is uttered, we have another word to whisper: “CitrixBleed”. As many know, the term CitrixBleed now refers to not a single vulnerability, but an entire class of Memory Disclosure-esque vulnerabilities in Citrix NetScaler devices, many of which have played roles in breaches and incidents in recent memory. [..] We’ve given up counting the numbers, and so we’ve decided to call this vulnerability “CitrixBleed To Infinity And Beyond”. --------------------------------------------- https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netsca… ∗∗∗ Over 900 Oracle E-Business instances exposed to ongoing attacks ∗∗∗ --------------------------------------------- Over 900 Oracle E-Business Suite (EBS) instances have been found exposed online amid ongoing attacks exploiting a critical security flaw. --------------------------------------------- https://www.bleepingcomputer.com/news/security/over-900-oracle-e-business-i… ∗∗∗ The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign ∗∗∗ --------------------------------------------- Kaspersky experts have uncovered a malicious network infrastructure for delivering AsyncRAT. The Trojan is dropped via compromised ScreenConnect software. In this post, we break down the infection chain and analyze the C2 infrastructure. --------------------------------------------- https://securelist.com/tr/the-soc-files-screenconnect-campaign-with-asyncra… ∗∗∗ Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data ∗∗∗ --------------------------------------------- New Microsoft research shows how attackers can hijack AI agents that act on a users behalf, using nothing more than a poisoned tool description to make the agent quietly hand over company data to an outsider.The trick is that the agent never breaks a rule. Every step looks routine, so in a default setup no alarm may fire. --------------------------------------------- https://thehackernews.com/2026/06/microsoft-warns-poisoned-mcp-tool.html ∗∗∗ RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS ∗∗∗ --------------------------------------------- A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline. [..] RustDuck does not lean on a single clever trick. It sprays a mix of old, well-known weaknesses and hopes one sticks. The first is the oldest in the book: devices left on the internet with weak or default passwords on their remote-login services (Telnet and SSH). Guess the password, walk in. --------------------------------------------- https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html ∗∗∗ Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector ∗∗∗ --------------------------------------------- Unit 42 researchers found that large language models (LLMs) consistently hallucinate web domains for legitimate brands. Adversaries are actively weaponizing this vector by registering these nonexistent domains to intercept traffic generated by AI systems. We call this phenomenon phantom squatting, and it poses a significant risk to the software supply chain. --------------------------------------------- https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-doma… ∗∗∗ ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365 ∗∗∗ --------------------------------------------- Cisco Talos identified a fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform documented by Sekoia and Microsoft in early 2026. --------------------------------------------- https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-p… ∗∗∗ Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique ∗∗∗ --------------------------------------------- In this research, DeepSeek connected unrealistic browser-malware concepts with a real browser capability, turning an AI-generated malware hallucination into a plausible browser-native ransomware technique. Although the generated sample was incomplete, it exposed a practical abuse path based on the File System Access API and access to photo directories. --------------------------------------------- https://research.checkpoint.com/2026/browser-only-ransomware-from-llm-hallu… ===================== = Vulnerabilities = ===================== ∗∗∗ Adobe patches seven max severity ColdFusion, Campaign flaws ∗∗∗ --------------------------------------------- Adobe has released security patches for seven maximum-severity vulnerabilities in the ColdFusion web app development platform and the Campaign Classic marketing automation platform. --------------------------------------------- https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-seve… ∗∗∗ Riesiges Update: 382 Sicherheitslücken in Google Chrome entdeckt ∗∗∗ --------------------------------------------- Die neueste Chrome-Version schließt fast 400 teils kritische Sicherheitslücken. Auch für Edge, Vivaldi und Brave dürften entsprechende Updates folgen. --------------------------------------------- https://www.golem.de/news/riesiges-update-382-sicherheitsluecken-in-google-… ∗∗∗ Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service ∗∗∗ --------------------------------------------- Citrix on Tuesday released security updates to address multiple flaws in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that could be exploited by an attacker to facilitate arbitrary file reads or trigger a denial-of-service (DoS) condition. CVE-2026-8451 (CVSS score: 8.8) - An insufficient input validation vulnerability leading to memory overread when NetScaler ADC or NetScaler Gateway is configured as a SAML IDP. --------------------------------------------- https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html ∗∗∗ Root-Sicherheitslücken in alternativer Router-Firmware OpenWRT geschlossen ∗∗∗ --------------------------------------------- Die OpenWRT-Entwickler haben in einer aktuellen Version unter anderem mehrere kritische Sicherheitslücken geschlossen. [..] Am gefährlichsten gilt eine „kritische“ Lücke mit einem CVSSS Score 9.9 von 10 in LuCI. Eine CVE-Nummer wurde offensichtlich bislang nicht vergeben. Voraussetzung für eine Attacke ist, dass der VPN-Dienst Tailscale installiert ist. --------------------------------------------- https://www.heise.de/news/Root-Sicherheitsluecken-in-alternativer-Router-Fi… ∗∗∗ HCL BigFix: PC-Fernverwaltung: Man-in-the-Middle-Attacken auf HCL BigFix möglich ∗∗∗ --------------------------------------------- https://www.heise.de/news/PC-Fernverwaltung-Man-in-the-Middle-Attacken-auf-… ∗∗∗ LWN: Security updates for Wednesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1080689/ ∗∗∗ mozilla: Security Vulnerabilities fixed in Thunderbird 140.12.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-64/ ∗∗∗ mozilla: Security Vulnerabilities fixed in Thunderbird 152.0.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-63/ ∗∗∗ Genucenter: Publish SBA-ADV-20260424-01: Genucenter Disclosure of SNMP Credentials ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/d78bf80a4103af68e8c17ba027… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 30.06.2026
