===================== = End-of-Day report = =====================

Timeframe: Freitag 17-07-2026 18:00 − Montag 20-07-2026 18:00 Handler: Guenes Holler Co-Handler: n/a

===================== = News = =====================

∗∗∗ Microsoft warns of surge in ACR Stealer attacks on customers ∗∗∗ --------------------------------------------- Microsoft has observed a surge in attacks using the ACR Stealer malware to steal browser-stored passwords, authentication tokens, and sensitive documents from its enterprise customers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-warns-of-surge-in-a...

∗∗∗ Cyberangriff: Bafin verhängt 240.000 Euro-Strafe gegen Teamviewer ∗∗∗ --------------------------------------------- Weil Teamviewer einen Angriff durch russische Hacker nicht sofort an die Börse meldete, greift die Finanzaufsicht Bafin nun durch. --------------------------------------------- https://www.golem.de/news/cyberangriff-bafin-verhaengt-240-000-euro-strafe-g...

∗∗∗ Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine ∗∗∗ --------------------------------------------- At least one Russian intelligence service is systematically hijacking internet-connected security cameras across Europe and Ukraine, using the feeds to watch military transport routes, weapons shipments bound for Kyiv, and the locations of Ukrainian troops. --------------------------------------------- https://thehackernews.com/2026/07/russian-intelligence-hacks-ip-cameras.html

∗∗∗ Critical ServiceNow code execution flaw now exploited in attacks ∗∗∗ --------------------------------------------- Attackers have begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform, according to threat intelligence company Defused. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-servicenow-code-exec...

∗∗∗ New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens ∗∗∗ --------------------------------------------- A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS keys. --------------------------------------------- https://thehackernews.com/2026/07/new-nadmesh-botnet-hunts-exposed-ai.html

∗∗∗ Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT ∗∗∗ --------------------------------------------- Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. --------------------------------------------- https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html

∗∗∗ SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines ∗∗∗ --------------------------------------------- Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. --------------------------------------------- https://thehackernews.com/2026/07/sleepergem-uses-three-malicious.html

∗∗∗ HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 ∗∗∗ --------------------------------------------- A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. --------------------------------------------- https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.ht...

∗∗∗ IPFire: Knot Resolver ersetzt Unbound ∗∗∗ --------------------------------------------- IPFire Core Update 203 ersetzt Unbound durch Knot Resolver, bringt DNS-Firewall, DoT und 6-GHz-WLAN. --------------------------------------------- https://www.heise.de/news/IPFire-Knot-Resolver-ersetzt-Unbound-11371136.html

∗∗∗ 7 Sandbox Escape Vulnerabilities Across 4 Coding Agent Vendors ∗∗∗ --------------------------------------------- Over several months, Pillar Research found and reproduced sandbox escapes and boundary bypasses across Cursor, Codex, Gemini CLI, and Antigravity. In almost every case, the agent did not need to break the sandbox directly. It only had to write something that a trusted component outside the sandbox would later run, load, scan, or treat as safe. In aggregate, these vulnerabilities show that AI coding agents change the endpoint threat model, and that most sandbox designs have not caught up. --------------------------------------------- https://www.pillar.security/blog/the-week-of-sandbox-escapes

∗∗∗ Abbott Laboratories probes two cyber incidents amid extortion claims ∗∗∗ --------------------------------------------- Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, while also investigating a separate claim that attackers breached its LabCentral portal and stole company data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/abbott-laboratories-probes-tw...

===================== = Vulnerabilities = =====================

∗∗∗ Kritische Sicherheitslücken in WordPress - Updates verfügbar ∗∗∗ --------------------------------------------- In WordPress existieren zwei Sicherheitslücken. Eine SQL-Injection-Schwachstelle im Parameter „author__not_in“ von „WP_Query“ betrifft WordPress ab Version 6.8. Ab WordPress 6.9 lässt sich diese laut Advisory in Kombination mit einer Schwachstelle in der REST-API (Batch-Route-Confusion) zur Ausführung von beliebigem Code (Remote Code Execution) ausnutzen. Laut Searchlight Cyber ist diese Angriffskette ohne vorherige Authentifizierung und ohne weitere Voraussetzungen in einer Standardinstallation ohne Plugins nutzbar. --------------------------------------------- https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordp...

∗∗∗ Update now: 7-Zip fixes RCE flaw exploitable with malicious archives ∗∗∗ --------------------------------------------- 7-Zip version 26.02 was released on June 25 to fix a remote code execution vulnerability that could allow attackers to execute malicious code by convincing users to open specially crafted compressed files. The vulnerability, disclosed by Lunbun researcher Landon Peng, exists in 7-Zip's processing of XZ-compressed data. According to an advisory from the Zero Day Initiative published this week, a specially crafted XZ data can trigger a heap-based buffer overflow, potentially allowing attackers to execute arbitrary code as the user. --------------------------------------------- https://www.bleepingcomputer.com/news/security/update-now-7-zip-fixes-rce-fl...

∗∗∗ Angriff mit nur 11 Bytes: OpenSSL-Bug lässt Speicher von Servern volllaufen ∗∗∗ --------------------------------------------- Durch eine Sicherheitslücke in OpenSSL können Angreifer mit 11-Byte-Paketen den RAM anfälliger Server stark auslasten und Ausfälle herbeiführen. --------------------------------------------- https://www.golem.de/news/angriff-mit-nur-11-bytes-openssl-bug-laesst-speich...

∗∗∗ Cyberangriff auf Hugging Face: KI erkennt KI-Angriff auf KI-Plattform ∗∗∗ --------------------------------------------- Hugging Face hat einen von KI-Agenten ausgeführten Cyberangriff per KI entdeckt. Der Zugriff gelang durch Sicherheitslücken in der KI-Plattform. --------------------------------------------- https://www.golem.de/news/cyberangriff-auf-hugging-face-ki-erkennt-ki-angrif...

∗∗∗ Kritische Sicherheitslücke: Schadcode kann auf Nginx-Server schlüpfen ∗∗∗ --------------------------------------------- Angreifer können Nginx Open Source und Nginx Plus attackieren. Sicherheitsupdates sind verfügbar. --------------------------------------------- https://www.heise.de/news/Kritische-Sicherheitsluecke-Schadcode-kann-auf-Ngi...

∗∗∗ Microsoft verteilt außerplanmäßiges Windows-Update ∗∗∗ --------------------------------------------- Microsoft verteilt ein ungeplantes Windows-Update. Es soll Probleme beheben, die insbesondere bei Dell-Computern aufgetreten sind. --------------------------------------------- https://www.heise.de/news/Windows-Update-ausser-der-Reihe-korrigiert-Perform...

∗∗∗ LWN Security updates for Monday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1083708/

∗∗∗ Langflow 1.3.0 Remote Code Execution ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2026070007

∗∗∗ K000162343: Multiple Oracle Java SE vulnerabilities ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000162343

∗∗∗ Case closed: DIVD-2025-00003 - Multiple vulnerabilities in Mennekes Smart / Premium Charging stations ∗∗∗ --------------------------------------------- https://csirt.divd.nl/cases/DIVD-2025-00003/