===================== = End-of-Day report = =====================
Timeframe: Dienstag 13-10-2026 18:00 − Mittwoch 14-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler
===================== = News = =====================
∗∗∗ Trezor Wallets Also Compromised with Implants ∗∗∗ --------------------------------------------- Despite claims by Trezor today that none of its devices have been compromised -- unlike the devices of its competitor, Ledger -- hardware hacker Joe Grand says he found implants in two Trezor devices and reported this to the company in August. --------------------------------------------- https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implants...
∗∗∗ GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking ∗∗∗ --------------------------------------------- GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. --------------------------------------------- https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html
∗∗∗ Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave ∗∗∗ --------------------------------------------- Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. --------------------------------------------- https://thehackernews.com/2026/10/four-byte-write-and-timing-bug-let.html
∗∗∗ Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days ∗∗∗ --------------------------------------------- A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. --------------------------------------------- https://thehackernews.com/2026/10/researchers-used-public-openai-model-to.ht...
∗∗∗ GhostScript-Schwachstelle CVE-2026-39919 wird angegriffen ∗∗∗ --------------------------------------------- Kurze Erinnerung für Nutzer, die GhostScript verwenden (ist in vielen Software-Paketen zur PDF-Erzeugung enthalten). Es gibt eine (gefixte) kritische Schwachstelle CVE-2026-39919 in GhostScript vor der Version 10.08.0, die nun wohl angegriffen wird. Angreifer können PDF-Server übernehmen. --------------------------------------------- https://borncity.com/blog/2026/10/14/ghostscript-schwachstelle-cve-2026-3991...
∗∗∗ Passkeys Are Not a Trap ∗∗∗ --------------------------------------------- A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this true?' kind of vibe. It's written for "non-technical citizens of the web", and the headline advice is to stop using passkeys and go back to TOTP codes and passwords. --------------------------------------------- https://scotthelme.co.uk/passkeys-are-not-a-trap/
===================== = Vulnerabilities = =====================
∗∗∗ Chrome 155: Google stopft sieben kritische Löcher ∗∗∗ --------------------------------------------- Google hat ein Sicherheitsupdate für Chrome 155 veröffentlicht. Es beseitigt 37 Anfälligkeiten, von denen sieben als kritisch eingestuft sind. Angreifer können unter Umständen aus der Ferne Schadcode einschleusen und außerhalb der Sandbox des Browsers ausführen. Betroffen sind Chrome für Windows, MacOS und Linux. --------------------------------------------- https://www.golem.de/news/chrome-155-google-stopft-sieben-kritische-loecher-...
∗∗∗ Neue curl-Version entfernt SMB-Unterstützung und behebt 24 Sicherheitslücken ∗∗∗ --------------------------------------------- Die neueste Version von curl behebt eine schwere und dreiundzwanzig leichte Sicherheitslücken und verabschiedet sich von der Unterstützung für das SMB-Protokoll. Die Open-Source-Bibliothek zum Aufruf von URLs ist praktisch auf jedem vernetzten Gerät weltweit installiert – das Update betrifft also Milliarden Installationen. --------------------------------------------- https://www.heise.de/news/Neue-curl-Version-entfernt-SMB-Unterstuetzung-und-...
∗∗∗ Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities ∗∗∗ --------------------------------------------- Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical." --------------------------------------------- https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/
∗∗∗ Patchday: Sicherheitslücken mit Höchstwertung gefährden Adobe-Anwendungen ∗∗∗ --------------------------------------------- Adobe hat wichtige Sicherheitsupdates unter anderem für ColdFusion, Commerce und Experience Manager veröffentlicht. --------------------------------------------- https://heise.de/-11487282
∗∗∗ DNSSEC-Schlüsseltausch: Updates für Secunet- und RISE-Konnektoren verfügbar ∗∗∗ --------------------------------------------- Secunet- und RISE-Konnektoren verlieren nach einem DNSSEC-Schlüsselwechsel die Verbindung zur Telematikinfrastruktur. Jetzt stehen Updates bereit. --------------------------------------------- https://heise.de/-11477109
∗∗∗ LWN Security updates for Wednesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1100426/
∗∗∗ VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/382143
∗∗∗ VU#166125: Bisheng has authentication bypass vulnerabilities ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/166125
∗∗∗ Improper access control and session management in the web management interface ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-26-185
∗∗∗ Multiple Arbitrary File Read/Write via SQL Injection ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-26-178
∗∗∗ SQL command injection in webmail ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-26-184