by Daily end-of-shift report 30 Jun '26

30 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Montag 29-06-2026 18:00 − Dienstag 30-06-2026 18:00 Handler: Guenes Holler Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Parkstrafe per SMS? Kriminelle haben es auf Kreditkartendaten abgesehen! ∗∗∗ --------------------------------------------- Alles beginnt mit einer SMS-Nachricht zu einer angeblich offenen Parkstrafe. Am Ende hat das Opfer den Kriminellen sein Auto-Kennzeichen und die Kreditkartendaten übermittelt. Eine Phishing-Falle, die klassischer nicht sein könnte. Und so funktioniert sie. --------------------------------------------- https://www.watchlist-internet.at/news/parkstrafe-per-sms-kreditkartendaten/ ∗∗∗ Sicherheitslücken ohne Ende: Flut an KI-Bug-Reports überfordert Github ∗∗∗ --------------------------------------------- Github kommt bei der Bearbeitung von Sicherheitsmeldungen nicht mehr hinterher. Es gibt wohl einen Rückstau von mehreren Wochen. --------------------------------------------- https://www.golem.de/news/sicherheitsluecken-ohne-ende-flut-an-ki-bug-repor… ∗∗∗ Fernwartung SimpleHelp: Schwachstelle wird angegriffen ∗∗∗ --------------------------------------------- In der Fernwartungssoftware SimpleHelp klafft eine Sicherheitslücke, die die Höchstwertung beim Risiko erreicht. Sie wurde Mitte des Monats bekannt. Jetzt haben IT-Sicherheitsexperten Cyberangriffe auf das Sicherheitsleck beobachtet. --------------------------------------------- https://heise.de/-11348620 ∗∗∗ CISA: Windows BlueHammer flaw now exploited by ransomware gangs ∗∗∗ --------------------------------------------- CISA confirmed on Monday that ransomware gangs have begun exploiting a high-severity Microsoft Defender privilege escalation vulnerability that has previously been abused in zero-day attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisa-windows-bluehammer-flaw… ∗∗∗ Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input ∗∗∗ --------------------------------------------- Microsoft has found a malicious Chrome extension that posed as the AI search engine Perplexity and quietly logged what people searched for. It routed every query and every character typed into the address bar through an attacker-controlled server before redirecting users to real results. --------------------------------------------- https://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.html ∗∗∗ Daktronics: Straßenschilder durch Controller-Lücken manipulierbar ∗∗∗ --------------------------------------------- Durch Sicherheitslücken in Daktronics-Controllern können Angreifer LED-Anzeigetafeln kompromittieren – unter anderem solche am Straßenrand. --------------------------------------------- https://www.golem.de/news/daktronics-strassenschilder-durch-controller-luec… ∗∗∗ Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037) ∗∗∗ --------------------------------------------- This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a habit of becoming the way in rather than the thing keeping people out, and CVE-2026-8037 keeps that streak alive: a pre-authentication Remote Code Execution vulnerability accessible to anyone who can access the API. So, in probably a predictable turn of events, we're back doing what we do best. --------------------------------------------- https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadm… ∗∗∗ Bot-Schutz: Googles reCaptcha mit Handgesten fällt auf Fotos rein ∗∗∗ --------------------------------------------- Google hat vergangene Woche angekündigt, den reCaptcha-Bot-Schutz mit Handgesten auszustatten. Das lässt sich mit Fotos aushebeln. --------------------------------------------- https://heise.de/-11348830 ∗∗∗ Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307 ∗∗∗ --------------------------------------------- To understand the bug, we first need a high-level overview of TurboFan, how it inlines JS-to-Wasm calls, and how its deoptimization metadata decides what kind of value should be reconstructed after a lazy deopt. Furthermore, we need to understand how V8 heap sandbox works and why this single vulnerability allows attackers to do two things at once: 1) gain arbitrary read/write primitives in the sandbox, and 2) escape the sandbox to write outside of it. --------------------------------------------- https://nebusec.ai/research/v8-cve-2026-6307-writeup/ ∗∗∗ Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215) ∗∗∗ --------------------------------------------- A use-after-free in the DRM GEM core ioctl DRM_IOCTL_GEM_CHANGE_HANDLE lets any local user with access to a render node escalate to root. drm_gem_change_handle_ioctl() moves a GEM object from one handle to another, but it never adjusts the object’s handle_count. For a short window the object has two IDR entries while its handle count still reads 1, and a concurrent DRM_IOCTL_GEM_CLOSE on the old handle drives that count to 0 and frees the object while the new handle is still pointing at it. The dangling handle is the use-after-free. --------------------------------------------- https://cyberstan.co.uk/drm-lpe-linux/ ∗∗∗ Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates ∗∗∗ --------------------------------------------- Malicious Chrome and Firefox extensions posed as free VPNs while stealing clipboard data through later extension updates. --------------------------------------------- https://socket.dev/blog/chrome-and-firefox-extensions-free-vpns-add-clipboa… ===================== = Vulnerabilities = ===================== ∗∗∗ iOS 26.5.2, iPadOS 26.5.2 und macOS 26.5.2: Wichtige Sicherheitsfixes wegen KI ∗∗∗ --------------------------------------------- Apple hat am Montagabend insgesamt drei Betriebssysteme aktualisiert sowie seinen Browser Safari für macOS 15 (Sequoia) und 14 (Sonoma) auf einen neuen Stand gebracht. Systeme und Browser enthalten keine bekannten Neuerungen, dafür stopfen sie diverse Sicherheitslöcher, die Apple laut eigenen Angaben auch aufgrund der neuen Gefahren durch KI flotter liefert. --------------------------------------------- https://www.heise.de/news/iOS-26-5-2-iPadOS-26-5-2-und-macOS-26-5-2-Wichtig… ∗∗∗ ipv6_frag_escape: Linux LPE - Reliable Jail/Container Escape ∗∗∗ --------------------------------------------- A reliable unprivileged container / jail escape proof of concept for CentOS / RHEL 10.It rides a now fixed IPv6 fragmentation bug in __ip6_append_data() (closed upstream by 38becddc, no CVE), an in-slab linear overflow into the skb_shared_info at the tail of a packet's own head object. This README documents the exploitation chain only. It does not cover the trigger. --------------------------------------------- https://github.com/sgkdev/ipv6_frag_escape ∗∗∗ LWN Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1080439/ ∗∗∗ DGM3103SCT vulnerable to OS command injection ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN28979424/ ∗∗∗ Security Vulnerabilities fixed in Firefox 152.0.4 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2026-62/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 29.06.2026
