===================== = End-of-Day report = =====================
Timeframe: Donnerstag 22-10-2026 18:00 − Freitag 23-10-2026 18:00 Handler: Katharina Siess Co-Handler: Guenes Holler
===================== = News = =====================
∗∗∗ Railway warns devs to rotate secrets after potential breach ∗∗∗ --------------------------------------------- Cloud hosting provider Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. --------------------------------------------- https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-...
∗∗∗ Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data ∗∗∗ --------------------------------------------- Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. --------------------------------------------- https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.htm...
∗∗∗ Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. --------------------------------------------- https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.ht...
∗∗∗ SEO Poisoning Campaign Delivers New Armorsteal Malware ∗∗∗ --------------------------------------------- In September 2026, Zscaler Threat Hunting identified an SEO poisoning campaign that used fake websites impersonating the Chocolatey package manager and the Microsoft Activation Scripts (MAS) tool to distribute a Python-based malware family we track as Armorsteal. The fake websites targeted users searching for Chocolatey or MAS software installation commands. Each lure page displayed a malicious PowerShell command that downloaded and executed the Armorsteal installer. The installer deployed a Python 3.11 runtime environment and three main components providing remote access, surveillance, and information stealing capabilities, with the Python code protected by Pyarmor. --------------------------------------------- https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-deliv...
∗∗∗ GitHub Package Firewall blockiert schädliche npm-Pakete ∗∗∗ --------------------------------------------- GitHub hat die Package Firewall als öffentliche Vorschau für Enterprise-Cloud-Kunden freigegeben. Sie prüft Paketabfragen und Downloads. --------------------------------------------- https://www.heise.de/news/GitHub-Package-Firewall-blockiert-schaedliche-npm-...
∗∗∗ Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes ∗∗∗ --------------------------------------------- Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. --------------------------------------------- https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html
===================== = Vulnerabilities = =====================
∗∗∗ Arista patches new VeloCloud Orchestrator zero-day exploited in attacks ∗∗∗ --------------------------------------------- Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. --------------------------------------------- https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-...
∗∗∗ Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image ∗∗∗ --------------------------------------------- The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first. Ghostscript can read a name chosen by an attacker as instructions rather than as a file, and point it to a second file that carries commands to run. Pillow's maintainers fixed it in version 13.0.0, released on October 16. --------------------------------------------- https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.ht...
∗∗∗ LWN Security updates for Friday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/1102546/
∗∗∗ ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-26-787/
∗∗∗ ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-26-786/
∗∗∗ [R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2, 6.8.0, 6.9.1: SC-202610.1 ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2026-28