by Daily end-of-shift report 29 Jun '26

29 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 26-06-2026 18:00 − Montag 29-06-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Cybersecurity firms targeted by fraudulent OpenAI organization invites ∗∗∗ --------------------------------------------- Threat actors are creating OpenAI tenants that impersonate legitimate companies and inviting employees to join them, in what appears to be a ploy to trick targets into submitting sensitive company information in chats and projects. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cybersecurity-firms-targeted… ∗∗∗ Polymarket customers lose $3 million in supply-chain attack ∗∗∗ --------------------------------------------- Polymarket says it will fully reimburse customers who lost an estimated $3 million after hackers injected a malicious script into the platforms frontend following a breach at a third-party vendor. --------------------------------------------- https://www.bleepingcomputer.com/news/security/polymarket-customers-lose-3-… ∗∗∗ Hackers now exploit critical Oracle E-Business flaw in attacks ∗∗∗ --------------------------------------------- Attackers have begun exploiting a critical vulnerability (CVE-2026-46817) in the Oracle E-Business Suite (EBS) financial application, according to threat intelligence company Defused. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-oracle-e-business-suite-… ∗∗∗ Root-Zugriff möglich: Exploits für gefährliche Lücke im Linux-Kernel geleakt ∗∗∗ --------------------------------------------- Admins sollten zügig ihre Linux-Systeme absichern. Auf Github sind Exploits für eine Root-Lücke in Debian, Ubuntu und RHEL aufgetaucht. --------------------------------------------- https://www.golem.de/news/root-zugriff-moeglich-exploits-fuer-gefaehrliche-… ∗∗∗ The Gentlemen are knocking: сustom backdoors and evolving tactics ∗∗∗ --------------------------------------------- Kaspersky researchers analyze incidents related to The Gentlemen RaaS group, disclose their tools and TTPs, and find a new ransomware variant. --------------------------------------------- https://securelist.com/the-gentlemen-raas/120447/ ∗∗∗ Microsoft Adds Another Year To Windows 10 Extended Update Program ∗∗∗ --------------------------------------------- Microsoft has quietly extended free Windows 10 security updates for consumers by another year, pushing the Extended Security Updates (ESU) programs end date from October 12, 2026, to October 12, 2027. "The ESU support page was updated with that date, and Microsofts blog post on the program has a new editors note confirming the change," reports Ars Technica. From the report: The prevalence of Windows across so many devices and form factors has given Microsoft a .. --------------------------------------------- https://tech.slashdot.org/story/26/06/26/0029235/microsoft-adds-another-yea… ∗∗∗ New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks ∗∗∗ --------------------------------------------- A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.Kaspersky, which is tracking the activity under the moniker StrikeShark, said the campaign has targeted a diplomatic organization in Indonesia, government organizations in Taiwan, .. --------------------------------------------- https://thehackernews.com/2026/06/new-sharkloader-malware-deploys-cobalt.ht… ∗∗∗ Microsoft keeps Windows Server 2022 hotpatching alive into 2027 ∗∗∗ --------------------------------------------- In the Azure Edition, of course --------------------------------------------- https://www.theregister.com/security/2026/06/29/microsoft-keeps-windows-ser… ∗∗∗ Critical Unauthenticated Remote Code Execution in Splunk Enterprise (CVE-2026-20253) ∗∗∗ --------------------------------------------- Splunk disclosed a critical unauthenticated remote code execution (RCE) vulnerability in Splunk Enterprise tracked as CVE-2026-20253 on June 10, 2026. The vulnerability has a CVSS score of 9.8 and stems from missing authentication on a PostgreSQL sidecar service recovery endpoint that can be reached through the Splunk Web interface, which proxies requests to the internal PostgreSQL sidecar service without enforcing authentication. A successful attacker can create or truncate .. --------------------------------------------- https://www.zscaler.com/blogs/security-research/critical-unauthenticated-re… ∗∗∗ Taiwan: Cybersicherheitsbehörde warnt vor Überwachung durch billige eSIMs ∗∗∗ --------------------------------------------- Günstig für den Urlaub erworbene eSIMs könnten Datenverkehr durch China leiten, warnt Taiwans Digitalministerium. Dabei könnten Daten abgegriffen werden. --------------------------------------------- https://www.heise.de/news/Taiwanische-Cybersicherheitsbehoerde-warnt-vor-Ue… ∗∗∗ FBI-Warnung: Russischer Geheimdienst sieht es auf Messenger-Backup-Keys ab ∗∗∗ --------------------------------------------- Russische Angreifer geben sich inzwischen als Messenger-Support aus, der Zugriff auf die Backup-Wiederherstellungsschlüssel braucht. --------------------------------------------- https://www.heise.de/news/FBI-Warnung-Russischer-Geheimdienst-sieht-es-auf-… ∗∗∗ Cyberangriffe auf Hotel- und Gastgewerbe: Täter nisten sich ein ∗∗∗ --------------------------------------------- Microsoft Threat Intelligence beobachtet eine mehrstufige Angriffswelle auf das Hotel- und Gastgewerbe in Asien und Europa. --------------------------------------------- https://www.heise.de/news/Cyberangriffe-auf-Hotel-und-Gastgewerbe-Taeter-ni… ∗∗∗ Kritische libssh2-Lücke: Proof-of-Concept-Exploit veröffentlicht ∗∗∗ --------------------------------------------- Vergangene Woche wurde eine Sicherheitslücke in libssh2 bekannt. Jetzt ist Exploit-Code aufgetaucht, der sie missbrauchen kann. --------------------------------------------- https://www.heise.de/news/Kritische-libssh2-Luecke-Proof-of-Concept-Exploit… ∗∗∗ Hacking-Fähigkeiten von Chinas KI Z.ai angeblich so gut wie die von Claude ∗∗∗ --------------------------------------------- Zhipu AIs offenes Modell GLM-5.2 erreicht laut Sicherheitsexperten die Fähigkeiten von Anthropics Mythos bei der Bug-Erkennung. --------------------------------------------- https://www.heise.de/news/Hacking-Faehigkeiten-von-Chinas-KI-Z-ai-angeblich… ∗∗∗ Harnessing Harnesses - Climbing the LLM Hills ∗∗∗ --------------------------------------------- Trying to coerce useful work out of LLMs without the harness is like supervising a room full of drunk toddlers, each convinced theyre helping, none of them checking with each other and falling over the next. --------------------------------------------- https://blog.zsec.uk/harnessing-harnesses/ ∗∗∗ From Perimeter to Proof: The New Architecture of Email Security ∗∗∗ --------------------------------------------- How identity, investigation, browser security, and AI are reshaping the future of email defense. --------------------------------------------- https://softwareanalyst.substack.com/p/from-perimeter-to-proof-the-new-arch… ∗∗∗ Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages ∗∗∗ --------------------------------------------- Latest wave affects legitimate @immobiliarelabs Backstage packages, with malicious npm releases published across GitLab and LDAP authentication plugin families on June 26, 2026.Socket Threat Research is tracking a fresh compromise in the ongoing Miasma Mini Shai-Hulud supply chain campaign. The latest activity affects legitimate npm packages published under the @immobiliarelabs scope, including Backstage plugins used for GitLab integration and LDAP authentication .. --------------------------------------------- https://socket.dev/blog/miasma-mini-shai-hulud-hits-immobiliarelabs-npm-pac… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 26.06.2026
by Daily end-of-shift report 26 Jun '26

26 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 25-06-2026 18:00 − Freitag 26-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ New macOS malware embeds fake errors to confuse AI analysis tools ∗∗∗ --------------------------------------------- A newly discovered macOS malware dubbed "Gaslight" is designed to confuse AI-assisted malware analysis tools by hiding prompt injection strings and fake debugging data within the executable. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-macos-malware-embeds-fak… ∗∗∗ Order-tracking app Shop abused to push callback phishing attacks ∗∗∗ --------------------------------------------- Threat actors are increasingly abusing Shop, the order-tracking app from Shopify, by adding fake purchase receipts in users order histories to trick them into providing sensitive data or installing remote access software. --------------------------------------------- https://www.bleepingcomputer.com/news/security/order-tracking-app-shop-abus… ∗∗∗ Security boss thought MFA would be too much security ∗∗∗ --------------------------------------------- One rule for the workers, another for execs --------------------------------------------- https://www.theregister.com/security/2026/06/26/security-boss-thought-mfa-w… ∗∗∗ Miasma campaign poisons 20-plus npm packages, hunts for developer secrets ∗∗∗ --------------------------------------------- Microsoft says latest attack targets Leo Platform and RStreams packages, harvesting creds and going after more maintainers --------------------------------------------- https://www.theregister.com/security/2026/06/26/miasma-campaign-poisons-20-… ∗∗∗ Amazon Q flaw let booby-trapped Git repos execute code, swipe cloud creds ∗∗∗ --------------------------------------------- Researchers warn many AI coding assistants now execute commands from project configurations --------------------------------------------- https://www.theregister.com/cyber-crime/2026/06/26/amazon-q-flaw-let-booby-… ∗∗∗ YouTube-Werbeblocker mit 11 Millionen Installationen mit möglicher Hintertür ∗∗∗ --------------------------------------------- Adblock for YouTube kommt auf mehr als 11 Millionen Installationen. Es kann jedoch unkontrolliert Script-Code in jede Seite injizieren. --------------------------------------------- https://www.heise.de/news/YouTube-Werbeblocker-mit-11-Millionen-Installatio… ∗∗∗ Polymarket: Kriminelle sollen Kryptowerte in Millionenhöhe gestohlen haben ∗∗∗ --------------------------------------------- Bei Polymarket haben Angreifer über eingeschleusten Schadcode Geld von Nutzerkonten gestohlen. Das Wettportal will Betroffene entschädigen. --------------------------------------------- https://www.heise.de/news/Polymarket-Kriminelle-entwenden-Kryptowerte-in-Mi… ∗∗∗ Malware steals Chrome session cookies to take over your accounts ∗∗∗ --------------------------------------------- A phishing campaign installs a malicious Chrome extension to hijack browser sessions and compromise Windows devices. --------------------------------------------- https://www.malwarebytes.com/blog/news/2026/06/malware-steals-chrome-sessio… ∗∗∗ The "Akrites" vulnerability-mitigation project launches ∗∗∗ --------------------------------------------- The Linux Foundation, in aletter co-signed by a large range of organizations and companies, hasannounced the launch of "Akrites", a project to fast-track vulnerabilityfixes into projects. As Akrites works upstream to fix projects at the source, we commit to support downstream efforts to secure critical infrastructure before it can be exploited. When patches are .. --------------------------------------------- https://lwn.net/Articles/1079657/ ∗∗∗ Russia used social engineering to breach prominent messaging accounts, Ukraine says ∗∗∗ --------------------------------------------- Ukraines SBU described a long-running Russian operation that used fake tech-support workers to persuade people to hand over credentials to their messaging apps. --------------------------------------------- https://therecord.media/russia-ukraine-social-engineering-messaging-accounts ∗∗∗ DHS chief says president has met with likely CISA nominee; agency plans to hire 600 ∗∗∗ --------------------------------------------- Once a new CISA director is in place, the agency will ramp up hiring efforts, Homeland Security Secretary Markwayne Mullin told lawmakers. The White House has not yet announced a nominee. --------------------------------------------- https://therecord.media/cisa-director-nominee-workforce-hires-mullin-house-… ∗∗∗ macOS Flaw Allowed Standard Users to Disable CrowdStrike and Kandji Security Tools ∗∗∗ --------------------------------------------- A macOS XPC flaw let regular users disable CrowdStrike and Kandji tools, exposing security gaps that vendors patched after XM Cyber reported the security issue. --------------------------------------------- https://hackread.com/macos-flaw-users-disable-crowdstrike-kandji-security-t… ∗∗∗ Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem ∗∗∗ --------------------------------------------- Latest wave affects LeoPlatform/RStreams npm packages, three llxlr-published npm packages, the Verana Blockchain Go module, and GitHub Actions/developer-tool workflows.Socket Threat Research is tracking a new .. --------------------------------------------- https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-package… ===================== = Vulnerabilities = ===================== ∗∗∗ Synology-SA-26:11 Synology MailPlus Server ∗∗∗ --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_26_11 ∗∗∗ [R2] Nessus Version 10.12.1 Fixes SQL Injection Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2026-17 ∗∗∗ [R3] Tenable Identity Exposure Version 3.93.5 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2026-16 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 25.06.2026
by Daily end-of-shift report 25 Jun '26

25 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 24-06-2026 18:00 − Donnerstag 25-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Malicious Edge extension abuses Native Messaging as bridge to malware ∗∗∗ --------------------------------------------- A malicious Microsoft Edge extension dubbed Edgecution has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-edge-extension-abu… ∗∗∗ Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access ∗∗∗ --------------------------------------------- New details have been revealed on how hackers exploited a Cisco Catalyst SD-WAN vulnerability tracked as CVE-2026-20245 in zero-day attacks to create rogue root accounts on targeted devices. --------------------------------------------- https://www.bleepingcomputer.com/news/security/mandiant-reveals-how-cisco-s… ∗∗∗ Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools ∗∗∗ --------------------------------------------- In the first four months of 2026, Kaspersky solutions detected over 33,300 cyberattacks on SMBs masquerading as popular artificial intelligence (AI) tools – almost five times more than in 2025 and 39% more than the number of attacks disguised as the office and collaboration tools that Kaspersky’s research focuses on. --------------------------------------------- https://securelist.com/smb-threat-report-2026/120357/ ∗∗∗ What do Ports Hear When Nobodys Listening? An Assessment of Automated Cybercrime [Guest Diary], (Wed, Jun 24th) ∗∗∗ --------------------------------------------- For network defenders and analysts, it's important to understand the depth of the noise and how it should be treated. Observing patterns and structural shifts within the static is essential for keeping pace with an automated, multi-directional threat that never stops running. The infrastructure persists, campaigns evolve, payloads update, and the ports keep listening. --------------------------------------------- https://isc.sans.edu/diary/rss/33104 ∗∗∗ StealC Historical Bot Infection Special Report ∗∗∗ --------------------------------------------- On Wednesday 24th June 2026, international law enforcement partners announced additional successful cyber crime disruption actions as part of the ongoing Operation Endgame initiative. This time the StealC infostealer and Amadey malware-as-a-service families were targeted. --------------------------------------------- https://www.shadowserver.org/news/stealc-historical-bot-infection-special-r… ∗∗∗ Verfassungsschutz zu Spionage: Unis sollen wachsamer sein ∗∗∗ --------------------------------------------- Sicherheitsbehörden warnen vor chinesischer Wissenschaftsspionage an deutschen Hochschulen. Sind die Forschungseinrichtungen wachsam genug? --------------------------------------------- https://www.heise.de/news/Verfassungsschutz-zu-Spionage-Unis-sollen-wachsam… ∗∗∗ Raiffeisen Phishingmail fordert zur pushTAN-Aktivierung auf ∗∗∗ --------------------------------------------- Aktuell versenden Kriminelle betrügerische E-Mails im Namen der Raiffeisen Bank. Die Nachrichten fordern Kund:innen auf, über einen Link den pushTAN-Dienst zu aktivieren und führen dabei auf eine gefälschte Website, die Kontodaten abgreift. --------------------------------------------- https://www.watchlist-internet.at/news/raiffeisen-phishingmail-fordert-push… ∗∗∗ Introduction to COM usage by Windows threats ∗∗∗ --------------------------------------------- Component Object Model (COM) is a fundamental Windows technology used by legitimate applications for object activation, inter-process communication, automation and language-independent component reuse. Those same qualities make it useful to threat actors. --------------------------------------------- https://blog.talosintelligence.com/introduction-to-com-usage-by-windows-thr… ∗∗∗ Windows 10: Sicherheitsupdates für Privatkunden jetzt doch noch bis Oktober 2027 ∗∗∗ --------------------------------------------- Microsoft hat das ESU-Programm für Privatkunden ohne große Vorankündigung um ein weiteres Jahr verlängert. --------------------------------------------- https://heise.de/-11344923 ∗∗∗ Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond ∗∗∗ --------------------------------------------- Datadog Security Research investigates a June 2026 adversary-in-the-middle phishing campaign that cloned the AWS console login page to harvest victim credentials and multi-factor authentication codes. --------------------------------------------- https://securitylabs.datadoghq.com/articles/behind-the-console-aws-aitm-phi… ∗∗∗ Ignore DNSSEC if you like MITM attacks ∗∗∗ --------------------------------------------- It really bothers me that almost all distributions and operating systems don’t validate DNSSEC by default. The above attacks are feasible on almost anyone, purely because of lousy defaults. --------------------------------------------- https://whynothugo.nl/journal/2026/06/24/ignore-dnssec-if-you-like-mitm-att… ===================== = Vulnerabilities = ===================== ∗∗∗ LWN: Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1079551/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 24.06.2026
by Daily end-of-shift report 24 Jun '26

24 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Dienstag 23-06-2026 18:00 − Mittwoch 24-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ New macOS ClickFix attack silently mounts DMGs to push infostealer ∗∗∗ --------------------------------------------- A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-si… ∗∗∗ Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks ∗∗∗ --------------------------------------------- A high-severity SSRF vulnerability, tracked as CVE-2026-20230, in Cisco Unified Communications Manager Server is now being exploited in attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cv… ∗∗∗ Stealthy Mistic backdoor linked to ransomware access broker KongTuke ∗∗∗ --------------------------------------------- A new backdoor dubbed Mistic has been observed in financially motivated attacks targeting organizations in the insurance, education, IT, and professional services sectors. --------------------------------------------- https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-lin… ∗∗∗ Sicherheitslücke: Millionen von Samsung-Smartphones durch Kernel-Bug gefährdet ∗∗∗ --------------------------------------------- Forscher haben einen gefährlichen Bug im Android-Kernel von Samsung entdeckt, der unzählige Smartphones zwischen Galaxy S9 und S25 betrifft. --------------------------------------------- https://www.golem.de/news/sicherheitsluecke-acht-jahre-alter-kernel-bug-gef… ∗∗∗ Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root ∗∗∗ --------------------------------------------- Threat actors have begun to exploit a recently disclosed critical security flaw impacting Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME).The vulnerability, tracked as CVE-2026-20230 (CVSS score: 8.6), is a case of improper input validation for specific HTTP requests that could allow an unauthenticated, .. --------------------------------------------- https://thehackernews.com/2026/06/cisco-unified-cm-flaw-exploited-after.html ∗∗∗ Home Assistant: Update stopft Informationsleck ∗∗∗ --------------------------------------------- Die jüngeren Home-Assistant-Updates stopfen unter anderem Informationslecks. Zudem gibt es das Home Assistant OS in neuer Version. --------------------------------------------- https://www.heise.de/news/Home-Assistant-Update-stopft-Informationsleck-113… ∗∗∗ Ubiquiti UniFi OS-Sicherheitslücken werden angegriffen ∗∗∗ --------------------------------------------- Ende Mai wurden kritische Sicherheitslücken in Ubiquiti UniFi OS bekannt. Inzwischen haben Angreifer diese im Visier. --------------------------------------------- https://www.heise.de/news/Ubiquiti-UniFi-OS-Sicherheitsluecken-werden-angeg… ∗∗∗ Cyberkriminelle: Die „Wirtschaftsprüfer“, die Sie nie beauftragt haben ∗∗∗ --------------------------------------------- Jede Organisation wird geprüft. Die Frage ist, wer die Prüfung durchführt. --------------------------------------------- https://www.welivesecurity.com/de/business-security/cyberkriminelle-die-wir… ∗∗∗ Hackergruppe will den Flughafen Wien angegriffen haben ∗∗∗ --------------------------------------------- Als Beweis wurden Frachtpapiere mit Waffenlieferungen veröffentlicht. Laut dem Flughafen Wien sind keine personenbezogenen Daten darunter --------------------------------------------- https://www.derstandard.at/story/3000000328608/hackergruppe-will-den-flugha… ∗∗∗ Zoho Corp. ManageEngine: Kritische SSO-Lücke ermöglicht Kontenübernahme ∗∗∗ --------------------------------------------- Angreifer können eine kritische Sicherheitslücke in mehreren Zoho Corp. ManageEngine-Produkten missbrauchen, um Konten zu übernehmen. --------------------------------------------- https://heise.de/-11342888 ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (corosync, firefox, kernel, kernel-rt, libpq, memcached, postgresql, postgresql16, postgresql:13, postgresql:16, python-urllib3, python3.14-urllib3, redis:6, skopeo, and vim), Debian (beets, gst-plugins-bad1.0, imagemagick, libmatio, python-urllib3, and u-boot), Fedora (chromium, coturn, frr, grout, materialx, perl-Crypt-DSA, and yt-dlp), Mageia (opensc, perl-Archive-Tar, and podofo), Oracle (fence-agents, libpq, mysql:8.4, and postgresql:16), .. --------------------------------------------- https://lwn.net/Articles/1079365/ ∗∗∗ [R1] Tenable Identity Exposure Version 3.93.5 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2026-16 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 23.06.2026
by Daily end-of-shift report 23 Jun '26

23 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Montag 22-06-2026 18:00 − Dienstag 23-06-2026 18:00 Handler: Guenes Holler Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Auswirkungen auf die Cybersicherheit von Organisationen durch die Entwicklung im Bereich Künstlicher Intelligenz ∗∗∗ --------------------------------------------- Künstliche Intelligenz verändert die Cybersicherheitslage grundlegend und erfordert neue Maßstäbe in der Reaktionsgeschwindigkeit. Während böswillige Akteure in der Vergangenheit bereits arbeitsteilig auf Künstliche Intelligenz gesetzt hatten – beispielsweise um Phishing-Mails zu verfassen – sind aktuelle KI-Systeme derart leistungsfähig, dass Schwachstellen in Software innerhalb kurzer Zeit sowohl umfassend als auch teilweise autonom erkannt, analysiert und in verwertbare Angriffspfade überführt können. Daraus kann eine Lage entstehen, die Organisationen mit einer erheblich steigenden Zahl neu entdeckter Schwachstellen, Exploits, Patches und Folgevorfällen konfrontiert. --------------------------------------------- https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-2… ∗∗∗ WhatsApp phishing attack uses fake business docs to hack PCs ∗∗∗ --------------------------------------------- An ongoing malware campaign is targeting WhatsApp users in multiple countries with deceptive messages that push VBScript files, leading to remote system access. --------------------------------------------- https://www.bleepingcomputer.com/news/security/whatsapp-phishing-attack-use… ∗∗∗ Nearly Half of LG Smart TV Apps Are Laced with Proxies ∗∗∗ --------------------------------------------- Everyone worries about the apps on their phone. Almost no one looks at the ones on their TV. We scanned 6,038 of them across LG and Samsung; 2,058 were selling your IP address. On screen, its a relaxing fish tank. Or a clock. Or solitaire. Or puppies. Under the hood, it is a residential proxy: software that can send other peoples internet traffic out through your living room. And we found it everywhere. --------------------------------------------- https://spur.us/blog/smart-tv-apps-residential-proxy-sdks ∗∗∗ Nach Protesten: AMD bringt RAM-Verschlüsselung TSME zurück ∗∗∗ --------------------------------------------- Ohne Ankündigung hat AMD das Sicherheitsmerkmal TSME bei bestimmten Ryzen-Prozessoren deaktiviert. Kunden protestierten, AMD reagiert. --------------------------------------------- https://www.heise.de/news/Nach-Protesten-AMD-bringt-RAM-Verschluesselung-TS… ∗∗∗ Secure-Boot: Zertifikatablauf steht an, Microsoft gibt weitere Hilfestellung ∗∗∗ --------------------------------------------- Die ersten Secure-Boot-Zertifikate laufen in diesen Tagen ab. Microsoft legt noch mal Handreichungen nach, für Linux auf Azure-VMs. --------------------------------------------- https://www.heise.de/news/Secure-Boot-Zertifikate-Ablauf-startet-weitere-Ha… ∗∗∗ The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration ∗∗∗ --------------------------------------------- We recently identified a bucket hijacking technique impacting multiple services across major cloud service providers (CSPs). The attack technique exploits a fundamental architectural flaw that is common across cloud providers and could potentially affect other cloud providers as well. --------------------------------------------- https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ ∗∗∗ Detecting the Klue supply chain attack in Salesforce instances ∗∗∗ --------------------------------------------- We summarize the Klue supply chain attack and provide detection guidance for Salesforce environments monitored by Datadog Cloud SIEM. --------------------------------------------- https://securitylabs.datadoghq.com/articles/detecting-the-klue-supply-chain… ∗∗∗ Fake-Shops, Abo-Fallen, Phishing-Gewinnspiele: Wie Kriminelle das Fußball-Fieber nutzen ∗∗∗ --------------------------------------------- Die Weltmeisterschaft in den USA, Mexiko und Kanada ist in vollem Gange. Dass Betrüger:innen von diesem Hype profitieren möchten, überrascht nicht. Dieser Artikel zeigt, welche Strategien und Mechanismen sie für ihre Fallen nutzen. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shops-abofallen-fussball/ ∗∗∗ Introducing Patch the Planet ∗∗∗ --------------------------------------------- What happens when you clear dozens of Trail of Bits engineers’ schedules, pair them with every open-source maintainer they can contact, and unleash the latest frontier models like GPT-5.5-Cyber on critical open-source targets? Thanks to our partnership with OpenAI and its Daybreak initiative, we can report that the impact is hundreds of discovered bugs, 64 pull requests, and 51 issues filed across 19 projects (with many more still undergoing coordinated disclosure). That was just the first week of Patch the Planet. --------------------------------------------- https://blog.trailofbits.com/2026/06/22/introducing-patch-the-planet/ ===================== = Vulnerabilities = ===================== ∗∗∗ Pixelsmash: Lücke in FFmpeg-Decoder gefährdet unzählige Systeme ∗∗∗ --------------------------------------------- Sicherheitsforscher von JFrog haben eine gefährliche Sicherheitslücke in dem weitverbreiteten freien Multimedia-Framework FFmpeg aufgedeckt. Wie die Forscher in einem Blogbeitrag schildern, können Angreifer damit zahlreiche auf FFmpeg angewiesene Softwarelösungen zum Absturz bringen. In einigen Fällen, etwa bei Jellyfin und Nextcloud, soll sogar eine Schadcodeausführung möglich sein. --------------------------------------------- https://www.golem.de/news/pixelsmash-luecke-in-ffmpeg-decoder-gefaehrdet-un… ∗∗∗ LWN Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1079083/ ∗∗∗ NCSC-2026-0209 [1.00] [M/H] Kwetsbaarheden verholpen in MongoDB Server ∗∗∗ --------------------------------------------- https://advisories.ncsc.nl/advisory?id=NCSC-2026-0209 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 22.06.2026
by Daily end-of-shift report 22 Jun '26

22 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Freitag 19-06-2026 18:00 − Montag 22-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Angriffswelle gegen FortiGate Devices - "FortiBleed" ∗∗∗ --------------------------------------------- Fortinet hat letzten Freitag, am 19.5.2026, nun auch ein offizielles Statement zu "FortiBleed" veröffentlicht. Wir hatten zuvor in einem Blog-Artikel unseren aktuellen Wissensstand beschrieben. Bei dieser Angriffswelle handelt es sich nicht um die Ausnutzung einer neuen Schwachstelle. Die Angreifer:innen verwenden stattdessen Zugangsdaten, die bei früheren Sicherheitsvorfällen (u. a. im Zusammenhang mit CVE-2025-59718, CVE-2025-59719 und CVE-2026-24858) erlangt wurden, sowie Brute-Force-Methoden gegen Geräte mit schwacher Passworthygiene und ohne Multi-Faktor-Authentifizierung (MFA). --------------------------------------------- https://www.cert.at/de/warnungen/2026/6/angriffswelle-gegen-fortigate-devic… ∗∗∗ New Prinz Eugen ransomware prioritizes recent files for encryption ∗∗∗ --------------------------------------------- A new ransomware operation named Prinz Eugen prioritizes recently modified files for encryption and leaves no ransom note on the system. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-prinz-eugen-ransomware-p… ∗∗∗ Squidbleed: 29 Jahre alte Lücke in populärer Proxy-Software entdeckt ∗∗∗ --------------------------------------------- Die zuletzt unter anderem durch die Entdeckung von HTTP/2 Bomb aufgefallenen Sicherheitsforscher von Calif haben mithilfe von Claude Mythos eine Sicherheitslücke in der weitverbreiteten freien Proxyserver-Software Squid entdeckt. Angreifer können damit Speicherinhalte leaken und Daten aus von Squid verarbeiteten HTTP-Requests abgreifen. Die Besonderheit dabei: Die Lücke wurde 1997 eingeführt und blieb damit fast drei Jahrzehnte unentdeckt. --------------------------------------------- https://www.golem.de/news/squidbleed-29-jahre-alte-luecke-in-populaerer-pro… ∗∗∗ AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network ∗∗∗ --------------------------------------------- A new malware family is turning forgotten home routers into a distributed reconnaissance and proxy network, not the DDoS botnet these devices usually end up in. [..] The campaign goes after routers built on Realtek's RTL819X chips, hardware that was current around 2012 to 2015. XLab first saw it on March 12, 2026, spreading from a single IP, 107.150.106.14. [..] The infected pool is mostly D-Link, with the DIR-850L alone making up about 75 percent. --------------------------------------------- https://thehackernews.com/2026/06/arystinger-malware-infects-4300-legacy.ht… ∗∗∗ New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported malware loader dubbed OXLOADER. According to Elastic Security Labs, the campaign leverages malicious Google Ads as a starting point to distribute the malware. --------------------------------------------- https://thehackernews.com/2026/06/new-oxloader-loader-uses-malicious.html ∗∗∗ Anlagebetrug mit Promi-Namen: Gefälschter oe24-Artikel lockt in die Falle ∗∗∗ --------------------------------------------- Angebliche Anlagetipps von Prominenten sind oft Teil einer Betrugsmasche. Aktuell missbrauchen Kriminelle den Namen von Armin Wolf und der Raiffeisen Bank für eine gefälschte Berichterstattung im Design von oe24. Das Ziel besteht darin, Leser:innen auf eine betrügerische Anlageplattform zu locken. --------------------------------------------- https://www.watchlist-internet.at/news/anlagebetrug-mit-promi-namen-gefaels… ∗∗∗ Popa Botnetz kapert Smart TVs für Web-Scraping ∗∗∗ --------------------------------------------- icherheitsforscher haben ein Botnetz enttarnt, welches Millionen Smart TVs gekapert hat. Die Millionen Android Smart TV-Geräte, die Teil des Popa-Botnets sind, leiteten Webverkehr (Web-Scaping) an dessen Betreiber weiter. --------------------------------------------- https://borncity.com/blog/2026/06/22/popa-botnetz-kapert-smart-tvs-fuer-web… ∗∗∗ Mark-of-the-web and pinning installers to sites ∗∗∗ --------------------------------------------- While MoTW is intended for the operating system and other origin-aware applications such as MSFT Office to make security decisions, an executable can also access its own MoTW. This is the basis for a proof-of-concept with a simple Win32 GUI application ... --------------------------------------------- https://blog.randomoracle.io/2026/06/20/mark-of-the-web-and-pinning-install… ===================== = Vulnerabilities = ===================== ∗∗∗ libssh2: Teils kritische Lücken in populärer SSH-Bibliothek ∗∗∗ --------------------------------------------- Angreifer können CVE-2026-55200 ausnutzen, indem sie speziell gestaltete SSH-Pakete mit übermäßig großen package_length-Werten übermitteln und dadurch Schreibvorgänge außerhalb vorgesehener Grenzen auslösen. Die Folge ist eine Korruption des Heap-Speichers, wodurch im schlimmsten Fall Schadcode eingeschleust und zur Ausführung gebracht werden kann. [..] Alle Versionen von libssh2 bis einschließlich der seit Oktober 2024 als aktuell geltenden Version 1.11.1 sollen anfällig für CVE-2026-55199 und CVE-2026-55200 sein. Korrekturen wurden mit den Commits 1762685 und 97acf3d bereitgestellt. Wann ein neues Release mit den beiden Patches erscheint, ist noch unklar. --------------------------------------------- https://www.golem.de/news/libssh2-teils-kritische-luecken-in-populaerer-ssh… ∗∗∗ Bamboo, Confluence & Co.: Atlassian schließt 100 Sicherheitslücken ∗∗∗ --------------------------------------------- Wie aus dem Sicherheitsbereich der Atlassian-Website hervorgeht, haben die Entwickler in aktuellen Versionen insgesamt 100 Lücken geschlossen. Davon sind neben dem eigenen Code auch Abhängigkeiten zu etwa Apache Tomcat betroffen. --------------------------------------------- https://www.heise.de/news/Bamboo-Confluence-Co-Atlassian-schliesst-100-Sich… ∗∗∗ LWN: Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1078922/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

Tageszusammenfassung - 19.06.2026
by Daily end-of-shift report 19 Jun '26

19 Jun '26

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 18-06-2026 18:00 − Freitag 19-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ USB worm spreads crypto-stealing malware via Windows shortcut files ∗∗∗ --------------------------------------------- Threat actors targeting cryptocurrency wallets have been distributing clipboard-stealing malware with self-spreading capabilities and using the Tor network to conceal communication. --------------------------------------------- https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stea… ∗∗∗ Jailbreak möglich: Wohl unpatchbarer Hardware-Bug gefährdet iPhones ∗∗∗ --------------------------------------------- Forscher haben einen offenbar unpatchbaren Bug entdeckt, der Jailbreaks für mehrere iPhone-, iPad- und Apple-Watch-Modelle ermöglichen könnte. --------------------------------------------- https://www.golem.de/news/jailbreak-moeglich-wohl-unpatchbarer-hardware-bug… ∗∗∗ Warnung vor Fake-Rechnungen von Sixt Server ∗∗∗ --------------------------------------------- Derzeit melden sich zahlreiche Unternehmen bei uns, die Rechnungen für angebliche Cloud-Dienstleistungen erhalten haben. Tatsächlich handelt es sich dabei um einen Betrugsversuch: Die gefälschten Rechnungen sollen Unternehmen zu einer unberechtigten Zahlung verleiten. --------------------------------------------- https://www.watchlist-internet.at/news/fake-rechnungen-von-sixt-server/ ∗∗∗ Killing me gently: Inside Gentlemen’s EDR killer framework ∗∗∗ --------------------------------------------- ESET Research shares the results of a months-long investigation into the suite of EDR killers maintained by the RaaS gang Gentlemen. --------------------------------------------- https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-ge… ∗∗∗ Brand der Floridsdorfer Brücke: Glasfaserausfälle in Wien ∗∗∗ --------------------------------------------- Heute hat es auf der Floridsdorfer Brücke gebrannt. Was der ORF nicht meldet ist, dass über diese Brücke auch Glasfasertrassen geführt werden, und dass durch den Brand einige dieser Leitungen ausgefallen sind. Wenn man die Standorte der relevanten Rechenzentren in Wien kennt, dann ist sofort klar, dass das sehr relevant ist. Bei uns ging bis jetzt eine formelle NIS Meldung ein, weiters haben wir informell von anderen Organisationen gehört, dass sie betroffen sind. --------------------------------------------- https://www.cert.at/de/aktuelles/2026/6/brand-der-floridsdorfer-brucke-glas… ∗∗∗ Bulgaria allowed surveillance tech firm to sell products to repressive regimes, report says ∗∗∗ --------------------------------------------- The nonprofit Human Rights Watch obtained export licensing records covering 2018 through 2023, which show the Bulgarian government allowed the surveillance firm Circles to peddle the tech to law enforcement and intelligence agencies in several countries known for human rights abuses. --------------------------------------------- https://therecord.media/bulgaria-allowed-surveillance-tech-firm-to-sell-to-… ∗∗∗ PeopleSoft PeopleTools Pre-Authentication RCE: A PSIGW SSRF Chain That Executes Inside the JVM ∗∗∗ --------------------------------------------- A pre-authentication remote code execution (RCE) chain in Oracle PeopleSoft PeopleTools reaches an internal-only management servlet through a server-side request forgery (SSRF) in the PSIGW gateway, then gains code execution through Java XMLDecoder deserialization. Oracle assigned CVE-2026-35273 (CVSS 9.8) and released an out-of-band patch on June 10, 2026. [..] Our researchers discovered new information about this vulnerability, which was responsibly disclosed to Oracle as part of our investigation. --------------------------------------------- https://www.trendmicro.com/en_us/research/26/f/PeopleTools.html ∗∗∗ Anthropics KI Mythos: Unternehmen haben weiter Zugriff auf Preview-Version ∗∗∗ --------------------------------------------- Trotz US-Anordnung haben manche Unternehmen weiterhin Zugriff auf eine Preview-Version von Anthropics KI-Modell Mythos. --------------------------------------------- https://heise.de/-11338742 ∗∗∗ I discovered a large-scale malware distribution on GitHub ∗∗∗ --------------------------------------------- This is the story of how I found 10,000 repositories on GitHub that distribute Trojan malware. They are all from different contributors, have different names, and are not forks of other repositories. But they share a common pattern, which is what allowed me to write a script to find such repositories. --------------------------------------------- https://orchidfiles.com/github-repositories-distributing-malware/ ===================== = Vulnerabilities = ===================== ∗∗∗ Windows 10/11: Rechteausweitung in AMD-RAID-Treiber ∗∗∗ --------------------------------------------- Im AMD RAID-Treiber für Windows 10 und Windows 11 ist ein gravierender Bug bekannt geworden, der die Sicherheit des Systems gefährdet. Die Schwachstelle CVE-2024-21962, hat einen CVSS-Score von 8.6. AMD und auch der Hersteller HP haben Sicherheitshinweise sowie eine neue Treiberversion veröffentlicht. --------------------------------------------- https://borncity.com/blog/2026/06/19/windows-10-11-rechteausweitung-in-amd-… ∗∗∗ LWN: Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1078662/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/mailman3/postorius/lists/daily.lists.cert.at/

1 0

← Newer
1
...
5
6
7
8
9
10
11
...
352
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily