Dieser Feed beinhaltet die Tagesberichte von www.CERT.atCERT.at2026-07-10T18:16:23Z2026-07-10T18:16:23Z

<h2>End-of-Day report</h2> Timeframe: Donnerstag 09-07-2026 18:00 - Freitag 10-07-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a <h2> News </h2> <h3>Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers</h3> A single wrong variable on one line in XQUIC, Alibabas QUIC and HTTP/3 library, lets any remote client crash the server with a short burst of completely legal traffic. There is no patch. FoxIO researcher Sébastien Féry disclosed the flaw on July 8 and nicknamed it XRING. He says it needs no login and no malformed packets: about 260 bytes of ordinary QPACK traffic takes the server process down. [..] FoxIO demonstrated a crash, not code execution, and reported no exploitation in the wild. [..] XRING is the latest in a string of remote crashes in HTTP/2 and HTTP/3 stacks. <p /> <A HREF="https://thehackernews.com/2026/07/unpatched-xring-flaw-in-xquic-lets.html">https://thehackernews.com/2026/07/unpatched-xring-flaw-in-xquic-lets.html</a> <hr> <h3>Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites</h3> A cybercrime crew left one of its own servers wide open on the internet for three weeks, and it exposed the operations inner workings: the hacking tools, the activity logs, and target lists naming more than 1.4 million websites. Far fewer were actually broken into, but the exposed files showed researchers how a mass site-hacking operation runs from the inside. <p /> <A HREF="https://thehackernews.com/2026/07/exposed-hacker-server-reveals-wp.html">https://thehackernews.com/2026/07/exposed-hacker-server-reveals-wp.html</a> <hr> <h3>Software developers are the target. New trojan attacks supply chains and inflicts multifaceted damage on infected PCs</h3> A new trojan engaging in supply chain attacks has recently come under the scrutiny of our antivirus laboratory. The malware primarily targets C++ and C# project files. This malicious sample is particularly dangerous as its payload incorporates multiple damaging features, allowing it to steal data, access clipboard content, operate as a backdoor, engage in rogue mining and also infect other files. [..] It mainly spreads over the Internet via infected executable files and Python scripts. The infection process is quite complex, so let-s examine the entire sequence phase by phase. <p /> <A HREF="https://news.drweb.com/show/?i=15276&lng=en&c=9">https://news.drweb.com/show/?i=15276&lng=en&c=9</a> <hr> <h3>"Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?, (Fri, Jul 10th)</h3> Anyone who deals with phishing messages caught by basic security filters knows that most phishing samples tend to blend into one another, since only a small set of techniques and approaches keeps reappearing in them. That is precisely why it is worth pausing on the occasional message that does something a little out of the ordinary. <p /> <A HREF="https://isc.sans.edu/diary/rss/33144">https://isc.sans.edu/diary/rss/33144</a> <hr> <h3>npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk</h3> GitHub has officially announced the release of npm version 12 with install scripts disabled by default, along with deprecating granular access tokens (GATs) designed to bypass two-factor authentication (2FA). <p /> <A HREF="https://thehackernews.com/2026/07/npm-12-disables-install-scripts-by.html">https://thehackernews.com/2026/07/npm-12-disables-install-scripts-by.html</a> <hr> <h3>Microsoft warns customers AI will mean busier Patch Tuesdays</h3> More patches mean more reasons to buy Redmond-s auto-patching tools <p /> <A HREF="https://www.theregister.com/security/2026/07/10/microsoft-warns-customers-ai-will-mean-busier-patch-tuesdays/5269618">https://www.theregister.com/security/2026/07/10/microsoft-warns-customers-ai-will-mean-busier-patch-tuesdays/5269618</a> <hr> <h3>GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware</h3> In October 2025, Microsoft Threat Intelligence identified destructive wiping activity and uncovered a sophisticated Go programming language (Golang)-based backdoor we now track as GigaWiper, a versatile implant that combines robust command-and-control (C2) capabilities with multiple destructive payloads, including disk wiping, fake ransomware, and system-level sabotage. [..] In this blog, we provide a code-level analysis of GigaWiper-s architecture. <p /> <A HREF="https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/">https://www.microsoft.com/en-us/security/blog/2026/07/09/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware/</a> <hr> <h3>Flying with the Flipper Zero</h3> Why is the world so alarmed about taking the Flipper on board planes? Is it just poorly educated armchair cyber commentators of the -don-t use open Wi-Fi / USB juicejacking- style of fearmongering, or is there something to it? [..] Flippers are not a threat to the safety of a flight. <p /> <A HREF="https://www.pentestpartners.com/security-blog/flying-with-the-flipper-zero/">https://www.pentestpartners.com/security-blog/flying-with-the-flipper-zero/</a> <hr> <h3>Organized Cybercrime Merging with Other Crime</h3> In a recent report, the FBI warns that Silent Ransom Group has also begun recruiting gig workers in the victims- area under the guise of hiring helpdesk personnel. Gig workers are people who earn money through short-term, flexible jobs rather than a traditional permanent role. They are usually paid per task, project or assignment. <p /> <A HREF="https://www.truesec.com/hub/blog/organized-cybercrime-merging-with-other-crime">https://www.truesec.com/hub/blog/organized-cybercrime-merging-with-other-crime</a> <hr> <h3>Wiz in the Verizon DBIR: How AI Acceleration and Cloud Sprawl Impact Modern Defense</h3> Verizons latest DBIR highlights how attackers are exploiting familiar weaknesses at increasing speed and scale. [..] The lesson from this year's DBIR is that familiar weaknesses remain highly effective when combined with cloud scale, interconnected trust relationships, and increasingly rapid exploitation cycles. <p /> <A HREF="https://www.wiz.io/blog/verizon-dbir-2026-ai-cloud-security">https://www.wiz.io/blog/verizon-dbir-2026-ai-cloud-security</a> <h2> Vulnerabilities </h2> <h3>GitLab Patch Release: 19.1.2, 19.0.4, 18.11.7</h3> <p /> <A HREF="https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/">https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/</a> <hr> <h3>LWN: Security updates for Friday</h3> <p /> <A HREF="https://lwn.net/Articles/1082272/">https://lwn.net/Articles/1082272/</a>

CERT.at2026-07-10T18:16:23ZCERT.at2026-07-09T18:26:11Z2026-07-09T18:26:11Z

<h2>End-of-Day report</h2> Timeframe: Mittwoch 08-07-2026 18:00 - Donnerstag 09-07-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a <h2> News </h2> <h3>Microsoft patches RoguePlanet Defender zero-day vulnerability</h3> Microsoft has released a security patch to address a Defender zero-day vulnerability known as "RoguePlanet," disclosed after the June 2026 Patch Tuesday. The flaw (tracked as CVE-2026-50656) was disclosed by a security researcher using the "Nightmare Eclipse" handle as part of an ongoing dispute with Microsoft over the company's bug bounty and vulnerability disclosure practices. <p /> <A HREF="https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-rogueplanet-defender-zero-day-vulnerability/">https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-rogueplanet-defender-zero-day-vulnerability/</a> <hr> <h3>Schwachstelle in Coding-Agenten: Zugriff auf beliebige Dateien über Symlinks</h3> In sechs großen Coding-Agenten findet sich eine Sicherheitslücke: Über ein Repository mit Schadcode können Angreifer die KI-Modelle dazu bewegen, auf beliebige Dateien zuzugreifen - auch außerhalb einer Sandbox. [..] Betroffen sind Amazon Q Developer, Anthropics Claude Code, Augment, Cursor, Google Antigravity und Windsurf. Für die meisten Tools existiert inzwischen ein Update, das die Schwachstelle behebt, aber für Augment und Windsurf existieren noch keine Patches. <p /> <A HREF="https://heise.de/-11358849">https://heise.de/-11358849</a> <hr> <h3>IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years</h3> GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by VEGA that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in kernelCTF. This writeup covers the technical details of the exploit. <p /> <A HREF="https://nebusec.ai/research/ionstack-part-2/">https://nebusec.ai/research/ionstack-part-2/</a> <hr> <h3>Entra passkey enrollment vishing targets Microsoft 365 users</h3> A threat actor has been targeting organizations across multiple sectors with voice-based fake security requests that ask Microsoft 365 users to enroll a new Entra passkey. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/">https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/</a> <hr> <h3>New Forg365 phishing platform uses AI to target Microsoft 365 accounts</h3> A new phishing-as-a-service (PhaaS) operation called Forg365 focuses on stealing Microsoft 365 accounts by combining adversary-in-the-middle (AiTM) and device code methods with AI-assisted lure generation. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/new-forg365-phishing-platform-uses-ai-to-target-microsoft-365-accounts/">https://www.bleepingcomputer.com/news/security/new-forg365-phishing-platform-uses-ai-to-target-microsoft-365-accounts/</a> <hr> <h3>Fake Installers, Fake Reviews, Fake Services - Real Proxies, Real Victims</h3> Residential proxies are one of the hottest topics in cybersecurity today. Turns out, they are often not in residences, and they facilitate a wide range of criminal activity. In the simplest terms, a little piece of software in a TV, digital picture frame, or your phone might enable a company to sell access to your device-s bandwidth to their own customers. [..] Our discovery started with a single campaign: In early 2026, the actor, who we track as Lurking Lizard, fooled users into downloading a fake version of the 7-Zip archive utility. Fake Installers, Fake Reviews, Fake Services - Real Proxies, Real Victims <h3>GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses</h3> Cybersecurity researchers have flagged a new ransomware family called GodDamn that employs the PoisonX kernel driver to neutralize security software as part of its defense evasion strategy. According to a new report published by the Threat Hunter Team from Symantec, the ransomware was first publicly spotted in the wild on May 21, 2026. It's assessed to be a rebrand of the Beast ransomware, which, in turn, was an enhanced version of Monster, a Delphi-based ransomware that surfaced in March 2022. <p /> <A HREF="https://thehackernews.com/2026/07/goddamn-ransomware-uses-poisonx-driver.html">https://thehackernews.com/2026/07/goddamn-ransomware-uses-poisonx-driver.html</a> <hr> <h3>GitHub Copilot: Sorry Dave, I cant do that harmful thing - unless you ask me in code</h3> t's the latest example of AI safety guardrails being bypassed. GitHub Copilot refuses harmful prompts almost always if asked in chat - like, "how to fool a breathalyzer test" or "smuggle bulk cash out of the US" - but then will write them in code 100 percent of the time if the prompt is broken into smaller steps and distributed across multiple stages of a software development workflow. <p /> <A HREF="https://www.theregister.com/security/2026/07/08/github-copilot-sorry-dave-i-cant-do-that-harmful-thing-unless-you-ask-me-in-code/5268654">https://www.theregister.com/security/2026/07/08/github-copilot-sorry-dave-i-cant-do-that-harmful-thing-unless-you-ask-me-in-code/5268654</a> <hr> <h3>Eintrag wider Willen: Wenn Unternehmen ungefragt auf dubiosen Portalen landen</h3> Taucht das eigene Unternehmen plötzlich auf unbekannten Portalen auf, ist die Überraschung groß. Unangenehm wird es dann, wenn sich das Profil ohne Registrierung nicht löschen lässt und sich die Plattformbetreiber regelmäßig mit aufdringlichen Spam-Mails melden. Und wie war das nochmal mit dem Urheberrecht? Das Problem, dargestellt am Beispiel evepla.com. <p /> <A HREF="https://www.watchlist-internet.at/news/eintrag-wider-willen-dubiose-portale/">https://www.watchlist-internet.at/news/eintrag-wider-willen-dubiose-portale/</a> <h2> Vulnerabilities </h2> <h3>n8n: CERT-Bund veröffentlicht Warnmeldung zu kürzlich beseitigten Schwachstellen</h3> Kritisch ist keine der jüngst gefixten Lücken in der Automatisierungslösung n8n. Dennoch betont eine Warnmeldung des BSI die hohe Update-Relevanz. <p /> <A HREF="https://heise.de/-11359656">https://heise.de/-11359656</a> <hr> <h3>Drupal Security Advisories 2026-July-08</h3> <p /> <A HREF="https://www.drupal.org/security">https://www.drupal.org/security</a> <hr> <h3>LWN: Security updates for Thursday</h3> <p /> <A HREF="https://lwn.net/Articles/1082030/">https://lwn.net/Articles/1082030/</a> <hr> <h3>Paloalto: PAN-SA-2026-0010 Chromium: Monthly Vulnerability Update (July 2026) (Severity: HIGH)</h3> <p /> <A HREF="https://security.paloaltonetworks.com/PAN-SA-2026-0010">https://security.paloaltonetworks.com/PAN-SA-2026-0010</a> <hr> <h3>Paloalto: PAN-SA-2026-0010 Chromium and Prisma Browser: Monthly Vulnerability Update (July 2026) (Severity: HIGH)</h3> <p /> <A HREF="https://security.paloaltonetworks.com/PAN-SA-2026-0010">https://security.paloaltonetworks.com/PAN-SA-2026-0010</a> <hr> <h3>Chrome-Browser & ChromeOS LTS : Updates schließen teils kritische Lücken</h3> <p /> <A HREF="https://heise.de/-11359376">https://heise.de/-11359376</a> <hr> <h3>Wireshark 4.6.7 Fixes 12 Security Issues Across SSH, IEEE 802.11, Catapult DCT2000 and Other Protocols</h3> <p /> <A HREF="https://thecyberexpress.com/wireshark-4-6-7/">https://thecyberexpress.com/wireshark-4-6-7/</a>

CERT.at2026-07-09T18:26:11ZCERT.at2026-07-08T19:16:01Z2026-07-08T19:16:01Z

<h2>End-of-Day report</h2> Timeframe: Dienstag 07-07-2026 18:00 - Mittwoch 08-07-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a <h2> News </h2> <h3>Accenture confirms breach after hacker offers stolen data for sale</h3> IT services giant Accenture has confirmed it suffered a security breach after a threat actor claimed to have stolen 35 GB of source code and other data from the company. [..] According to the threat actor, the data includes source code, RSA keys, SSH keys, Azure PAT (personal access tokens), Azure Storage access keys, and configuration files. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/accenture-confirms-breach-after-hacker-offers-stolen-data-for-sale/">https://www.bleepingcomputer.com/news/security/accenture-confirms-breach-after-hacker-offers-stolen-data-for-sale/</a> <hr> <h3>GitHub AI agent leaks private repos when asked nicely</h3> Malicious prompters could easily trick GitHub agents into pulling data from private repositories and then leaking the information as a public comment for anyone to access, according to Noma Labs researchers who named the vulnerability GitLost. The issue exists in GitHub-s Agentic Workflows, which allow an AI agent powered by Claude or GitHub Copilot to autonomously execute tasks in GitHub Actions. <p /> <A HREF="https://www.theregister.com/security/2026/07/07/github-ai-agent-leaks-private-repos-when-asked-nicely/5267924">https://www.theregister.com/security/2026/07/07/github-ai-agent-leaks-private-repos-when-asked-nicely/5267924</a> <hr> <h3>-Ihr Paket liegt im Logistikzentrum!- - Über eine Zollgebühr in die Phishing-Falle</h3> Zwei Sätze, eine Aufforderung, eine Frist. Mehr braucht es nicht - und die Phishing-Falle ist fertig. Eine zurzeit besonders häufig gemeldete Masche nutzt den Paketdienstleister DPD als Tarnung. Da sich entsprechende Hinweise im Posteingang der Redaktion stapeln, ist es an der Zeit, die Masche erneut unter die Lupe zu nehmen. <p /> <A HREF="https://www.watchlist-internet.at/news/dpd-paket-im-logistikzentrum/">https://www.watchlist-internet.at/news/dpd-paket-im-logistikzentrum/</a> <hr> <h3>Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation</h3> In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide. [..] We assess the operator of the campaign to be a Vidar stealer malware-as-a-service (MaaS) affiliate involved in operations targeting victims in the U.S. and European Union. This article provides a technical analysis of the campaign. <p /> <A HREF="https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/">https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/</a> <hr> <h3>Offene Datenbank: Nextcloud GmbH behebt potenzielles Datenleck</h3> Daten des Unternehmens hinter der populären Kollaborationslösung standen wegen einer Fehlkonfiguration offen im Netz. Die Software ist nicht betroffen. <p /> <A HREF="https://heise.de/-11358275">https://heise.de/-11358275</a> <h2> Vulnerabilities </h2> <h3>Joomla Security Advisories (Fixed Date: 2026-07-07)</h3> Joomla has released 12 new security advisories. <p /> <A HREF="https://developer.joomla.org/security-centre/">https://developer.joomla.org/security-centre/</a> <hr> <h3>Foxit-Entwickler schließen Schwachstellen in PDF Reader und Editor</h3> Nicht kritisch, aber zahlreich: Aktuelle Sicherheitsupdates dichten Foxits PDF Reader und Editor gegen eine lange Lückenliste ab. <p /> <A HREF="https://www.heise.de/news/Foxit-Entwickler-schliessen-Schwachstellen-in-PDF-Reader-und-Editor-11358393.html">https://www.heise.de/news/Foxit-Entwickler-schliessen-Schwachstellen-in-PDF-Reader-und-Editor-11358393.html</a> <hr> <h3>ILIAS: Wichtige Aktualisierungen für Lernplattform beseitigen Schwachstellen</h3> Für die von Hochschulen, Kliniken und anderen öffentlichen Institutionen genutzte offene Lernplattform ILIAS stehen Aktualisierungen bereit. Die neuen Versionen 9.21, 10.9 und 11.2 schließen Sicherheitslücken, von denen alle früheren Ausgaben betroffen waren. Von drei Lücken geht ein hohes, von den übrigen ein mittleres Sicherheitsrisiko aus. <p /> <A HREF="https://heise.de/-11357739">https://heise.de/-11357739</a> <hr> <h3>Juniper: 2026-07 Security Bulletin: Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker (CVE-2026-57028)</h3> <p /> <A HREF="https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-Evolved-A-port-which-has-been-inadvertently-exposed-can-be-reached-by-an-attacker-CVE-2026-57028">https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-Evolved-A-port-which-has-been-inadvertently-exposed-can-be-reached-by-an-attacker-CVE-2026-57028</a> <hr> <h3>Juniper: 2026-07 Security Bulletin: Junos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crash (CVE-2026-57026)</h3> <p /> <A HREF="https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-MX-Series-with-SPC3-SRX-Series-Processing-of-a-specifically-malformed-SIP-invite-causes-a-flowd-crash-CVE-2026-57026">https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-MX-Series-with-SPC3-SRX-Series-Processing-of-a-specifically-malformed-SIP-invite-causes-a-flowd-crash-CVE-2026-57026</a> <hr> <h3>Juniper: 2026-07 Security Bulletin: Junos OS: MX Series with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd crash (CVE-2026-57023)</h3> <p /> <A HREF="https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-MX-Series-with-SPC3-SRX-Series-A-specifically-malformed-TCP-packet-causes-a-flowd-crash-CVE-2026-57023">https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-MX-Series-with-SPC3-SRX-Series-A-specifically-malformed-TCP-packet-causes-a-flowd-crash-CVE-2026-57023</a> <hr> <h3>Juniper: 2026-07 Security Bulletin: Junos OS and Junos OS Evolved: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crash (CVE-2026-33799)</h3> <p /> <A HREF="https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-a-specific-SNMPv3-request-results-in-memory-leak-and-eventual-snmpd-crash-CVE-2026-33799">https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-a-specific-SNMPv3-request-results-in-memory-leak-and-eventual-snmpd-crash-CVE-2026-33799</a> <hr> <h3>Juniper: 2026-07 Security Bulletin: Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash (CVE-2026-21901)</h3> <p /> <A HREF="https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Configuration-of-a-specific-SSH-option-results-in-mgd-crash-CVE-2026-21901">https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Configuration-of-a-specific-SSH-option-results-in-mgd-crash-CVE-2026-21901</a> <hr> <h3>Juniper: 2026-07 Security Bulletin: cRPD: Multiple vulnerabilities resolved in cRPD 26.2R1</h3> <p /> <A HREF="https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-cRPD-Multiple-vulnerabilities-resolved-in-cRPD-26-2R1">https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-cRPD-Multiple-vulnerabilities-resolved-in-cRPD-26-2R1</a> <hr> <h3>Juniper: 2026-07 Security Bulletin: Junos Space: Multiple vulnerabilities resolved in 26.1R1 Patch V1 Release</h3> <p /> <A HREF="https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-Space-Multiple-vulnerabilities-resolved-in-26-1R1-Patch-V1-Release">https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-Space-Multiple-vulnerabilities-resolved-in-26-1R1-Patch-V1-Release</a> <hr> <h3>Juniper: 2026-07 Security Bulletin: Network Director: Multiple vulnerabilities resolved in 7.1R3 release</h3> <p /> <A HREF="https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Network-Director-Multiple-vulnerabilities-resolved-in-7-1R3-release">https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Network-Director-Multiple-vulnerabilities-resolved-in-7-1R3-release</a> <hr> <h3>Juniper: 2026-07 Security Bulletin: Junos OS Evolved: URL handling vulnerability in libfetch results in heap buffer overflow (CVE-2020-7450)</h3> <p /> <A HREF="https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-Evolved-URL-handling-vulnerability-in-libfetch-results-in-heap-buffer-overflow-CVE-2020-7450">https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-Evolved-URL-handling-vulnerability-in-libfetch-results-in-heap-buffer-overflow-CVE-2020-7450</a> <hr> <h3>Juniper: 2026-07 Security Bulletin: CTPView: Multiple vulnerabilities resolved in 9.3R2-3 Release</h3> <p /> <A HREF="https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-CTPView-Multiple-vulnerabilities-resolved-in-9-3R2-3-Release">https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-CTPView-Multiple-vulnerabilities-resolved-in-9-3R2-3-Release</a> <hr> <h3>LWN: Security updates for Wednesday</h3> <p /> <A HREF="https://lwn.net/Articles/1081798/">https://lwn.net/Articles/1081798/</a>

CERT.at2026-07-08T19:16:01ZCERT.at2026-07-07T18:59:45Z2026-07-07T18:59:45Z

<h2>End-of-Day report</h2> Timeframe: Montag 06-07-2026 18:00 - Dienstag 07-07-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler <h2> News </h2> <h3>Angreifer können Balkonkraftwerke aus der Ferne abschalten</h3> Geräte des chinesischen Herstellers Hoymiles lassen sich durch eine Sicherheitslücke fernsteuern. <p /> <A HREF="https://futurezone.at/digital-life/balkonkraftwerk-sicherheitsluecke-hoymiles-pv-anlage-passwort/403174823">https://futurezone.at/digital-life/balkonkraftwerk-sicherheitsluecke-hoymiles-pv-anlage-passwort/403174823</a> <hr> <h3>Air-Gapped-Systeme: Malware leitet Daten über Monitorkabel aus</h3> Air Gapping schützt vor einer unerwünschten Datenausleitung. Ein neuartiger Angriff umgeht diesen Schutz über das Monitor-Kabel - und das ziemlich performant. <p /> <A HREF="https://www.golem.de/news/air-gapped-systeme-malware-leitet-daten-ueber-monitorkabel-aus-2607-210592.html">https://www.golem.de/news/air-gapped-systeme-malware-leitet-daten-ueber-monitorkabel-aus-2607-210592.html</a> <hr> <h3>Geheimdienstbericht in Kanada: Cyberoperationen im Ausland</h3> Kanadas Nachrichtendienst führt Cyberangriffe gegen Drogenhändler, Extremisten und Cyberkriminelle durch. Ungewöhnlich ist das öffentliche Bekenntnis. <p /> <A HREF="https://www.heise.de/news/Geheimdienstbericht-in-Kanada-Cyberoperationen-im-Ausland-11355701.html">https://www.heise.de/news/Geheimdienstbericht-in-Kanada-Cyberoperationen-im-Ausland-11355701.html</a> <hr> <h3>OpenSSH bringt erstmals hybride Post-Quantum-Signaturen</h3> OpenSSH 10.4 behebt mehrere Sicherheitslücken in SSH, SCP und SFTP. Zudem gibt es Protokollverschärfungen und experimentelle Post-Quantum-Signaturen. <p /> <A HREF="https://www.heise.de/news/OpenSSH-bringt-erstmals-hybride-Post-Quantum-Signaturen-11356381.html">https://www.heise.de/news/OpenSSH-bringt-erstmals-hybride-Post-Quantum-Signaturen-11356381.html</a> <hr> <h3>Woodruff: You shouldnt trust trusted publishing</h3> Trusted Publishing is a mechanism for establishing trust between an external machine identity (like a CI/CD workflow) and one or more projects on a package index/registry. The "trust" in "Trusted Publishing" refers to that trust relationship, and not to anything else. It is not, and cannot be, a signal for package trust or quality. You cannot use it to determine whether a package is safe or "good," and PyPI consciously stymies attempts to misuse it for that purpose by not rendering it as a "green checkmark" or anything else of the sort. Or as another framing: Trusted Publishing is just a form of authentication. It doesn't tell you anything other than that an upload was authenticated, which all uploads to PyPI are. <p /> <A HREF="https://lwn.net/Articles/1081690/">https://lwn.net/Articles/1081690/</a> <hr> <h3>Scattered Spider-Mitglied Peter Stokes durch Windows GUID identifiziert und überführt</h3> Vor einiger Zeit wurde Peter Stokes als mutmaßliches Mitglied der Cybergang Scattered Spider in Finnland verhaftet und ist inzwischen in die USA ausgeliefert worden. Aus Gerichtsdokumenten geht nun hervor, dass die von Windows vergebene eindeutige GDID, per Telemetrie - samt weiteren Daten - an Microsoft übertragen, Stokes bei seinen Aktivitäten, die er bestmöglich verschleierte, verraten und zu seiner Identifizierung geführt hat. <p /> <A HREF="https://borncity.com/blog/2026/07/06/scattered-spider-mitglied-peter-stokes-durch-windows-guid-identifiziert-und-ueberfuehrt/">https://borncity.com/blog/2026/07/06/scattered-spider-mitglied-peter-stokes-durch-windows-guid-identifiziert-und-ueberfuehrt/</a> <hr> <h3>Joomla Helix3-Lücke: Hacked by Antonkill</h3> Kurzer Hinweis für Leute, die eine Joomla-Instanz betreiben oder eine solche Installation in ihrem Umfeld kennen. Eine Schwachstelle im Helix3-Framework von JoomShaper wird durch ein Botnetz ausgenutzt, um Joomla-Instanzen zu infizieren. Dort taucht dann die Meldung "Hacked by AntonKill" oder auch "Hacked by trenggalek6etar" auf. <p /> <A HREF="https://borncity.com/blog/2026/07/07/joomla-helix3-luecke-hacked-by-antonkill/">https://borncity.com/blog/2026/07/07/joomla-helix3-luecke-hacked-by-antonkill/</a> <hr> <h3>Reducing Microsoft Sentinel Costs Without Compromising Detection - Part 2: The Firewall Quest</h3> Continuing our journey through Sentinel ingestion cost reduction, this part focuses on one of the most expensive log sources: firewalls, and more specifically, network traffic events. <p /> <A HREF="https://blog.nviso.eu/2026/07/07/reducing-microsoft-sentinel-costs-without-compromising-detection-part-2-the-firewall-quest/">https://blog.nviso.eu/2026/07/07/reducing-microsoft-sentinel-costs-without-compromising-detection-part-2-the-firewall-quest/</a> <hr> <h3>UAT-7810 continues building ORB networks using new malware</h3> Talos assesses with high confidence that UAT-7810 is a China-nexus threat actor based on the infrastructure that it provides to secondary China-nexus APTs such as UAT-5918. Open-source reporting has also illustrated overlapping tooling between UAT-5918 and UAT-7810. However, at this time, Talos considers UAT-5918 and UAT-7810 separate APT actors tasked with their own set of objectives and targets. <p /> <A HREF="https://blog.talosintelligence.com/uat-7810/">https://blog.talosintelligence.com/uat-7810/</a> <hr> <h3>Software vom BSI und Fraunhofer: Wie KI ihre eigenen Deepfakes entlarvt</h3> Forschende vom Fraunhofer-Institut und Bundesamt für Sicherheit haben ein neues Verfahren entwickelt, um Deepfakes zu erkennen. Doch es bietet noch mehr. <p /> <A HREF="https://heise.de/-11355899">https://heise.de/-11355899</a> <hr> <h3>Sicherheitsalbtraum Wechselrichter: Hoymiles lässt Nachbarschaften verstummen</h3> Schwere Funkschwachstellen bei Hunderttausenden PV-Anlagen erlauben laut Forschern das Abschalten im Vorbeifahren und sogar die physische Zerstörung der Geräte. <p /> <A HREF="https://heise.de/-11357067">https://heise.de/-11357067</a> <hr> <h3>Entra Agent ID: Protect, detect, respond</h3> This post continues and concludes our series on Agent ID, by outlining steps that an administrator or security team can take to secure blueprints and agent identities created in their local Entra ID tenant. <p /> <A HREF="https://securitylabs.datadoghq.com/articles/agent-id-protect-detect-respond/">https://securitylabs.datadoghq.com/articles/agent-id-protect-detect-respond/</a> <hr> <h3>KYC : Bypass age verification using generative video models</h3> Historically reserved for the banking sector, the KYC (Know Your Customer) process is now making its way into many online services, driven by increasingly strict legislation on anonymity and age verification. To comply, platforms deploy significant measures aimed at guaranteeing the "proof of life" of the user behind their webcam or smartphone. However, the meteoric rise of generative video AI models completely reshuffles the deck, offering attackers formidable and accessible tools to fool these systems. The French PVID framework aims to counter this new threat. <p /> <A HREF="https://www.synacktiv.com/en/publications/kyc-bypass-age-verification-using-generative-video-models.html">https://www.synacktiv.com/en/publications/kyc-bypass-age-verification-using-generative-video-models.html</a> <hr> <h3>Phishing poses as big-brand job interview to steal Google accounts</h3> A phishing campaign is impersonating more than 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, in fake job interviews to steal Google account credentials from marketing professionals. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/">https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/</a> <h2> Vulnerabilities </h2> <h3>BeyondTrust warns of critical flaws in remote access software</h3> BeyondTrust warned customers to patch two critical security flaws in its Remote Support (RS) and Privileged Remote Access (PRA) software that could allow attackers to bypass authentication. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-flaws-in-remote-access-software/">https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-flaws-in-remote-access-software/</a> <hr> <h3>Tenda firmware (multiple versions) contains hidden authentication backdoor</h3> Several versions of Tenda firmware contain an undocumented authentication backdoor that grants administrative access to the devices' web management interfaces. An attacker can expoit this vulnerability, tracked as CVE-2026-11405, to bypass the password verification process and obtain full administrative control without valid credentials. <p /> <A HREF="https://kb.cert.org/vuls/id/213560">https://kb.cert.org/vuls/id/213560</a> <hr> <h3>Samsung-Sicherheitsupdate: Juli-Patches für Galaxy-Geräte</h3> Samsung hat sein Security-Bulletin für Juli 2026 veröffentlicht und verteilt wichtige Sicherheitspatches vor allem für die Topmodelle der Galaxy-Reihe. <p /> <A HREF="https://www.heise.de/news/Samsung-Sicherheitsupdate-Juli-Patches-fuer-Galaxy-Geraete-11356339.html">https://www.heise.de/news/Samsung-Sicherheitsupdate-Juli-Patches-fuer-Galaxy-Geraete-11356339.html</a> <hr> <h3>Zimbra Collaboration Suite: Kritische Lücke macht Classic Web Client angreifbar</h3> Die Zimbra-Entwickler haben im Zuge eines Patch Release Updates auf Version 10.1.19 der Zimbra Collaboration Suite (ZCS) auf ein mögliches Sicherheitsrisiko aufmerksam gemacht. Laut Patch Release Notes kann die zugrundeliegende Schwachstelle ausschließlich über die Komponente Classic Web Client missbraucht werden, wird in diesem Kontext allerdings als -kritisch- bezeichnet. <p /> <A HREF="https://www.heise.de/news/Zimbra-Collaboration-Suite-Kritische-Luecke-macht-Classic-Web-Client-angreifbar-11356522.html">https://www.heise.de/news/Zimbra-Collaboration-Suite-Kritische-Luecke-macht-Classic-Web-Client-angreifbar-11356522.html</a> <hr> <h3>Cloudsysteme gefährdet: 16 Jahre alte KVM-Lücke ermöglicht VM-Ausbruch unter Linux</h3> Eine seit 2010 bestehende Lücke im KVM-Code des Linux-Kernels gefährdet unter anderem Cloudsysteme. Angreifer können damit VM-Hosts kapern. <p /> <A HREF="https://www.golem.de/news/cloudsysteme-gefaehrdet-16-jahre-alte-kvm-luecke-ermoeglicht-vm-ausbruch-unter-linux-2607-210581.html">https://www.golem.de/news/cloudsysteme-gefaehrdet-16-jahre-alte-kvm-luecke-ermoeglicht-vm-ausbruch-unter-linux-2607-210581.html</a> <hr> <h3>LWN Security updates for Tuesday</h3> <p /> <A HREF="https://lwn.net/Articles/1081644/">https://lwn.net/Articles/1081644/</a>

CERT.at2026-07-07T18:59:45ZCERT.at2026-07-06T18:14:32Z2026-07-06T18:14:32Z

<h2>End-of-Day report</h2> Timeframe: Freitag 03-07-2026 18:00 - Montag 06-07-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler <h2> News </h2> <h3>Sicherheitswarnungen: Node.js will KI-Flut mit KI bekämpfen</h3> In der Node.js-Community ist eine Diskussion darüber entstanden, wie sie weiter mit der Vielzahl an LLM-generierten Sicherheitsmeldungen verfahren soll. <p /> <A HREF="https://www.heise.de/news/Sicherheitswarnungen-Node-js-will-KI-Flut-mit-KI-bekaempfen-11355142.html">https://www.heise.de/news/Sicherheitswarnungen-Node-js-will-KI-Flut-mit-KI-bekaempfen-11355142.html</a> <hr> <h3>WhatsApp-Benutzernamen wecken Befürchtungen an möglichem Identitätsdiebstahl</h3> Betrüger könnten WhatsApp-Benutzernamen bekannter Personen zu kriminellen Zwecken missbrauchen, warnen Sicherheitsexperten. Reservierungen sind bereits möglich. <p /> <A HREF="https://heise.de/-11354304">https://heise.de/-11354304</a> <hr> <h3>When checking the URL isn-t enough: a Device Code Phishing attack via a Microsoft website</h3> The OAuth 2.0 Device Authorization Grant specification was designed to streamline authentication for Smart TVs, IoT devices, and printers. Today, threat actors are weaponizing it. <p /> <A HREF="https://securelist.com/microsoft-device-code-phishing-attack/120350/">https://securelist.com/microsoft-device-code-phishing-attack/120350/</a> <hr> <h3>SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing</h3> Scanners meant to catch malicious add-on "skills" for AI coding agents can be fooled by a few simple changes that leave the malware working, according to a new study from researchers at the Hong Kong University of Science and Technology. Their strongest trick slipped past every scanner tested more than 90% of the time, and the same team built a runtime checker that catches most of the disguised skills the scanners miss. <p /> <A HREF="https://thehackernews.com/2026/07/new-skillcloak-technique-lets-malicious.html">https://thehackernews.com/2026/07/new-skillcloak-technique-lets-malicious.html</a> <hr> <h3>Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages</h3> Researchers found a flaw in Opera GX, the gaming-focused version of the Opera browser, that let a malicious website silently install a browser add-on and use it to lift specific data from the pages a victim visits.In a proof of concept, they reconstructed a signed-in users full Gmail address from a single visit, with no click. [..] The fix shipped in Opera GX version 130.0.5847.89, so anyone on a current build is already covered; you can confirm yours at opera://about. There is no CVE. <p /> <A HREF="https://thehackernews.com/2026/07/opera-gx-flaw-let-malicious-sites-auto.html">https://thehackernews.com/2026/07/opera-gx-flaw-let-malicious-sites-auto.html</a> <hr> <h3>PDF-Abo-Falle: Wenn aus 99 Cent ein teures Abo wird</h3> Wer eine PDF-Datei schnell online bearbeiten möchte, stößt auf zahlreiche Dienste, die kostenlos oder besonders günstig wirken. Nach der Bearbeitung wird häufig lediglich ein kleiner Betrag von 99 Cent für den Download verlangt. Was viele nicht bemerken: Im Hintergrund wird oft ein teures Abo abgeschlossen. <p /> <A HREF="https://www.watchlist-internet.at/news/pdf-abo-falle/">https://www.watchlist-internet.at/news/pdf-abo-falle/</a> <hr> <h3>AI Used in Ransomware Attack</h3> Using AI to automate part or all of the attack chain is also more of an evolution than a revolution in ransomware. [..] Nevertheless, the attack shows how the use of AI can lead to faster, if still unsophisticated, attacks that give victims less time to react. <p /> <A HREF="https://www.truesec.com/hub/blog/ai-used-in-ransomware-attack">https://www.truesec.com/hub/blog/ai-used-in-ransomware-attack</a> <h2> Vulnerabilities </h2> <h3>OPNsense-Update beseitigt kritische Rootlücke und weitere Sicherheitsrisiken</h3> Die kürzlich erschienenen Versionen 26.1.11 und 26.4.1(p1) von OPNsense, einer quelloffenen Firewall- und Routing-Plattform auf FreeBSD-Basis, bringen Sicherheitsfixes mit. Unter den geschlossenen Lücken befindet sich auch eine kritische: CVE-2026-57155 (CVSS-Score 9.9 von 10.0) hätte unter bestimmten Voraussetzungen zur Rechteausweitung und letztlich zur kompletten Firewall-Übernahme missbraucht werden können. <p /> <A HREF="https://www.heise.de/news/OPNsense-Update-beseitigt-kritische-Rootluecke-und-weitere-Sicherheitsrisiken-11355118.html">https://www.heise.de/news/OPNsense-Update-beseitigt-kritische-Rootluecke-und-weitere-Sicherheitsrisiken-11355118.html</a> <hr> <h3>HestiaCP Admin Takeover & RCE</h3> A low privileged user in HestiaCP can exploit a Broken Authorisation flaw to takeover Admin accounts. [..] A patch can be found here. This currently needs to be applied manually until HestiaCP decide to create a release. CVE-2026-12196 <p /> <A HREF="https://projectblack.io/blog/hestiacp-admin-takeover-rce/">https://projectblack.io/blog/hestiacp-admin-takeover-rce/</a> <hr> <h3>Dell: DSA-2026-278: Security Update for Dell PowerProtect Data Domain Multiple Vulnerabilities</h3> <p /> <A HREF="https://www.dell.com/support/kbdoc/de-de/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities">https://www.dell.com/support/kbdoc/de-de/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities</a> <hr> <h3>Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression - host root</h3> <p /> <A HREF="https://github.com/coollabsio/coolify/security/advisories/GHSA-chg4-63hm-xv9x">https://github.com/coollabsio/coolify/security/advisories/GHSA-chg4-63hm-xv9x</a> <hr> <h3>LWN: Security updates for Monday</h3> <p /> <A HREF="https://lwn.net/Articles/1081495/">https://lwn.net/Articles/1081495/</a> <hr> <h3>Roundcube: Security updates 1.6.17 and 1.7.2 released</h3> <p /> <A HREF="https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2">https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2</a>

CERT.at2026-07-06T18:14:32ZCERT.at2026-07-03T18:15:57Z2026-07-03T18:15:57Z

<h2>End-of-Day report</h2> Timeframe: Donnerstag 02-07-2026 18:00 - Freitag 03-07-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler <h2> News </h2> <h3>Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices</h3> Google has significantly degraded NetNut, one of the biggest networks that turns home devices into rented relays for other people's traffic. <p /> <A HREF="https://thehackernews.com/2026/07/google-disrupts-netnut-residential.html">https://thehackernews.com/2026/07/google-disrupts-netnut-residential.html</a> <hr> <h3>Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials</h3> Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access. <p /> <A HREF="https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html">https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html</a> <hr> <h3>Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer</h3> A previously undocumented threat actor known as Armored Likho has been attributed to cyber attacks targeting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan. <p /> <A HREF="https://thehackernews.com/2026/07/armored-likho-targets-government.html">https://thehackernews.com/2026/07/armored-likho-targets-government.html</a> <hr> <h3>Indirect Prompt Injection in Web Content Targets AI Agents</h3> AI agents are increasingly changing how users interact with web content, making the content itself a growing attack surface for threat actors. Just as a human user can be socially engineered through phishing, AI agents are also susceptible to similar attacks. Indirect prompt injection (IPI) is an example of these types of attacks that embed malicious instructions in the content retrieved by an AI agent (websites, documents, email, etc.) to influence the agent-s reasoning during task execution. Zscaler ThreatLabz has observed malicious websites that impersonate legitimate services and use IPI to manipulate AI-driven workflows. <p /> <A HREF="https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents">https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents</a> <hr> <h3>Fake Google and Cloudflare verification pages spread multiple malware families</h3> ClickFix attacks, which trick people into running malicious commands themselves, continue to evolve. This latest campaign uses fake Google and Cloudflare verification pages to convince victims to infect their own devices. <p /> <A HREF="https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families">https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families</a> <hr> <h3>The Gentlemen ransomware: what you need to know</h3> Despite the impeccably polite name, there is nothing polite or refined about this particular gang of cybercriminals. In little more than a year, The Gentlemen has gone from relative obscurity to becoming one of the most active ransomware operations on the planet. First surfacing in mid-2025, The Gentlemen is a ransomware-as-a-service (RaaS) operation that appears to have splintered away from the notorious Qilin ransomware group. <p /> <A HREF="https://www.fortra.com/blog/gentlemen-ransomware-what-you-need-know">https://www.fortra.com/blog/gentlemen-ransomware-what-you-need-know</a> <hr> <h3>It-s 37oC, And All We Can Think About Is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza)</h3> We-re back, melting - we-ve tried shouting, screaming, and throwing things at the Sun, and it is just not working. <p /> <A HREF="https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/">https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/</a> <hr> <h3>Mitglied im Sonderausschuss zu Pegasus: EU-Abgeordneter mit Spyware attackiert</h3> Vor Jahren hat das Europaparlament Angriffe mit der Pegasus-Spyware in der EU untersucht. Ein stellvertretendes Ausschussmitglied wurde da selbst angegriffen. <p /> <A HREF="https://heise.de/-11352514">https://heise.de/-11352514</a> <hr> <h3>How GitHub used secret scanning to reach inbox zero</h3> GitHub had 20,000+ secret scanning alerts across 15,000 repositories. Here-s how we separated signal from noise, built remediation workflows, and reached inbox zero in nine months. <p /> <A HREF="https://github.blog/security/application-security/how-github-used-secret-scanning-to-reach-inbox-zero/">https://github.blog/security/application-security/how-github-used-secret-scanning-to-reach-inbox-zero/</a> <h2> Vulnerabilities </h2> <h3>Behörde warnt: Microsoft-Sharepoint-Server werden attackiert</h3> Angreifer nutzen eine gefährliche Sicherheitslücke in Microsoft Sharepoint aus, um Schadcode einzuschleusen. Admins sollten handeln. <p /> <A HREF="https://www.golem.de/news/behoerde-warnt-microsoft-sharepoint-server-werden-attackiert-2607-210462.html">https://www.golem.de/news/behoerde-warnt-microsoft-sharepoint-server-werden-attackiert-2607-210462.html</a> <hr> <h3>Jetzt updaten: Kritische Lücken in Ubiquiti UniFi erlauben Remote-Angriffe</h3> Mehrere Produkte aus Ubiquitis UniFi-Ökosystem sind von teils kritischen Lücken betroffen. Admins sollten die abgesicherten Versionen zügig einspielen. <p /> <A HREF="https://www.heise.de/news/Jetzt-updaten-Kritische-Luecken-in-Ubiquiti-UniFi-erlauben-Remote-Angriffe-11352622.html">https://www.heise.de/news/Jetzt-updaten-Kritische-Luecken-in-Ubiquiti-UniFi-erlauben-Remote-Angriffe-11352622.html</a> <hr> <h3>Angriff per USB-Stick: KI findet gefährliche Lücke in populärem FatFs-Treiber</h3> Das bloße Anschließen eines USB-Sticks reicht aus, um auf vielen Embedded- und IoT-Geräten Schadcode einzuschleusen. Einen Patch gibt es bisher nicht. (Sicherheitslücke, Speichermedien) <p /> <A HREF="https://www.golem.de/news/angriff-per-usb-stick-ki-findet-gefaehrliche-luecke-in-populaerem-fatfs-treiber-2607-210484.html">https://www.golem.de/news/angriff-per-usb-stick-ki-findet-gefaehrliche-luecke-in-populaerem-fatfs-treiber-2607-210484.html</a> <hr> <h3>LWN Security updates for Friday</h3> <p /> <A HREF="https://lwn.net/Articles/1081187/">https://lwn.net/Articles/1081187/</a> <hr> <h3>NCSC-2026-0219 [1.00] [M/H] Kwetsbaarheden verholpen in GitHub Enterprise Server</h3> <p /> <A HREF="https://advisories.ncsc.nl/advisory?id=NCSC-2026-0219">https://advisories.ncsc.nl/advisory?id=NCSC-2026-0219</a> <hr> <h3>NCSC-2026-0220 [1.00] [M/H] Kwetsbaarheden verholpen in Rancher door Rancher Labs</h3> <p /> <A HREF="https://advisories.ncsc.nl/advisory?id=NCSC-2026-0220">https://advisories.ncsc.nl/advisory?id=NCSC-2026-0220</a>

CERT.at2026-07-03T18:15:57ZCERT.at2026-07-02T18:23:08Z2026-07-02T18:23:08Z

<h2>End-of-Day report</h2> Timeframe: Mittwoch 01-07-2026 18:00 - Donnerstag 02-07-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler <h2> News </h2> <h3>Cisco finally confirms attackers exploiting Unified CM flaw</h3> Cisco confirmed that attackers are now exploiting a Unified Communications Manager (Unified CM) vulnerability patched in early June. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/cisco-finally-confirms-attackers-exploiting-unified-cm-flaw/">https://www.bleepingcomputer.com/news/security/cisco-finally-confirms-attackers-exploiting-unified-cm-flaw/</a> <hr> <h3>6 security settings every GitHub maintainer should enable this week</h3> These six free settings will not make your project unhackable. Nothing will. What they will do is close the easy doors. Turn these on, and your project will be meaningfully harder to attack than it was before. <p /> <A HREF="https://github.blog/security/6-security-settings-every-github-maintainer-should-enable-this-week/">https://github.blog/security/6-security-settings-every-github-maintainer-should-enable-this-week/</a> <hr> <h3>Ransomware im Anmarsch: Hacker greifen mit fieser Interpol-Masche an</h3> Angreifer geben sich bei Unternehmen als Personal von Interpol aus und ködern mit angeblichen Beweismitteln. Doch stattdessen gibt es Ransomware. <p /> <A HREF="https://www.golem.de/news/ransomware-im-anmarsch-hacker-greifen-mit-fieser-interpol-masche-an-2607-210436.html">https://www.golem.de/news/ransomware-im-anmarsch-hacker-greifen-mit-fieser-interpol-masche-an-2607-210436.html</a> <hr> <h3>Falsche Rechnungen und Chatpartner bei ZumDaten, MichVerlieben & Co.</h3> Eine Rechnung über mehrere hundert Euro von einer Datingplattform, bei der Sie nie ein Konto angelegt haben? Genau das berichten derzeit zahlreiche Betroffene. Doch nicht nur Menschen, die sich nie angemeldet haben, geraten ins Visier: Auch Registrierte können durch fragwürdige Praktiken viel Geld verlieren. Was hinter den Maschen von michverlieben.com, zumdaten.com und Co. steckt - und wie Sie sich dagegen wehren können. <p /> <A HREF="https://www.watchlist-internet.at/news/falsche-zahlungsaufforderungen-von-datingplattformen/">https://www.watchlist-internet.at/news/falsche-zahlungsaufforderungen-von-datingplattformen/</a> <hr> <h3>New ChocoPoC malware targets researchers via trojanized PoC exploits</h3> Multiple weaponized proof-of-concept (PoC) exploits on GitHub were found delivering a Python-based remote access trojan (RAT) named ChocoPoC that can execute commands and steal sensitive data in a campaign believed to target cybersecurity researchers. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/">https://www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/</a> <hr> <h3>Medtronic notifies customers impacted by ShinyHunters data breach</h3> Healthcare device firm Medtronic is notifying affected customers about a data breach that exposed their personal data to an unauthorized third party. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/medtronic-notifies-customers-impacted-by-shinyhunters-data-breach/">https://www.bleepingcomputer.com/news/security/medtronic-notifies-customers-impacted-by-shinyhunters-data-breach/</a> <hr> <h3>Opera rolls out Paste Protect feature to fight ClickFix attacks</h3> Opera has introduced Paste Protect, a security feature designed to block ClickFix-style attacks that trick users into executing malicious commands through social engineering. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/opera-rolls-out-paste-protect-feature-to-fight-clickfix-attacks/">https://www.bleepingcomputer.com/news/security/opera-rolls-out-paste-protect-feature-to-fight-clickfix-attacks/</a> <hr> <h3>VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer</h3> Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to deliver an information stealer called PureLogs. <p /> <A HREF="https://thehackernews.com/2026/07/veildrop-malware-chain-uses-blogger.html">https://thehackernews.com/2026/07/veildrop-malware-chain-uses-blogger.html</a> <hr> <h3>Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters</h3> Argo CD, a widely used tool for deploying software to Kubernetes, has an unpatched flaw in its repo-server component that lets an unauthenticated attacker run code, provided they can reach the component's internal network port. Synacktiv, which found the bug, says it can lead to a full cluster takeover. There is no fix and no CVE. The firm says it reported the flaw to Argo CD's maintainers in January 2025; roughly eighteen months later, it remains unpatched, so it published the details to warn users. <p /> <A HREF="https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html">https://thehackernews.com/2026/07/unpatched-argo-cd-repo-server-flaw.html</a> <hr> <h3>FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations</h3> The recently discovered financially-motivated FortiBleed campaign has been attributed to INC and Lynx ransomware operations, indicating that the verified, stolen credentials were intended for follow-on intrusions. <p /> <A HREF="https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html">https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html</a> <hr> <h3>Fehler in -E-Mail-Adresse verbergen- von Apple weiter ohne Fix</h3> -Hide my E-Mail- oder -E-Mail-Adresse verbergen- soll eigentlich User vor Spam und Co. schützen. Es gibt aber eine Lücke. Die Entdecker warten weiter auf Apple. <p /> <A HREF="https://heise.de/-11351055">https://heise.de/-11351055</a> <hr> <h3>PamStealer: a Rust-based macOS infostealer that validates credentials through PAM</h3> Jamf Threat Labs investigates PamStealer, a macOS infostealer disguised as the legitimate Maccy clipboard manager that uses a two-stage attack chain to silently harvest data and clipboard contents while evading detection. <p /> <A HREF="https://www.jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/">https://www.jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/</a> <h2> Vulnerabilities </h2> <h3>WinRAR flaw could allow attackers to take control of your computer</h3> A new WinRAR update fixes a serious security flaw, but without automatic updates many users could miss the patch. <p /> <A HREF="https://www.malwarebytes.com/blog/news/2026/07/winrar-flaw-could-allow-attackers-to-take-control-of-your-computer">https://www.malwarebytes.com/blog/news/2026/07/winrar-flaw-could-allow-attackers-to-take-control-of-your-computer</a> <hr> <h3>Schwachstellen in Synology MailPlus Server lassen Angreifer passieren</h3> Netzwerkspeicher von Synology mit MailPlus Server sind attackierbar. Ein Sicherheitspatch schafft Abhilfe. <p /> <A HREF="https://heise.de/-11351331">https://heise.de/-11351331</a> <hr> <h3>ClamAV Vulnerabilities Affecting Cisco Products: July 2026</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR</a> <hr> <h3>Cisco Catalyst Center Arbitrary File Read Vulnerability</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-catc-file-read-wLH2vf8X">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-catc-file-read-wLH2vf8X</a> <hr> <h3>Drupal Security Advisories 2026-July-01</h3> <p /> <A HREF="https://www.drupal.org/security">https://www.drupal.org/security</a> <hr> <h3>SVD-2026-0701: Third-Party Package Updates in Python for Scientific Computing - July 2026</h3> <p /> <A HREF="https://advisory.splunk.com//advisories/SVD-2026-0701">https://advisory.splunk.com//advisories/SVD-2026-0701</a> <hr> <h3>LWN Security updates for Thursday</h3> <p /> <A HREF="https://lwn.net/Articles/1080956/">https://lwn.net/Articles/1080956/</a>

CERT.at2026-07-02T18:23:08ZCERT.at2026-07-01T18:23:47Z2026-07-01T18:23:47Z

<h2>End-of-Day report</h2> Timeframe: Dienstag 30-06-2026 18:00 - Mittwoch 01-07-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler <h2> News </h2> <h3>CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)</h3> For those that don-t start violently wretching when the phrase -Citrix NetScaler- is uttered, we have another word to whisper: -CitrixBleed-. As many know, the term CitrixBleed now refers to not a single vulnerability, but an entire class of Memory Disclosure-esque vulnerabilities in Citrix NetScaler devices, many of which have played roles in breaches and incidents in recent memory. [..] We-ve given up counting the numbers, and so we-ve decided to call this vulnerability -CitrixBleed To Infinity And Beyond-. <p /> <A HREF="https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451/">https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451/</a> <hr> <h3>Over 900 Oracle E-Business instances exposed to ongoing attacks</h3> Over 900 Oracle E-Business Suite (EBS) instances have been found exposed online amid ongoing attacks exploiting a critical security flaw. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/over-900-oracle-e-business-instances-exposed-to-ongoing-attacks/">https://www.bleepingcomputer.com/news/security/over-900-oracle-e-business-instances-exposed-to-ongoing-attacks/</a> <hr> <h3>The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign</h3> Kaspersky experts have uncovered a malicious network infrastructure for delivering AsyncRAT. The Trojan is dropped via compromised ScreenConnect software. In this post, we break down the infection chain and analyze the C2 infrastructure. <p /> <A HREF="https://securelist.com/tr/the-soc-files-screenconnect-campaign-with-asyncrat/120472/">https://securelist.com/tr/the-soc-files-screenconnect-campaign-with-asyncrat/120472/</a> <hr> <h3>Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data</h3> New Microsoft research shows how attackers can hijack AI agents that act on a users behalf, using nothing more than a poisoned tool description to make the agent quietly hand over company data to an outsider.The trick is that the agent never breaks a rule. Every step looks routine, so in a default setup no alarm may fire. <p /> <A HREF="https://thehackernews.com/2026/06/microsoft-warns-poisoned-mcp-tool.html">https://thehackernews.com/2026/06/microsoft-warns-poisoned-mcp-tool.html</a> <hr> <h3>RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS</h3> A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline. [..] RustDuck does not lean on a single clever trick. It sprays a mix of old, well-known weaknesses and hopes one sticks. The first is the oldest in the book: devices left on the internet with weak or default passwords on their remote-login services (Telnet and SSH). Guess the password, walk in. <p /> <A HREF="https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html">https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html</a> <hr> <h3>Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector</h3> Unit 42 researchers found that large language models (LLMs) consistently hallucinate web domains for legitimate brands. Adversaries are actively weaponizing this vector by registering these nonexistent domains to intercept traffic generated by AI systems. We call this phenomenon phantom squatting, and it poses a significant risk to the software supply chain. <p /> <A HREF="https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/">https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/</a> <hr> <h3>ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365</h3> Cisco Talos identified a fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform documented by Sekoia and Microsoft in early 2026. <p /> <A HREF="https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/">https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/</a> <hr> <h3>Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique</h3> In this research, DeepSeek connected unrealistic browser-malware concepts with a real browser capability, turning an AI-generated malware hallucination into a plausible browser-native ransomware technique. Although the generated sample was incomplete, it exposed a practical abuse path based on the File System Access API and access to photo directories. <p /> <A HREF="https://research.checkpoint.com/2026/browser-only-ransomware-from-llm-hallucinations-to-a-practical-attack-technique/">https://research.checkpoint.com/2026/browser-only-ransomware-from-llm-hallucinations-to-a-practical-attack-technique/</a> <h2> Vulnerabilities </h2> <h3>Adobe patches seven max severity ColdFusion, Campaign flaws</h3> Adobe has released security patches for seven maximum-severity vulnerabilities in the ColdFusion web app development platform and the Campaign Classic marketing automation platform. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-severity-coldfusion-campaign-flaws/">https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-severity-coldfusion-campaign-flaws/</a> <hr> <h3>Riesiges Update: 382 Sicherheitslücken in Google Chrome entdeckt</h3> Die neueste Chrome-Version schließt fast 400 teils kritische Sicherheitslücken. Auch für Edge, Vivaldi und Brave dürften entsprechende Updates folgen. <p /> <A HREF="https://www.golem.de/news/riesiges-update-382-sicherheitsluecken-in-google-chrome-entdeckt-2607-210372.html">https://www.golem.de/news/riesiges-update-382-sicherheitsluecken-in-google-chrome-entdeckt-2607-210372.html</a> <hr> <h3>Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service</h3> Citrix on Tuesday released security updates to address multiple flaws in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that could be exploited by an attacker to facilitate arbitrary file reads or trigger a denial-of-service (DoS) condition. CVE-2026-8451 (CVSS score: 8.8) - An insufficient input validation vulnerability leading to memory overread when NetScaler ADC or NetScaler Gateway is configured as a SAML IDP. <p /> <A HREF="https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html">https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html</a> <hr> <h3>Root-Sicherheitslücken in alternativer Router-Firmware OpenWRT geschlossen</h3> Die OpenWRT-Entwickler haben in einer aktuellen Version unter anderem mehrere kritische Sicherheitslücken geschlossen. [..] Am gefährlichsten gilt eine -kritische- Lücke mit einem CVSSS Score 9.9 von 10 in LuCI. Eine CVE-Nummer wurde offensichtlich bislang nicht vergeben. Voraussetzung für eine Attacke ist, dass der VPN-Dienst Tailscale installiert ist. <p /> <A HREF="https://www.heise.de/news/Root-Sicherheitsluecken-in-alternativer-Router-Firmware-OpenWRT-geschlossen-11350761.html">https://www.heise.de/news/Root-Sicherheitsluecken-in-alternativer-Router-Firmware-OpenWRT-geschlossen-11350761.html</a> <hr> <h3>HCL BigFix: PC-Fernverwaltung: Man-in-the-Middle-Attacken auf HCL BigFix möglich</h3> <p /> <A HREF="https://www.heise.de/news/PC-Fernverwaltung-Man-in-the-Middle-Attacken-auf-HCL-BigFix-moeglich-11350301.html">https://www.heise.de/news/PC-Fernverwaltung-Man-in-the-Middle-Attacken-auf-HCL-BigFix-moeglich-11350301.html</a> <hr> <h3>LWN: Security updates for Wednesday</h3> <p /> <A HREF="https://lwn.net/Articles/1080689/">https://lwn.net/Articles/1080689/</a> <hr> <h3>mozilla: Security Vulnerabilities fixed in Thunderbird 140.12.1</h3> <p /> <A HREF="https://www.mozilla.org/en-US/security/advisories/mfsa2026-64/">https://www.mozilla.org/en-US/security/advisories/mfsa2026-64/</a> <hr> <h3>mozilla: Security Vulnerabilities fixed in Thunderbird 152.0.1</h3> <p /> <A HREF="https://www.mozilla.org/en-US/security/advisories/mfsa2026-63/">https://www.mozilla.org/en-US/security/advisories/mfsa2026-63/</a> <hr> <h3>Genucenter: Publish SBA-ADV-20260424-01: Genucenter Disclosure of SNMP Credentials</h3> <p /> <A HREF="https://github.com/sbaresearch/advisories/commit/d78bf80a4103af68e8c17ba027e813efc3780d50">https://github.com/sbaresearch/advisories/commit/d78bf80a4103af68e8c17ba027e813efc3780d50</a>

CERT.at2026-07-01T18:23:47ZCERT.at2026-06-30T18:47:44Z2026-06-30T18:47:44Z

<h2>End-of-Day report</h2> Timeframe: Montag 29-06-2026 18:00 - Dienstag 30-06-2026 18:00 Handler: Guenes Holler Co-Handler: n/a <h2> News </h2> <h3>Parkstrafe per SMS? Kriminelle haben es auf Kreditkartendaten abgesehen!</h3> Alles beginnt mit einer SMS-Nachricht zu einer angeblich offenen Parkstrafe. Am Ende hat das Opfer den Kriminellen sein Auto-Kennzeichen und die Kreditkartendaten übermittelt. Eine Phishing-Falle, die klassischer nicht sein könnte. Und so funktioniert sie. <p /> <A HREF="https://www.watchlist-internet.at/news/parkstrafe-per-sms-kreditkartendaten/">https://www.watchlist-internet.at/news/parkstrafe-per-sms-kreditkartendaten/</a> <hr> <h3>Sicherheitslücken ohne Ende: Flut an KI-Bug-Reports überfordert Github</h3> Github kommt bei der Bearbeitung von Sicherheitsmeldungen nicht mehr hinterher. Es gibt wohl einen Rückstau von mehreren Wochen. <p /> <A HREF="https://www.golem.de/news/sicherheitsluecken-ohne-ende-flut-an-ki-bug-reports-ueberfordert-github-2606-210347.html">https://www.golem.de/news/sicherheitsluecken-ohne-ende-flut-an-ki-bug-reports-ueberfordert-github-2606-210347.html</a> <hr> <h3>Fernwartung SimpleHelp: Schwachstelle wird angegriffen</h3> In der Fernwartungssoftware SimpleHelp klafft eine Sicherheitslücke, die die Höchstwertung beim Risiko erreicht. Sie wurde Mitte des Monats bekannt. Jetzt haben IT-Sicherheitsexperten Cyberangriffe auf das Sicherheitsleck beobachtet. <p /> <A HREF="https://heise.de/-11348620">https://heise.de/-11348620</a> <hr> <h3>CISA: Windows BlueHammer flaw now exploited by ransomware gangs</h3> CISA confirmed on Monday that ransomware gangs have begun exploiting a high-severity Microsoft Defender privilege escalation vulnerability that has previously been abused in zero-day attacks. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs/">https://www.bleepingcomputer.com/news/security/cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs/</a> <hr> <h3>Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input</h3> Microsoft has found a malicious Chrome extension that posed as the AI search engine Perplexity and quietly logged what people searched for. It routed every query and every character typed into the address bar through an attacker-controlled server before redirecting users to real results. <p /> <A HREF="https://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.html">https://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.html</a> <hr> <h3>Daktronics: Straßenschilder durch Controller-Lücken manipulierbar</h3> Durch Sicherheitslücken in Daktronics-Controllern können Angreifer LED-Anzeigetafeln kompromittieren - unter anderem solche am Straßenrand. <p /> <A HREF="https://www.golem.de/news/daktronics-strassenschilder-durch-controller-luecken-manipulierbar-2606-210333.html">https://www.golem.de/news/daktronics-strassenschilder-durch-controller-luecken-manipulierbar-2606-210333.html</a> <hr> <h3>Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)</h3> This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a habit of becoming the way in rather than the thing keeping people out, and CVE-2026-8037 keeps that streak alive: a pre-authentication Remote Code Execution vulnerability accessible to anyone who can access the API. So, in probably a predictable turn of events, we're back doing what we do best. <p /> <A HREF="https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/">https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/</a> <hr> <h3>Bot-Schutz: Googles reCaptcha mit Handgesten fällt auf Fotos rein</h3> Google hat vergangene Woche angekündigt, den reCaptcha-Bot-Schutz mit Handgesten auszustatten. Das lässt sich mit Fotos aushebeln. <p /> <A HREF="https://heise.de/-11348830">https://heise.de/-11348830</a> <hr> <h3>Longinus: 2 Boundaries in One Bug, Piercing Chrome-s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307</h3> To understand the bug, we first need a high-level overview of TurboFan, how it inlines JS-to-Wasm calls, and how its deoptimization metadata decides what kind of value should be reconstructed after a lazy deopt. Furthermore, we need to understand how V8 heap sandbox works and why this single vulnerability allows attackers to do two things at once: 1) gain arbitrary read/write primitives in the sandbox, and 2) escape the sandbox to write outside of it. <p /> <A HREF="https://nebusec.ai/research/v8-cve-2026-6307-writeup/">https://nebusec.ai/research/v8-cve-2026-6307-writeup/</a> <hr> <h3>Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215)</h3> A use-after-free in the DRM GEM core ioctl DRM_IOCTL_GEM_CHANGE_HANDLE lets any local user with access to a render node escalate to root. drm_gem_change_handle_ioctl() moves a GEM object from one handle to another, but it never adjusts the object-s handle_count. For a short window the object has two IDR entries while its handle count still reads 1, and a concurrent DRM_IOCTL_GEM_CLOSE on the old handle drives that count to 0 and frees the object while the new handle is still pointing at it. The dangling handle is the use-after-free. <p /> <A HREF="https://cyberstan.co.uk/drm-lpe-linux/">https://cyberstan.co.uk/drm-lpe-linux/</a> <hr> <h3>Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates</h3> Malicious Chrome and Firefox extensions posed as free VPNs while stealing clipboard data through later extension updates. <p /> <A HREF="https://socket.dev/blog/chrome-and-firefox-extensions-free-vpns-add-clipboard-stealers?utm_medium=feed">https://socket.dev/blog/chrome-and-firefox-extensions-free-vpns-add-clipboard-stealers?utm_medium=feed</a> <hr> <h2> Vulnerabilities </h2> <h3>iOS 26.5.2, iPadOS 26.5.2 und macOS 26.5.2: Wichtige Sicherheitsfixes wegen KI</h3> Apple hat am Montagabend insgesamt drei Betriebssysteme aktualisiert sowie seinen Browser Safari für macOS 15 (Sequoia) und 14 (Sonoma) auf einen neuen Stand gebracht. Systeme und Browser enthalten keine bekannten Neuerungen, dafür stopfen sie diverse Sicherheitslöcher, die Apple laut eigenen Angaben auch aufgrund der neuen Gefahren durch KI flotter liefert. <p /> <A HREF="https://www.heise.de/news/iOS-26-5-2-iPadOS-26-5-2-und-macOS-26-5-2-Wichtige-Sicherheitsfixes-wegen-KI-11348504.html">https://www.heise.de/news/iOS-26-5-2-iPadOS-26-5-2-und-macOS-26-5-2-Wichtige-Sicherheitsfixes-wegen-KI-11348504.html</a> <hr> <h3>ipv6_frag_escape: Linux LPE - Reliable Jail/Container Escape</h3> A reliable unprivileged container / jail escape proof of concept for CentOS / RHEL 10.It rides a now fixed IPv6 fragmentation bug in __ip6_append_data() (closed upstream by 38becddc, no CVE), an in-slab linear overflow into the skb_shared_info at the tail of a packet's own head object. This README documents the exploitation chain only. It does not cover the trigger. <p /> <A HREF="https://github.com/sgkdev/ipv6_frag_escape">https://github.com/sgkdev/ipv6_frag_escape</a> <hr> <h3>LWN Security updates for Tuesday</h3> <p /> <A HREF="https://lwn.net/Articles/1080439/">https://lwn.net/Articles/1080439/</a> <hr> <h3>DGM3103SCT vulnerable to OS command injection</h3> <p /> <A HREF="https://jvn.jp/en/jp/JVN28979424/">https://jvn.jp/en/jp/JVN28979424/</a> <hr> <h3>Security Vulnerabilities fixed in Firefox 152.0.4</h3> <p /> <A HREF="https://www.mozilla.org/en-US/security/advisories/mfsa2026-62/">https://www.mozilla.org/en-US/security/advisories/mfsa2026-62/</a>

CERT.at2026-06-30T18:47:44ZCERT.at2026-06-29T18:12:40Z2026-06-29T18:12:40Z

<h2>End-of-Day report</h2> Timeframe: Freitag 26-06-2026 18:00 - Montag 29-06-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a <h2> News </h2> <h3>Cybersecurity firms targeted by fraudulent OpenAI organization invites</h3> Threat actors are creating OpenAI tenants that impersonate legitimate companies and inviting employees to join them, in what appears to be a ploy to trick targets into submitting sensitive company information in chats and projects. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/cybersecurity-firms-targeted-by-fraudulent-openai-organization-invites/">https://www.bleepingcomputer.com/news/security/cybersecurity-firms-targeted-by-fraudulent-openai-organization-invites/</a> <hr> <h3>Polymarket customers lose $3 million in supply-chain attack</h3> Polymarket says it will fully reimburse customers who lost an estimated $3 million after hackers injected a malicious script into the platforms frontend following a breach at a third-party vendor. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/polymarket-customers-lose-3-million-in-supply-chain-attack/">https://www.bleepingcomputer.com/news/security/polymarket-customers-lose-3-million-in-supply-chain-attack/</a> <hr> <h3>Hackers now exploit critical Oracle E-Business flaw in attacks</h3> Attackers have begun exploiting a critical vulnerability (CVE-2026-46817) in the Oracle E-Business Suite (EBS) financial application, according to threat intelligence company Defused. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/new-oracle-e-business-suite-flaw-now-exploited-in-attacks/">https://www.bleepingcomputer.com/news/security/new-oracle-e-business-suite-flaw-now-exploited-in-attacks/</a> <hr> <h3>Root-Zugriff möglich: Exploits für gefährliche Lücke im Linux-Kernel geleakt</h3> Admins sollten zügig ihre Linux-Systeme absichern. Auf Github sind Exploits für eine Root-Lücke in Debian, Ubuntu und RHEL aufgetaucht. <p /> <A HREF="https://www.golem.de/news/root-zugriff-moeglich-exploits-fuer-gefaehrliche-luecke-im-linux-kernel-geleakt-2606-210283.html">https://www.golem.de/news/root-zugriff-moeglich-exploits-fuer-gefaehrliche-luecke-im-linux-kernel-geleakt-2606-210283.html</a> <hr> <h3>The Gentlemen are knocking: -ustom backdoors and evolving tactics</h3> Kaspersky researchers analyze incidents related to The Gentlemen RaaS group, disclose their tools and TTPs, and find a new ransomware variant. <p /> <A HREF="https://securelist.com/the-gentlemen-raas/120447/">https://securelist.com/the-gentlemen-raas/120447/</a> <hr> <h3>Microsoft Adds Another Year To Windows 10 Extended Update Program</h3> Microsoft has quietly extended free Windows 10 security updates for consumers by another year, pushing the Extended Security Updates (ESU) programs end date from October 12, 2026, to October 12, 2027. "The ESU support page was updated with that date, and Microsofts blog post on the program has a new editors note confirming the change," reports Ars Technica. From the report: The prevalence of Windows across so many devices and form factors has given Microsoft a .. <p /> <A HREF="https://tech.slashdot.org/story/26/06/26/0029235/microsoft-adds-another-year-to-windows-10-extended-update-program">https://tech.slashdot.org/story/26/06/26/0029235/microsoft-adds-another-year-to-windows-10-extended-update-program</a> <hr> <h3>New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks</h3> A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.Kaspersky, which is tracking the activity under the moniker StrikeShark, said the campaign has targeted a diplomatic organization in Indonesia, government organizations in Taiwan, .. <p /> <A HREF="https://thehackernews.com/2026/06/new-sharkloader-malware-deploys-cobalt.html">https://thehackernews.com/2026/06/new-sharkloader-malware-deploys-cobalt.html</a> <hr> <h3>Microsoft keeps Windows Server 2022 hotpatching alive into 2027</h3> In the Azure Edition, of course <p /> <A HREF="https://www.theregister.com/security/2026/06/29/microsoft-keeps-windows-server-2022-hotpatching-alive-into-2027/5263688">https://www.theregister.com/security/2026/06/29/microsoft-keeps-windows-server-2022-hotpatching-alive-into-2027/5263688</a> <hr> <h3>Critical Unauthenticated Remote Code Execution in Splunk Enterprise (CVE-2026-20253)</h3> Splunk disclosed a critical unauthenticated remote code execution (RCE) vulnerability in Splunk Enterprise tracked as CVE-2026-20253 on June 10, 2026. The vulnerability has a CVSS score of 9.8 and stems from missing authentication on a PostgreSQL sidecar service recovery endpoint that can be reached through the Splunk Web interface, which proxies requests to the internal PostgreSQL sidecar service without enforcing authentication. A successful attacker can create or truncate .. <p /> <A HREF="https://www.zscaler.com/blogs/security-research/critical-unauthenticated-remote-code-execution-splunk-enterprise-cve-2026">https://www.zscaler.com/blogs/security-research/critical-unauthenticated-remote-code-execution-splunk-enterprise-cve-2026</a> <hr> <h3>Taiwan: Cybersicherheitsbehörde warnt vor Überwachung durch billige eSIMs</h3> Günstig für den Urlaub erworbene eSIMs könnten Datenverkehr durch China leiten, warnt Taiwans Digitalministerium. Dabei könnten Daten abgegriffen werden. <p /> <A HREF="https://www.heise.de/news/Taiwanische-Cybersicherheitsbehoerde-warnt-vor-Ueberwachung-durch-billige-eSIMs-11347212.html">https://www.heise.de/news/Taiwanische-Cybersicherheitsbehoerde-warnt-vor-Ueberwachung-durch-billige-eSIMs-11347212.html</a> <hr> <h3>FBI-Warnung: Russischer Geheimdienst sieht es auf Messenger-Backup-Keys ab</h3> Russische Angreifer geben sich inzwischen als Messenger-Support aus, der Zugriff auf die Backup-Wiederherstellungsschlüssel braucht. <p /> <A HREF="https://www.heise.de/news/FBI-Warnung-Russischer-Geheimdienst-sieht-es-auf-Messenger-Backup-Keys-ab-11347302.html">https://www.heise.de/news/FBI-Warnung-Russischer-Geheimdienst-sieht-es-auf-Messenger-Backup-Keys-ab-11347302.html</a> <hr> <h3>Cyberangriffe auf Hotel- und Gastgewerbe: Täter nisten sich ein</h3> Microsoft Threat Intelligence beobachtet eine mehrstufige Angriffswelle auf das Hotel- und Gastgewerbe in Asien und Europa. <p /> <A HREF="https://www.heise.de/news/Cyberangriffe-auf-Hotel-und-Gastgewerbe-Taeter-nisten-sich-ein-11347609.html">https://www.heise.de/news/Cyberangriffe-auf-Hotel-und-Gastgewerbe-Taeter-nisten-sich-ein-11347609.html</a> <hr> <h3>Kritische libssh2-Lücke: Proof-of-Concept-Exploit veröffentlicht</h3> Vergangene Woche wurde eine Sicherheitslücke in libssh2 bekannt. Jetzt ist Exploit-Code aufgetaucht, der sie missbrauchen kann. <p /> <A HREF="https://www.heise.de/news/Kritische-libssh2-Luecke-Proof-of-Concept-Exploit-veroeffentlicht-11347855.html">https://www.heise.de/news/Kritische-libssh2-Luecke-Proof-of-Concept-Exploit-veroeffentlicht-11347855.html</a> <hr> <h3>Hacking-Fähigkeiten von Chinas KI Z.ai angeblich so gut wie die von Claude</h3> Zhipu AIs offenes Modell GLM-5.2 erreicht laut Sicherheitsexperten die Fähigkeiten von Anthropics Mythos bei der Bug-Erkennung. <p /> <A HREF="https://www.heise.de/news/Hacking-Faehigkeiten-von-Chinas-KI-Z-ai-angeblich-so-gut-wie-die-von-Claude-11348003.html">https://www.heise.de/news/Hacking-Faehigkeiten-von-Chinas-KI-Z-ai-angeblich-so-gut-wie-die-von-Claude-11348003.html</a> <hr> <h3>Harnessing Harnesses - Climbing the LLM Hills</h3> Trying to coerce useful work out of LLMs without the harness is like supervising a room full of drunk toddlers, each convinced theyre helping, none of them checking with each other and falling over the next. <p /> <A HREF="https://blog.zsec.uk/harnessing-harnesses/">https://blog.zsec.uk/harnessing-harnesses/</a> <hr> <h3>From Perimeter to Proof: The New Architecture of Email Security</h3> How identity, investigation, browser security, and AI are reshaping the future of email defense. <p /> <A HREF="https://softwareanalyst.substack.com/p/from-perimeter-to-proof-the-new-architecture">https://softwareanalyst.substack.com/p/from-perimeter-to-proof-the-new-architecture</a> <hr> <h3>Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages</h3> Latest wave affects legitimate @immobiliarelabs Backstage packages, with malicious npm releases published across GitLab and LDAP authentication plugin families on June 26, 2026.Socket Threat Research is tracking a fresh compromise in the ongoing Miasma Mini Shai-Hulud supply chain campaign. The latest activity affects legitimate npm packages published under the @immobiliarelabs scope, including Backstage plugins used for GitLab integration and LDAP authentication .. <p /> <A HREF="https://socket.dev/blog/miasma-mini-shai-hulud-hits-immobiliarelabs-npm-packages">https://socket.dev/blog/miasma-mini-shai-hulud-hits-immobiliarelabs-npm-packages</a>

CERT.at2026-06-29T18:12:40ZCERT.at2026-06-26T18:05:19Z2026-06-26T18:05:19Z

<h2>End-of-Day report</h2> Timeframe: Donnerstag 25-06-2026 18:00 - Freitag 26-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer <h2> News </h2> <h3>New macOS malware embeds fake errors to confuse AI analysis tools</h3> A newly discovered macOS malware dubbed "Gaslight" is designed to confuse AI-assisted malware analysis tools by hiding prompt injection strings and fake debugging data within the executable. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/new-macos-malware-embeds-fake-errors-to-confuse-ai-analysis-tools/">https://www.bleepingcomputer.com/news/security/new-macos-malware-embeds-fake-errors-to-confuse-ai-analysis-tools/</a> <hr> <h3>Order-tracking app Shop abused to push callback phishing attacks</h3> Threat actors are increasingly abusing Shop, the order-tracking app from Shopify, by adding fake purchase receipts in users order histories to trick them into providing sensitive data or installing remote access software. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/order-tracking-app-shop-abused-to-push-callback-phishing-attacks/">https://www.bleepingcomputer.com/news/security/order-tracking-app-shop-abused-to-push-callback-phishing-attacks/</a> <hr> <h3>Security boss thought MFA would be too much security</h3> One rule for the workers, another for execs <p /> <A HREF="https://www.theregister.com/security/2026/06/26/security-boss-thought-mfa-would-be-too-much-security/5261934">https://www.theregister.com/security/2026/06/26/security-boss-thought-mfa-would-be-too-much-security/5261934</a> <hr> <h3>Miasma campaign poisons 20-plus npm packages, hunts for developer secrets</h3> Microsoft says latest attack targets Leo Platform and RStreams packages, harvesting creds and going after more maintainers <p /> <A HREF="https://www.theregister.com/security/2026/06/26/miasma-campaign-poisons-20-plus-npm-packages-hunts-for-developer-secrets/5262886">https://www.theregister.com/security/2026/06/26/miasma-campaign-poisons-20-plus-npm-packages-hunts-for-developer-secrets/5262886</a> <hr> <h3>Amazon Q flaw let booby-trapped Git repos execute code, swipe cloud creds</h3> Researchers warn many AI coding assistants now execute commands from project configurations <p /> <A HREF="https://www.theregister.com/cyber-crime/2026/06/26/amazon-q-flaw-let-booby-trapped-git-repos-execute-code-swipe-cloud-creds/5263202">https://www.theregister.com/cyber-crime/2026/06/26/amazon-q-flaw-let-booby-trapped-git-repos-execute-code-swipe-cloud-creds/5263202</a> <hr> <h3>YouTube-Werbeblocker mit 11 Millionen Installationen mit möglicher Hintertür</h3> Adblock for YouTube kommt auf mehr als 11 Millionen Installationen. Es kann jedoch unkontrolliert Script-Code in jede Seite injizieren. <p /> <A HREF="https://www.heise.de/news/YouTube-Werbeblocker-mit-11-Millionen-Installationen-mit-moeglicher-Hintertuer-11345655.html">https://www.heise.de/news/YouTube-Werbeblocker-mit-11-Millionen-Installationen-mit-moeglicher-Hintertuer-11345655.html</a> <hr> <h3>Polymarket: Kriminelle sollen Kryptowerte in Millionenhöhe gestohlen haben</h3> Bei Polymarket haben Angreifer über eingeschleusten Schadcode Geld von Nutzerkonten gestohlen. Das Wettportal will Betroffene entschädigen. <p /> <A HREF="https://www.heise.de/news/Polymarket-Kriminelle-entwenden-Kryptowerte-in-Millionenhoehe-11345764.html">https://www.heise.de/news/Polymarket-Kriminelle-entwenden-Kryptowerte-in-Millionenhoehe-11345764.html</a> <hr> <h3>Malware steals Chrome session cookies to take over your accounts</h3> A phishing campaign installs a malicious Chrome extension to hijack browser sessions and compromise Windows devices. <p /> <A HREF="https://www.malwarebytes.com/blog/news/2026/06/malware-steals-chrome-session-cookies-to-take-over-your-accounts">https://www.malwarebytes.com/blog/news/2026/06/malware-steals-chrome-session-cookies-to-take-over-your-accounts</a> <hr> <h3>The "Akrites" vulnerability-mitigation project launches</h3> The Linux Foundation, in aletter co-signed by a large range of organizations and companies, hasannounced the launch of "Akrites", a project to fast-track vulnerabilityfixes into projects. As Akrites works upstream to fix projects at the source, we commit to support downstream efforts to secure critical infrastructure before it can be exploited. When patches are .. <p /> <A HREF="https://lwn.net/Articles/1079657/">https://lwn.net/Articles/1079657/</a> <hr> <h3>Russia used social engineering to breach prominent messaging accounts, Ukraine says</h3> Ukraines SBU described a long-running Russian operation that used fake tech-support workers to persuade people to hand over credentials to their messaging apps. <p /> <A HREF="https://therecord.media/russia-ukraine-social-engineering-messaging-accounts">https://therecord.media/russia-ukraine-social-engineering-messaging-accounts</a> <hr> <h3>DHS chief says president has met with likely CISA nominee; agency plans to hire 600</h3> Once a new CISA director is in place, the agency will ramp up hiring efforts, Homeland Security Secretary Markwayne Mullin told lawmakers. The White House has not yet announced a nominee. <p /> <A HREF="https://therecord.media/cisa-director-nominee-workforce-hires-mullin-house-hearing">https://therecord.media/cisa-director-nominee-workforce-hires-mullin-house-hearing</a> <hr> <h3>macOS Flaw Allowed Standard Users to Disable CrowdStrike and Kandji Security Tools</h3> A macOS XPC flaw let regular users disable CrowdStrike and Kandji tools, exposing security gaps that vendors patched after XM Cyber reported the security issue. <p /> <A HREF="https://hackread.com/macos-flaw-users-disable-crowdstrike-kandji-security-tools/">https://hackread.com/macos-flaw-users-disable-crowdstrike-kandji-security-tools/</a> <hr> <h3>Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem</h3> Latest wave affects LeoPlatform/RStreams npm packages, three llxlr-published npm packages, the Verana Blockchain Go module, and GitHub Actions/developer-tool workflows.Socket Threat Research is tracking a new .. <p /> <A HREF="https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem">https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem</a> <hr> <h2> Vulnerabilities </h2> <h3>Synology-SA-26:11 Synology MailPlus Server</h3> <p /> <A HREF="https://www.synology.com/en-global/support/security/Synology_SA_26_11">https://www.synology.com/en-global/support/security/Synology_SA_26_11</a> <hr> <h3>[R2] Nessus Version 10.12.1 Fixes SQL Injection Vulnerabilities</h3> <p /> <A HREF="https://www.tenable.com/security/tns-2026-17">https://www.tenable.com/security/tns-2026-17</a> <hr> <h3>[R3] Tenable Identity Exposure Version 3.93.5 Fixes Multiple Vulnerabilities</h3> <p /> <A HREF="https://www.tenable.com/security/tns-2026-16">https://www.tenable.com/security/tns-2026-16</a>

CERT.at2026-06-26T18:05:19ZCERT.at2026-06-25T19:41:57Z2026-06-25T19:41:57Z

<h2>End-of-Day report</h2> Timeframe: Mittwoch 24-06-2026 18:00 - Donnerstag 25-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer <h2> News </h2> <h3>Malicious Edge extension abuses Native Messaging as bridge to malware</h3> A malicious Microsoft Edge extension dubbed Edgecution has been used in a ransomware attack to escape the browser sandbox and deploy a Python-based backdoor. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/malicious-edge-extension-abuses-native-messaging-as-bridge-to-malware/">https://www.bleepingcomputer.com/news/security/malicious-edge-extension-abuses-native-messaging-as-bridge-to-malware/</a> <hr> <h3>Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access</h3> New details have been revealed on how hackers exploited a Cisco Catalyst SD-WAN vulnerability tracked as CVE-2026-20245 in zero-day attacks to create rogue root accounts on targeted devices. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/mandiant-reveals-how-cisco-sd-wan-zero-day-attacks-gained-root-access/">https://www.bleepingcomputer.com/news/security/mandiant-reveals-how-cisco-sd-wan-zero-day-attacks-gained-root-access/</a> <hr> <h3>Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools</h3> In the first four months of 2026, Kaspersky solutions detected over 33,300 cyberattacks on SMBs masquerading as popular artificial intelligence (AI) tools - almost five times more than in 2025 and 39% more than the number of attacks disguised as the office and collaboration tools that Kaspersky-s research focuses on. <p /> <A HREF="https://securelist.com/smb-threat-report-2026/120357/">https://securelist.com/smb-threat-report-2026/120357/</a> <hr> <h3>What do Ports Hear When Nobodys Listening? An Assessment of Automated Cybercrime [Guest Diary], (Wed, Jun 24th)</h3> For network defenders and analysts, it's important to understand the depth of the noise and how it should be treated. Observing patterns and structural shifts within the static is essential for keeping pace with an automated, multi-directional threat that never stops running. The infrastructure persists, campaigns evolve, payloads update, and the ports keep listening. <p /> <A HREF="https://isc.sans.edu/diary/rss/33104">https://isc.sans.edu/diary/rss/33104</a> <hr> <h3>StealC Historical Bot Infection Special Report</h3> On Wednesday 24th June 2026, international law enforcement partners announced additional successful cyber crime disruption actions as part of the ongoing Operation Endgame initiative. This time the StealC infostealer and Amadey malware-as-a-service families were targeted. <p /> <A HREF="https://www.shadowserver.org/news/stealc-historical-bot-infection-special-report/">https://www.shadowserver.org/news/stealc-historical-bot-infection-special-report/</a> <hr> <h3>Verfassungsschutz zu Spionage: Unis sollen wachsamer sein</h3> Sicherheitsbehörden warnen vor chinesischer Wissenschaftsspionage an deutschen Hochschulen. Sind die Forschungseinrichtungen wachsam genug? <p /> <A HREF="https://www.heise.de/news/Verfassungsschutz-zu-Spionage-Unis-sollen-wachsamer-sein-11343924.html">https://www.heise.de/news/Verfassungsschutz-zu-Spionage-Unis-sollen-wachsamer-sein-11343924.html</a> <hr> <h3>Raiffeisen Phishingmail fordert zur pushTAN-Aktivierung auf</h3> Aktuell versenden Kriminelle betrügerische E-Mails im Namen der Raiffeisen Bank. Die Nachrichten fordern Kund:innen auf, über einen Link den pushTAN-Dienst zu aktivieren und führen dabei auf eine gefälschte Website, die Kontodaten abgreift. <p /> <A HREF="https://www.watchlist-internet.at/news/raiffeisen-phishingmail-fordert-pushtan-aktivierung-auf/">https://www.watchlist-internet.at/news/raiffeisen-phishingmail-fordert-pushtan-aktivierung-auf/</a> <hr> <h3>Introduction to COM usage by Windows threats</h3> Component Object Model (COM) is a fundamental Windows technology used by legitimate applications for object activation, inter-process communication, automation and language-independent component reuse. Those same qualities make it useful to threat actors. <p /> <A HREF="https://blog.talosintelligence.com/introduction-to-com-usage-by-windows-threats/">https://blog.talosintelligence.com/introduction-to-com-usage-by-windows-threats/</a> <hr> <h3>Windows 10: Sicherheitsupdates für Privatkunden jetzt doch noch bis Oktober 2027</h3> Microsoft hat das ESU-Programm für Privatkunden ohne große Vorankündigung um ein weiteres Jahr verlängert. <p /> <A HREF="https://heise.de/-11344923">https://heise.de/-11344923</a> <hr> <h3>Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond</h3> Datadog Security Research investigates a June 2026 adversary-in-the-middle phishing campaign that cloned the AWS console login page to harvest victim credentials and multi-factor authentication codes. <p /> <A HREF="https://securitylabs.datadoghq.com/articles/behind-the-console-aws-aitm-phishing-kit-and-beyond/">https://securitylabs.datadoghq.com/articles/behind-the-console-aws-aitm-phishing-kit-and-beyond/</a> <hr> <h3>Ignore DNSSEC if you like MITM attacks</h3> It really bothers me that almost all distributions and operating systems don-t validate DNSSEC by default. The above attacks are feasible on almost anyone, purely because of lousy defaults. <p /> <A HREF="https://whynothugo.nl/journal/2026/06/24/ignore-dnssec-if-you-like-mitm-attacks/">https://whynothugo.nl/journal/2026/06/24/ignore-dnssec-if-you-like-mitm-attacks/</a> <h2> Vulnerabilities </h2> <h3>LWN: Security updates for Thursday</h3> <p /> <A HREF="https://lwn.net/Articles/1079551/">https://lwn.net/Articles/1079551/</a>

CERT.at2026-06-25T19:41:57ZCERT.at2026-06-24T18:20:32Z2026-06-24T18:20:32Z

<h2>End-of-Day report</h2> Timeframe: Dienstag 23-06-2026 18:00 - Mittwoch 24-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Guenes Holler <h2> News </h2> <h3>New macOS ClickFix attack silently mounts DMGs to push infostealer</h3> A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/">https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/</a> <hr> <h3>Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks</h3> A high-severity SSRF vulnerability, tracked as CVE-2026-20230, in Cisco Unified Communications Manager Server is now being exploited in attacks. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/">https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/</a> <hr> <h3>Stealthy Mistic backdoor linked to ransomware access broker KongTuke</h3> A new backdoor dubbed Mistic has been observed in financially motivated attacks targeting organizations in the insurance, education, IT, and professional services sectors. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/">https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/</a> <hr> <h3>Sicherheitslücke: Millionen von Samsung-Smartphones durch Kernel-Bug gefährdet</h3> Forscher haben einen gefährlichen Bug im Android-Kernel von Samsung entdeckt, der unzählige Smartphones zwischen Galaxy S9 und S25 betrifft. <p /> <A HREF="https://www.golem.de/news/sicherheitsluecke-acht-jahre-alter-kernel-bug-gefaehrdet-samsung-smartphones-2606-210117.html">https://www.golem.de/news/sicherheitsluecke-acht-jahre-alter-kernel-bug-gefaehrdet-samsung-smartphones-2606-210117.html</a> <hr> <h3>Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root</h3> Threat actors have begun to exploit a recently disclosed critical security flaw impacting Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME).The vulnerability, tracked as CVE-2026-20230 (CVSS score: 8.6), is a case of improper input validation for specific HTTP requests that could allow an unauthenticated, .. <p /> <A HREF="https://thehackernews.com/2026/06/cisco-unified-cm-flaw-exploited-after.html">https://thehackernews.com/2026/06/cisco-unified-cm-flaw-exploited-after.html</a> <hr> <h3>Home Assistant: Update stopft Informationsleck</h3> Die jüngeren Home-Assistant-Updates stopfen unter anderem Informationslecks. Zudem gibt es das Home Assistant OS in neuer Version. <p /> <A HREF="https://www.heise.de/news/Home-Assistant-Update-stopft-Informationsleck-11342266.html">https://www.heise.de/news/Home-Assistant-Update-stopft-Informationsleck-11342266.html</a> <hr> <h3>Ubiquiti UniFi OS-Sicherheitslücken werden angegriffen</h3> Ende Mai wurden kritische Sicherheitslücken in Ubiquiti UniFi OS bekannt. Inzwischen haben Angreifer diese im Visier. <p /> <A HREF="https://www.heise.de/news/Ubiquiti-UniFi-OS-Sicherheitsluecken-werden-angegriffen-11343015.html">https://www.heise.de/news/Ubiquiti-UniFi-OS-Sicherheitsluecken-werden-angegriffen-11343015.html</a> <hr> <h3>Cyberkriminelle: Die -Wirtschaftsprüfer-, die Sie nie beauftragt haben</h3> Jede Organisation wird geprüft. Die Frage ist, wer die Prüfung durchführt. <p /> <A HREF="https://www.welivesecurity.com/de/business-security/cyberkriminelle-die-wirtschaftsprufer-die-sie-nie-beauftragt-haben/">https://www.welivesecurity.com/de/business-security/cyberkriminelle-die-wirtschaftsprufer-die-sie-nie-beauftragt-haben/</a> <hr> <h3>Hackergruppe will den Flughafen Wien angegriffen haben</h3> Als Beweis wurden Frachtpapiere mit Waffenlieferungen veröffentlicht. Laut dem Flughafen Wien sind keine personenbezogenen Daten darunter <p /> <A HREF="https://www.derstandard.at/story/3000000328608/hackergruppe-will-den-flughafen-wien-angegriffen-haben">https://www.derstandard.at/story/3000000328608/hackergruppe-will-den-flughafen-wien-angegriffen-haben</a> <hr> <h3>Zoho Corp. ManageEngine: Kritische SSO-Lücke ermöglicht Kontenübernahme</h3> Angreifer können eine kritische Sicherheitslücke in mehreren Zoho Corp. ManageEngine-Produkten missbrauchen, um Konten zu übernehmen. <p /> <A HREF="https://heise.de/-11342888">https://heise.de/-11342888</a> <hr> <h2> Vulnerabilities </h2> <h3>Security updates for Wednesday</h3> Security updates have been issued by AlmaLinux (corosync, firefox, kernel, kernel-rt, libpq, memcached, postgresql, postgresql16, postgresql:13, postgresql:16, python-urllib3, python3.14-urllib3, redis:6, skopeo, and vim), Debian (beets, gst-plugins-bad1.0, imagemagick, libmatio, python-urllib3, and u-boot), Fedora (chromium, coturn, frr, grout, materialx, perl-Crypt-DSA, and yt-dlp), Mageia (opensc, perl-Archive-Tar, and podofo), Oracle (fence-agents, libpq, mysql:8.4, and postgresql:16), .. <p /> <A HREF="https://lwn.net/Articles/1079365/">https://lwn.net/Articles/1079365/</a> <hr> <h3>[R1] Tenable Identity Exposure Version 3.93.5 Fixes Multiple Vulnerabilities</h3> <p /> <A HREF="https://www.tenable.com/security/tns-2026-16">https://www.tenable.com/security/tns-2026-16</a>

CERT.at2026-06-24T18:20:32ZCERT.at2026-06-23T18:36:50Z2026-06-23T18:36:50Z

<h2>End-of-Day report</h2> Timeframe: Montag 22-06-2026 18:00 - Dienstag 23-06-2026 18:00 Handler: Guenes Holler Co-Handler: n/a <h2> News </h2> <h3>Auswirkungen auf die Cybersicherheit von Organisationen durch die Entwicklung im Bereich Künstlicher Intelligenz</h3> Künstliche Intelligenz verändert die Cybersicherheitslage grundlegend und erfordert neue Maßstäbe in der Reaktionsgeschwindigkeit. Während böswillige Akteure in der Vergangenheit bereits arbeitsteilig auf Künstliche Intelligenz gesetzt hatten - beispielsweise um Phishing-Mails zu verfassen - sind aktuelle KI-Systeme derart leistungsfähig, dass Schwachstellen in Software innerhalb kurzer Zeit sowohl umfassend als auch teilweise autonom erkannt, analysiert und in verwertbare Angriffspfade überführt können. Daraus kann eine Lage entstehen, die Organisationen mit einer erheblich steigenden Zahl neu entdeckter Schwachstellen, Exploits, Patches und Folgevorfällen konfrontiert. <p /> <A HREF="https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-262788-1032.pdf">https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-262788-1032.pdf</a> <hr> <h3>WhatsApp phishing attack uses fake business docs to hack PCs</h3> An ongoing malware campaign is targeting WhatsApp users in multiple countries with deceptive messages that push VBScript files, leading to remote system access. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/whatsapp-phishing-attack-uses-fake-business-docs-to-hack-pcs/">https://www.bleepingcomputer.com/news/security/whatsapp-phishing-attack-uses-fake-business-docs-to-hack-pcs/</a> <hr> <h3>Nearly Half of LG Smart TV Apps Are Laced with Proxies</h3> Everyone worries about the apps on their phone. Almost no one looks at the ones on their TV. We scanned 6,038 of them across LG and Samsung; 2,058 were selling your IP address. On screen, its a relaxing fish tank. Or a clock. Or solitaire. Or puppies. Under the hood, it is a residential proxy: software that can send other peoples internet traffic out through your living room. And we found it everywhere. <p /> <A HREF="https://spur.us/blog/smart-tv-apps-residential-proxy-sdks">https://spur.us/blog/smart-tv-apps-residential-proxy-sdks</a> <hr> <h3>Nach Protesten: AMD bringt RAM-Verschlüsselung TSME zurück</h3> Ohne Ankündigung hat AMD das Sicherheitsmerkmal TSME bei bestimmten Ryzen-Prozessoren deaktiviert. Kunden protestierten, AMD reagiert. <p /> <A HREF="https://www.heise.de/news/Nach-Protesten-AMD-bringt-RAM-Verschluesselung-TSME-zurueck-11340937.html">https://www.heise.de/news/Nach-Protesten-AMD-bringt-RAM-Verschluesselung-TSME-zurueck-11340937.html</a> <hr> <h3>Secure-Boot: Zertifikatablauf steht an, Microsoft gibt weitere Hilfestellung</h3> Die ersten Secure-Boot-Zertifikate laufen in diesen Tagen ab. Microsoft legt noch mal Handreichungen nach, für Linux auf Azure-VMs. <p /> <A HREF="https://www.heise.de/news/Secure-Boot-Zertifikate-Ablauf-startet-weitere-Handreichungen-von-Microsoft-11341007.html">https://www.heise.de/news/Secure-Boot-Zertifikate-Ablauf-startet-weitere-Handreichungen-von-Microsoft-11341007.html</a> <hr> <h3>The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration</h3> We recently identified a bucket hijacking technique impacting multiple services across major cloud service providers (CSPs). The attack technique exploits a fundamental architectural flaw that is common across cloud providers and could potentially affect other cloud providers as well. <p /> <A HREF="https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/">https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/</a> <hr> <h3>Detecting the Klue supply chain attack in Salesforce instances</h3> We summarize the Klue supply chain attack and provide detection guidance for Salesforce environments monitored by Datadog Cloud SIEM. <p /> <A HREF="https://securitylabs.datadoghq.com/articles/detecting-the-klue-supply-chain-attack-in-salesforce/">https://securitylabs.datadoghq.com/articles/detecting-the-klue-supply-chain-attack-in-salesforce/</a> <hr> <h3>Fake-Shops, Abo-Fallen, Phishing-Gewinnspiele: Wie Kriminelle das Fußball-Fieber nutzen</h3> Die Weltmeisterschaft in den USA, Mexiko und Kanada ist in vollem Gange. Dass Betrüger:innen von diesem Hype profitieren möchten, überrascht nicht. Dieser Artikel zeigt, welche Strategien und Mechanismen sie für ihre Fallen nutzen. <p /> <A HREF="https://www.watchlist-internet.at/news/fake-shops-abofallen-fussball/">https://www.watchlist-internet.at/news/fake-shops-abofallen-fussball/</a> <hr> <h3>Introducing Patch the Planet</h3> What happens when you clear dozens of Trail of Bits engineers- schedules, pair them with every open-source maintainer they can contact, and unleash the latest frontier models like GPT-5.5-Cyber on critical open-source targets? Thanks to our partnership with OpenAI and its Daybreak initiative, we can report that the impact is hundreds of discovered bugs, 64 pull requests, and 51 issues filed across 19 projects (with many more still undergoing coordinated disclosure). That was just the first week of Patch the Planet. <p /> <A HREF="https://blog.trailofbits.com/2026/06/22/introducing-patch-the-planet/">https://blog.trailofbits.com/2026/06/22/introducing-patch-the-planet/</a> <hr> <h2> Vulnerabilities </h2> <h3>Pixelsmash: Lücke in FFmpeg-Decoder gefährdet unzählige Systeme</h3> Sicherheitsforscher von JFrog haben eine gefährliche Sicherheitslücke in dem weitverbreiteten freien Multimedia-Framework FFmpeg aufgedeckt. Wie die Forscher in einem Blogbeitrag schildern, können Angreifer damit zahlreiche auf FFmpeg angewiesene Softwarelösungen zum Absturz bringen. In einigen Fällen, etwa bei Jellyfin und Nextcloud, soll sogar eine Schadcodeausführung möglich sein. <p /> <A HREF="https://www.golem.de/news/pixelsmash-luecke-in-ffmpeg-decoder-gefaehrdet-unzaehlige-systeme-2606-210068.html">https://www.golem.de/news/pixelsmash-luecke-in-ffmpeg-decoder-gefaehrdet-unzaehlige-systeme-2606-210068.html</a> <hr> <h3>LWN Security updates for Tuesday</h3> <p /> <A HREF="https://lwn.net/Articles/1079083/">https://lwn.net/Articles/1079083/</a> <hr> <h3>NCSC-2026-0209 [1.00] [M/H] Kwetsbaarheden verholpen in MongoDB Server</h3> <p /> <A HREF="https://advisories.ncsc.nl/advisory?id=NCSC-2026-0209">https://advisories.ncsc.nl/advisory?id=NCSC-2026-0209</a>

CERT.at2026-06-23T18:36:50ZCERT.at2026-06-22T18:20:23Z2026-06-22T18:20:23Z

<h2>End-of-Day report</h2> Timeframe: Freitag 19-06-2026 18:00 - Montag 22-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer <h2> News </h2> <h3>Angriffswelle gegen FortiGate Devices - "FortiBleed"</h3> Fortinet hat letzten Freitag, am 19.5.2026, nun auch ein offizielles Statement zu "FortiBleed" veröffentlicht. Wir hatten zuvor in einem Blog-Artikel unseren aktuellen Wissensstand beschrieben. Bei dieser Angriffswelle handelt es sich nicht um die Ausnutzung einer neuen Schwachstelle. Die Angreifer:innen verwenden stattdessen Zugangsdaten, die bei früheren Sicherheitsvorfällen (u. a. im Zusammenhang mit CVE-2025-59718, CVE-2025-59719 und CVE-2026-24858) erlangt wurden, sowie Brute-Force-Methoden gegen Geräte mit schwacher Passworthygiene und ohne Multi-Faktor-Authentifizierung (MFA). <p /> <A HREF="https://www.cert.at/de/warnungen/2026/6/angriffswelle-gegen-fortigate-devices-fortibleed">https://www.cert.at/de/warnungen/2026/6/angriffswelle-gegen-fortigate-devices-fortibleed</a> <hr> <h3>New Prinz Eugen ransomware prioritizes recent files for encryption</h3> A new ransomware operation named Prinz Eugen prioritizes recently modified files for encryption and leaves no ransom note on the system. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/new-prinz-eugen-ransomware-prioritizes-recent-files-for-encryption/">https://www.bleepingcomputer.com/news/security/new-prinz-eugen-ransomware-prioritizes-recent-files-for-encryption/</a> <hr> <h3>Squidbleed: 29 Jahre alte Lücke in populärer Proxy-Software entdeckt</h3> Die zuletzt unter anderem durch die Entdeckung von HTTP/2 Bomb aufgefallenen Sicherheitsforscher von Calif haben mithilfe von Claude Mythos eine Sicherheitslücke in der weitverbreiteten freien Proxyserver-Software Squid entdeckt. Angreifer können damit Speicherinhalte leaken und Daten aus von Squid verarbeiteten HTTP-Requests abgreifen. Die Besonderheit dabei: Die Lücke wurde 1997 eingeführt und blieb damit fast drei Jahrzehnte unentdeckt. <p /> <A HREF="https://www.golem.de/news/squidbleed-29-jahre-alte-luecke-in-populaerer-proxy-software-entdeckt-2606-210022.html">https://www.golem.de/news/squidbleed-29-jahre-alte-luecke-in-populaerer-proxy-software-entdeckt-2606-210022.html</a> <hr> <h3>AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network</h3> A new malware family is turning forgotten home routers into a distributed reconnaissance and proxy network, not the DDoS botnet these devices usually end up in. [..] The campaign goes after routers built on Realtek's RTL819X chips, hardware that was current around 2012 to 2015. XLab first saw it on March 12, 2026, spreading from a single IP, 107.150.106.14. [..] The infected pool is mostly D-Link, with the DIR-850L alone making up about 75 percent. <p /> <A HREF="https://thehackernews.com/2026/06/arystinger-malware-infects-4300-legacy.html">https://thehackernews.com/2026/06/arystinger-malware-infects-4300-legacy.html</a> <hr> <h3>New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer</h3> Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported malware loader dubbed OXLOADER. According to Elastic Security Labs, the campaign leverages malicious Google Ads as a starting point to distribute the malware. <p /> <A HREF="https://thehackernews.com/2026/06/new-oxloader-loader-uses-malicious.html">https://thehackernews.com/2026/06/new-oxloader-loader-uses-malicious.html</a> <hr> <h3>Anlagebetrug mit Promi-Namen: Gefälschter oe24-Artikel lockt in die Falle</h3> Angebliche Anlagetipps von Prominenten sind oft Teil einer Betrugsmasche. Aktuell missbrauchen Kriminelle den Namen von Armin Wolf und der Raiffeisen Bank für eine gefälschte Berichterstattung im Design von oe24. Das Ziel besteht darin, Leser:innen auf eine betrügerische Anlageplattform zu locken. <p /> <A HREF="https://www.watchlist-internet.at/news/anlagebetrug-mit-promi-namen-gefaelschter-oe24-artikel-lockt-in-die-falle/">https://www.watchlist-internet.at/news/anlagebetrug-mit-promi-namen-gefaelschter-oe24-artikel-lockt-in-die-falle/</a> <hr> <h3>Popa Botnetz kapert Smart TVs für Web-Scraping</h3> icherheitsforscher haben ein Botnetz enttarnt, welches Millionen Smart TVs gekapert hat. Die Millionen Android Smart TV-Geräte, die Teil des Popa-Botnets sind, leiteten Webverkehr (Web-Scaping) an dessen Betreiber weiter. <p /> <A HREF="https://borncity.com/blog/2026/06/22/popa-botnetz-kapert-smart-tvs-fuer-web-scraping/">https://borncity.com/blog/2026/06/22/popa-botnetz-kapert-smart-tvs-fuer-web-scraping/</a> <hr> <h3>Mark-of-the-web and pinning installers to sites</h3> While MoTW is intended for the operating system and other origin-aware applications such as MSFT Office to make security decisions, an executable can also access its own MoTW. This is the basis for a proof-of-concept with a simple Win32 GUI application ... <p /> <A HREF="https://blog.randomoracle.io/2026/06/20/mark-of-the-web-and-pinning-installers-to-sites/">https://blog.randomoracle.io/2026/06/20/mark-of-the-web-and-pinning-installers-to-sites/</a> <h2> Vulnerabilities </h2> <h3>libssh2: Teils kritische Lücken in populärer SSH-Bibliothek</h3> Angreifer können CVE-2026-55200 ausnutzen, indem sie speziell gestaltete SSH-Pakete mit übermäßig großen package_length-Werten übermitteln und dadurch Schreibvorgänge außerhalb vorgesehener Grenzen auslösen. Die Folge ist eine Korruption des Heap-Speichers, wodurch im schlimmsten Fall Schadcode eingeschleust und zur Ausführung gebracht werden kann. [..] Alle Versionen von libssh2 bis einschließlich der seit Oktober 2024 als aktuell geltenden Version 1.11.1 sollen anfällig für CVE-2026-55199 und CVE-2026-55200 sein. Korrekturen wurden mit den Commits 1762685 und 97acf3d bereitgestellt. Wann ein neues Release mit den beiden Patches erscheint, ist noch unklar. <p /> <A HREF="https://www.golem.de/news/libssh2-teils-kritische-luecken-in-populaerer-ssh-bibliothek-2606-210011.html">https://www.golem.de/news/libssh2-teils-kritische-luecken-in-populaerer-ssh-bibliothek-2606-210011.html</a> <hr> <h3>Bamboo, Confluence & Co.: Atlassian schließt 100 Sicherheitslücken</h3> Wie aus dem Sicherheitsbereich der Atlassian-Website hervorgeht, haben die Entwickler in aktuellen Versionen insgesamt 100 Lücken geschlossen. Davon sind neben dem eigenen Code auch Abhängigkeiten zu etwa Apache Tomcat betroffen. <p /> <A HREF="https://www.heise.de/news/Bamboo-Confluence-Co-Atlassian-schliesst-100-Sicherheitsluecken-11336541.html">https://www.heise.de/news/Bamboo-Confluence-Co-Atlassian-schliesst-100-Sicherheitsluecken-11336541.html</a> <hr> <h3>LWN: Security updates for Monday</h3> <p /> <A HREF="https://lwn.net/Articles/1078922/">https://lwn.net/Articles/1078922/</a>

CERT.at2026-06-22T18:20:23ZCERT.at2026-06-19T18:14:16Z2026-06-19T18:14:16Z

<h2>End-of-Day report</h2> Timeframe: Donnerstag 18-06-2026 18:00 - Freitag 19-06-2026 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer <h2> News </h2> <h3>USB worm spreads crypto-stealing malware via Windows shortcut files</h3> Threat actors targeting cryptocurrency wallets have been distributing clipboard-stealing malware with self-spreading capabilities and using the Tor network to conceal communication. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/">https://www.bleepingcomputer.com/news/security/usb-worm-spreads-crypto-stealing-malware-via-windows-shortcut-files/</a> <hr> <h3>Jailbreak möglich: Wohl unpatchbarer Hardware-Bug gefährdet iPhones</h3> Forscher haben einen offenbar unpatchbaren Bug entdeckt, der Jailbreaks für mehrere iPhone-, iPad- und Apple-Watch-Modelle ermöglichen könnte. <p /> <A HREF="https://www.golem.de/news/jailbreak-moeglich-wohl-unpatchbarer-hardware-bug-gefaehrdet-iphones-2606-209965.html">https://www.golem.de/news/jailbreak-moeglich-wohl-unpatchbarer-hardware-bug-gefaehrdet-iphones-2606-209965.html</a> <hr> <h3>Warnung vor Fake-Rechnungen von Sixt Server</h3> Derzeit melden sich zahlreiche Unternehmen bei uns, die Rechnungen für angebliche Cloud-Dienstleistungen erhalten haben. Tatsächlich handelt es sich dabei um einen Betrugsversuch: Die gefälschten Rechnungen sollen Unternehmen zu einer unberechtigten Zahlung verleiten. <p /> <A HREF="https://www.watchlist-internet.at/news/fake-rechnungen-von-sixt-server/">https://www.watchlist-internet.at/news/fake-rechnungen-von-sixt-server/</a> <hr> <h3>Killing me gently: Inside Gentlemen-s EDR killer framework</h3> ESET Research shares the results of a months-long investigation into the suite of EDR killers maintained by the RaaS gang Gentlemen. <p /> <A HREF="https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/">https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/</a> <hr> <h3>Brand der Floridsdorfer Brücke: Glasfaserausfälle in Wien</h3> Heute hat es auf der Floridsdorfer Brücke gebrannt. Was der ORF nicht meldet ist, dass über diese Brücke auch Glasfasertrassen geführt werden, und dass durch den Brand einige dieser Leitungen ausgefallen sind. Wenn man die Standorte der relevanten Rechenzentren in Wien kennt, dann ist sofort klar, dass das sehr relevant ist. Bei uns ging bis jetzt eine formelle NIS Meldung ein, weiters haben wir informell von anderen Organisationen gehört, dass sie betroffen sind. <p /> <A HREF="https://www.cert.at/de/aktuelles/2026/6/brand-der-floridsdorfer-brucke-glasfaserausfalle-in-wien">https://www.cert.at/de/aktuelles/2026/6/brand-der-floridsdorfer-brucke-glasfaserausfalle-in-wien</a> <hr> <h3>Bulgaria allowed surveillance tech firm to sell products to repressive regimes, report says</h3> The nonprofit Human Rights Watch obtained export licensing records covering 2018 through 2023, which show the Bulgarian government allowed the surveillance firm Circles to peddle the tech to law enforcement and intelligence agencies in several countries known for human rights abuses. <p /> <A HREF="https://therecord.media/bulgaria-allowed-surveillance-tech-firm-to-sell-to-repressive-regimes-report">https://therecord.media/bulgaria-allowed-surveillance-tech-firm-to-sell-to-repressive-regimes-report</a> <hr> <h3>PeopleSoft PeopleTools Pre-Authentication RCE: A PSIGW SSRF Chain That Executes Inside the JVM</h3> A pre-authentication remote code execution (RCE) chain in Oracle PeopleSoft PeopleTools reaches an internal-only management servlet through a server-side request forgery (SSRF) in the PSIGW gateway, then gains code execution through Java XMLDecoder deserialization. Oracle assigned CVE-2026-35273 (CVSS 9.8) and released an out-of-band patch on June 10, 2026. [..] Our researchers discovered new information about this vulnerability, which was responsibly disclosed to Oracle as part of our investigation. <p /> <A HREF="https://www.trendmicro.com/en_us/research/26/f/PeopleTools.html">https://www.trendmicro.com/en_us/research/26/f/PeopleTools.html</a> <hr> <h3>Anthropics KI Mythos: Unternehmen haben weiter Zugriff auf Preview-Version</h3> Trotz US-Anordnung haben manche Unternehmen weiterhin Zugriff auf eine Preview-Version von Anthropics KI-Modell Mythos. <p /> <A HREF="https://heise.de/-11338742">https://heise.de/-11338742</a> <hr> <h3>I discovered a large-scale malware distribution on GitHub</h3> This is the story of how I found 10,000 repositories on GitHub that distribute Trojan malware. They are all from different contributors, have different names, and are not forks of other repositories. But they share a common pattern, which is what allowed me to write a script to find such repositories. <p /> <A HREF="https://orchidfiles.com/github-repositories-distributing-malware/">https://orchidfiles.com/github-repositories-distributing-malware/</a> <h2> Vulnerabilities </h2> <h3>Windows 10/11: Rechteausweitung in AMD-RAID-Treiber</h3> Im AMD RAID-Treiber für Windows 10 und Windows 11 ist ein gravierender Bug bekannt geworden, der die Sicherheit des Systems gefährdet. Die Schwachstelle CVE-2024-21962, hat einen CVSS-Score von 8.6. AMD und auch der Hersteller HP haben Sicherheitshinweise sowie eine neue Treiberversion veröffentlicht. <p /> <A HREF="https://borncity.com/blog/2026/06/19/windows-10-11-rechteausweitung-in-amd-raid-treiber/">https://borncity.com/blog/2026/06/19/windows-10-11-rechteausweitung-in-amd-raid-treiber/</a> <hr> <h3>LWN: Security updates for Friday</h3> <p /> <A HREF="https://lwn.net/Articles/1078662/">https://lwn.net/Articles/1078662/</a>

CERT.at2026-06-19T18:14:16ZCERT.at2026-06-18T18:05:31Z2026-06-18T18:05:31Z

<h2>End-of-Day report</h2> Timeframe: Mittwoch 17-06-2026 18:00 - Donnerstag 18-06-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a <h2> News </h2> <h3>Rogueplanet-Exploit: Microsoft verspricht ein "High-Quality-Sicherheitsupdate"</h3> Microsoft will mit einem Update die Ausnutzung des Rogueplanet-Exploits auf Windows-Geräten unterbinden. Wann das passiert, bleibt aber ein Rätsel. <p /> <A HREF="https://www.golem.de/news/rogueplanet-exploit-microsoft-verspricht-ein-high-quality-sicherheitsupdate-2606-209904.html">https://www.golem.de/news/rogueplanet-exploit-microsoft-verspricht-ein-high-quality-sicherheitsupdate-2606-209904.html</a> <hr> <h3>Jetzt patchen: Nginx-Webserver durch kritische Lücken angreifbar</h3> Angreifer können aufgrund von Sicherheitslücken in drei Nginx-Modulen Webserver lahmlegen oder Schadcode einschleusen. Patches verhindern das. <p /> <A HREF="https://www.golem.de/news/jetzt-patchen-nginx-webserver-durch-kritische-luecken-angreifbar-2606-209926.html">https://www.golem.de/news/jetzt-patchen-nginx-webserver-durch-kritische-luecken-angreifbar-2606-209926.html</a> <hr> <h3>Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline</h3> A French-speaking attacker broke into a small French automotive business, planted a keylogger, and stole banking and email credentials.Ordinary stuff, until one move near the end.Before his command-and-control server went dark, he installed OpenSSH and Tailscale on a victims machine, building a way back in that did not run through the C2 at all. When the Havoc server went .. <p /> <A HREF="https://thehackernews.com/2026/06/junior-hacker-used-tailscale-and.html">https://thehackernews.com/2026/06/junior-hacker-used-tailscale-and.html</a> <hr> <h3>Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments</h3> An unknown threat actor has been observed leveraging paid or promoted posts on legitimate news websites to drum up buzz for their warez, according to new findings from Check Point Research.The threat actor also has at their disposal a dedicated WordPress .. <p /> <A HREF="https://thehackernews.com/2026/06/crypto-clipper-campaign-abuses-fake.html">https://thehackernews.com/2026/06/crypto-clipper-campaign-abuses-fake.html</a> <hr> <h3>Operation Endgame: Ermittler säubern tausende Blogs von SocGholish</h3> Strafverfolger aus vier Ländern zerschlugen ein Botnet und Wordpress-Blogs, die Kriminelle als Verteilstationen für Schadsoftware mißbrauchten. <p /> <A HREF="https://www.heise.de/news/Operation-Endgame-Ermittler-saeubern-tausende-Blogs-von-SocGholish-11337399.html">https://www.heise.de/news/Operation-Endgame-Ermittler-saeubern-tausende-Blogs-von-SocGholish-11337399.html</a> <hr> <h3>Auslaufende Secure Boot-Zertifikate - was war, was ist, was kommt</h3> Zwei völlig unterschiedliche Technologien, eine sehr ähnliche Problematik - DNS und Secure Boot sind beides Technologien die (idealerweise) problemfrei im Hintergrund laufen .. bis sie dann plötzlich zum Thema werden. Genau das könnte im Laufe dieses Jahres bei Secure Boot der Fall sein - die kryptographischen Vertrauensanker, auf denen UEFI Secure Boot beruht, stammen größtenteils aus dem Jahr 2011. Und das Ende fünfzehnjährigen .. <p /> <A HREF="https://www.cert.at/de/blog/2026/6/auslaufende-secure-boot-zertifikate-was-ist-was-kommt">https://www.cert.at/de/blog/2026/6/auslaufende-secure-boot-zertifikate-was-ist-was-kommt</a> <hr> <h3>Aktueller Stand rund um "FortiBleed"</h3> Vergangenes Wochenende entdeckte ein Sicherheitsforscher im Rahmen seiner Arbeit eine ungewöhnlich strukturierte Sammlung gestohlener Daten, welche sich nach weiterer Analyse als kompromittierte Zugangsdaten für zehntausende Fortinet-Systeme weltweit herausstellten. Die Echtheit der Daten wurden in weiterer Folge sowohl durch unabhängige Sicherheitsexperten als auch das Sicherheitsunternehmen Hudson Rock bestätigt. Die rund 75.000 betroffenen Fortinet-Systeme .. <p /> <A HREF="https://www.cert.at/de/blog/2026/6/aktueller-stand-rund-um-fortibleed">https://www.cert.at/de/blog/2026/6/aktueller-stand-rund-um-fortibleed</a> <hr> <h3>EU grants Ukraine access to cybersecurity reserve for major attacks</h3> As Kyiv takes steps toward formal accession to the EU, the bloc is integrating Ukraine with its pool of pre-approved cybersecurity incident response companies. <p /> <A HREF="https://therecord.media/ukraine-access-eu-cybersecurity-reserve">https://therecord.media/ukraine-access-eu-cybersecurity-reserve</a> <hr> <h3>Von Blaster bis BlueHammer: Wiederholt sich die Geschichte bei Microsoft?</h3> Seit einigen Wochen gibt es ja einen ziemlichen Disput zwischen einem Sicherheitsforscher mit dem Alias Nightmare Eclipse und dem Microsoft Security Response Center-Team (MSRC-Team). Es geht um die Art, wie Sicherheitslücken gemeldet, .. <p /> <A HREF="https://borncity.com/blog/2026/06/18/von-blaster-bis-bluehammer-wiederholt-sich-die-geschichte-bei-microsoft/">https://borncity.com/blog/2026/06/18/von-blaster-bis-bluehammer-wiederholt-sich-die-geschichte-bei-microsoft/</a> <hr> <h3>The Road to Post-Quantum Readiness Part 1 of 2: Understanding the Risk</h3> Post-Quantum Cryptography is no longer a future-only concern. Standards are final, major providers have already deployed hybrid protection, and the real risk now is data captured today and decrypted later. Part 1 explains the fundamentals, the threat, and why organizations can no longer afford to wait. <p /> <A HREF="https://blog.nviso.eu/2026/06/18/the-road-to-post-quantum-readiness-part-1/">https://blog.nviso.eu/2026/06/18/the-road-to-post-quantum-readiness-part-1/</a> <hr> <h3>Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign</h3> Cybercriminals hijacked Google Ads searches for popular AI developer tools to funnel over 2,000 victims toward malicious download pages before quietly moving their operation onto claude.ais own platform, turning the trusted domain into a delivery mechanism for credential-stealing malware. <p /> <A HREF="https://www.trendmicro.com/en_us/research/26/f/claudeai-shared-chat-abused-in-malvertising.html">https://www.trendmicro.com/en_us/research/26/f/claudeai-shared-chat-abused-in-malvertising.html</a> <hr> <h2> Vulnerabilities </h2> <h3>Drupal core - Critical - PHP object injection - SA-CORE-2026-005</h3> Project: Drupal coreDate: 2026-June-05Security risk: Critical 18 - 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: PHP object injectionAffected versions: =10.6.0 =11.2.0 =11.3.0 CVE IDs: CVE-2026-55803Description: SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web .. <p /> <A HREF="https://www.drupal.org/sa-core-2026-005">https://www.drupal.org/sa-core-2026-005</a> <hr> <h3>Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050</h3> Project: Plotly.js GraphingDate: 2026-June-17Security risk: Critical 19 - 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: PHP object injectionAffected versions: CVE IDs: .. <p /> <A HREF="https://www.drupal.org/sa-contrib-2026-050">https://www.drupal.org/sa-contrib-2026-050</a> <hr> <h3>Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049</h3> Project: Flag attendance fieldDate: 2026-June-17Security risk: Critical 19 - 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: PHP object injectionAffected versions: CVE IDs: CVE-2026-55809Description: The Flag attendance field module gives you the ability to add attendance by depending on Flag module.flag_attendance_field stores .. <p /> <A HREF="https://www.drupal.org/sa-contrib-2026-049">https://www.drupal.org/sa-contrib-2026-049</a> <hr> <h3>Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048</h3> Project: Formatter FieldDate: 2026-June-17Security risk: Critical 19 - 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: PHP object injectionAffected versions: CVE IDs: CVE-2026-12535Description: The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a .. <p /> <A HREF="https://www.drupal.org/sa-contrib-2026-048">https://www.drupal.org/sa-contrib-2026-048</a> <hr> <h3>SVD-2026-0614: OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit</h3> In Splunk AI Toolkit versions below 5.7.4, a user who holds the -admin- Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance.The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation. <p /> <A HREF="https://advisory.splunk.com//advisories/SVD-2026-0614">https://advisory.splunk.com//advisories/SVD-2026-0614</a> <hr> <h3>Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv</a> <hr> <h3>Cisco Crosswork Network Controller Server-Side Template Injection Vulnerability</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cnc-inj-QNMeEmxk">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cnc-inj-QNMeEmxk</a> <hr> <h3>Cisco Webex App Open Redirect Vulnerability</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-redirect-KOyxhffH">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-redirect-KOyxhffH</a> <hr> <h3>Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-priv-esc-F4wJB7AU">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-priv-esc-F4wJB7AU</a> <hr> <h3>Hardcoded Root Cloud Credentials in Application Binaries in Silver Leaf Technologies Worksnaps</h3> <p /> <A HREF="https://sec-consult.com/vulnerability-lab/advisory/hardcoded-root-cloud-credentials-in-application-binaries-in-silver-leaf-technologies-worksnaps/">https://sec-consult.com/vulnerability-lab/advisory/hardcoded-root-cloud-credentials-in-application-binaries-in-silver-leaf-technologies-worksnaps/</a>

CERT.at2026-06-18T18:05:31ZCERT.at2026-06-17T18:05:14Z2026-06-17T18:05:14Z

<h2>End-of-Day report</h2> Timeframe: Dienstag 16-06-2026 18:00 - Mittwoch 17-06-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a <h2> News </h2> <h3>Kodak confirms data breach claimed by ShinyHunters extortion gang</h3> Kodak has confirmed that its working with external cybersecurity experts to investigate a security breach after hackers gained access to some of the companys data. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/kodak-confirms-data-breach-claimed-by-shinyhunters-extortion-gang/">https://www.bleepingcomputer.com/news/security/kodak-confirms-data-breach-claimed-by-shinyhunters-extortion-gang/</a> <hr> <h3>Historischer Anstieg: KI lässt Anzahl gemeldeter Sicherheitslücken explodieren</h3> Neuen Hochrechnungen zufolge könnten 2026 etwa 66.000 neue Sicherheitslücken registriert werden. Im Vorjahr waren es noch deutlich weniger. <p /> <A HREF="https://www.golem.de/news/historischer-anstieg-ki-laesst-anzahl-gemeldeter-sicherheitsluecken-explodieren-2606-209853.html">https://www.golem.de/news/historischer-anstieg-ki-laesst-anzahl-gemeldeter-sicherheitsluecken-explodieren-2606-209853.html</a> <hr> <h3>Fußball-WM: Offizielles Streamingportal der Fifa gehackt</h3> Eine Forscherin hat eine unzureichende Sicherheitsprüfung bei Systemen der Fifa entdeckt. Angreifer hätten Streams der laufenden WM sabotieren können. <p /> <A HREF="https://www.golem.de/news/fussball-wm-offizielles-streamingportal-der-fifa-gehackt-2606-209873.html">https://www.golem.de/news/fussball-wm-offizielles-streamingportal-der-fifa-gehackt-2606-209873.html</a> <hr> <h3>France To Stop Certifying Products Without Quantum-Safe Encryption</h3> Starting in 2027, Frances cybersecurity agency ANSSI will stop certifying security products that lack quantum-resistant encryption, effectively forcing government agencies and critical infrastructure operators to phase out older cryptographic systems. Reuters reports: Samih Souissi, ANSSIs chief of staff, said at the France Quantum conference that .. <p /> <A HREF="https://it.slashdot.org/story/26/06/16/181236/france-to-stop-certifying-products-without-quantum-safe-encryption">https://it.slashdot.org/story/26/06/16/181236/france-to-stop-certifying-products-without-quantum-safe-encryption</a> <hr> <h3>WordPress PBN Plugin Drops Dual Webshells via Database Injection</h3> During a recent incident response engagement, our team uncovered a multi-stage WordPress infection that goes beyond the usual file-based malware. The attacker combined a fake plugin, a remote command-and-control server, and two PHP web shells stored directly inside the WordPress database.The campaign is operated by a Turkish-speaking threat actor .. <p /> <A HREF="https://blog.sucuri.net/2026/06/wordpress-pbn-plugin-drops-dual-webshells-via-database-injection.html">https://blog.sucuri.net/2026/06/wordpress-pbn-plugin-drops-dual-webshells-via-database-injection.html</a> <hr> <h3>CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution</h3> The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting Widget Factory Joomla Content Editor (JCE) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. <p /> <A HREF="https://thehackernews.com/2026/06/cisa-warns-of-actively-exploited-joomla.html">https://thehackernews.com/2026/06/cisa-warns-of-actively-exploited-joomla.html</a> <hr> <h3>Three critical Fortinet sandbox bugs splattered by unknown attackers</h3> All have patches, so make sure you upgrade to a fixed version <p /> <A HREF="https://www.theregister.com/security/2026/06/16/three-critical-fortinet-sandbox-bugs-splattered-by-unknown-attackers/5256461">https://www.theregister.com/security/2026/06/16/three-critical-fortinet-sandbox-bugs-splattered-by-unknown-attackers/5256461</a> <hr> <h3>-Dangerous- AI Models Are Coming No Matter What</h3> The US government crackdown on Anthropic-s Claude Fable 5 and Mythos 5 hides a glaring truth: AI models with advanced hacking capabilities will soon be the norm. <p /> <A HREF="https://www.wired.com/story/dangerous-ai-models-are-coming-no-matter-what/">https://www.wired.com/story/dangerous-ai-models-are-coming-no-matter-what/</a> <hr> <h3>Mehrere Plug-ins für JetBrains-IDEs stehlen API-Keys für OpenAI, DeepSeek & Co.</h3> Mindestens 15 Plug-ins für JetBrains-IDEs übermitteln API-Keys an einen externen Server. Dabei bieten sie ansonsten die versprochenen Funktionen. <p /> <A HREF="https://www.heise.de/news/Mehrere-Plug-ins-fuer-JetBrains-IDEs-stehlen-API-Keys-fuer-OpenAI-DeepSeek-Co-11335021.html">https://www.heise.de/news/Mehrere-Plug-ins-fuer-JetBrains-IDEs-stehlen-API-Keys-fuer-OpenAI-DeepSeek-Co-11335021.html</a> <hr> <h3>Android 17 hat direkt Sicherheitspatches mit an Bord</h3> Googles Entwickler haben in der Launchversion von Android 17 diverse Sicherheitslücken geschlossen. <p /> <A HREF="https://www.heise.de/news/Android-17-hat-direkt-Sicherheitspatches-mit-an-Bord-11335345.html">https://www.heise.de/news/Android-17-hat-direkt-Sicherheitspatches-mit-an-Bord-11335345.html</a> <hr> <h3>Angriffe auf FortiSandbox-Schwachstellen</h3> Schwachstellen in FortiSandbox sind derzeit Ziel von Angriffen im Internet. Patches zum Absichern stehen seit April bereit. <p /> <A HREF="https://www.heise.de/news/Angriffe-auf-FortiSandbox-Schwachstellen-11335667.html">https://www.heise.de/news/Angriffe-auf-FortiSandbox-Schwachstellen-11335667.html</a> <hr> <h3>NIS2-Mahnung: BSI setzt neue Frist zur Registrierung bis Ende Juli</h3> Die Registrierungszahlen zum IT-Sicherheitsgesetz enttäuschen. Das BSI mahnt Firmen, NIS2-Vorgaben einzuhalten, und gibt eine neue Deadline vor. <p /> <A HREF="https://www.heise.de/news/NIS2-Mahnung-BSI-setzt-neue-Frist-zur-Registrierung-bis-Ende-Juli-11336134.html">https://www.heise.de/news/NIS2-Mahnung-BSI-setzt-neue-Frist-zur-Registrierung-bis-Ende-Juli-11336134.html</a> <hr> <h3>GitHub dismissed security reports on flaws now exploited by supply-chain worm, researchers say</h3> GitHub rejected two formal vulnerability reports identifying design flaws that researchers say are enabling variants of the Shai-Hulud supply-chain worm to infect and compromise hundreds of software packages and developer accounts worldwide. <p /> <A HREF="https://therecord.media/github-dismissed-reports-shai-hulud-deep-specter">https://therecord.media/github-dismissed-reports-shai-hulud-deep-specter</a> <hr> <h3>Reducing Microsoft Sentinel Costs Without Compromising Detection - Part 1: The Summary Rules Quest</h3> This blog is the first in a series exploring how Summary Rules, together with Auxiliary or Data Lake storage, can help organizations optimize SIEM costs without compromising core threat detection and monitoring capabilities. <p /> <A HREF="https://blog.nviso.eu/2026/06/17/reducing-microsoft-sentinel-costs-without-compromising-detection-part-1-the-summary-rules-quest/">https://blog.nviso.eu/2026/06/17/reducing-microsoft-sentinel-costs-without-compromising-detection-part-1-the-summary-rules-quest/</a> <hr> <h3>FortiBleed - 75k Fortinet firewalls have admin passwords cracked</h3> An interesting post popped up on LinkedIn at the weekend from Voldymyr Diachenko saying plain text passwords were found in the wild by Hunt Intelligence Inc for Fortinet firewalls .. <p /> <A HREF="https://doublepulsar.com/fortibleed-75k-fortinet-firewalls-have-admin-passwords-cracked-60299faa65f8">https://doublepulsar.com/fortibleed-75k-fortinet-firewalls-have-admin-passwords-cracked-60299faa65f8</a> <hr> <h3>Threat tactic spotlight: Subdomain takeover</h3> In this blog post you-ll learn how to detect and prevent subdomain takeover - a tactic where threat actors exploit dangling DNS records to redirect traffic to attacker-controlled resources. We-ll explain the issue, how the situation arises, and how you can use various AWS features and services to help mitigate the impact of this tactic. <p /> <A HREF="https://aws.amazon.com/blogs/security/threat-tactic-spotlight-subdomain-takeover/">https://aws.amazon.com/blogs/security/threat-tactic-spotlight-subdomain-takeover/</a> <hr> <h2> Vulnerabilities </h2> <h3>Critical Security Patch Update Advisory - June 2026</h3> <p /> <A HREF="https://www.oracle.com/security-alerts/cspujun2026.html">https://www.oracle.com/security-alerts/cspujun2026.html</a> <hr> <h3>Multiple Vulnerabilities in Quanos Content Solutions SCHEMA ST4</h3> <p /> <A HREF="https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-quanos-content-solutions-schema-st4/">https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-quanos-content-solutions-schema-st4/</a> <hr> <h3>A 27-Year-Old Authentication Bypass in OpenBSDs PPP Stack</h3> <p /> <A HREF="https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html">https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html</a>

CERT.at2026-06-17T18:05:14ZCERT.at2026-06-16T18:41:48Z2026-06-16T18:41:48Z

<h2>End-of-Day report</h2> Timeframe: Montag 15-06-2026 18:00 - Dienstag 16-06-2026 18:00 Handler: Guenes Holler Co-Handler: n/a <h2> News </h2> <h3>ÖIAT-Studie: Über 600.000 betrügerische und problematische Werbeanzeigen auf Facebook und Instagram</h3> Eine -Analyse des Betrugsökosystems Online-Werbung auf Meta-Plattformen- hat erstaunliche Ergebnisse geliefert. Über einen Zeitraum von drei Monaten entdeckte die Forschungsabteilung des ÖIAT über 600.000 betrügerische bzw. problematische Werbeanzeigen auf Meta-Plattformen. EU-weit wurden diese über 1 Milliarde Mal ausgespielt, davon 123 Millionen Mal allein in Österreich. <p /> <A HREF="https://www.watchlist-internet.at/news/betruegerische-problematische-werbeanzeigen-meta/">https://www.watchlist-internet.at/news/betruegerische-problematische-werbeanzeigen-meta/</a> <hr> <h3>Mit Malware erbeutet: 124 Millionen neue Passwörter bei HaveIBeenPwned</h3> Cyberkriminelle greifen mit Infostealer-Malware häufig Zugangsdaten ab. HaveIBeenPwned hat seine Datenbank um eine große Sammlung davon erweitert. <p /> <A HREF="https://www.golem.de/news/mit-malware-erbeutet-124-millionen-neue-passwoerter-bei-haveibeenpwned-2606-209825.html">https://www.golem.de/news/mit-malware-erbeutet-124-millionen-neue-passwoerter-bei-haveibeenpwned-2606-209825.html</a> <hr> <h3>Windows version of SprySOCKS Linux malware used to attack govt orgs</h3> Windows variants for the SprySOCKS Linux malware have been used in attacks targeting government organizations in at least four countries. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/windows-version-of-sprysocks-linux-malware-used-to-attack-govt-orgs/">https://www.bleepingcomputer.com/news/security/windows-version-of-sprysocks-linux-malware-used-to-attack-govt-orgs/</a> <hr> <h3>Ransomware gang abuses Microsoft Teams relays to hide malicious traffic</h3> DragonForce ransomware used a custom malware named 'Backdoor.Turn' to hide command-and-control traffic inside Microsoft Teams relay infrastructure. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/ransomware-gang-abuses-microsoft-teams-relays-to-hide-malicious-traffic/">https://www.bleepingcomputer.com/news/security/ransomware-gang-abuses-microsoft-teams-relays-to-hide-malicious-traffic/</a> <hr> <h3>North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels</h3> Cybersecurity researchers have flagged two malicious cyber campaigns that exhibit similarities with a persistent North Korean threat cluster known as Contagious Interview (aka Famous Chollima, HexagonalRodent, and Void Dokkaebi). According to a report published by Proofpoint, the threat actor has been found orchestrating phishing campaigns using developer role recruitment or code review themes to target nearly 100 organizations in finance, cryptocurrency, education, technology, and several other sectors. The activity has been codenamed UNK_DeadDrop. <p /> <A HREF="https://thehackernews.com/2026/06/north-korean-hackers-are-turning.html">https://thehackernews.com/2026/06/north-korean-hackers-are-turning.html</a> <hr> <h3>EvilTokens: Neue Phishing-Kampagne verschafft sich Zugriff mit legitimen Mitteln</h3> Was passiert, wenn bei einem Phishing-Angriff offizielle Infrastruktur genutzt wird, anstatt diese zu fälschen? EvilTokens markiert eine Weiterentwicklung des Phishing: Es werden nicht mehr Anmeldedaten gestohlen, sondern die Opfer dazu verleitet, legitime Sitzungen zu autorisieren. <p /> <A HREF="https://www.welivesecurity.com/de/cybercrime/eviltokens-neue-phishing-kampagne-verschafft-sich-zugriff-mit-legitimen-mitteln/">https://www.welivesecurity.com/de/cybercrime/eviltokens-neue-phishing-kampagne-verschafft-sich-zugriff-mit-legitimen-mitteln/</a> <hr> <h3>Pickle in the Middle - Hijacking Vertex AI Model Uploads for Cross-Tenant RCE</h3> We discovered a vulnerability in the Google Cloud Vertex AI software development kit (SDK) for Python, and responsibly disclosed it to Google. Before Google-s fix, the vulnerability would have allowed an attacker operating entirely from their own Google Cloud project to hijack a victim's model upload and poison it. By exploiting this flaw in vulnerable versions of the SDK, an attacker can achieve remote code execution (RCE) within a target-s Vertex AI serving infrastructure, with zero initial access to the victim's project. <p /> <A HREF="https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/">https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/</a> <hr> <h3>Viel Geduld: Chinesische IT-Spione lauerten lange in Forschungseinrichtungen</h3> Viel Geduld haben chinesische Angreifer bewiesen: Sie nisteten sich in Redcap-Servern ein, nutzten das aber erst mehr als ein Jahr später voll aus. <p /> <A HREF="https://heise.de/-11333355">https://heise.de/-11333355</a> <hr> <h3>GlassWASM: WebAssembly Malware Found in Trojanized Open VSX Extensions</h3> The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure. <p /> <A HREF="https://socket.dev/blog/glasswasm-malware-open-vsx-extensions?utm_medium=feed">https://socket.dev/blog/glasswasm-malware-open-vsx-extensions?utm_medium=feed</a> <hr> <h3>A backdoor in a LinkedIn job offer</h3> Last week, I got a LinkedIn message from a recruiter at a small crypto startup. We exchanged a few messages over a couple of days, she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to -check out the deprecated Node modules issue.- It-s not uncommon to ask for a review of an existing codebase, but something felt off and raised an alarm in my head, so I decided to get a bit extra paranoid. <p /> <A HREF="https://roman.pt/posts/linkedin-backdoor/">https://roman.pt/posts/linkedin-backdoor/</a> <hr> <h3>Critical Fortinet FortiSandbox flaws now exploited in attacks</h3> Attackers are now exploiting several critical vulnerabilities in Fortinet's FortiSandbox cyber threat detection platform, according to threat intelligence company Defused. Fortinet released security updates for these three critical-severity security flaws (tracked as CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089) on April 14. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/critical-fortinet-fortisandbox-flaws-now-exploited-in-attacks/">https://www.bleepingcomputer.com/news/security/critical-fortinet-fortisandbox-flaws-now-exploited-in-attacks/</a> <h2> Vulnerabilities </h2> <h3>Root-Attacken auf Cisco Catalyst SD-WAN Manager und cPanel-Plug-in LiteSpeed</h3> Admins, die Cisco Catalyst SD-WAN Manager oder cPanel mit LiteSpeed-Plug-in verwalten, sollten aufgrund von laufenden Angriffen umgehend die verfügbaren Sicherheitsupdates installieren. Im schlimmsten Fall können Angreifer als root-Nutzer auf Systeme zugreifen. Damit das klappt, müssen sie aber zuerst einige Hürden überwinden. <p /> <A HREF="https://www.heise.de/news/Root-Attacken-auf-Cisco-Catalyst-SD-WAN-Manager-und-cPanel-Plug-in-LiteSpeed-11333457.html">https://www.heise.de/news/Root-Attacken-auf-Cisco-Catalyst-SD-WAN-Manager-und-cPanel-Plug-in-LiteSpeed-11333457.html</a> <hr> <h3>LWN Security updates for Tuesday</h3> <p /> <A HREF="https://lwn.net/Articles/1078158/">https://lwn.net/Articles/1078158/</a> <hr> <h3>Broken Access Control in syracom AG Secure Login (2FA) for Atlassian Jira / Confluence / Bitbucket</h3> <p /> <A HREF="https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in-syracom-ag-secure-login-2fa-for-atlassian-jira-confluence-bitbucket/">https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in-syracom-ag-secure-login-2fa-for-atlassian-jira-confluence-bitbucket/</a> <hr> <h3>Zyxel security advisory for stack-based buffer overflow vulnerability in GS1900 series switches</h3> <p /> <A HREF="https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026">https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026</a>

CERT.at2026-06-16T18:41:48ZCERT.at2026-06-15T18:42:27Z2026-06-15T18:42:27Z

<h2>End-of-Day report</h2> Timeframe: Freitag 12-06-2026 18:00 - Montag 15-06-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl <h2> News </h2> <h3>New attack turned Microsoft 365 Copilot into 1-click data theft tool</h3> A critical vulnerability chain dubbed SearchLeak in Microsoft 365 Copilot Enterprise could allow attackers to steal sensitive data from a targets mailbox, OneDrive, or SharePoint account through a specially crafted URL. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/new-attack-turned-microsoft-365-copilot-into-1-click-data-theft-tool/">https://www.bleepingcomputer.com/news/security/new-attack-turned-microsoft-365-copilot-into-1-click-data-theft-tool/</a> <hr> <h3>Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites</h3> An attacker tampered with trusted JavaScript files used by WordPress sites running PushEngage, OptinMonster, and TrustPulse, turning those files into a way to break into the sites.When a site administrator was logged in as the file loaded, the code created an admin account under the attackers control and installed a hidden plugin that opened a way back in. <p /> <A HREF="https://thehackernews.com/2026/06/popular-wordpress-plugin-scripts.html">https://thehackernews.com/2026/06/popular-wordpress-plugin-scripts.html</a> <hr> <h3>-Sommer der Glückseligkeit-: curl nimmt einen Monat lang keine Bug-Reports an</h3> Seit Wochen kämpft der Maintainer von curl mit der Arbeitslast durch die Flut an KI-generierten Bug-Reports. Im Juli soll deshalb keiner angenommen werden. <p /> <A HREF="https://www.heise.de/news/Sommer-der-Glueckseligkeit-curl-nimmt-einen-Monat-lang-keine-Bug-Reports-an-11332339.html">https://www.heise.de/news/Sommer-der-Glueckseligkeit-curl-nimmt-einen-Monat-lang-keine-Bug-Reports-an-11332339.html</a> <hr> <h3>WKO-Phishing: Betrugsmail fordert Datenaktualisierung</h3> Aktuell behauptet eine E-Mail im Namen der Wirtschaftskammer Österreich (WKO), dass Unternehmensdaten nicht aktualisiert wurden. Wer den enthaltenen Link nicht ausfüllt, dem werden umfassende Strafen angedroht. Tatsächlich haben es Kriminelle auf sensible Unternehmens- und Personendaten abgesehen. <p /> <A HREF="https://www.watchlist-internet.at/news/wko-phishing-betrugsmail-fordert-datenaktualisierung/">https://www.watchlist-internet.at/news/wko-phishing-betrugsmail-fordert-datenaktualisierung/</a> <hr> <h3>FortiNet SSO Vulnerability CVE-2025-59718 and CVE-2025-59719 Leading to Full System Compromise</h3> Earlier this year, Truesec CSIRT responded to multiple incidents related to the two FortiCloud single-sign-on (SSO) vulnerabilities from December 2025 (tracked as CVE-2025-59718 and CVE-2025-59719). In this blog post, we share our insights into threat actors- activities and methods for compromising an environment. <p /> <A HREF="https://www.truesec.com/hub/blog/vulnerability-cve-2025-59718-and-cve-2025-59719">https://www.truesec.com/hub/blog/vulnerability-cve-2025-59718-and-cve-2025-59719</a> <hr> <h3>Routerhersteller fordern Kontrolle importierter Geräte</h3> EU-Sicherheitsvorschriften für 5G-Mobilfunk sollen Spionage vorbeugen. Für Heimnetzwerke gibt es keine entsprechenden Regeln, kritisieren nun Hersteller. <p /> <A HREF="https://heise.de/-11331799">https://heise.de/-11331799</a> <hr> <h3>152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Faked Google Search Traffic</h3> Sockets Threat Research Team identified a family of 152 Chrome Web Store new-tab "live wallpaper" extensions, built from one shared codebase but distributed across 38 separate Chrome Web Store publisher accounts and three brand backends, carrying a combined total of approximately 105,000 reported installs. <p /> <A HREF="https://socket.dev/blog/152-chrome-live-wallpaper-extensions-hid-ad-tracking">https://socket.dev/blog/152-chrome-live-wallpaper-extensions-hid-ad-tracking</a> <hr> <h3>Präparierte PDF-Datei kann Avira Antivirus gefährlich werden</h3> In einer Schwachstellendatenbank sind Lücken in Avira Antivirus aufgetaucht. Bislang listet der Softwarehersteller die Lücken nicht auf. Sie sind aber gepatcht. <p /> <A HREF="https://www.heise.de/news/Praeparierte-PDF-Datei-kann-Avira-Antivirus-gefaehrlich-werden-11332323.html">https://www.heise.de/news/Praeparierte-PDF-Datei-kann-Avira-Antivirus-gefaehrlich-werden-11332323.html</a> <hr> <h3>LibreNMS Authenticated RCE (< 26.5.0)</h3> When theres one, theres normally more. This is a part 2 to our previous post on LibreNMS. This vulnerability allows an admin user to inject commands that are passed to the exec function, which will then be executed as the user running the poller. <p /> <A HREF="https://projectblack.io/blog/librenms-authenticated-rce-26-5-0/">https://projectblack.io/blog/librenms-authenticated-rce-26-5-0/</a> <hr> <h3>Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE)</h3> On June 10th, Splunk published this CVE-2026-20253 advisory [..] It has everything that we love: No authentication requirements, An almost full-mark CVSS score, Claims to be a security product, Vulnerability name longer than the average piece of spaghetti. <p /> <A HREF="https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/">https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/</a> <h2> Vulnerabilities </h2> <h3>Splunk: SVD-2026-0603: Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise</h3> In Splunk Enterprise versions below 10.2.4 and 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. <p /> <A HREF="https://advisory.splunk.com//advisories/SVD-2026-0603">https://advisory.splunk.com//advisories/SVD-2026-0603</a> <hr> <h3>phpBB: Kritische Sicherheitslücke ermöglicht Kompromittierung</h3> In der Forensoftware phpBB haben IT-Forscher eine kritische Sicherheitslücke entdeckt, die Zugang mit jedem angelegten Konto ermöglicht. <p /> <A HREF="https://www.heise.de/news/phpBB-Kritische-Sicherheitsluecke-ermoeglicht-Kompromittierung-11332689.html">https://www.heise.de/news/phpBB-Kritische-Sicherheitsluecke-ermoeglicht-Kompromittierung-11332689.html</a> <hr> <h3>LWN: Security updates for Monday</h3> <p /> <A HREF="https://lwn.net/Articles/1077945/">https://lwn.net/Articles/1077945/</a> <hr> <h3>Zahlreiche kritische Schwachstellen in Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)</h3> <p /> <A HREF="https://sec-consult.com/de/vulnerability-lab/advisory/zahlreiche-kritische-schwachstellen-in-wertheim-safecontroller-software-for-vault-rooms-safe-deposit-locker-system/">https://sec-consult.com/de/vulnerability-lab/advisory/zahlreiche-kritische-schwachstellen-in-wertheim-safecontroller-software-for-vault-rooms-safe-deposit-locker-system/</a>

CERT.at2026-06-15T18:42:27ZCERT.at2026-06-12T18:04:13Z2026-06-12T18:04:13Z

<h2>End-of-Day report</h2> Timeframe: Donnerstag 11-06-2026 18:00 - Freitag 12-06-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a <h2> News </h2> <h3>Pharma giant Novo Nordisk discloses breach of clinical trials data</h3> Danish pharmaceutical giant Novo Nordisk, the worlds largest producer of insulin, disclosed a data breach affecting patient information from some clinical trials. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/pharmaceutical-giant-novo-nordisk-discloses-security-breach/">https://www.bleepingcomputer.com/news/security/pharmaceutical-giant-novo-nordisk-discloses-security-breach/</a> <hr> <h3>336 Millionen Euro in Bitcoin gewaschen: Geldwäschedienst AudiA6 zerschlagen</h3> Ein AudiA6 genannter Geldwäschedienst ließ Hacker und Betrüger Bitcoin-Transaktionen in Millionenhöhe verschleiern. Doch damit ist jetzt Schluss. <p /> <A HREF="https://www.golem.de/news/336-millionen-euro-in-bitcoin-gewaschen-geldwaeschedienst-audia6-zerschlagen-2606-209687.html">https://www.golem.de/news/336-millionen-euro-in-bitcoin-gewaschen-geldwaeschedienst-audia6-zerschlagen-2606-209687.html</a> <hr> <h3>Kernel-Bug: FreeBSD-Exploit "Bumsrakete" verleiht Root-Zugriff</h3> Ein Exploit namens Bumsrakete gefährdet alle FreeBSD-Versionen der letzten fünf Jahre. Die Entdecker nehmen es mit reichlich Humor. <p /> <A HREF="https://www.golem.de/news/kernel-bug-freebsd-exploit-bumsrakete-verleiht-root-zugriff-2606-209694.html">https://www.golem.de/news/kernel-bug-freebsd-exploit-bumsrakete-verleiht-root-zugriff-2606-209694.html</a> <hr> <h3>LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution</h3> Cybersecurity researchers have disclosed details of three now-patched security flaws impacting LangGraph, including a critical vulnerability chain that could result in remote code execution.LangGraph is an open-source framework created by LangChain to .. <p /> <A HREF="https://thehackernews.com/2026/06/langgraph-flaw-chain-exposes-self.html">https://thehackernews.com/2026/06/langgraph-flaw-chain-exposes-self.html</a> <hr> <h3>INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator</h3> An INTERPOL-led operation last month resulted in the disruption of Sniper Dz, a decade-long phishing-as-a-service (PhaaS) platform, Group-IB said Thursday.The effort, codenamed Operation Ramz, took place between October 2025 and February .. <p /> <A HREF="https://thehackernews.com/2026/06/interpol-takes-down-sniper-dz-phishing.html">https://thehackernews.com/2026/06/interpol-takes-down-sniper-dz-phishing.html</a> <hr> <h3>Drug Sites Hijacked Spotify-s Search Ranking Through Fake Podcasts</h3> A joint congressional report describes a spam operation that turned tens of thousands of fake podcasts into search-engine bait for illegal pharmacy and scam sites. <p /> <A HREF="https://www.wired.com/story/drug-sites-hijacked-spotifys-search-ranking-through-fake-podcasts-report-finds/">https://www.wired.com/story/drug-sites-hijacked-spotifys-search-ranking-through-fake-podcasts-report-finds/</a> <hr> <h3>Ivanti Sentry: Verwirrung um Status von kritischem Befehlsschmuggel-Leck</h3> Ivanti warnt aktuell vor kritischen Sicherheitslücken in Sentry. Die CISA warnt vor Angriffen, Ivanti wiegelt jedoch ab. <p /> <A HREF="https://www.heise.de/news/Ivanti-Sentry-Wirrwar-um-Missbrauch-kritischer-Befehlsschmuggel-Luecke-11329730.html">https://www.heise.de/news/Ivanti-Sentry-Wirrwar-um-Missbrauch-kritischer-Befehlsschmuggel-Luecke-11329730.html</a> <hr> <h3>Ubiquiti UniFi OS: Kritische Lücken erlauben Codeschmuggel</h3> Ubiquiti warnt vor teils kritischen Sicherheitslücken in UniFi OS. Aktualisierte Software steht bereit, um sie zu schließen. <p /> <A HREF="https://www.heise.de/news/Ubiquiti-UniFi-OS-Kritische-Luecken-erlauben-Codeschmuggel-11329967.html">https://www.heise.de/news/Ubiquiti-UniFi-OS-Kritische-Luecken-erlauben-Codeschmuggel-11329967.html</a> <hr> <h3>Fake verification pages are stealing Steam accounts from players</h3> A convincing fake FACEIT verification page is stealing Steam accounts by using a fake login window that looks completely legitimate. <p /> <A HREF="https://www.malwarebytes.com/blog/threat-intel/2026/06/fake-verification-pages-are-stealing-steam-accounts-from-players">https://www.malwarebytes.com/blog/threat-intel/2026/06/fake-verification-pages-are-stealing-steam-accounts-from-players</a> <hr> <h3>Hundreds of AUR packages compromised</h3> Hundreds of orphaned packages hosted by the Arch User Repository (AUR) have been compromised by an attacker who has added a malicious npm package (atomic-lockfile) that can exfiltrate sensitive data. The project is currently working on cleaning up the mess. There is a list of affected packages and post (possibly NSFW domain) by"sodiboo" with additional information .. <p /> <A HREF="https://lwn.net/Articles/1077718/">https://lwn.net/Articles/1077718/</a> <hr> <h3>Decade-Long SniperDz Phishing Network Disrupted in Operation Ramz</h3> Group-IB, INTERPOL and Algerian Police dismantle decade-old SniperDZ phishing network used to steal credentials, with its alleged developer arrested. <p /> <A HREF="https://hackread.com/authorities-dismantle-sniperdz-phishing-network/">https://hackread.com/authorities-dismantle-sniperdz-phishing-network/</a> <hr> <h3>Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751)</h3> It is yet another day in this parallel universe of security, where the devices we bolt onto the edge of our networks to keep the bad people out are, with remarkable consistency, the exact thing that let the bad .. <p /> <A HREF="https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751/">https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751/</a> <hr> <h2> Vulnerabilities </h2> <h3>CVE-2026-45257: LPE in FreeBSD via kTLS-RX</h3> <p /> <A HREF="https://bumsrake.de">https://bumsrake.de</a>

CERT.at2026-06-12T18:04:13ZCERT.at2026-06-11T18:14:50Z2026-06-11T18:14:50Z

<h2>End-of-Day report</h2> Timeframe: Mittwoch 10-06-2026 18:00 - Donnerstag 11-06-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a <h2> News </h2> <h3>Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks</h3> Oracle PeopleSoft servers are being targeted in ongoing data theft attacks by the ShinyHunters extortion gang, which claims to have stolen data from over 100 organizations. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/oracle-peoplesoft-servers-hacked-in-shinyhunters-data-theft-attacks/">https://www.bleepingcomputer.com/news/security/oracle-peoplesoft-servers-hacked-in-shinyhunters-data-theft-attacks/</a> <hr> <h3>Neuer Bitlocker-Bypass: Chaotic Eclipse wirft weiter mit Windows-Exploits um sich</h3> Chaotic Eclipse ist wohl doch nicht so erschöpft wie behauptet. Ein neuer Exploit zur Umgehung von Bitlocker auf Windows-Geräten ist noch drin. <p /> <A HREF="https://www.golem.de/news/neuer-bitlocker-bypass-chaotic-eclipse-wirft-weiter-mit-windows-exploits-um-sich-2606-209646.html">https://www.golem.de/news/neuer-bitlocker-bypass-chaotic-eclipse-wirft-weiter-mit-windows-exploits-um-sich-2606-209646.html</a> <hr> <h3>Chinese agents caught rebuilding botnets and stirring the pot on AI datacenter debate</h3> PRC eyes are watching you <p /> <A HREF="https://www.theregister.com/security/2026/06/11/china-linked-operators-revive-botnet-stir-ai-datacenter-debate/5253873">https://www.theregister.com/security/2026/06/11/china-linked-operators-revive-botnet-stir-ai-datacenter-debate/5253873</a> <hr> <h3>Every employee-s password was stored in a single Excel file</h3> The CEO thought this was the best way to deal with some email issues <p /> <A HREF="https://www.theregister.com/security/2026/06/11/every-employees-password-was-stored-in-a-single-excel-file/5253784">https://www.theregister.com/security/2026/06/11/every-employees-password-was-stored-in-a-single-excel-file/5253784</a> <hr> <h3>CISA Tells US Agencies to Fix Security Bugs in as Little as 3 Days Thanks to AI Threats</h3> -Defenders cannot afford to take weeks to patch,- one Cybersecurity and Infrastructure Security Agency official warned on Wednesday. <p /> <A HREF="https://www.wired.com/story/cisa-ai-vulnerability-directive/">https://www.wired.com/story/cisa-ai-vulnerability-directive/</a> <hr> <h3>OpenSSL: Präparierte Signatur kann Weg für Schadcode ebnen</h3> In aktuellen Versionen haben die OpenSSL-Entwickler insgesamt 18 Sicherheitslücken geschlossen. <p /> <A HREF="https://www.heise.de/news/OpenSSL-Praeparierte-Signatur-kann-Weg-fuer-Schadcode-ebnen-11328258.html">https://www.heise.de/news/OpenSSL-Praeparierte-Signatur-kann-Weg-fuer-Schadcode-ebnen-11328258.html</a> <hr> <h3>Intel-Aus: So lange will Apple Sicherheitspatches liefern</h3> Mit macOS 27 ist das x86-Zeitalter bei Apple vorbei. Immerhin soll es noch über einen längeren Zeitraum Patches geben. Wie vollständig die sind - unklar. <p /> <A HREF="https://www.heise.de/news/macOS-Apple-teilt-mit-wie-lange-es-Intel-Sicherheitsupdates-geben-wird-11327980.html">https://www.heise.de/news/macOS-Apple-teilt-mit-wie-lange-es-Intel-Sicherheitsupdates-geben-wird-11327980.html</a> <hr> <h3>FreeBSD: Rechteausweitungslücke mit augenzwinkerndem Codenamen</h3> Auch in FreeBSD haben IT-Forscher eine Sicherheitslücke gefunden, die die Rechteausweitung ermöglicht. Name: -Bumsrakete[tm]-. <p /> <A HREF="https://www.heise.de/news/FreeBSD-Rechteausweitungsluecke-mit-augenzwinkerndem-Codenamen-11328722.html">https://www.heise.de/news/FreeBSD-Rechteausweitungsluecke-mit-augenzwinkerndem-Codenamen-11328722.html</a> <hr> <h3>GenAI Is Both Hunter and Hunted at Pwn2Own Berlin 2026</h3> This year-s Pwn2Own competition in Berlin revealed just how much of the AI stack remains exposed -- and the gap between what these tools promise and what they can withstand point to the fragile security foundations underneath. <p /> <A HREF="https://www.trendmicro.com/en_us/research/26/f/pwn2own-genai.html">https://www.trendmicro.com/en_us/research/26/f/pwn2own-genai.html</a> <hr> <h2> Vulnerabilities </h2> <h3>SVD-2026-0609: Improper Access Control in Splunk Enterprise</h3> In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, and 9.3.2411.131, a user who holds a Splunk role that contains the high-privilege capability edit_saved_search_owner could reassign saved search ownership to users outside their authorized scope. The ownership reassignment endpoint lacks access control. <p /> <A HREF="https://advisory.splunk.com//advisories/SVD-2026-0609">https://advisory.splunk.com//advisories/SVD-2026-0609</a> <hr> <h3>SVD-2026-0606: Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise</h3> In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the -admin- or -power- Splunk roles could cause data exfiltration through classic dashboards by redirecting a victim to an external site using a protocol-relative URL in a drill-down link.The vulnerability exists because the URL classifier in classic dashboards <p /> <A HREF="https://advisory.splunk.com//advisories/SVD-2026-0606">https://advisory.splunk.com//advisories/SVD-2026-0606</a> <hr> <h3>SVD-2026-0605: Improper Input Validation through Classic Dashboards in Splunk Enterprise</h3> In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the -admin- or -power- Splunk roles could craft a malicious classic dashboard that exfiltrates sensitive data to an external server.The vulnerability exists because URL validation on the external content dialog is incomplete, which can allow for requests to <p /> <A HREF="https://advisory.splunk.com//advisories/SVD-2026-0605">https://advisory.splunk.com//advisories/SVD-2026-0605</a> <hr> <h3>SVD-2026-0601: Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway</h3> In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the -admin- or -power- Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.The Remote Code Execution is possible because of unsafe deserialization of App <p /> <A HREF="https://advisory.splunk.com//advisories/SVD-2026-0601">https://advisory.splunk.com//advisories/SVD-2026-0601</a> <hr> <h3>Oracle Security Alert Advisory - CVE-2026-35273</h3> <p /> <A HREF="https://www.oracle.com/security-alerts/alert-cve-2026-35273.html">https://www.oracle.com/security-alerts/alert-cve-2026-35273.html</a> <hr> <h3>Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047</h3> <p /> <A HREF="https://www.drupal.org/sa-contrib-2026-047">https://www.drupal.org/sa-contrib-2026-047</a> <hr> <h3>Composer - Critical - Unsupported - SA-CONTRIB-2026-046</h3> <p /> <A HREF="https://www.drupal.org/sa-contrib-2026-046">https://www.drupal.org/sa-contrib-2026-046</a>

CERT.at2026-06-11T18:14:50ZCERT.at2026-06-10T18:27:47Z2026-06-10T18:27:47Z

<h2>End-of-Day report</h2> Timeframe: Dienstag 09-06-2026 18:00 - Mittwoch 10-06-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a <h2> News </h2> <h3>OpenClaw AI agent found falling for phishing attacks, spills user data</h3> Phishing simulation on an OpenClaw email agent with various configuration profiles showed that it was susceptible to tactics commonly used to compromise human users. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/openclaw-ai-agent-found-falling-for-phishing-attacks-spills-user-data/">https://www.bleepingcomputer.com/news/security/openclaw-ai-agent-found-falling-for-phishing-attacks-spills-user-data/</a> <hr> <h3>Wurm-Attacken möglich: Kernel-Lücke lässt Angreifer Windows-Systeme kapern</h3> Microsofts Juni-Updates schließen über 500 Sicherheitslücken. Eine davon ermöglicht automatisierte Schadcode-Attacken auf Windows-Systeme. <p /> <A HREF="https://www.golem.de/news/wurm-attacken-moeglich-kernel-luecke-laesst-angreifer-windows-systeme-kapern-2606-209595.html">https://www.golem.de/news/wurm-attacken-moeglich-kernel-luecke-laesst-angreifer-windows-systeme-kapern-2606-209595.html</a> <hr> <h3>Servicenow: Großer Cloudanbieter informiert Kunden über Datenpanne</h3> Bei Servicenow konnten Angreifer ohne Authentifizierung über ein API Kundendaten ausleiten. Mindestens ein Cyberakteur hat das ausgenutzt. <p /> <A HREF="https://www.golem.de/news/servicenow-grosser-cloudanbieter-informiert-kunden-ueber-datenpanne-2606-209617.html">https://www.golem.de/news/servicenow-grosser-cloudanbieter-informiert-kunden-ueber-datenpanne-2606-209617.html</a> <hr> <h3>Ivanti tells Sentry customers to patch now as critical bugs hit 10.0 and 9.9</h3> Remote, unauthenticated RCE with root privileges is about as bad as it gets <p /> <A HREF="https://www.theregister.com/patches/2026/06/10/ivanti-urges-sentry-users-to-patch-two-critical-bugs/5253428">https://www.theregister.com/patches/2026/06/10/ivanti-urges-sentry-users-to-patch-two-critical-bugs/5253428</a> <hr> <h3>GitHub pulls pin on npms auto-run scripts</h3> Shai-Hulud worm exploited exactly this. Better late than never, says everyone except the malware authors <p /> <A HREF="https://www.theregister.com/devops/2026/06/10/github-pulls-pin-on-npms-auto-run-scripts/5253453">https://www.theregister.com/devops/2026/06/10/github-pulls-pin-on-npms-auto-run-scripts/5253453</a> <hr> <h3>Wait, binding.gyp Can Do What? Exploring npms Weirdest Build System</h3> It has only been a couple of days since the Miasma attack hit 32 official Red Hat packages on npm. The worm added a malicious preinstall script to each compromised package, so that node index.js ran automatically the moment you installed the dependency, harvesting cloud credentials, CI tokens, SSH keys and more before you ever ran a single line of your .. <p /> <A HREF="https://www.aikido.dev/blog/exploring-binding-gyp-npm-build-system">https://www.aikido.dev/blog/exploring-binding-gyp-npm-build-system</a> <hr> <h3>Bundesregierung will KI-Sicherheitsinstitut gründen</h3> Mit einer neuen Einrichtung will die Bundesregierung ihre Analysefähigkeiten bei KI-Modellen stärken. Minister Wildberger verspricht -Experten auf Weltniveau-. <p /> <A HREF="https://www.heise.de/news/Bundesregierung-will-KI-Sicherheitsinstitut-gruenden-11326247.html">https://www.heise.de/news/Bundesregierung-will-KI-Sicherheitsinstitut-gruenden-11326247.html</a> <hr> <h3>Datenleck: Cyberangriff auf französischen Regierungs-Messenger Tchap</h3> Frankreichs Digitalstelle DINUM räumt ein Datenleck beim Regierungs-Messenger Tchap ein. Angreifer konnten ein Konto kompromittieren. <p /> <A HREF="https://www.heise.de/news/Datenleck-Cyberangriff-auf-franzoesischen-Regierungs-Messenger-Tchap-11326766.html">https://www.heise.de/news/Datenleck-Cyberangriff-auf-franzoesischen-Regierungs-Messenger-Tchap-11326766.html</a> <hr> <h3>Fortinet schließt Befehlsschmuggel-Lücke in FortiSandbox und mehr</h3> Fortinet warnt vor einer kritischen Sicherheitslücke in FortiSandbox und weiteren Lecks in FortiPortal und FortiOS/FortiProxy. <p /> <A HREF="https://www.heise.de/news/Fortinet-schliesst-Befehlsschmuggel-Luecke-in-FortiSandbox-und-mehr-11326887.html">https://www.heise.de/news/Fortinet-schliesst-Befehlsschmuggel-Luecke-in-FortiSandbox-und-mehr-11326887.html</a> <hr> <h3>Phishing: Banken nutzen halbseidene Domains</h3> Namhafte Banken wie die Sparkassen warnen zwar vor Phishing, nutzen aber selbst Phishing-artige Domains. Es ginge sicher besser. <p /> <A HREF="https://www.heise.de/news/Phishing-Banken-nutzen-halbseidene-Domains-11327434.html">https://www.heise.de/news/Phishing-Banken-nutzen-halbseidene-Domains-11327434.html</a> <hr> <h3>E-Mail-Fälschung bei Exchange Online: Ghost-Sender betrifft viele Unternehmen</h3> Nicht alle Unternehmenskunden von Microsofts Maildienst sind betroffen. Ein Prüfdienst schafft Klarheit und zeigt die möglichen Auswirkungen. <p /> <A HREF="https://www.heise.de/news/Ghost-Sender-Exchange-Online-laesst-gefaelschte-E-Mails-anstandslos-durch-11327666.html">https://www.heise.de/news/Ghost-Sender-Exchange-Online-laesst-gefaelschte-E-Mails-anstandslos-durch-11327666.html</a> <hr> <h3>Who Runs the Ransomware Group -The Gentlemen?-</h3> A cybercrime group known as The Gentlemen has emerged as the second most active ransomware gang by victim count, rapidly attracting a talented pool of hackers through an aggressive recruitment strategy that promises affiliates 90 percent of any ransom paid by victims. This post examines clues pointing to a real life identity for the administrator of The Gentlemen ransomware group. <p /> <A HREF="https://krebsonsecurity.com/2026/06/who-runs-the-ransomware-group-the-gentlemen/">https://krebsonsecurity.com/2026/06/who-runs-the-ransomware-group-the-gentlemen/</a> <hr> <h3>FinanzOnline-Phishing: "Neuer Bescheid" in der DataBox als Lockmittel</h3> Aktuell rollt wieder einmal eine Phishing-Welle im Namen von FinanzOnline. Darin dreht sich alles um einen vermeintlichen Bescheid, der in der DataBox von FinanzOnline wartet und eine Gutschrift verspricht. Dieser existiert natürlich nicht. Konkret abgesehen haben es die Kriminellen auf Logindaten ihrer Opfer. <p /> <A HREF="https://www.watchlist-internet.at/news/finanzonline-phishing-bescheid-datenbox/">https://www.watchlist-internet.at/news/finanzonline-phishing-bescheid-datenbox/</a> <hr> <h3>Microsoft Patch Tuesday Juni 2026 & "RoguePlanet"</h3> Im Rahmen des diesmonatigen Patchdays hat Microsoft Sicherheitsupdates für rund 200 Schwachstellen veröffentlicht. Damit übertrifft dieser Patchday den bisherigen Rekord von 167 Lücken aus dem Oktober 2025 deutlich. Über 30 der behobenen Sicherheitslücken sind als "Critical" eingestuft. Besonders im Blick behalten sollten Administrator:innen drei Probleme, die bereits vor Verfügbarkeit eines Patches öffentlich bekannt waren. Alle drei werden von .. <p /> <A HREF="https://www.cert.at/de/aktuelles/2026/6/microsoft-patch-tuesday-juni-2026">https://www.cert.at/de/aktuelles/2026/6/microsoft-patch-tuesday-juni-2026</a> <hr> <h3>More Evidence That Words Dont Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520)</h3> Today, Ivanti published an advisory.-No way?- we hear you say. "Yes way!" a random dog screams back at you, across the street.Today-s rare advisory outlines two vulnerabilities in Ivanti-s Sentry product, appealing directly to our inner desire for sophisticated .. <p /> <A HREF="https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/">https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/</a>

CERT.at2026-06-10T18:27:47ZCERT.at2026-06-09T19:06:56Z2026-06-09T19:06:56Z

<h2>End-of-Day report</h2> Timeframe: Montag 08-06-2026 18:00 - Dienstag 09-06-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a <h2> News </h2> <h3>High-severity vulnerability in Linux caused by a single errant character</h3> The presence of a single mis-issued exclamation point in code implementing nf_tables introduced a use-after-free, a class of vulnerability that corrupts memory by placing malicious code at memory addresses that haven-t been properly freed of their previous contents. [..] The vulnerability was fixed in the kernel in February. Security firm FuzzingLabs demonstrated a proof of concept exploit in April. Exodus Intelligence, which discovered the bug, included its own PoC exploit in Monday-s post. It worked on Debian and Ubuntu. <p /> <A HREF="https://arstechnica.com/security/2026/06/a-single-errant-character-in-the-linux-kernel-allows-attacker-to-gain-root/">https://arstechnica.com/security/2026/06/a-single-errant-character-in-the-linux-kernel-allows-attacker-to-gain-root/</a> <hr> <h3>WhatsApp says it disrupted new NSO spyware phishing attacks</h3> WhatsApp has detected and stopped spear-phishing campaigns allegedly conducted by the NSO Group after investigating user reports of social engineering attacks. [..] The firm has been on the U.S. sanctioned entities list since November 2021, due to supplying to foreign governments software products that were used against people and organizations in the U.S. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/whatsapp-says-it-disrupted-new-nso-spyware-phishing-attacks/">https://www.bleepingcomputer.com/news/security/whatsapp-says-it-disrupted-new-nso-spyware-phishing-attacks/</a> <hr> <h3>-Bestätigen Sie Ihre Reservierung!- - Betrugsklassiker im Namen von booking.com</h3> Nachdem Kriminelle im April 2026 Kontakt- und Reservierungsdaten von booking.com erbeutet hatten, setzt nun die dazugehörige Betrugswelle ein. Über WhatsApp sollen die Opfer zur -erneuten Bestätigung einer Reservierung- gedrängt werden. Reale Buchungsinfos wie Hotelname und An- bzw. Abreisedatum lassen die Nachricht vermeintlich seriös wirken. Abgesehen haben es die Betrüger:innen auf Geld und Zahlungsinformationen. <p /> <A HREF="https://www.watchlist-internet.at/news/reservierung-betrugsklassiker-bookingcom/">https://www.watchlist-internet.at/news/reservierung-betrugsklassiker-bookingcom/</a> <hr> <h3>When -Hi, This Is IT- Comes Through Microsoft Teams</h3> Attackers are increasingly targeting collaboration platforms like Microsoft Teams. [..] If external chat is open, attackers will use it. <p /> <A HREF="https://unit42.paloaltonetworks.com/microsoft-teams-phishing/">https://unit42.paloaltonetworks.com/microsoft-teams-phishing/</a> <hr> <h3>Microsoft benachrichtigt einige Kunden über Downloads infizierter GitHub-Pakete</h3> Zum Wochenende hatte ich über eine Infektion von GitHub-Repositories mit Microsoft Tools berichtet. Diese waren mit einem Infostealer für AI-Tokens infiziert. Nun bestätigt, dass man eine kleine Anzahl Kunden benachrichtigt habe, die die kompromittierten Repositories mit den Tools heruntergeladen haben. <p /> <A HREF="https://borncity.com/blog/2026/06/09/microsoft-benachrichtigt-einige-kunden-ueber-downloads-infizierter-github-pakete/">https://borncity.com/blog/2026/06/09/microsoft-benachrichtigt-einige-kunden-ueber-downloads-infizierter-github-pakete/</a> <hr> <h3>Hidden in Plain Sight: PowerShell Visibility Most Defender XDR Analysts Miss</h3> Discover how an often-overlooked telemetry source in Microsoft Defender XDR can reveal PowerShell script activity that traditional process hunting misses. <p /> <A HREF="https://detect.fyi/hidden-in-plain-sight-powershell-visibility-most-defender-xdr-analysts-miss-83944ddc56df?source=rssd5fd8f494f6a4">https://detect.fyi/hidden-in-plain-sight-powershell-visibility-most-defender-xdr-analysts-miss-83944ddc56df?source=rssd5fd8f494f6a4</a> <hr> <h3>Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels</h3> Socket Threat Research team identified a newer PyPI wave connected to the broader Mini Shai-Hulud, Miasma, and Hades supply chain attacks. This wave expands beyond the 37 malicious PyPI wheels covered in our weekend report and shows that the threat actors are iterating quickly across delivery mechanisms, package themes, and runtime triggers. <p /> <A HREF="https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious?utm_medium=feed">https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious?utm_medium=feed</a> <h2> Vulnerabilities </h2> <h3>Ivanti: Security Advisory Ivanti Sentry (CVE-2026-10520, CVE-2026-10523)</h3> An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access ... <p /> <A HREF="https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US">https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US</a> <hr> <h3>Ivanti: Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2026-6973 & CVE-2026-10727)</h3> A configuration control vulnerability in the Ivanti Endpoint Manager Mobile before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to inject arbitrary Apache directives, leading to remote code execution. ... <p /> <A HREF="https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727?language=en_US">https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727?language=en_US</a> <hr> <h3>TYPO3 Security Advisories 09.06.2026</h3> TYPO3 has published 14 new security advisories. <p /> <A HREF="https://typo3.org/security">https://typo3.org/security</a> <hr> <h3>XEN Security Advisories 09.06.2026</h3> Xenbits has published 4 new security advisories. <p /> <A HREF="https://xenbits.xen.org/xsa/">https://xenbits.xen.org/xsa/</a> <hr> <h3>SAP-Patchday: Kritische Lücken in SAP NetWeaver und weitere Schwachstellen</h3> Zum Juni-Patchday kümmert sich SAP um 15 neue Schwachstellen in mehreren Produkten. Gleich drei kritische betreffen NetWeaver. <p /> <A HREF="https://www.heise.de/news/SAP-Patchday-Kritische-Luecken-in-SAP-NetWeaver-und-weitere-Schwachstellen-11323078.html">https://www.heise.de/news/SAP-Patchday-Kritische-Luecken-in-SAP-NetWeaver-und-weitere-Schwachstellen-11323078.html</a> <hr> <h3>Vulnerability Resolved in Veeam Backup & Replication 12.3.2.4854</h3> A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. CVE-2026-44963 <p /> <A HREF="https://www.veeam.com/kb4869">https://www.veeam.com/kb4869</a> <hr> <h3>LWN: Security updates for Tuesday</h3> <p /> <A HREF="https://lwn.net/Articles/1077163/">https://lwn.net/Articles/1077163/</a> <hr> <h3>Waves Central: Zahlreiche Local Privilege Escalation Schwachstellen in Waves Audio Waves Central</h3> <p /> <A HREF="https://sec-consult.com/de/vulnerability-lab/advisory/zahlreiche-local-privilege-escalation-schwachstellen-in-waves-audio-waves-central/">https://sec-consult.com/de/vulnerability-lab/advisory/zahlreiche-local-privilege-escalation-schwachstellen-in-waves-audio-waves-central/</a> <hr> <h3>Google: Jetzt updaten! Chrome-Update stopft attackierte Lücke und 73 weitere</h3> <p /> <A HREF="https://heise.de/-11322503">https://heise.de/-11322503</a>

CERT.at2026-06-09T19:06:56ZCERT.at2026-06-08T18:35:10Z2026-06-08T18:35:10Z

<h2>End-of-Day report</h2> Timeframe: Freitag 05-06-2026 18:00 - Montag 08-06-2026 18:00 Handler: Guenes Holler Co-Handler: n/a <h2> News </h2> <h3>C0XMO botnet spreads via DD-WRT router flaw, kills rival malware</h3> A new variant of the Gafgyt botnet called C0XMO is targeting DD-WRT router firmware and can move to other device types with various CPU architectures. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/">https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/</a> <hr> <h3>Over 20,000 Instagram accounts stolen in Meta AI support hack</h3> Meta has revealed that 20,225 Instagram users had their accounts hijacked in a recent incident where attackers used Meta's AI-powered support system to reset passwords. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/meta-ai-support-data-breach-affects-20-000-instagram-accounts/">https://www.bleepingcomputer.com/news/security/meta-ai-support-data-breach-affects-20-000-instagram-accounts/</a> <hr> <h3>Angst vor Russland: Hacker entschuldigen sich bei attackierter Firma</h3> Ein Cyberakteur entpuppt sich als "Ransomware-Trottel des Tages". Er hat ein Ziel attackiert, das ihm wirklich Probleme bereiten kann. <p /> <A HREF="https://www.golem.de/news/angst-vor-russland-hacker-entschuldigen-sich-bei-attackierter-firma-2606-209426.html">https://www.golem.de/news/angst-vor-russland-hacker-entschuldigen-sich-bei-attackierter-firma-2606-209426.html</a> <hr> <h3>VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances</h3> A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM, as well as two other malware families codenamed PLENET (aka GRIMBOLT) and AGENTPSD to target Linux systems. <p /> <A HREF="https://thehackernews.com/2026/06/verdantbamboo-deploys-bsd-variant-of.html">https://thehackernews.com/2026/06/verdantbamboo-deploys-bsd-variant-of.html</a> <hr> <h3>Google warnt: Angreifer geben sich als IT-Techniker aus und betreten Büros</h3> Die Google Threat Intelligence Group warnt vor der Gruppe UNC3753. Die Angreifer geben sich vor Ort als IT-Techniker aus, um Daten per USB-Stick zu stehlen. <p /> <A HREF="https://www.heise.de/news/Google-warnt-Angreifer-geben-sich-als-IT-Techniker-aus-und-betreten-Bueros-11320590.html">https://www.heise.de/news/Google-warnt-Angreifer-geben-sich-als-IT-Techniker-aus-und-betreten-Bueros-11320590.html</a> <hr> <h3>Passwortmanager Dashlane: Angreifer kopieren fast 20 Passwort-Vaults</h3> Dashlane informiert darüber, dass Angreifer nach massiven Brute-Force-Attacken rund 20 Passwort-Vaults kopiert haben. <p /> <A HREF="https://www.heise.de/news/Passwortmanager-Dashlane-Angreifer-kopieren-fast-20-Passwort-Vaults-11321244.html">https://www.heise.de/news/Passwortmanager-Dashlane-Angreifer-kopieren-fast-20-Passwort-Vaults-11321244.html</a> <hr> <h3>Schweizer Rüstungsunternehmen RUAG zahlt Lösegeld an Cybergang</h3> Nachdem die Cybergang Akira bei der RUAG-Tochter Mecanex USA Daten abgezogen hat, hat RUAG ein Lösegeld gezahlt. <p /> <A HREF="https://www.heise.de/news/Schweizer-Ruestungsunternehmen-RUAG-zahlt-Loesegeld-an-Cybergang-11321552.html">https://www.heise.de/news/Schweizer-Ruestungsunternehmen-RUAG-zahlt-Loesegeld-an-Cybergang-11321552.html</a> <hr> <h3>Recovery Scam: Fake-Agenturen schädigen Opfer erneut</h3> Sie versprechen Hilfe bei der Wiederbeschaffung von Vermögen, das durch eine Betrugsmasche gestohlen wurde. Die Website zur angeblichen Agentur sieht ansprechend aus, nutzt reale Impressumsdaten und übersteht damit erste Überprüfungen. Tatsächlich stecken hinter diesem Angebot Kriminelle, die frühere Opfer erneut bestehlen wollen. So funktioniert der Betrug nach dem Betrug. <p /> <A HREF="https://www.watchlist-internet.at/news/fake-agenturen-schaedigen-opfer/">https://www.watchlist-internet.at/news/fake-agenturen-schaedigen-opfer/</a> <hr> <h3>Got a LinkedIn message from a recruiter? It might be Chinese intelligence, warn FBI and MI5</h3> If you've ever received an out-of-the-blue message via LinkedIn from a recruiter offering some well-paid consultancy work, intelligence agencies have a message for you: be very careful. <p /> <A HREF="https://www.bitdefender.com/en-us/blog/hotforsecurity/linkedin-recruiter-chinese-intelligence-fbi-mi5">https://www.bitdefender.com/en-us/blog/hotforsecurity/linkedin-recruiter-chinese-intelligence-fbi-mi5</a> <hr> <h3>Israelische Firma Bright Data missbraucht mit Backdoor in Apps Millionen Smart-TV</h3> Eine israelische Firma ist dabei aufgeflogen, dass sie Millionen Smart TV-Geräte in Zombi-Proxys verwandelt hat, um AI-Web-Scraping durchzuführen. Dazu wurden entsprechende Backdoors in Apps für Smart TV-Geräte eingebaut. Einige Anbieter wie Roku, Fire TV und Google TV haben diese Praxis untersagt. Aber Samsung- und LG-Smart TV-Geräte fungieren heimlich als Ausgangsknoten für KI-basiertes Web-Scraping, wie eine Untersuchung gezeigt hat. <p /> <A HREF="https://borncity.com/blog/2026/06/06/israelische-firma-bright-data-missbraucht-mit-backdoor-in-apps-millionen-smart-tv/">https://borncity.com/blog/2026/06/06/israelische-firma-bright-data-missbraucht-mit-backdoor-in-apps-millionen-smart-tv/</a> <hr> <h3>New Pink Extortion Group Targets Microsoft 365 Cloud Data Via Vishing Scams</h3> Cybersecurity researchers are warning businesses about Pink Extortion Group, a threat actor that uses voice phishing to bypass multi-factor authentication and steal files from cloud environments. <p /> <A HREF="https://hackread.com/pink-extortion-microsoft-365-cloud-data-vishing-scams/">https://hackread.com/pink-extortion-microsoft-365-cloud-data-vishing-scams/</a> <hr> <h3>Did Claude Increase Bugs in rsync?</h3> A simple distributional analysis of every rsync release with bug data. Nothing complicated, answers only one question: are the Claude-assisted releases unusually buggy? <p /> <A HREF="https://alexispurslane.github.io/rsync-analysis/">https://alexispurslane.github.io/rsync-analysis/</a> <hr> <h3>How a USB-connected speaker can infect a PC without ever being touched</h3> Operating system makers take many steps to prevent their wares from accepting commands from remote devices. The safeguards, designed to thwart malicious attacks, typically require hackers to jump through all kinds of hoops to bypass the measures. But what if remote code execution were as simple as being within Bluetooth range of a speaker connected to the targeted device? <p /> <A HREF="https://arstechnica.com/security/2026/06/highly-reviewed-speaker-can-be-hacked-over-the-air-to-infect-connected-devices/">https://arstechnica.com/security/2026/06/highly-reviewed-speaker-can-be-hacked-over-the-air-to-infect-connected-devices/</a> <h2> Vulnerabilities </h2> <h3>Angriffe gegen Checkpoint VPN Lösungen - Hotfix verfügbar</h3> Checkpoint warnt vor beobachteten Angriffen gegen die Produkte Checkpoint Security Gateway und Checkpoint Spark Firewall. Auswirkungen Die zugrunde liegende Sicherheitslücke CVE-2026-50751 erlaubt unbefugten Zugriff auf das VPN. <p /> <A HREF="https://www.cert.at/de/warnungen/2026/6/angriffe-gegen-checkpoint-vpn-losungen-hotfix-verfugbar">https://www.cert.at/de/warnungen/2026/6/angriffe-gegen-checkpoint-vpn-losungen-hotfix-verfugbar</a> <hr> <h3>Critical UniFi OS bug lets hackers gain root without authentication</h3> Attackers can chain three already fixed vulnerabilities in the Ubiquiti UniFi OS server to execute remote code with root privileges and without authentication. The security issues are tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. They have been addressed in May and impact UniFi OS Server versions 5.0.6 and earlier. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/critical-unifi-os-bug-lets-hackers-gain-root-without-authentication/">https://www.bleepingcomputer.com/news/security/critical-unifi-os-bug-lets-hackers-gain-root-without-authentication/</a> <hr> <h3>SolarWinds Serv-U: Angreifer missbrauchen DoS-Lücke in FTP-Server</h3> In SolarWinds-Serv-U-Servern können Angreifer eine Schwachstelle für Denial-of-Service-Angriffe missbrauchen. Laut CISA tun sie das bereits. <p /> <A HREF="https://www.heise.de/news/SolarWinds-Serv-U-Angreifer-missbrauchen-DoS-Luecke-in-FTP-Server-11321084.html">https://www.heise.de/news/SolarWinds-Serv-U-Angreifer-missbrauchen-DoS-Luecke-in-FTP-Server-11321084.html</a> <hr> <h3>VMware: Mehrere Produkte mit Stored-Cross-Site-Scripting-Lücken</h3> Broadcom warnt vor mehreren Stored-Cross-Site-Scripting-Lücken in VMware Cloud Foundation und weiteren Produkten. Updates helfen. <p /> <A HREF="https://www.heise.de/news/VMware-Mehrere-Produkte-mit-Stored-Cross-Site-Scripting-Luecken-11321673.html">https://www.heise.de/news/VMware-Mehrere-Produkte-mit-Stored-Cross-Site-Scripting-Luecken-11321673.html</a> <hr> <h3>Comodo Internet Security: DoS-Bug ohne Sicherheitsupdate</h3> Wer sich eine Internet Security Suite installiert, möchte den Rechner absichern. Im Fall von Comodo kommt eine Sicherheitslücke mit. <p /> <A HREF="https://www.heise.de/news/Comodo-Internet-Security-DoS-Bug-ohne-Sicherheitsupdate-11321732.html">https://www.heise.de/news/Comodo-Internet-Security-DoS-Bug-ohne-Sicherheitsupdate-11321732.html</a> <hr> <h3>Critical Everest Forms Pro flaw exploited to take over WordPress sites</h3> Hackers are actively exploiting a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro plugin, which lets them take complete control of a WordPress website. The security issue affects versions 1.9.12 and earlier of the plugin and can be leveraged without authentication to execute arbitrary code on the server. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/critical-everest-forms-pro-flaw-exploited-to-take-over-wordpress-sites/">https://www.bleepingcomputer.com/news/security/critical-everest-forms-pro-flaw-exploited-to-take-over-wordpress-sites/</a> <hr> <h3>Kein Patch verfügbar: Bitlocker-Exploit Bitskrieg veröffentlicht</h3> Microsofts empfohlene Korrektur für den Bitlocker-Exploit Yellowkey ist offenbar unvollständig. Mit Bitskrieg soll sie sich umgehen lassen. <p /> <A HREF="https://www.golem.de/news/kein-patch-verfuegbar-bitlocker-exploit-bitskrieg-veroeffentlicht-2606-209491.html">https://www.golem.de/news/kein-patch-verfuegbar-bitlocker-exploit-bitskrieg-veroeffentlicht-2606-209491.html</a> <hr> <h3>LWN Security updates for Monday</h3> <p /> <A HREF="https://lwn.net/Articles/1076983/">https://lwn.net/Articles/1076983/</a>

CERT.at2026-06-08T18:35:10ZCERT.at2026-06-05T18:44:16Z2026-06-05T18:44:16Z

<h2>End-of-Day report</h2> Timeframe: Mittwoch 03-06-2026 18:00 - Freitag 05-06-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a <h2> News </h2> <h3>Unauthenticated RCE as QSECOFR via IBM i Management Central</h3> Management Central is one of those services that has been running quietly on IBM i systems for over two decades. Many administrators don-t know it-s there, and its protocol security missed the scrutiny of researchers until now. The combination of a custom binary protocol, client-controlled authentication flags, and a derived usedForAuth field that can be trivially satisfied resulted in unauthenticated root-level command execution. <p /> <A HREF="https://blog.silentsignal.eu/2026/06/05/unauthenticated-rce-as-qsecofr-via-ibm-i-management-central/">https://blog.silentsignal.eu/2026/06/05/unauthenticated-rce-as-qsecofr-via-ibm-i-management-central/</a> <hr> <h3>New IronWorm malware hits 36 packages in npm supply-chain attack</h3> A new supply-chain attack has infected 36 packages on the Node Package Manager (npm) index with infostealer malware called IronWorm. The malware targets 86 environment variables (key-value pairs) and 20 credential files that may contain OpenAI, AWS, Anthropic, and npm credentials, vault configuration files, SSH keys, and Exodus cryptocurrency wallet files. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/new-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack/">https://www.bleepingcomputer.com/news/security/new-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack/</a> <hr> <h3>Software supply chain attacks: check your dependencies</h3> This blog, aimed at cyber security professionals, exposes the insidious nature of recent attacks, underlining the growing threat from software supply chains, and how attackers are able to exploit them. We explain how organisations can check if they have been affected by such a supply chain attack, and recommend actions to take to mitigate compromise and prevent further spread. <p /> <A HREF="https://www.ncsc.gov.uk/blogs/software-supply-chain-attacks-check-your-dependencies">https://www.ncsc.gov.uk/blogs/software-supply-chain-attacks-check-your-dependencies</a> <hr> <h3>Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT</h3> Cybersecurity researchers have flagged a new malspam campaign that makes use of Googles DoubleClick domain as a way to evade detection and ultimately deliver a remote access trojan (RAT) named DesckVB RAT. [..] The attack begins when an unsuspecting user opens an HTML file that's attached to a phishing email. The file triggers a meta-refresh browser redirect to a Google DoubleClick Campaign Manager click-tracking URL, from where the user is steered to another redirector, which decodes the Base64-encoded email address and leads the victim to a landing page containing a "Download PDF" button. <p /> <A HREF="https://thehackernews.com/2026/06/google-doubleclick-abused-in-new.html">https://thehackernews.com/2026/06/google-doubleclick-abused-in-new.html</a> <hr> <h3>Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS</h3> Cybersecurity researchers have flagged a large-scale operation that impersonates open-source and freeware projects to funnel unsuspecting users through a Traffic Distribution System (TDS) and deliver malware families like Remus Stealer, AnimateClipper, and the SessionGate framework. [..] Attack chains specifically target users looking for such tools on search engines like Google, causing the bogus sites to be surfaced on top of the search results. <p /> <A HREF="https://thehackernews.com/2026/06/fake-sites-mimicking-open-source-tools.html">https://thehackernews.com/2026/06/fake-sites-mimicking-open-source-tools.html</a> <hr> <h3>EU-Paket für digitale Souveränität: -Gefahr einer technologischen Entkopplung-</h3> Das neue Tech-Souveränitätspaket der EU erntet gemischte Reaktionen: Open-Source-Verfechter jubeln, doch US-Branchenverbände warnen vor schweren Marktstörungen. <p /> <A HREF="https://heise.de/-11318218">https://heise.de/-11318218</a> <hr> <h3>Analyse zum Souveränitätspaket der EU: Krisenfest per Gesetz?</h3> Die EU-Kommission hat ein großes Paket vorgestellt, das den Staatenbund technologisch souveräner machen soll. Immerhin ein Anfang, analysiert Falk Steiner. <p /> <A HREF="https://heise.de/-11318875">https://heise.de/-11318875</a> <hr> <h3>Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog</h3> A newly released federal audit now documents NIST-s long-running NVD backlog, with findings that are hard to square with two years of public assurances that the database was being brought back under control. <p /> <A HREF="https://socket.dev/blog/federal-audit-finds-nist-wasted-funds-with-no-plan-to-clear-nvd-backlog">https://socket.dev/blog/federal-audit-finds-nist-wasted-funds-with-no-plan-to-clear-nvd-backlog</a> <hr> <h3>A Post-Quantum Future for Lets Encrypt</h3> Let-s Encrypt is committed to a post-quantum-safe Web PKI. The path we-re planning to take is Merkle Tree Certificates (-MTCs-), a new approach that adds post-quantum authentication to the web without sacrificing the speed and reliability that have made TLS universal. This post is about these plans and why we believe MTCs are worth pursuing as a key to a post-quantum future. <p /> <A HREF="https://letsencrypt.org/2026/06/03/pq-certs.html">https://letsencrypt.org/2026/06/03/pq-certs.html</a> <hr> <h3>The Interesting Case of WSL for Payload Staging</h3> Windows Subsystem for Linux (WSL) lets you run a Linux environment directly on Windows without a traditional virtual machine or dual-boot setup. [..] This is a case study in indirect command execution - a class of techniques where the process responsible for a malicious action is not the process that appears in telemetry. <p /> <A HREF="https://detect.fyi/the-interesting-case-of-wsl-for-payload-staging-bfaa0f69329a?source=rssd5fd8f494f6a4">https://detect.fyi/the-interesting-case-of-wsl-for-payload-staging-bfaa0f69329a?source=rssd5fd8f494f6a4</a> <hr> <h3>IT-Forscher zeigen anpassungsfähigen KI-Wurm</h3> IT-Forscher untersuchen, ob künstliche Intelligenz eine Bedrohung darstellt. Dabei haben sie eine neue Bedrohungsart entwickelt: Ein KI-Wurm, der maßgeschneiderte Angriffe auf jedes Ziel startet, dem er begegnet. <p /> <A HREF="https://www.heise.de/news/IT-Forscher-zeigen-anpassungsfaehigen-KI-Wurm-11318083.html">https://www.heise.de/news/IT-Forscher-zeigen-anpassungsfaehigen-KI-Wurm-11318083.html</a> <hr> <h3>Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257</h3> We include indicators of activity and mitigations for PAN-OS vulnerability CVE-2026-0257. <p /> <A HREF="https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/">https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/</a> <h2> Vulnerabilities </h2> <h3>Drupal: Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042</h3> <p /> <A HREF="https://www.drupal.org/sa-contrib-2026-042">https://www.drupal.org/sa-contrib-2026-042</a> <hr> <h3>Drupal: Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041</h3> <p /> <A HREF="https://www.drupal.org/sa-contrib-2026-041">https://www.drupal.org/sa-contrib-2026-041</a> <hr> <h3>Drupal: TacJS - Moderately critical - Improper Access Control - SA-CONTRIB-2026-040</h3> <p /> <A HREF="https://www.drupal.org/sa-contrib-2026-040">https://www.drupal.org/sa-contrib-2026-040</a> <hr> <h3>Drupal: LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039</h3> <p /> <A HREF="https://www.drupal.org/sa-contrib-2026-039">https://www.drupal.org/sa-contrib-2026-039</a> <hr> <h3>Cisco Webex Meetings Cross-Site Scripting Vulnerability</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-jw3NeQzS">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-jw3NeQzS</a> <hr> <h3>Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW</a> <hr> <h3>Cisco Finesse Remote File Inclusion Vulnerability</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-rfi-gwpkdc89">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-rfi-gwpkdc89</a> <hr> <h3>Cisco Catalyst SD-WAN Manager Authenticated Privilege Escalation Vulnerability</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx</a> <hr> <h3>LWN: Security updates for Thursday</h3> <p /> <A HREF="https://lwn.net/Articles/1076364/">https://lwn.net/Articles/1076364/</a> <hr> <h3>LWN: Security updates for Friday</h3> <p /> <A HREF="https://lwn.net/Articles/1076605/">https://lwn.net/Articles/1076605/</a>

CERT.at2026-06-05T18:44:16ZCERT.at2026-06-03T19:11:38Z2026-06-03T19:11:38Z

<h2>End-of-Day report</h2> Timeframe: Dienstag 02-06-2026 18:00 - Mittwoch 03-06-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a <h2> News </h2> <h3>Absicherung von Software: Anthropic öffnet -Project Glasswing- für Europa</h3> Anthropic will den Zugriff auf sein leistungsstärkstes KI-Modell Mythos deutlich ausweiten und Organisationen in mehr als 15 Staaten damit nach Sicherheitslücken in systemrelevanter Software suchen lassen. Das hat das KI-Unternehmen jetzt mitgeteilt, ohne das aber aufzuschlüsseln. [..] Anthropic hat Mythos Anfang April vorgestellt und erklärt, dass das Modell so gefährlich sei, dass es nur Firmen zur Verfügung gestellt wird, die an IT-Sicherheit arbeiten. <p /> <A HREF="https://heise.de/-11316440">https://heise.de/-11316440</a> <hr> <h3>Trump gibt sich exklusiven Zugriff auf neue KI vor allen anderen</h3> Geheimes Benchmarking von KI, Zugriff für die US-Regierung vor allen anderen, staatliche Suche nach Software-Bugs. Das und mehr ordnet der US-Präsident an. <p /> <A HREF="https://www.heise.de/news/Trump-gibt-sich-exklusiven-Zugriff-auf-neue-KI-vor-allen-anderen-11316188.html">https://www.heise.de/news/Trump-gibt-sich-exklusiven-Zugriff-auf-neue-KI-vor-allen-anderen-11316188.html</a> <hr> <h3>Android bekommt Anrufererkennung gegen Betrugsanrufe</h3> Google baut einen neuen Mechanismus in Android ein, der betrügerische Anrufe mit gefälschten Kontakten unterbinden soll. Betrugsversuche mit gefälschten Caller-IDs (der übertragenen Anrufer-Rufnummer) soll das eindämmen. <p /> <A HREF="https://heise.de/-11316362">https://heise.de/-11316362</a> <hr> <h3>Codex Discovered a Hidden HTTP/2 Bomb</h3> We-re publishing HTTP/2 Bomb, a remote denial-of-service exploit against most major web servers, including: nginx, Apache httpd, Microsoft IIS, Envoy, Cloudflare Pingora [..] The vulnerable behavior exists in each server's default HTTP/2 configuration. [..] A curious search on Shodan revealed 880,000+ websites supporting HTTP/2 and running one of these servers, though many sit behind a CDN, which is much harder to bring down. [..] A home computer on a 100Mbps connection can render a vulnerable server inaccessible within seconds. [..] We disclosed the issue to nginx in April. They responded by importing the max_headers directive from freenginx, shipping it in 1.29.8 the next day. At this point, we consider the attack public. <p /> <A HREF="https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb">https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb</a> <hr> <h3>Over 116,000 Mincraft systems infected in WeedHack malware campaign</h3> A large-scale malware campaign dubbed WeedHack is targeting Minecraft players and has infected more than 116,000 systems since January. The malware is distributed through Minecraft-related malicious mods, clients, cheats, and utilities that are promoted over YouTube and SEO (search engine optimization) poisoning. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/over-116-000-mincraft-systems-infected-in-weedhack-malware-campaign/">https://www.bleepingcomputer.com/news/security/over-116-000-mincraft-systems-infected-in-weedhack-malware-campaign/</a> <hr> <h3>Argamal: Malware hidden in hentai games</h3> The DLLs were spawned by different games written using various game engines and programming languages, including RenPy (Python) and RPG Maker MV (JavaScript), among others. However, they all had one thing in common: they were all hentai games. <p /> <A HREF="https://securelist.com/argamal-rat-distributed-with-hentai-games/119999/">https://securelist.com/argamal-rat-distributed-with-hentai-games/119999/</a> <hr> <h3>Espionage Campaign Targeted Stock Exchange Executive for Five Months</h3> The attackers' focus throughout was on a single objective: long-term, incremental theft of the contents of a single Outlook mailbox, exfiltrated through Dropbox and OneDrive Personal in small batches over a period of five months to avoid raising suspicions or triggering alerts on the system. This was a tightly focused and highly targeted campaign, with five months being a significant dwell time for an attacker. It is notable to see the different techniques and approaches used by the attacker in order to stay under the radar and maintain persistent access. [..] The initial infection vector used by the attackers in this incident is unknown. <p /> <A HREF="https://www.security.com/threat-intelligence/stock-exchange-espionage">https://www.security.com/threat-intelligence/stock-exchange-espionage</a> <h2> Vulnerabilities </h2> <h3>Acer working to patch max severity zero-days in Wave 7 routers</h3> Acer is working to address two maximum-severity zero-day vulnerabilities affecting its Wave 7 mesh routers. [..] The first zero-day, a broken access control vulnerability tracked as CVE-2026-49200, can allow unauthenticated attackers to remotely access plaintext credentials stored in log archives. [..] The second one (CVE-2026-49201) stems from a hardcoded cryptographic key that lets remote attackers without privileges gain persistent backdoor access to the router. [..] While no security patches are available yet for these two flaws, Acer says it's working on fixes that should be released by the end of the month. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/acer-warns-of-max-severity-zero-days-affecting-wave-7-routers/">https://www.bleepingcomputer.com/news/security/acer-warns-of-max-severity-zero-days-affecting-wave-7-routers/</a> <hr> <h3>Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes</h3> Cybersecurity researchers have disclosed details of an unpatched issue that could be exploited to disclose a users NTLMv2 hash to the attacker. [..] As a result, a threat actor could leverage the captured hash to conduct relay attacks and gain deeper access into a network. Following responsible disclosure on April 15, 2026, Microsoft declined to address the issue, stating "only Important and Critical severity cases meet our bar for servicing." <p /> <A HREF="https://thehackernews.com/2026/06/unpatched-windows-search-uri.html">https://thehackernews.com/2026/06/unpatched-windows-search-uri.html</a> <hr> <h3>GitHub-Drama 1: Sicherheitsforscher veröffentlicht 0-Day-Schwachstelle</h3> Ein weiterer Sicherheitsforscher hat die koordinierte Offenlegung von Schwachstellen beim Microsoft Security Resource Center (MSRC) übersprungen und eine kritische 1-Klick-GitHub-Schwachstelle öffentlich gemacht. Mit der Schwachstelle in VSCode lassen sich GitHub-Tokens stehlen, und der Entdecker hatte keine Lust mit dem MSRC zu diskutieren. [..] Der Sicherheitsforscher hat einen funktionierenden Proof-of-Concept veröffentlicht. [..] Er empfiehlt, die Daten der Website http://github[.]dev zu löschen, um das Risiko zu mindern, solange das Problem öffentlich bekannt ist. <p /> <A HREF="https://borncity.com/blog/2026/06/03/github-drama-1-sicherheitsforscher-veroeffentlicht-0-day-schwachstelle/">https://borncity.com/blog/2026/06/03/github-drama-1-sicherheitsforscher-veroeffentlicht-0-day-schwachstelle/</a> <hr> <h3>LWN: Security updates for Wednesday</h3> <p /> <A HREF="https://lwn.net/Articles/1076117/">https://lwn.net/Articles/1076117/</a> <hr> <h3>Mozilla: Security Vulnerabilities fixed in Firefox 151.0.3</h3> <p /> <A HREF="https://www.mozilla.org/en-US/security/advisories/mfsa2026-54/">https://www.mozilla.org/en-US/security/advisories/mfsa2026-54/</a> <hr> <h3>Paloalto: CVE-2026-0249 GlobalProtect App: Certificate Validation Bypass Vulnerabilities (Severity: LOW)</h3> <p /> <A HREF="https://security.paloaltonetworks.com/CVE-2026-0249">https://security.paloaltonetworks.com/CVE-2026-0249</a> <hr> <h3>Solarwinds: WHD 2026.2 release notes</h3> <p /> <A HREF="https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2_release_notes.htm">https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2_release_notes.htm</a>

CERT.at2026-06-03T19:11:38ZCERT.at2026-06-02T18:14:06Z2026-06-02T18:14:06Z

<h2>End-of-Day report</h2> Timeframe: Montag 01-06-2026 18:00 - Dienstag 02-06-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a <h2> News </h2> <h3>Passwortmanager: Hacker erbeuten Passwort-Tresore von Dashlane-Nutzern</h3> Infolge eines Brute-Force-Angriffs wurden einige Dashlane-Nutzer temporär gesperrt. Die Angreifer sollen zudem an Passwort-Tresore gelangt sein. <p /> <A HREF="https://www.golem.de/news/brute-force-attacke-angreifer-erbeuten-passwort-tresore-von-dashlane-2606-209302.html">https://www.golem.de/news/brute-force-attacke-angreifer-erbeuten-passwort-tresore-von-dashlane-2606-209302.html</a> <hr> <h3>New Wave Of Phishing Emails with SVG Files, (Tue, Jun 2nd)</h3> This time, the SVG files are really simple and even don-t contain any graphical element but a simple piece of JavaScript that will redirect the victim's browser to the phishing page. <p /> <A HREF="https://isc.sans.edu/diary/rss/33040">https://isc.sans.edu/diary/rss/33040</a> <hr> <h3>CVSS: NIST schränkt Bewertung von IT-Sicherheitslücken ein</h3> Das US-amerikanische National Institute of Standards and Technology (NIST) wird die Bewertung von IT-Sicherheitslücken mit den bekannten CVSS-Schweregraden weitgehend einstellen. Das ist eine der Maßnahmen, mit denen NIST den wachsenden Rückstau seiner National Vulnerability Database (NVD) bekämpfen möchte. Wie das vereinbar ist mit der rechtlichen Verpflichtung, CVSS (Common Vulnerability Scoring System) zu berechnen, bleibt offen - aber wo kein Kläger, da kein Richter. <p /> <A HREF="https://www.heise.de/news/CVSS-NIST-schraenkt-Bewertung-von-IT-Sicherheitsluecken-ein-11314492.html">https://www.heise.de/news/CVSS-NIST-schraenkt-Bewertung-von-IT-Sicherheitsluecken-ein-11314492.html</a> <hr> <h3>Red-Hat-Infostealer kommt auf mehr als 100.000 Downloads</h3> Ende Mai haben Cyberkriminelle in einer Lieferkettenattacke, die mittels eines Mini-Shai-Hulud-Klons erfolgte, bösartige Versionen von npm-Paketen verbreitet. Ziel der Malware, die sich selbst Miasma nennt, waren die Managed Cloud Services von Red Hat. Mittlerweile sind keine bösartigen Paketversionen mehr im Umlauf. Sicherheitsexperten raten dennoch dazu, die Credentials zu rotieren. <p /> <A HREF="https://www.heise.de/news/Mini-Shai-Hulud-Klon-Miasma-nimmt-Red-Hat-ins-Visier-11315039.html">https://www.heise.de/news/Mini-Shai-Hulud-Klon-Miasma-nimmt-Red-Hat-ins-Visier-11315039.html</a> <hr> <h3>Fake virus alerts are invading mobile games</h3> Sometimes it happens. You-re happily playing a game on your phone or laptop when suddenly alarms pop up out of nowhere: -Your device is infected!- [..] Unfortunately, cybercriminals sometimes manage to buy advertising space and use it to defraud gamers. <p /> <A HREF="https://www.malwarebytes.com/blog/mobile/2026/06/fake-virus-alerts-are-invading-mobile-games">https://www.malwarebytes.com/blog/mobile/2026/06/fake-virus-alerts-are-invading-mobile-games</a> <hr> <h3>Vorsicht, Phishing: Spar-Gewinnspiel zu Bier-Paketen ist ein Fake!</h3> Der Sommer naht mit Riesenschritten und die thematisch passenden Betrugsmaschen schießen aus dem Boden wie Schwammerl. Eine Falle, die im Vorjahr für besonders viel Aufsehen gesorgt hat, feiert dabei ein Comeback: Es geht um ein Bier-Gewinnspiel! Die optische und inhaltliche Gestaltung hat sich im Vergleich zur 2025er-Variante zwar etwas geändert, die Abläufe sind allerdings dieselben geblieben. Ein kleines Update. <p /> <A HREF="https://www.watchlist-internet.at/news/phishing-spar-gewinnspiel-bier/">https://www.watchlist-internet.at/news/phishing-spar-gewinnspiel-bier/</a> <hr> <h3>ASFINAG-Phishing: Über eine Fake-Mail an die Kreditkartendaten</h3> Erwischt beim Fahren ohne Vignette? Mit der Zahlung einer Ersatzmaut in Höhe von 12,36 Euro oder dem nachträglichen Kauf einer 10-Tages-Vignette ist die Angelegenheit aus der Welt geschafft? Was auf den ersten Blick aussieht wie eine echte Benachrichtigung der ASFINAG, ist in Wahrheit eine neue Phishing-Welle. <p /> <A HREF="https://www.watchlist-internet.at/news/asfinag-phishing-mail-kreditkartendaten/">https://www.watchlist-internet.at/news/asfinag-phishing-mail-kreditkartendaten/</a> <hr> <h3>Hacker stehlen Hunderte Instagram-Konten über Metas KI-Support</h3> Die Schatten eines ausgelagerten Instagram-Supports an eine KI. Hackern ist es gelungen, langjährige, hochkarätige Instagram-Konten zu kapern. Dazu haben Sie die Funktion zum Passwort-Reset aufgerufen und den KI-Support-Chatbot von Meta einfach gebeten, die mit dem Konto verknüpfte E-Mail-Adresse zu ändern. <p /> <A HREF="https://borncity.com/blog/2026/06/02/hacker-stehlen-hunderte-instagram-konten-ueber-ki-support/">https://borncity.com/blog/2026/06/02/hacker-stehlen-hunderte-instagram-konten-ueber-ki-support/</a> <hr> <h3>Ivanti EPMM -Sleeper Shells- not so sleepy?</h3> In late January 2026, an advisory covering two remote code execution vulnerabilities (CVE-2026-1281 & CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM) was published. [..] In a recent incident that NVISO CSIRT handled, we came across a compromised Ivanti EPMM device, and the logs quickly revealed that the aforementioned vulnerabilities were used to compromise the device. From the log entries, we quickly identified what we believe is the same webshell Defused was reporting on. <p /> <A HREF="https://blog.nviso.eu/2026/03/13/ivanti-epmm-sleeper-shells-not-so-sleepy/">https://blog.nviso.eu/2026/03/13/ivanti-epmm-sleeper-shells-not-so-sleepy/</a> <hr> <h3>New WordPress Malware Uses Steam Profile Comments to Hide C2 Instructions</h3> GoDaddy researchers found WordPress malware using Steam Community profile comments to hide encoded command and control data, with nearly 1,980 sites affected. <p /> <A HREF="https://hackread.com/wordpress-malware-steam-profile-comments-instructions/">https://hackread.com/wordpress-malware-steam-profile-comments-instructions/</a> <h2> Vulnerabilities </h2> <h3>LWN: Security updates for Tuesday</h3> <p /> <A HREF="https://lwn.net/Articles/1075966/">https://lwn.net/Articles/1075966/</a> <hr> <h3>WebKitGTK and WPE WebKit Security Advisory WSA-2026-0003</h3> <p /> <A HREF="https://webkitgtk.org/security/WSA-2026-0003.html">https://webkitgtk.org/security/WSA-2026-0003.html</a> <hr> <h3>Zyxel security advisory for buffer overflow vulnerabilities in the UPnP function of certain 4G LTE/5G NR CPE and DSL/Ethernet CPE</h3> <p /> <A HREF="https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerabilities-in-the-upnp-function-of-certain-4g-lte-5g-nr-cpe-and-dsl-ethernet-cpe-06-02-2026">https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerabilities-in-the-upnp-function-of-certain-4g-lte-5g-nr-cpe-and-dsl-ethernet-cpe-06-02-2026</a> <hr> <h3>Android: Patchday: 18 kritische Sicherheitslücken bedrohen Android 14, 15, 16</h3> <p /> <A HREF="https://heise.de/-11314546">https://heise.de/-11314546</a> <hr> <h3>Samsung: Juni-Patchday bei Samsung: Zahlreiche Sicherheitslücken gestopft</h3> <p /> <A HREF="https://heise.de/-11315093">https://heise.de/-11315093</a>

CERT.at2026-06-02T18:14:06ZCERT.at2026-06-01T18:36:20Z2026-06-01T18:36:20Z

<h2>End-of-Day report</h2> Timeframe: Freitag 29-05-2026 18:00 - Montag 01-06-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a <h2> News </h2> <h3>Miasma: Supply Chain Attack Targeting RedHat npm Packages</h3> Detect and mitigate malicious npm packages linked to the latest npm supply chain attack, based on the open sourced Mini Shai-Hulud malware. <p /> <A HREF="https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages">https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages</a> <hr> <h3>On the cyber-security implications of current LLMs</h3> The rapid progress in the capabilities of LLMs for cyber-security related tasks naturally leads to the question of what the right response should be. [..] So, here is a rough outline of how I structure the problem set in my mind. It-s not a complete treatment of all the points, just a scaffolding that needs to be fleshed out. Nevertheless, I think it could provide some value. <p /> <A HREF="https://www.cert.at/en/blog/2026/6/on-the-cyber-security-implications-of-current-llms">https://www.cert.at/en/blog/2026/6/on-the-cyber-security-implications-of-current-llms</a> <hr> <h3>ChatGPT share links abused to host fake outage pages to deliver malware</h3> Threat actors are abusing ChatGPTs content-sharing feature to display fake OpenAI outage pages that direct users to download malware disguised as the ChatGPT desktop application. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/chatgpt-share-links-abused-to-host-fake-outage-pages-to-deliver-malware/">https://www.bleepingcomputer.com/news/security/chatgpt-share-links-abused-to-host-fake-outage-pages-to-deliver-malware/</a> <hr> <h3>Microsoft fixes KB5089549 Windows security update install issues</h3> Microsoft has resolved a known issue causing installation failures and 0x800f0922 errors when deploying the May 2026 Windows 11 security update (KB5089549). [..] On Friday, the company said the issue has been resolved in the Windows 11 KB5089573 preview cumulative update, with the fix to be made available to all users who install the June Patch Tuesday updates later this month. <p /> <A HREF="https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-kb5089549-windows-security-update-install-issues/">https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-kb5089549-windows-security-update-install-issues/</a> <hr> <h3>Patch Now: Another Palo Alto Auth Bypass Bug Under Active Exploit</h3> In May, Palo Alto Networks (PAN) disclosed and fixed the flaw, tracked as CVE-2026-0257, but it updated the advisory last week to note that there have been "limited exploit attempts on unpatched PAN-OS devices without mitigations applied." <p /> <A HREF="https://www.darkreading.com/threat-intelligence/patch-palo-alto-auth-bypass-bug-exploit">https://www.darkreading.com/threat-intelligence/patch-palo-alto-auth-bypass-bug-exploit</a> <hr> <h3>Containers on fire: from container escapes to supply chain attacks</h3> We break down the primary attack vectors in containerized environments: exposed secrets, privilege misconfigurations, API compromise, and supply chain attacks. <p /> <A HREF="https://securelist.com/container-attack-vectors/120010/">https://securelist.com/container-attack-vectors/120010/</a> <hr> <h3>Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit</h3> An unknown threat actor has been observed using a large language model (LLM) agent to conduct post-compromise actions after obtaining initial access following the exploitation of a publicly-accessible Marimo network using a recently disclosed vulnerability. <p /> <A HREF="https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html">https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html</a> <hr> <h3>Handy-Spione als Schnäppchen: Italiens boomende Spyware-Schattenindustrie</h3> Wenn von staatlicher Überwachungssoftware die Rede ist, fallen meist Namen wie Pegasus, Predator oder Paragon (Graphite)). Diese hochentwickelten Werkzeuge kosten Millionen und nutzen unbekannte Sicherheitslücken in Form von Zero-Day-Exploits, um Smartphones völlig ohne Zutun der Betroffenen zu infizieren. Doch diese High-End-Produkte bilden nur die Spitze des Eisbergs. Abseits des Rampenlichts hat sich in Europa ein paralleler, weitaus billigerer Markt etabliert. <p /> <A HREF="https://www.heise.de/news/Handy-Spione-als-Schnaeppchen-Italiens-boomende-Spyware-Schattenindustrie-11312651.html">https://www.heise.de/news/Handy-Spione-als-Schnaeppchen-Italiens-boomende-Spyware-Schattenindustrie-11312651.html</a> <hr> <h3>Let-s talk about encrypted reasoning</h3> Last week I decided it-d be fun to set up an OpenClaw agent. [..] But configuring the agent to talk to Claude exposed me to something way more interesting: I got a cool error. The kind of error that cryptographers can-t resist [..] So TL;DR, while I was able to extract application-specific secrets that did exist, I wasn-t able to extract model prompts that don-t. [..] I think model providers should think hard about this reasoning data, and they should make sure it doesn-t leak things they don-t want it to. <p /> <A HREF="https://blog.cryptographyengineering.com/2026/05/29/fooling-around-with-encrypted-reasoning-blobs/">https://blog.cryptographyengineering.com/2026/05/29/fooling-around-with-encrypted-reasoning-blobs/</a> <hr> <h3>CVE-2026-48710: A Maintainers Perspective</h3> Upgrade to Starlette 1.0.1 or later, which validates the Host header and rejects malformed values. Beyond that: don't base authorization on request.url.path. If you need the routed path, use request.scope["path"], which is never reconstructed from the Host header. Better yet, don't make authorization decisions on path strings at all. <p /> <A HREF="https://marcelotryle.com/blog/2026/05/28/cve-2026-48710-a-maintainers-perspective/">https://marcelotryle.com/blog/2026/05/28/cve-2026-48710-a-maintainers-perspective/</a> <h2> Vulnerabilities </h2> <h3>A census of the Starlette host-header auth bypass CVE-2026-48710</h3> CVE-2026-48710 is a Starlette host-header authentication bypass. Because FastAPI is built on Starlette, the affected population spans applications of every kind - AI and non-AI - and that broad impact is only starting to unfold. <p /> <A HREF="https://www.persistent-security.net/post/cve-2026-48710-bad-hosts-in-the-wild">https://www.persistent-security.net/post/cve-2026-48710-bad-hosts-in-the-wild</a> <hr> <h3>Ivanti: Security Advisory Ivanti Neurons for ITSM (CVE-2026-9614)</h3> An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access. <p /> <A HREF="https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2026-9614?language=en_US">https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2026-9614?language=en_US</a> <hr> <h3>IT-Sicherheitslösung Check Point Security Gateway ist verwundbar</h3> Insgesamt haben die Entwickler vier Softwareschwachstellen geschlossen. Drei davon (CVE-2026-48131, CVE-2026-48132, CVE-2026-48133) sind mit dem Bedrohungsgrad -hoch- eingestuft. In zwei Fällen können Angreifer durch das Versenden von präparierten Datenpaketen VPN-Verbindungen terminieren. Wenn im Kontext der Browser-basierten Authentifizierung die Funktion Identity Awareness aktiv ist, können Angreifer ohne Authentifizierung interne Dateien von Security Gateway einsehen. <p /> <A HREF="https://www.heise.de/news/IT-Sicherheitsloesung-Check-Point-Security-Gateway-ist-verwundbar-11312987.html">https://www.heise.de/news/IT-Sicherheitsloesung-Check-Point-Security-Gateway-ist-verwundbar-11312987.html</a> <hr> <h3>LWN: Security updates for Monday</h3> <p /> <A HREF="https://lwn.net/Articles/1075733/">https://lwn.net/Articles/1075733/</a> <hr> <h3>Mozilla: Security Vulnerabilities fixed in Firefox for iOS 151.2</h3> <p /> <A HREF="https://www.mozilla.org/en-US/security/advisories/mfsa2026-53/">https://www.mozilla.org/en-US/security/advisories/mfsa2026-53/</a>

CERT.at2026-06-01T18:36:20ZCERT.at2026-05-29T18:37:36Z2026-05-29T18:37:36Z

<h2>End-of-Day report</h2> Timeframe: Donnerstag 28-05-2026 18:00 - Freitag 29-05-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a <h2> News </h2> <h3>Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer</h3> Threat actors are continuing to exploit a critical, now-patched security flaw impacting FortiClient Endpoint Management Server (EMS) deployments to deliver credential-stealing malware. [..] The activity, observed by the cybersecurity company in May 2026, involves the exploitation of CVE-2026-35616 (CVSS score: 9.1), a critical pre-authentication API access bypass leading to privilege escalation. The issue was addressed by Fortinet in FortiClient EMS 7.4.7 and later. <p /> <A HREF="https://thehackernews.com/2026/05/threat-actors-exploit-critical.html">https://thehackernews.com/2026/05/threat-actors-exploit-critical.html</a> <hr> <h3>Signal users targeted in backup-stealing phishing attacks</h3> A new phishing campaign is targeting Signal users by attempting to steal their backup recovery keys to access encrypted message archives. The attack is initiated by a text message pretending to come from Signal Support. [..] For now, the attacks appear to be targeted. <p /> <A HREF="https://www.malwarebytes.com/blog/news/2026/05/signal-users-targeted-in-backup-stealing-phishing-attacks">https://www.malwarebytes.com/blog/news/2026/05/signal-users-targeted-in-backup-stealing-phishing-attacks</a> <hr> <h3>Sechs Zero-Days in sechs Wochen offengelegt: Microsoft reagiert mit Drohung</h3> Nachweise von Sicherheitslücken in Microsoft Windows sind zuletzt mehrfach veröffentlicht worden, ohne dass es dafür ein Sicherheitsupdate gegeben hat. [..] In einem Blogpost ärgert sich das Microsoft Security Response Center (MSRC), dass es nicht vorab über die Sicherheitslücken informiert wurde. [..] Das Github-Konto des mutmaßlichen Entdeckers der gegenständlichen Sicherheitslücken (Pseudonym Nightmare Eclipse) hat Microsoft bereits gelöscht. [..] Der Konzern droht mit Klagen und der Polizei. [..] In dem selben mit -Nightmare Eclipse- betitelten Blog weist der Autor den Vorwurf, CVD-Regeln nicht befolgt zu haben, als -Diffamierung- von sich. <p /> <A HREF="https://heise.de/-11310723">https://heise.de/-11310723</a> <hr> <h3>Chrome-Update schließt 151 Sicherheitslecks - davon 22 kritische</h3> Google hat am Mittwoch den Webbrowser Chrome in aktualisierter Fassung veröffentlicht. Erst in der Nacht zum Freitag haben die Entwickler jedoch Informationen über die damit geschlossenen Sicherheitslücken nachgeliefert: 151 Schwachstellen hat die neue Version weniger. Davon haben 22 die Einstufung als -kritisches- Risiko erhalten. <p /> <A HREF="https://heise.de/-11310811">https://heise.de/-11310811</a> <hr> <h3>Cybersicherheit: Kritische Infrastrukturen holen auf, doch -Risiko-Zone- wächst</h3> Ein Enisa-Bericht zeigt deutliche Fortschritte durch die NIS2-Richtlinie, warnt aber vor wachsenden digitalen Gefahren in den Sektoren Raumfahrt und Transport. <p /> <A HREF="https://heise.de/-11312014">https://heise.de/-11312014</a> <hr> <h3>RIPE NCC session fixation: poaching logins with an Atlas probe</h3> RIPE NCC-s single sign-on did not rotate session tokens on login, leaving 12000 Atlas probe hosts in a position to compromise other RIPE NCC users- logins. A single link click planted a session token in a target-s browser. [..] I reported this in April 2026, and it was fixed within three weeks. But the structural pattern that makes attacks like this possible, hosting third-party infrastructure under the same domain as the all-powerful SSO cookie, has not yet changed. <p /> <A HREF="https://mxsasha.eu/posts/ripe-ncc-session-fixation/">https://mxsasha.eu/posts/ripe-ncc-session-fixation/</a> <h2> Vulnerabilities </h2> <h3>Critical Security Patch Update Advisory - May 2026</h3> A Critical Security Patch Update (CSPU) provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption. Critical Security Patch Updates complement Oracle-s existing quarterly cumulative Critical Patch Updates (CPUs). These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. <p /> <A HREF="https://www.oracle.com/security-alerts/cspumay2026.html">https://www.oracle.com/security-alerts/cspumay2026.html</a> <hr> <h3>CIFSwitch: a non-universal Linux local root vulnerability</h3> A distro-specific Linux LPE found by harnessing LLMs into better multihop knowledge composition. [..] The harnessed agents found an issue at the intersection of kernel-s CIFS and the userspace cifs-utils-provided helper. [..] A very non-exhaustive list of systems tested. [..] You can use the released PoC to validate the mitigations. <p /> <A HREF="https://heyitsas.im/posts/cifswitch/">https://heyitsas.im/posts/cifswitch/</a> <hr> <h3>WP Maps Pro Vulnerability Exposed 15,000 WordPress Sites to Site Takeover</h3> A critical vulnerability in the WP Maps Pro WordPress plugin allowed unauthenticated attackers to create administrator accounts and potentially perform a complete site takeover on affected websites. The issue impacted all WP Maps Pro versions up to 6.1.0. [..] The vulnerability was submitted to the Wordfence Bug Bounty Program on March 24, 2026 [..] May 20, 2026 - WP Maps Pro 6.1.1 was released. [..] CVE-2026-8732 <p /> <A HREF="https://thecyberexpress.com/wp-maps-pro-vulnerability/">https://thecyberexpress.com/wp-maps-pro-vulnerability/</a> <hr> <h3>VU#780781: Casdoor contains multiple authentication bypass and access management vulnerabilities</h3> <p /> <A HREF="https://kb.cert.org/vuls/id/780781">https://kb.cert.org/vuls/id/780781</a> <hr> <h3>LWN: Security updates for Friday</h3> <p /> <A HREF="https://lwn.net/Articles/1075310/">https://lwn.net/Articles/1075310/</a>

CERT.at2026-05-29T18:37:36ZCERT.at2026-05-28T19:39:43Z2026-05-28T19:39:43Z

<h2>End-of-Day report</h2> Timeframe: Mittwoch 27-05-2026 18:00 - Donnerstag 28-05-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler <h2> News </h2> <h3>Update #2: Qilin-Ransomware nutzt Initial Access aus ZipLine-Kampagne - DACH-Recruiting-Domains im Fokus</h3> Update #2: 28. Mai 2026: Eine weitere neue Köderdomain wurde bekannt, die demselben Muster folgt: falkentalent[.]at <p /> <A HREF="https://www.cert.at/de/aktuelles/2026/5/zipline-qilin-raas-update">https://www.cert.at/de/aktuelles/2026/5/zipline-qilin-raas-update</a> <hr> <h3>GPU mining malware spreads via SEO poisoning, AI chatbots</h3> Threat actors are targeting systems with high-performance computers in an ongoing cryptojacking campaign spread through a coordinated SEO poisoning operation that also manipulated AI chatbot recommendations. -The compromise occurs through malicious download pages for utility software typically installed by owners of powerful systems, like CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack, and PDFgear. [..] Microsoft researchers discovered the campaign and determined that the attack begins when users look for one of the aforementioned utilities and are presented with malicious links boosted in search rankings through SEO poisoning. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/gpu-mining-malware-spreads-via-seo-poisoning-ai-chatbots/">https://www.bleepingcomputer.com/news/security/gpu-mining-malware-spreads-via-seo-poisoning-ai-chatbots/</a> <hr> <h3>Vibe-Coding-Verdacht: Datenpanne in NPM-Paket legt Malware-Operation offen</h3> Sicherheitsforscher von OX Security haben einen Malware-Angriff beobachtet, bei dem der Angreifer offenbar wenig Gespür für seine eigene operative Sicherheit hatte. Laut Blogbeitrag der Forscher versuchte der Angreifer, durch ein NPM-Paket einen Infostealer zu verbreiten. Das Paket enthielt jedoch sein Github-Token, so dass die Forscher die Malware-Aktivitäten ziemlich genau nachverfolgen konnten. <p /> <A HREF="https://www.golem.de/news/vibe-coding-verdacht-datenpanne-in-npm-paket-legt-malware-operation-offen-2605-209123.html">https://www.golem.de/news/vibe-coding-verdacht-datenpanne-in-npm-paket-legt-malware-operation-offen-2605-209123.html</a> <hr> <h3>Seitenkanalangriff per Javascript: Spionage über SSD-Zugriffe einer Website</h3> Durch gezielte SSD-Zugriffe und Zeitmessungen können Angreifer über eine Website mit speziellem Javascript-Code heimlich Informationen darüber auslesen, welche Anwendungen auf den Systemen der Besucher laufen. [..] Im Hintergrund geöffnete Webseiten konnten die Forscher bei ihren Tests mit einer Wahrscheinlichkeit von 88,95 Prozent, andere ausgeführte Anwendungen sogar mit einer Wahrscheinlichkeit von 95,83 Prozent korrekt identifizieren. <p /> <A HREF="https://www.golem.de/news/seitenkanalangriff-per-javascript-spionage-ueber-ssd-zugriffe-einer-website-2605-209137.html">https://www.golem.de/news/seitenkanalangriff-per-javascript-spionage-ueber-ssd-zugriffe-einer-website-2605-209137.html</a> <hr> <h3>Pirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for years</h3> In late April 2026, a client reached out to us for incident response support after discovering a miner running on users- computers. We later discovered that the malware was being distributed via illegal movie and TV show streaming sites. The infection chain leveraged a fake update for a video player plugin. When the user attempted to watch a video, the player displayed a message saying the plugin version was outdated and asking to install an update to continue. [..] The archive contained a legitimate executable, HLS Installer.874.exe, alongside a malicious DLL. <p /> <A HREF="https://securelist.com/video-books-pirates-miners-rat/119943/">https://securelist.com/video-books-pirates-miners-rat/119943/</a> <hr> <h3>Warnung vor gefälschten FIFA-Webseiten vor der Fußball-WM 2026</h3> In zwei Wochen startet die Fußball-WM. Kriminelle nutzen die Gunst der Stunde und fälschen die FIFA-Webseite etwa für Phishing. [..] Mehr als 300 Domains laufen mit der betrügerischen Infrastruktur im Hintergrund. Sie greifen das Ping-Identity-SSO-System der FIFA an, um Zugangsdaten abzugreifen. 140 weitere Domains gelten als verdächtig und 3800 sind noch geparkt und warten nur auf ihre Aktivierung. Insgesamt 2513 FIFA-Kontenzugangsdaten für die Domains fifa.com und fifa.org haben die IT-Forscher bereits im Darknet gefunden. <p /> <A HREF="https://www.heise.de/news/Warnung-vor-gefaelschten-FIFA-Webseiten-vor-der-Fussball-WM-2026-11309777.html">https://www.heise.de/news/Warnung-vor-gefaelschten-FIFA-Webseiten-vor-der-Fussball-WM-2026-11309777.html</a> <hr> <h3>Gefälschte SMS im Namen der Österreichischen Pensionsversicherung</h3> Eine SMS der Pensionsversicherung fordert zur Aktualisierung des Pensionskontos auf. Vorsicht: Hinter dem Link steckt keine Behörde, sondern eine Phishing-Falle. <p /> <A HREF="https://www.watchlist-internet.at/news/gefaelschte-sms-im-namen-der-pensionsversicherung/">https://www.watchlist-internet.at/news/gefaelschte-sms-im-namen-der-pensionsversicherung/</a> <hr> <h3>SharePoint Update für CVE-2026-45659 (26.5.2026)</h3> Microsoft hat zum 21. Mai 2026 einen Hinweis auf ein außerplanmäßiges Sicherheitsupdate für seine noch unterstützten SharePoint-Systeme freigegeben (oder zumindest dokumentiert, denn das Update kam bereits zum 12. Mai 2026 mit den regulären SharePoint-Updates). Die Information zum Update ist dann zum 26. Mai 2026 aktualisiert worden. Es handelt sich bei CVE-2026-45659 um eine Microsoft SharePoint Remote Code Execution-Schwachstelle. <p /> <A HREF="https://borncity.com/blog/2026/05/27/sharepoint-out-of-band-update-fuer-cve-2026-45659-26-5-2026/">https://borncity.com/blog/2026/05/27/sharepoint-out-of-band-update-fuer-cve-2026-45659-26-5-2026/</a> <hr> <h3>CISA warnt vor Malware durch Supply-Chain-Attacken</h3> Die CISA warnt aktuell vor den jüngst beobachteten Lieferkettenangriffen auf TanStack, Daemon Tools sowie Nx Console, die Malware verteilt haben. <p /> <A HREF="https://heise.de/-11309253">https://heise.de/-11309253</a> <h2> Vulnerabilities </h2> <h3>New Gogs zero-day flaw lets hackers get remote code execution</h3> An unpatched zero-day vulnerability in the Gogs self-hosted Git service can allow attackers to gain remote code execution (RCE) on Internet-facing instances. [..] This critical severity argument injection security flaw has yet to be assigned a CVE ID, affects the latest release versions (Gogs 0.14.2 and 0.15.0+dev), and can only be exploited by authenticated attackers without admin privileges. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/new-gogs-zero-day-flaw-lets-hackers-get-remote-code-execution/">https://www.bleepingcomputer.com/news/security/new-gogs-zero-day-flaw-lets-hackers-get-remote-code-execution/</a> <hr> <h3>Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038</h3> An attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the site codebase or installed dependencies, this can result in arbitrary PHP code execution. CVE IDs: CVE-2026-9726 <p /> <A HREF="https://www.drupal.org/sa-contrib-2026-038">https://www.drupal.org/sa-contrib-2026-038</a> <hr> <h3>Notepad++: Lücken erlauben Einschleusen von Schadcode und Befehlen</h3> Ein weiteres Update steht für Notepad++ bereit. Es schließt drei Sicherheitslücken, von denen zwei als hohes Risiko eingestuft sind und Angreifern ermöglichen, etwa Befehle oder gar Schadcode einzuschmuggeln und auszuführen. <p /> <A HREF="https://www.heise.de/news/Notepad-Luecken-erlauben-Einschleusen-von-Schadcode-und-Befehlen-11309111.html">https://www.heise.de/news/Notepad-Luecken-erlauben-Einschleusen-von-Schadcode-und-Befehlen-11309111.html</a> <hr> <h3>VMware Sicherheitsupdates für ESXi 8.0U3j & VSA 8.0U3j</h3> VMware by Broadcom hat gerade Sicherheitsupdates für seine Produkte ESXi 8.0U3j sowie VSA 8.0U3J (vSphere Storage Appliance) veröffentlicht. Ergänzung: Es gab in Kommentaren Hinweise, dass Updates ohne Wartungsvertrag nicht installiert werden dürfen. <p /> <A HREF="https://borncity.com/blog/2026/05/28/vmware-sicherheitsupdates-fuer-esxi-8-0u3j-vsa-8-0u3j/">https://borncity.com/blog/2026/05/28/vmware-sicherheitsupdates-fuer-esxi-8-0u3j-vsa-8-0u3j/</a> <hr> <h3>Veeam: Security Fixes and Improvements 2026-05-27</h3> <p /> <A HREF="https://www.veeam.com/knowledge-base.html?type=security">https://www.veeam.com/knowledge-base.html?type=security</a> <hr> <h3>Joomla: [20260520] - Framework - Inadequate content filtering within the cleanAttributes filter code</h3> <p /> <A HREF="https://developer.joomla.org/security-centre/1052-20260520-framework-inadequate-content-filtering-within-the-cleanattributes-filter-code.html">https://developer.joomla.org/security-centre/1052-20260520-framework-inadequate-content-filtering-within-the-cleanattributes-filter-code.html</a> <hr> <h3>LWN: Security updates for Thursday</h3> <p /> <A HREF="https://lwn.net/Articles/1075060/">https://lwn.net/Articles/1075060/</a>

CERT.at2026-05-28T19:39:43ZCERT.at2026-05-27T18:12:09Z2026-05-27T18:12:09Z

<h2>End-of-Day report</h2> Timeframe: Dienstag 26-05-2026 18:00 - Mittwoch 27-05-2026 18:00 Handler: Guenes Holler Co-Handler: Alexander Riepl <h2> News </h2> <h3>Millions of AI agents imperiled by critical vulnerability in open source package</h3> "BadHost" was found in Starlette, a package with 325 million weekly downloads. <p /> <A HREF="https://arstechnica.com/information-technology/2026/05/millions-of-ai-agents-imperiled-by-critical-vulnerability-in-open-source-package/">https://arstechnica.com/information-technology/2026/05/millions-of-ai-agents-imperiled-by-critical-vulnerability-in-open-source-package/</a> <hr> <h3>KnowledgeDeliver flaw exploited as a zero-day to install web shells</h3> Hackers exploited a critical zero-day vulnerability in a server running the KnowledgeDeliver learning management system (LMS) to deploy the Godzilla web shell. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/knowledgedeliver-flaw-exploited-as-a-zero-day-to-install-web-shells/">https://www.bleepingcomputer.com/news/security/knowledgedeliver-flaw-exploited-as-a-zero-day-to-install-web-shells/</a> <hr> <h3>Messenger-App: Schwachstelle in Signal kann Datenlöschung verhindern</h3> Wegen einer Schwachstelle beim Logging von Löschanfragen könnten Signal-Nachrichten auch nach Jahren wiederherstellbar sein. <p /> <A HREF="https://www.golem.de/news/messenger-app-schwachstelle-in-signal-kann-datenloeschung-verhindern-2605-209008.html">https://www.golem.de/news/messenger-app-schwachstelle-in-signal-kann-datenloeschung-verhindern-2605-209008.html</a> <hr> <h3>(g+) F5 BIG-IP APM: Ein alter DoS-Patch kehrt als RCE zurück</h3> F5 stuft CVE-2025-53521 von DoS auf RCE hoch, Angreifer hatten Zugang zum Quellcode. Die dringendste Frage für Admins: Sind BIG-IP-APM-Instanzen direkt aus dem Internet erreichbar? <p /> <A HREF="https://www.golem.de/news/f5-big-ip-apm-ein-alter-dos-patch-kehrt-als-rce-zurueck-2605-209075.html">https://www.golem.de/news/f5-big-ip-apm-ein-alter-dos-patch-kehrt-als-rce-zurueck-2605-209075.html</a> <hr> <h3>MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries</h3> The Iranian hacking group known as MuddyWater has been linked to a new campaign affecting at least nine organizations across nine countries on four continents in the first quarter of 2026. <p /> <A HREF="https://thehackernews.com/2026/05/muddywater-uses-dll-side-loading-in.html">https://thehackernews.com/2026/05/muddywater-uses-dll-side-loading-in.html</a> <hr> <h3>Gitea Vulnerability Exposes Private Container Images without Authentication</h3> Cybersecurity researchers have disclosed a security flaw in Gitea, an open-source, self-hosted platform for version control, that allows unauthenticated remote attackers to pull private container images from Gitea deployments without requiring an account, password, or other credentials. <p /> <A HREF="https://thehackernews.com/2026/05/gitea-vulnerability-exposes-private.html">https://thehackernews.com/2026/05/gitea-vulnerability-exposes-private.html</a> <hr> <h3>GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure</h3> CrowdStrike, in partnership with Google and the Shadowserver Foundation, has announced the simultaneous disruption of all command-and-control (C2) channels associated with GlassWorm, a persistent software chain campaign targeting software developers through malicious packages and extensions. <p /> <A HREF="https://thehackernews.com/2026/05/glassworm-malware-takedown-disrupts.html">https://thehackernews.com/2026/05/glassworm-malware-takedown-disrupts.html</a> <hr> <h3>Umstrittene Befugnisse: BKA erhält Zugriff auf Angreifer-Infrastruktur</h3> Das Kabinett hat den Weg für neue Befugnisse freigemacht: Das Bundeskriminalamt soll künftig IT-Systeme von Angreifern stören oder zerstören dürfen. <p /> <A HREF="https://www.heise.de/news/Hackback-Erlaubnis-Kabinett-macht-Weg-frei-11308323.html">https://www.heise.de/news/Hackback-Erlaubnis-Kabinett-macht-Weg-frei-11308323.html</a> <hr> <h3>Fake-Anwaltskanzlei: Letzte außergerichtliche Zahlungsaufforderung als Druckmittel</h3> Ein angeblich telefonisch abgeschlossenes Abo bei einem Gewinnspielunternehmen. Ausstehende Zahlungen und eine letzte Möglichkeit, die Sache außergerichtlich zu klären. Mit dieser Geschichte wollen Kriminelle ans Geld ihrer Opfer. Die dazugehörige Nachricht vom (Fake-)Anwalt kommt per E-Mail - oder per Post. <p /> <A HREF="https://www.watchlist-internet.at/news/fake-anwaltskanzlei-zahlungsaufforderung/">https://www.watchlist-internet.at/news/fake-anwaltskanzlei-zahlungsaufforderung/</a> <hr> <h3>FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts - no password required</h3> So, youve enabled multi-factor authentication. Youve taught your staff never to type their passwords into dodgy-looking login pages. Surely your Microsoft 365 accounts are safe now? Well, think again. <p /> <A HREF="https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-kali365-phishing-kit-breaks-microsoft-365-accounts-no-password-required">https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-kali365-phishing-kit-breaks-microsoft-365-accounts-no-password-required</a> <hr> <h3>BTMOB: A stealthy RAT burrowing deep into Android devices</h3> The malware pairs remote access capabilities with ready-made campaign tools, lowering the barrier for full device compromise <p /> <A HREF="https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices/">https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices/</a> <hr> <h3>Trojanized Gemini and Claude Installers Target Developers Via SEO Poisoning</h3> Cybercriminals are using SEO poisoning and fake Gemini and Claude installer sites to infect developers with fileless malware and steal data. <p /> <A HREF="https://hackread.com/trojan-gemini-claude-installers-developers-seo-poisoning/">https://hackread.com/trojan-gemini-claude-installers-developers-seo-poisoning/</a> <hr> <h3>OverlayPhantom Android Banking Trojan Targets 180+ Financial Apps Across 10 Countries</h3> A newly discovered Android banking trojan known as OverlayPhantom is raising concerns among cybersecurity researchers after evidence revealed that the malware is actively targeting banking, financial, and cryptocurrency users across multiple Western countries. <p /> <A HREF="https://thecyberexpress.com/overlayphantom-android-banking-trojan/">https://thecyberexpress.com/overlayphantom-android-banking-trojan/</a> <hr> <h3>Trotz fehlender Patches: Russland setzt weiterhin massiv auf Microsoft Exchange</h3> Zahlreiche russische Unternehmen haben wohl noch Exchange und andere westliche Software im Einsatz. Patches bekommen sie dafür aber schon lange nicht mehr. <p /> <A HREF="https://www.golem.de/news/trotz-fehlender-patches-russland-setzt-weiterhin-massiv-auf-microsoft-exchange-2605-209083.html">https://www.golem.de/news/trotz-fehlender-patches-russland-setzt-weiterhin-massiv-auf-microsoft-exchange-2605-209083.html</a> <hr> <h2> Vulnerabilities </h2> <h3>Ausnutzung wahrscheinlich: Kritische Nginx-Lücke gefährdet unzählige Webserver</h3> Erst vor wenigen Tagen hatten Forscher von Depthfirst eine Nginx Rift genannte Sicherheitslücke in der weit verbreiteten Webserver-Software Nginx aufgedeckt, mit der Angreifer anfällige Systeme temporär unerreichbar machen und manchmal sogar Schadcode zur Ausführung bringen können. Jetzt hat der Nginx-Entwickler F5 noch eine weitere Lücke gepatcht, die weitgehend über die gleichen Eigenschaften verfügt. <p /> <A HREF="https://www.golem.de/news/ausnutzung-wahrscheinlich-kritische-nginx-luecke-gefaehrdet-unzaehlige-webserver-2605-209060.html">https://www.golem.de/news/ausnutzung-wahrscheinlich-kritische-nginx-luecke-gefaehrdet-unzaehlige-webserver-2605-209060.html</a> <hr> <h3>UniFi OS Server: Kritische Sicherheitslücken ermöglichen Angriffe</h3> In der zentralen Verwaltungsplattform und dem Betriebssystem für UniFi-Geräte UniFi OS Server klaffen mehrere Sicherheitslücken - teils mit Höchstwertung beim Risiko. Es stehen Updates zur Verfügung, die die Lücken schließen. Wer betroffene UniFi-Geräte einsetzt, sollte mit dem Installieren der Aktualisierungen nicht lange warten. <p /> <A HREF="https://www.heise.de/news/UniFi-OS-Server-Kritische-Sicherheitsluecken-ermoeglichen-Angriffe-11307509.html">https://www.heise.de/news/UniFi-OS-Server-Kritische-Sicherheitsluecken-ermoeglichen-Angriffe-11307509.html</a> <hr> <h3>7-Zip: Update schließt Codeschmuggel-Lücke</h3> Das populäre Packprogramm 7-Zip enthält eine Schwachstelle, die das Einschleusen von Schadcode ermöglicht. Ein Update steht bereit. <p /> <A HREF="https://www.heise.de/news/7-Zip-Update-schliesst-Codeschmuggel-Luecke-11308241.html">https://www.heise.de/news/7-Zip-Update-schliesst-Codeschmuggel-Luecke-11308241.html</a> <hr> <h3>Fehler in Docker Model Runner erlaubt Sandboxausbruch unter macOS</h3> Nutzen Angreifer eine Sicherheitslücke in Docker unter macOS erfolgreich aus, können sie aus der Sandbox ausbrechen und Schadcode im Hostsystem ausführen. Eine dagegen gerüstete Version steht zum Download bereit. <p /> <A HREF="https://www.heise.de/news/Fehler-in-Docker-Model-Runner-erlaubt-Sandboxausbruch-unter-macOS-11308267.html">https://www.heise.de/news/Fehler-in-Docker-Model-Runner-erlaubt-Sandboxausbruch-unter-macOS-11308267.html</a> <hr> <h3>LiteSpeed cPanel-Plugin: Angriffe auf Schwachstelle beobachtet</h3> Im LiteSpeed-Plugin für cPanel klafft eine Sicherheitslücke, die der Hersteller als kritisch einstuft. Die US-amerikanische IT-Sicherheitsbehörde CISA warnt, dass Angriffe darauf beobachtet wurden. Aktualisierte Software steht bereit. <p /> <A HREF="https://heise.de/-11307435">https://heise.de/-11307435</a> <hr> <h3>CVE-2026-48131 - VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero</h3> <p /> <A HREF="https://support.checkpoint.com/results/sk/sk184981">https://support.checkpoint.com/results/sk/sk184981</a> <hr> <h3>CVE-2026-48132 - VPN service may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP</h3> <p /> <A HREF="https://support.checkpoint.com/results/sk/sk184982">https://support.checkpoint.com/results/sk/sk184982</a> <hr> <h3>CVE-2026-48133 Identity Awareness Captive Portal - Unauthenticated Local File Inclusion</h3> <p /> <A HREF="https://support.checkpoint.com/results/sk/sk184993">https://support.checkpoint.com/results/sk/sk184993</a> <hr> <h3>CVE-2026-48134 - SQL injection issue in UserCheck Portal when DLP is active</h3> <p /> <A HREF="https://support.checkpoint.com/results/sk/sk184983">https://support.checkpoint.com/results/sk/sk184983</a> <hr> <h3>CVE-2026-48135 - HTTP service can incorrectly process malformed HTTP requests</h3> <p /> <A HREF="https://support.checkpoint.com/results/sk/sk184991">https://support.checkpoint.com/results/sk/sk184991</a> <hr> <h3>CVE-2026-48136 - Authenticated Administrator Role-Based Access Control Bypass in Compliance</h3> <p /> <A HREF="https://support.checkpoint.com/results/sk/sk184992">https://support.checkpoint.com/results/sk/sk184992</a> <hr> <h3>LWN Security updates for Wednesday</h3> <p /> <A HREF="https://lwn.net/Articles/1074840/">https://lwn.net/Articles/1074840/</a>

CERT.at2026-05-27T18:12:09ZCERT.at2026-05-26T18:42:34Z2026-05-26T18:42:34Z

<h2>End-of-Day report</h2> Timeframe: Freitag 22-05-2026 18:00 - Dienstag 26-05-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl <h2> News </h2> <h3>Update #1: Qilin-Ransomware nutzt Initial Access aus ZipLine-Kampagne - DACH-Recruiting-Domains im Fokus</h3> Uns sind weitere Köderdomains bekannt geworden, die demselben Muster folgen: valenzsearch[.]at, haasrecruiting[.]at, bergersearch[.]at <p /> <A HREF="https://www.cert.at/de/aktuelles/2026/5/zipline-qilin-raas-update">https://www.cert.at/de/aktuelles/2026/5/zipline-qilin-raas-update</a> <hr> <h3>Anthropic to release Mythos-class models to the public</h3> Anthropic has revealed its intention to one day release models that match the performance of its Mythos bug-finding AI to the public, once it can make them safe. <p /> <A HREF="https://www.theregister.com/security/2026/05/25/anthropic-to-release-mythos-class-models-to-the-public/5245596">https://www.theregister.com/security/2026/05/25/anthropic-to-release-mythos-class-models-to-the-public/5245596</a> <hr> <h3>Critical Ghost CMS Vulnerability Exploited to Hack 700+ Websites</h3> A critical Ghost CMS vulnerability identified as CVE-2026-26980 has been exploited in a widespread cyber campaign that compromised more than 700 websites, including platforms associated with major institutions such as Harvard University, University of Oxford, and DuckDuckGo. [..] The flaw received a CVSS severity score of 9.4, highlighting the serious risks posed by CVE-2026-26980. The vulnerability was reportedly discovered by Anthropic using its Claude AI system. [..] Investigators noted that a DLL file involved in the campaign carried a compilation timestamp dated February 16, 2026 [..] The malicious activity was first detected on May 7, 2026. <p /> <A HREF="https://thecyberexpress.com/cve-2026-26980-ghost-cms-vulnerability/">https://thecyberexpress.com/cve-2026-26980-ghost-cms-vulnerability/</a> <hr> <h3>Github: Staged publishing and new install-time controls for NPM</h3> Staged publishing is now generally available on npm. Instead of a direct publish that immediately makes a package version available to consumers, the prebuilt tarball is uploaded to a stage queue where a maintainer must explicitly approve it before it becomes installable. <p /> <A HREF="https://github.blog/changelog/2026-05-22-staged-publishing-and-new-install-time-controls-for-npm/">https://github.blog/changelog/2026-05-22-staged-publishing-and-new-install-time-controls-for-npm/</a> <hr> <h3>Malicious Postinstall Hook Found Across 700+ GitHub Repositories, Including Packagist and Node.js Projects</h3> Socket researchers identified a coordinated supply chain campaign affecting eight packages on Packagist whose upstream repositories were modified to include the same malicious postinstall script. The script attempted to download a Linux binary from a GitHub Releases URL, save it to /tmp/.sshd, make it executable, and run it in the background. <p /> <A HREF="https://socket.dev/blog/malicious-postinstall-hook-found-across-700-github-repos">https://socket.dev/blog/malicious-postinstall-hook-found-across-700-github-repos</a> <hr> <h3>Fake software on GitHub and SourceForge distribute Deno RAT</h3> We found fake installers and plugins for ChatGPT, Claude, AutoTune, and other popular software that can give attackers full control over your device. [..] The infection chain is usually started via MSI files or PowerShell scripts downloaded from GitHub or SourceForge in most of the analyzed cases. <p /> <A HREF="https://www.malwarebytes.com/blog/threat-intel/2026/05/fake-software-on-github-and-sourceforge-distribute-deno-rat">https://www.malwarebytes.com/blog/threat-intel/2026/05/fake-software-on-github-and-sourceforge-distribute-deno-rat</a> <hr> <h3>Anruf, WhatsApp, QR-Code: Neue Phishing-Masche betrifft Erste Bank Kund:innen</h3> Kriminelle geben sich aktuell als Mitarbeitende der Erste Bank aus und fordern ihre Opfer per WhatsApp dazu auf, einen Aktivierungs-QR-Code für George zu übermitteln. Wer den Code weitergibt, ermöglicht den Tätern Zugriff auf das Konto. <p /> <A HREF="https://www.watchlist-internet.at/news/qr-code-erste-bank/">https://www.watchlist-internet.at/news/qr-code-erste-bank/</a> <hr> <h3>Betrüger verschicken seit Monaten Scam-Mails von offizieller Microsoft-Adresse</h3> Betrüger können über eine offizielle E-Mailadresse von Microsoft Nachrichten verschicken. Über die selbe Adresse werden auch Codes für die Zwei-Faktor-Authentifzierung versendet. [..] Die genutzte Absenderadresse lautet "msonlineservicesteam@microsoftonline.com". <p /> <A HREF="https://www.derstandard.at/story/3000000322088/betrueger-verschicken-seit-monaten-scam-mails-von-offizieller-microsoft-adresse">https://www.derstandard.at/story/3000000322088/betrueger-verschicken-seit-monaten-scam-mails-von-offizieller-microsoft-adresse</a> <hr> <h3>DBIR 2026: Sicherheitslücken als häufigstes Einfallstor für Angriffe</h3> Obwohl der Bericht (DBIR 2026) noch auf Daten aus dem Jahr 2025 basiert und somit vor den jüngsten Fortschritten bei KI-Spitzenmodellen entstanden ist, sind die Trends eindeutig: KI verändert die Cybersicherheitsbranche grundlegend. [..] Fast ein Drittel (31 %) aller Sicherheitsverletzungen beginnt mit der Ausnutzung von Schwachstellen. <p /> <A HREF="https://borncity.com/blog/2026/05/25/dbir-2026-sicherheitsluecken-sind-das-haeufigste-einfallstor-fuer-angriffe/">https://borncity.com/blog/2026/05/25/dbir-2026-sicherheitsluecken-sind-das-haeufigste-einfallstor-fuer-angriffe/</a> <hr> <h3>2 PhaaS 2 Furious: The Evolution of Chinese-language Phishing Services</h3> While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground. <p /> <A HREF="https://cloud.google.com/blog/topics/threat-intelligence/chinese-language-phishing-services/">https://cloud.google.com/blog/topics/threat-intelligence/chinese-language-phishing-services/</a> <hr> <h3>Six Signals for Threat Attribution</h3> Credible threat attribution weighs six signals together. Each signal has a disciplined methodology behind it, with citations and stress tests to back the conclusions. <p /> <A HREF="https://zeltser.com/six-signals-for-threat-attribution">https://zeltser.com/six-signals-for-threat-attribution</a> <hr> <h3>Noroboto: Lying fonts and mitigation in Rust</h3> The "noroboto.ttf" "lexploit" is straightforward: create a new malicious font definition which is embedded in a document according to the specification and lies about the Unicode representation of its glyphs. <p /> <A HREF="https://tritium.legal/blog/noroboto">https://tritium.legal/blog/noroboto</a> <hr> <h3>Detection Logic Bugs, Developing Context to Bypass MiniPlasma Rules</h3> Recently, because of Nightmare-eclipse-s Green Plasma and MiniPlasma variants, it-s been a busy week. There are tons of community detection rules out there now. But as someone who practices Adversarial Detection Engineering, that is, hunting for bugs in detection logic, you know a small tweaks can bypass detection. <p /> <A HREF="https://detect.fyi/detection-logic-bugs-developing-context-to-bypass-miniplasma-rules-903f1d7c68e8?source=rssd5fd8f494f6a4">https://detect.fyi/detection-logic-bugs-developing-context-to-bypass-miniplasma-rules-903f1d7c68e8?source=rssd5fd8f494f6a4</a> <hr> <h3>Remove SPNs and Fix Kerberoasting</h3> Remediate Kerberoasting vulnerabilities by removing SPNs for accounts that dont need them. <p /> <A HREF="https://projectblack.io/blog/remove-spn-fix-kerberoasting/">https://projectblack.io/blog/remove-spn-fix-kerberoasting/</a> <hr> <h3>NISG 2026: Der praktische 6-Monats-Fahrplan für österreichische Unternehmen</h3> Der 1. Oktober 2026 ist kein weiches Zieldatum. Ab diesem Tag gilt das Netz- und Informationssystemsicherheitsgesetz NISG 2026 in Österreich vollumfänglich [..] Dieser Fahrplan zeigt konkret, was in den nächsten 6 Monaten zu tun ist: So, dass ein IT-Verantwortlicher oder eine Geschäftsführerin morgen damit beginnen kann. <p /> <A HREF="https://www.zettasecure.com//post//nisg-2026-fahrplan-oesterreich">https://www.zettasecure.com//post//nisg-2026-fahrplan-oesterreich</a> <h2> Vulnerabilities </h2> <h3>Roundcube: Security updates 1.6.16 and 1.7.1 released</h3> We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities. <p /> <A HREF="https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1">https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1</a> <hr> <h3>Debian SE Linux and PinTheft</h3> PinTheft is a Linux local privilege escalation exploit for an RDS zerocopy double-free that can be turned into a page-cache overwrite through io_uring fixed buffers. [..] We duped on this bug with some other teams and a patch is available so we are releasing our PoC. <p /> <A HREF="https://etbe.coker.com.au/2026/05/24/debian-selinux-pintheft/">https://etbe.coker.com.au/2026/05/24/debian-selinux-pintheft/</a> <hr> <h3>Splunk: SVD-2026-0504: Denial of Service through coldToFrozen.sh Script in Splunk Enterprise</h3> <p /> <A HREF="https://advisory.splunk.com//advisories/SVD-2026-0504">https://advisory.splunk.com//advisories/SVD-2026-0504</a> <hr> <h3>LWN: Security updates for Tuesday</h3> <p /> <A HREF="https://lwn.net/Articles/1074443/">https://lwn.net/Articles/1074443/</a> <hr> <h3>Synology-SA-26:10 Synology Chat Server</h3> <p /> <A HREF="https://www.synology.com/en-global/support/security/Synology_SA_26_10">https://www.synology.com/en-global/support/security/Synology_SA_26_10</a> <hr> <h3>MISP 2.5.38 - UI and security update</h3> <p /> <A HREF="https://www.misp-project.org/2026/05/26/misp.2.5.38.released.html/">https://www.misp-project.org/2026/05/26/misp.2.5.38.released.html/</a> <hr> <h3>Zyxel security advisory for missing authorization vulnerability in GS1200v3 series switches</h3> <p /> <A HREF="https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-missing-authorization-vulnerability-in-gs1200v3-series-switches-05-26-2026">https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-missing-authorization-vulnerability-in-gs1200v3-series-switches-05-26-2026</a>

CERT.at2026-05-26T18:42:34ZCERT.at2026-05-22T19:02:00Z2026-05-22T19:02:00Z

<h2>End-of-Day report</h2> Timeframe: Donnerstag 21-05-2026 18:00 - Freitag 22-05-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer <h2> News </h2> <h3>Qilin-Ransomware nutzt Initial Access aus ZipLine-Kampagne - DACH-Recruiting-Domains im Fokus</h3> Wir haben Hinweise darauf, dass die Ransomware-Gruppe Qilin Initial Access von Akteur:innen der ZipLine-Phishing-Kampagne erwirbt und für eigene Verschlüsselungs- und Erpressungsoperationen weiterverwendet. In Österreich liegen uns bereits bestätigte Fälle vor. [..] Im DACH-Raum sehen wir aktuell vor allem Köderdomains mit Recruiting-Bezug. <p /> <A HREF="https://www.cert.at/de/aktuelles/2026/5/zipline-qilin-raas">https://www.cert.at/de/aktuelles/2026/5/zipline-qilin-raas</a> <hr> <h3>A hacker group is poisoning open source code at an unprecedented scale</h3> GitHub is just the latest victim of TeamPCP, a gang that has carried out a spree of software supply chain attacks. [..] Amid an epidemic of supply chain attacks like the ones TeamPCP has unleashed, Socket-s Burckhardt says open-source users will need to take trust-but-verify measures, like analyzing updates for malware before rolling them out across a network, as well as the kind of -cool-down- period that Read recommends before downloading and running code. <p /> <A HREF="https://arstechnica.com/information-technology/2026/05/a-hacker-group-is-poisoning-open-source-code-at-an-unprecedented-scale/">https://arstechnica.com/information-technology/2026/05/a-hacker-group-is-poisoning-open-source-code-at-an-unprecedented-scale/</a> <hr> <h3>Megalodon: Mass GitHub Repo Backdooring via CI Workflows</h3> On May 18, 2026, an automated campaign codenamed megalodon pushed 5,718 malicious commits to 5,561 GitHub repositories in a six-hour window. [..] 5,700+ commits in six hours, 5,561 repositories, one payload: replace a GitHub Actions workflow with a dormant secret exfiltration backdoor. The workflow_dispatch trigger design means these backdoors sit silent until activated, creating no visible CI runs. <p /> <A HREF="https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows">https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows</a> <hr> <h3>Drupal: Critical SQL injection flaw now targeted in attacks</h3> Drupal is warning that hackers are attempting to exploit a "highly critical" SQL injection vulnerability announced earlier this week. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/drupal-critical-sql-injection-flaw-now-targeted-in-attacks/">https://www.bleepingcomputer.com/news/security/drupal-critical-sql-injection-flaw-now-targeted-in-attacks/</a> <hr> <h3>Google API keys keep working after you delete them long enough to be exploited</h3> When you delete a Google API key, it says it-s immediately deleted. Our testing says ~23 minutes. During that window, an attacker with a leaked key keeps access to your data and enabled APIs (including Gemini). You have no way to revoke it faster or confirm when it stops working. Google closed our report as -won-t fix-. <p /> <A HREF="https://www.aikido.dev/blog/google-api-keys-deletion">https://www.aikido.dev/blog/google-api-keys-deletion</a> <hr> <h3>Paved With Intent: ROADtools and Nation-State Tactics in the Cloud</h3> Open-source framework ROADtools is being misused by threat actors for cloud intrusions. [..] ROADtools is an open-source framework written in Python and built for red-teaming and research. It primarily targets the identity and authentication layers of Azure, and focuses on how accounts, applications and tokens operate in tenants. <p /> <A HREF="https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/">https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/</a> <hr> <h3>CISA to allow researchers to report vulnerabilities to exploited bugs catalog</h3> The Cybersecurity and Infrastructure Security Agency (CISA) announced the creation of a nomination form on Thursday that they said enables -researchers, vendors, and industry partners- to report bugs that need to be added to the Known Exploited Vulnerabilities catalog. <p /> <A HREF="https://therecord.media/cisa-to-allow-researchers-to-report-vulnerabilities-kev">https://therecord.media/cisa-to-allow-researchers-to-report-vulnerabilities-kev</a> <h2> Vulnerabilities </h2> <h3>Ubiquiti patches three max severity UniFi OS vulnerabilities</h3> Ubiquiti has released security updates to patch three maximum severity vulnerabilities in Unify OS that can be exploited by remote attackers without privileges. [..] <p /> <A HREF="https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-unifi-os-vulnerabilities/">https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-unifi-os-vulnerabilities/</a> <hr> <h3>Trend Micro Apex One und Langflow: Warnung vor Angriffen</h3> Die unter Beschuss stehende Schwachstelle in Trend Micros Apex One schließen die Updates aus dem Mai, die der Hersteller am Donnerstag dieser Woche veröffentlicht hat. [..] In Langflow handelt es sich um eine verkettete Schwachstelle, die die Übernahme von Konten und das Ausführen von Schadcode aus dem Netz ermöglicht. <p /> <A HREF="https://www.heise.de/news/Schwachstellen-in-Trend-Micro-Apex-One-und-Langflow-unter-Beschuss-11303311.html">https://www.heise.de/news/Schwachstellen-in-Trend-Micro-Apex-One-und-Langflow-unter-Beschuss-11303311.html</a> <hr> <h3>Notepad++: Update bessert Schwachstelle im Installer aus</h3> Notepad++ schließt in der neuen Version 8.9.6 eine Sicherheitslücke im Installer. Die Risikobewertung ist noch nicht eindeutig, ein aufgeführter CVE-Eintrag noch nicht veröffentlicht. <p /> <A HREF="https://www.heise.de/news/Notepad-Update-bessert-Schwachstelle-im-Installer-aus-11303525.html">https://www.heise.de/news/Notepad-Update-bessert-Schwachstelle-im-Installer-aus-11303525.html</a> <hr> <h3>FatGid - FreeBSD 14.x kernel LPE</h3> A kernel stack buffer overflow exists in the setcred(2) system call introduced in FreeBSD 14.x. The overflow occurs before any privilege check, allowing any unprivileged local user to trigger arbitrary behaviour ranging from a kernel panic to full local privilege escalation. [..] The FreeBSD Security Team published FreeBSD-SA-26:18.setcred on 2026-05-21 with the assigned identifier CVE-2026-45250. Patches landed across all supported branches on 2026-05-20. <p /> <A HREF="https://fatgid.io/">https://fatgid.io/</a> <hr> <h3>LWN: Security updates for Friday</h3> <p /> <A HREF="https://lwn.net/Articles/1074040/">https://lwn.net/Articles/1074040/</a> <hr> <h3>Tenable: [R1] Sensor Proxy Version 1.4.0 Fixes Multiple Vulnerabilities</h3> <p /> <A HREF="https://www.tenable.com/security/tns-2026-15">https://www.tenable.com/security/tns-2026-15</a> <hr> <h3>Openwall: CVE-2026-47243: Kata Containers guest-root to host-root escape via virtiofs</h3> <p /> <A HREF="https://www.openwall.com/lists/oss-security/2026/05/21/14">https://www.openwall.com/lists/oss-security/2026/05/21/14</a>

CERT.at2026-05-22T19:02:00ZCERT.at2026-05-21T18:48:12Z2026-05-21T18:48:12Z

<h2>End-of-Day report</h2> Timeframe: Mittwoch 20-05-2026 18:00 - Donnerstag 21-05-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler <h2> News </h2> <h3>Hackers bypass SonicWall VPN MFA due to incomplete patching</h3> Threat actors brute-forced VPN credentials and bypassed multi-factor authentication (MFA) on SonicWall Gen6 SSL-VPN appliances to deploy tools used in ransomware attacks. [..] SonicWall warned in a security advisory for CVE-2024-12802 that installing the firmware update alone on Gen6 devices does not fully mitigate the vulnerability, and a manual reconfiguration of the LDAP server is required. Failing to do so leaves open the possibility of bypassing MFA protection. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/hackers-bypass-sonicwall-vpn-mfa-due-to-incomplete-patching/">https://www.bleepingcomputer.com/news/security/hackers-bypass-sonicwall-vpn-mfa-due-to-incomplete-patching/</a> <hr> <h3>A New SonicWall Scanning Spike Echoes the Pattern That Preceded CVE-2026-0400</h3> Between May 9 and May 18, 2026, GreyNoise observed a significant new spike in scanning of SonicWall SonicOS management interfaces. The May 12 peak - approximately 597,000 sessions - was the largest single-day total recorded on the SonicWall SonicOS API Scanner tag in the past 90 days, roughly 46× the typical daily volume for this tag in the 30 days before the elevation. <p /> <A HREF="https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400">https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400</a> <hr> <h3>Google publishes exploit code threatening millions of Chromium users</h3> Google on Wednesday published exploit code for an unfixed vulnerability in its Chromium browser codebase [..] The proof-of-concept code exploits the Browser Fetch programming interface, a standard that allows long videos and other large files to be downloaded in the background. An attacker can use the exploit to create a connection for monitoring some aspects of a user-s browser usage and as a proxy for viewing sites and launching denial-of-service attacks. [..] The unfixed vulnerability can be exploited by any website a user visits. [..] Users of Chromium browsers should be suspicious of download dropdowns that appear for no reason. <p /> <A HREF="https://arstechnica.com/security/2026/05/google-publishes-exploit-code-threatening-millions-of-chromium-users/">https://arstechnica.com/security/2026/05/google-publishes-exploit-code-threatening-millions-of-chromium-users/</a> <hr> <h3>Attackers spill plaintext passwords of 46k Myspace93 users after 2021 breach</h3> Users of the Myspace93 parody web art site be warned: the dataset spilled after a reported breach in 2021 included the plaintext usernames and passwords of more than 46,000 registered users. [..] In addition to the clear-as-day passwords and usernames, HIBP said email addresses and IP addresses were also among the exposed data. <p /> <A HREF="https://www.theregister.com/security/2026/05/21/46k-plaintext-passwords-pwned-in-myspace93-breach/5244024">https://www.theregister.com/security/2026/05/21/46k-plaintext-passwords-pwned-in-myspace93-breach/5244024</a> <hr> <h3>The npm Threat Landscape: Attack Surface and Mitigations (Updated May 20)</h3> Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more. <p /> <A HREF="https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/">https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/</a> <hr> <h3>Webworm: New burrowing techniques</h3> ESET researchers analyzed the 2025 activity of Webworm, a China-aligned APT group that started out targeting organizations in Asia, but has recently shifted its focus to Europe. <p /> <A HREF="https://www.welivesecurity.com/en/eset-research/webworm-new-burrowing-techniques/">https://www.welivesecurity.com/en/eset-research/webworm-new-burrowing-techniques/</a> <hr> <h3>Europe dismantles VPN service used by cybercriminals to hide ransomware attacks</h3> The international operation targeted a service known as First VPN, which had been marketed for years on Russian-speaking cybercrime forums as a secure way for criminals to evade law enforcement. <p /> <A HREF="https://therecord.media/europe-dismantles-first-vpn">https://therecord.media/europe-dismantles-first-vpn</a> <hr> <h3>Microsoft warnt vor Defender 0-Days und patcht</h3> Microsoft hat zum 19. Mai 2026 zwei 0-Day-Schwachstellen CVE-2026-41091 und CVE-2026-45498 im Defender durch Update der Defender Antimalware Platform geschlossen. Die Schwachstellen betrafen die Defender Antimalware Platform Version 4.18.26030.3011 und älter. <p /> <A HREF="https://borncity.com/blog/2026/05/21/microsoft-warnt-vor-defender-0-days-und-patcht/">https://borncity.com/blog/2026/05/21/microsoft-warnt-vor-defender-0-days-und-patcht/</a> <hr> <h3>Unpatchable Vulnerabilities of Kubernetes: CVE-2021-25740</h3> For this post, we're going to look at the last of the four unpatchable Kubernetes CVEs, CVE-2021-25740, which relates to how Kubernetes ingress or LoadBalancer features can be abused to bypass network security controls in a cluster. <p /> <A HREF="https://securitylabs.datadoghq.com/articles/unpatchable-kubernetes-vulnerabilities-cve-2021-25740/">https://securitylabs.datadoghq.com/articles/unpatchable-kubernetes-vulnerabilities-cve-2021-25740/</a> <h2> Vulnerabilities </h2> <h3>Sicherheitspatches Atlassian: Bamboo, Confluence & Co. sind verwundbar</h3> Angreifer können an mehreren Softwareschwachstellen unter anderem in Atlassian Bamboo Data Center and Server, Confluence Data Center and Server und Jira Data Center and Server ansetzen und betroffene Systeme im schlimmsten Fall vollständig kompromittieren. Sicherheitsupdates sind verfügbar. <p /> <A HREF="https://www.heise.de/news/Sicherheitspatches-Atlassian-Bamboo-Confluence-Co-sind-verwundbar-11301596.html">https://www.heise.de/news/Sicherheitspatches-Atlassian-Bamboo-Confluence-Co-sind-verwundbar-11301596.html</a> <hr> <h3>Grafikkartentreiber von Nvidia unter Linux und Windows angreifbar</h3> Nutzen Angreifer Schwachstellen im Grafikkartentreiber von Nvidia erfolgreich aus, können sie Dienste abstürzen lassen, unbefugt auf Informationen zugreifen oder sogar Schadcode ausführen. Dagegen stehen abgesicherte Versionen für Linux und Windows zum Download bereit. Weiterhin haben die Entwickler Lücken in der vGPU-Software geschlossen. <p /> <A HREF="https://www.heise.de/news/Grafikkartentreiber-von-Nvidia-unter-Linux-und-Windows-angreifbar-11301854.html">https://www.heise.de/news/Grafikkartentreiber-von-Nvidia-unter-Linux-und-Windows-angreifbar-11301854.html</a> <hr> <h3>Kritische Sicherheitslücke in Drupal Core - Updates verfügbar</h3> In Drupal Core existiert eine SQL-Injection-Schwachstelle in der Datenbank-Abstraktions-API. Speziell gestaltete Anfragen können zu beliebigen SQL-Injections führen. Die Schwachstelle ist ausschließlich für Drupal-Installationen relevant, die PostgreSQL als Datenbank einsetzen, und kann ohne Authentifizierung durch anonyme Benutzer:innen ausgenutzt werden. <p /> <A HREF="https://www.cert.at/de/warnungen/2026/5/kritische-sicherheitslucke-in-drupal-core-updates-verfugbar">https://www.cert.at/de/warnungen/2026/5/kritische-sicherheitslucke-in-drupal-core-updates-verfugbar</a> <hr> <h3>Cisco Secure Workload Unauthorized API Access Vulnerability</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-pnbsa-g8WEnuy">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-pnbsa-g8WEnuy</a> <hr> <h3>Splunk: SVD-2026-0515: Third-Party Package Updates in Splunk User Behavior Analytics - May 2026</h3> <p /> <A HREF="https://advisory.splunk.com//advisories/SVD-2026-0515">https://advisory.splunk.com//advisories/SVD-2026-0515</a> <hr> <h3>LWN: Security updates for Thursday</h3> <p /> <A HREF="https://lwn.net/Articles/1073860/">https://lwn.net/Articles/1073860/</a>

CERT.at2026-05-21T18:48:12ZCERT.at2026-05-20T19:14:43Z2026-05-20T19:14:43Z

<h2>End-of-Day report</h2> Timeframe: Dienstag 19-05-2026 18:00 - Mittwoch 20-05-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer <h2> News </h2> <h3>Datenklau: Hacker wollen 4.000 private Github-Repos geplündert haben</h3> Die Cybergang TeamPCP setzt Github unter Druck. Sie will an Daten aus Tausenden privaten Code-Repos gelangt sein und stellt diese nun zum Verkauf. <p /> <A HREF="https://www.golem.de/news/datenklau-hacker-wollen-4-000-private-github-repos-gepluendert-haben-2605-208851.html">https://www.golem.de/news/datenklau-hacker-wollen-4-000-private-github-repos-gepluendert-haben-2605-208851.html</a> <hr> <h3>Microsoft shares mitigation for YellowKey Windows zero-day</h3> Microsoft has shared mitigations for YellowKey, a recently disclosed Windows BitLocker zero-day vulnerability that grants access to protected drives. <p /> <A HREF="https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-mitigation-for-yellowkey-windows-zero-day/">https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-mitigation-for-yellowkey-windows-zero-day/</a> <hr> <h3>Stealer Spoofs Google, Microsoft & Apple, Then Backdoors macOS</h3> The SHub Reaper stealer, which hides behind fake WeChat and Miro installers, marks a shift from ClickFix social engineering to Apple script-based execution. <p /> <A HREF="https://www.darkreading.com/threat-intelligence/stealer-spoofs-google-microsoft-apple-backdoors-macos">https://www.darkreading.com/threat-intelligence/stealer-spoofs-google-microsoft-apple-backdoors-macos</a> <hr> <h3>How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102)</h3> We explain how a flaw in ExifTool allows attackers to compromise macOS systems via a malicious image (CVE-2026-3102). <p /> <A HREF="https://securelist.com/exiftool-compromise-mac/119866/">https://securelist.com/exiftool-compromise-mac/119866/</a> <hr> <h3>Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps</h3> Cybersecurity researchers have disclosed details of a new ad fraud and malvertising operation dubbed Trapdoor targeting Android device users.The activity, per HUMANs Satori Threat Intelligence and Research Team, encompassed 455 malicious Android apps and 183 threat actor-owned command-and-control (C2) domains, turning the infrastructure into a pipeline for multi-stage fraud. <p /> <A HREF="https://thehackernews.com/2026/05/trapdoor-android-ad-fraud-scheme-hit.html">https://thehackernews.com/2026/05/trapdoor-android-ad-fraud-scheme-hit.html</a> <hr> <h3>Microsoft shuts down illegal code-signing operation used by ransomware crims to mask their malware</h3> Thousands of US victims, including 12+ machines owned and operated by Redmond. <p /> <A HREF="https://www.theregister.com/security/2026/05/19/microsoft-disrupts-alleged-malware-signing-operation-used-by-ransomware-gangs/5243013">https://www.theregister.com/security/2026/05/19/microsoft-disrupts-alleged-malware-signing-operation-used-by-ransomware-gangs/5243013</a> <hr> <h3>Neue Phishing-Masche: Gutschrift nach "Fehler" von booking.com als Köder</h3> Kriminelle versenden via WhatsApp Nachrichten, in denen sie sich als Gästebetreuung eines Hotels ausgeben und eine Rückbuchung versprechen. Angeblich sei aufgrund eines technischen Fehlers bei booking.com ein falscher Betrag eingezogen worden. Besonders problematisch: Die Eckdaten stimmen mit einer echten Buchung überein! Wer der aufgebauten Falle folgt, liefert den Drahtziehern seine Logindaten fürs Onlinebanking. <p /> <A HREF="https://www.watchlist-internet.at/news/phishing-gutschrift-booking/">https://www.watchlist-internet.at/news/phishing-gutschrift-booking/</a> <hr> <h3>Tracking TamperedChef Clusters via Certificate and Code Reuse</h3> Unit 42 analyzes TamperedChef malware clusters that use trojanized productivity apps and malvertising to deliver stealthy payloads to targets. The post Tracking TamperedChef Clusters via Certificate and Code Reuse appeared first on Unit 42. <p /> <A HREF="https://unit42.paloaltonetworks.com/tracking-tampered-chef-clusters/">https://unit42.paloaltonetworks.com/tracking-tampered-chef-clusters/</a> <hr> <h3>Huawei zero-day attack behind last year-s crash of Luxembourgs entire telecoms network</h3> There is no evidence that the incident has recurred, but the flaw remains unexplained and has not been publicly acknowledged by the company. <p /> <A HREF="https://therecord.media/huawei-zero-day-behind-last-year-luxembourg-telecom-outage">https://therecord.media/huawei-zero-day-behind-last-year-luxembourg-telecom-outage</a> <hr> <h3>How OLTs may have exposed entire ISP networks</h3> This is the fifteenth article I have written over the past three years at Quarkslab, and without a doubt, it has been the most thrilling and fun to put together. The hidden world of ISP (Internet Service Provider) network security might sound complex, but what I am about to reveal could shake up how you see network defenses. In this post, I dive deep into how vulnerabilities in critical devices can lead to the complete takeover of service provider networks. <p /> <A HREF="http://blog.quarkslab.com/how-olts-may-have-exposed-entire-isp-networks.html">http://blog.quarkslab.com/how-olts-may-have-exposed-entire-isp-networks.html</a> <hr> <h3>durabletask: TeamPCPs Latest PyPi Compromise</h3> Discover the latest on malicious versions of the pypi package durabletask, matching TeamPCP tactics. <p /> <A HREF="https://www.wiz.io/blog/durabletask-teampcp-supply-chain-attack">https://www.wiz.io/blog/durabletask-teampcp-supply-chain-attack</a> <hr> <h3>Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor</h3> Sockets Threat Research Team identified a malicious Go module published as github.com/shopsprint/decimal, a typosquat of the widely used github.com/shopspring/decimal arbitrary precision arithmetic library. The typosquatted module has been present on the Go ecosystem since 2017-11-08 and was weaponized on 2023-08-19 when version v1.3.3 added a malicious init() function that opens a DNS TXT record command and control channel to a threat actor controlled subdomain on a free dynamic DNS provider. <p /> <A HREF="https://socket.dev/blog/popular-go-decimal-library-typosquat-dns-backdoor?utm_medium=feed">https://socket.dev/blog/popular-go-decimal-library-typosquat-dns-backdoor?utm_medium=feed</a> <h2> Vulnerabilities </h2> <h3>Max-severity flaw in ChromaDB for AI apps allows server hijacking</h3> A max-severity vulnerability in the latest Python FastAPI version of the ChromaDB project allows unauthenticated attackers to run arbitrary code on exposed servers. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/max-severity-flaw-in-chromadb-for-ai-apps-allows-server-hijacking/">https://www.bleepingcomputer.com/news/security/max-severity-flaw-in-chromadb-for-ai-apps-allows-server-hijacking/</a> <hr> <h3>Node.js: Vier kritische Sicherheitslücken mit Höchstwertung in vm2 geschlossen</h3> Angreifer können abermals aus der Node.js-Sandbox vm2 ausbrechen und Schadcode im Hostsystem ausführen. Sicherheitsupdates schaffen Abhilfe. <p /> <A HREF="https://www.heise.de/news/Node-js-Vier-kritische-Sicherheitsluecken-mit-Hoechstwertung-in-vm2-geschlossen-11300256.html">https://www.heise.de/news/Node-js-Vier-kritische-Sicherheitsluecken-mit-Hoechstwertung-in-vm2-geschlossen-11300256.html</a> <hr> <h3>Hunderte bösartige npm-Pakete im AntV-Ökosystem entdeckt</h3> In einer neuen Mini-Shai-Hulud-Lieferkettenattacke haben Bedrohungsakteure am 19. Mai mehr als 600 bösartige Versionen von npm-Paketen verbreitet. Hauptziel der Attacke war das Datenvisualisierungs-Ökosystem AntV. Die infizierten Versionen sind mittlerweile entfernt. <p /> <A HREF="https://heise.de/-11300242">https://heise.de/-11300242</a> <hr> <h3>LWN Security updates for Wednesday</h3> <p /> <A HREF="https://lwn.net/Articles/1073713/">https://lwn.net/Articles/1073713/</a> <hr> <h3>MISP 2.5.38 - UI and security update</h3> <p /> <A HREF="https://github.com/MISP/MISP/releases/tag/v2.5.38">https://github.com/MISP/MISP/releases/tag/v2.5.38</a>

CERT.at2026-05-20T19:14:43ZCERT.at2026-05-19T19:01:29Z2026-05-19T19:01:29Z

<h2>End-of-Day report</h2> Timeframe: Montag 18-05-2026 18:00 - Dienstag 19-05-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer <h2> News </h2> <h3>Vorankündigung: Kritische Sicherheitslücke in Drupal Core - Patch-Verfügbarkeit am 20. Mai 2026</h3> Drupal hat eine Vorankündigung (Pre-Announcement) zu einer als kritisch eingestuften Sicherheitslücke in Drupal Core veröffentlicht. Für alle unterstützten Versionszweige wird am 20. Mai 2026 zwischen 19:00 und 23:00 CEST eine Sicherheitsaktualisierung bereitgestellt. Zum Zeitpunkt dieser Vorankündigung sind noch keine Details zur Schwachstelle und kein Patch verfügbar. <p /> <A HREF="https://www.cert.at/de/aktuelles/2026/5/drupal-critical-preannounce">https://www.cert.at/de/aktuelles/2026/5/drupal-critical-preannounce</a> <hr> <h3>GitHub Actions Supply Chain Attack Redirects Tags to Steal CI/CD Credentials</h3> In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper, to run malicious code that harvests sensitive credentials and exfiltrates them to an attacker-controlled server. <p /> <A HREF="https://thehackernews.com/2026/05/github-actions-supply-chain-attack.html">https://thehackernews.com/2026/05/github-actions-supply-chain-attack.html</a> <hr> <h3>Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer</h3> Cybersecurity researchers have flagged a compromised version of the Nx Console extension that was published to the Microsoft Visual Studio Code (VS Code) Marketplace. The extension in question is rwl.angular-console (version 18.95.0), a popular user interface and plugin for code editors like VS Code, Cursor, and JetBrains. The VS Code extension has more than 2.2 million installations. <p /> <A HREF="https://thehackernews.com/2026/05/compromised-nx-console-18950-targeted.html">https://thehackernews.com/2026/05/compromised-nx-console-18950-targeted.html</a> <hr> <h3>DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability</h3> Proof-of-concept (PoC) exploit code has now been released for a recently patched security flaw in the Linux kernel that could allow for local privilege escalation (LPE). <p /> <A HREF="https://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html">https://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html</a> <hr> <h3>Cyberangriff Grafana: Erpresser kopieren Sourcecode und drohen mit Leak</h3> Grafana Labs ist Opfer einer Cyberattacke geworden. Dabei hatten Angreifer Zugriff auf die Codebasis von Grafana. Darunter fallen alle zu einem Projekt gehörenden Quelltext- und Konfigurationsdateien. Also offensichtlich mehr, als die Open-Source-Anwendung auf GitHub ohnehin öffentlich preisgibt. [..] Die Entwickler versichern, dass nach jetzigem Kenntnisstand keine Kundendaten oder persönliche Daten von Mitarbeitern von dem Vorfall betroffen sind. <p /> <A HREF="https://www.heise.de/news/Cyberattacke-Angreifer-kopieren-Sourcecode-von-Grafana-11298389.html">https://www.heise.de/news/Cyberattacke-Angreifer-kopieren-Sourcecode-von-Grafana-11298389.html</a> <hr> <h3>CISA Admin Leaked AWS GovCloud Keys on Github</h3> Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history. <p /> <A HREF="https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/">https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/</a> <hr> <h3>32-jähriger SMS-Betrüger in Wien festgenommen</h3> Ermittlern des Landeskriminalamts Wien ist ein Schlag gegen mutmaßliche Cyberkriminelle gelungen, die über sogenannte "SMS Blaster" millionenfach betrügerische Phishing-SMS versendet haben sollen. Seit dem 6. April sollen die Phishing-SMS insbesondere bei größeren Veranstaltungen verschickt worden sein. Am 14. Mai wurde ein Verdächtiger ausgeforscht und von Cobra-Beamten festgenommen. [..] Bei den eingesetzten Geräten handelt es sich um sogenannte "SMS Blaster". Das Gerät imitiert Mobilfunkzellen oder nutzt Mobilfunknetze automatisiert. Damit können tausende Nachrichten gleichzeitig an Mobiltelefone in der Umgebung gesendet werden. <p /> <A HREF="https://www.derstandard.at/story/3000000321362/32-jaehriger-sms-betrueger-in-wien-festgenommen">https://www.derstandard.at/story/3000000321362/32-jaehriger-sms-betrueger-in-wien-festgenommen</a> <hr> <h3>Microsoft Details Storm-2949 Cloud Attack on Azure and Microsoft 365</h3> Microsoft Threat Intelligence has disclosed details of a cyberattack carried out by a threat actor tracked as Storm-2949, which escalated from a targeted identity compromise into a large-scale breach of cloud infrastructure and sensitive enterprise systems. The campaign focused heavily on data theft from Microsoft 365 services, Azure-hosted production environments, and cloud storage resources, demonstrating how compromised identities can become gateways to an organization-s entire cloud ecosystem. <p /> <A HREF="https://thecyberexpress.com/microsoft-storm-2949-azure-m365-cloud-breach/">https://thecyberexpress.com/microsoft-storm-2949-azure-m365-cloud-breach/</a> <hr> <h3>When Filenames Become Attack Surfaces: Weaponizing NASAs CFITSIO Extended Filename Syntax</h3> This research was recently presented at BSides Luxembourg 2026. This blogpost documents our findings presented during the talk. [..] We-ll focus on perfectly documented features, useful during file processing, but chained together to achieve some unexpected offensive primitives. <p /> <A HREF="https://blog.doyensec.com/2026/05/19/cfitsio-weaponized-filenames.html">https://blog.doyensec.com/2026/05/19/cfitsio-weaponized-filenames.html</a> <h2> Vulnerabilities </h2> <h3>SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access</h3> Critical security vulnerabilities have been disclosed in SEPPMail Secure E-Mail Gateway, an enterprise-grade email security solution, that could be exploited to achieve remote code execution and enable an attacker to read arbitrary mails from the virtual appliance. [..] One significant hurdle that an attacker must overcome to achieve remote code execution is that syslogd re-reads the configuration only upon receiving the SIGHUP (aka "signal hang up") signal. <p /> <A HREF="https://thehackernews.com/2026/05/seppmail-secure-e-mail-gateway.html">https://thehackernews.com/2026/05/seppmail-secure-e-mail-gateway.html</a> <hr> <h3>Linux kernel flaw opens root-only files to unprivileged users</h3> Despite its official designation, a demo exploit on GitHub calls it ssh-keysign-pwn. It is not quite as catchy a name as Copy Fail, or Dirty Frag, or indeed Fragnesia, but we feel it is safe to say it hasn't been a good month. [..] The good news is that it's already been fixed [..] This time, the culprit is CVE-2026-46333, a local kernel vulnerability that lets an unprivileged user read files they should not be able to access, including those normally available only to root. An attacker who already has login access to an affected machine could therefore potentially grab SSH keys, password files, or other confidential credentials. <p /> <A HREF="https://www.theregister.com/security/2026/05/18/linux-kernel-flaw-opens-root-only-files-to-unprivileged-users/5241950">https://www.theregister.com/security/2026/05/18/linux-kernel-flaw-opens-root-only-files-to-unprivileged-users/5241950</a> <hr> <h3>TYPO3 Security Advisories 19.05.2026</h3> TYPO3 has release security advisories for ceselector, tt_address, ke_search, news, crawler and sf_register. <p /> <A HREF="https://typo3.org/security">https://typo3.org/security</a> <hr> <h3>Mozilla Foundation Security Advisories for Firefox 19.05.2026</h3> <p /> <A HREF="https://www.mozilla.org/en-US/security/advisories/">https://www.mozilla.org/en-US/security/advisories/</a> <hr> <h3>LWN: Security updates for Tuesday</h3> <p /> <A HREF="https://lwn.net/Articles/1073542/">https://lwn.net/Articles/1073542/</a> <hr> <h3>DFIR-IRIS advisories</h3> <p /> <A HREF="https://github.com/sbaresearch/advisories/commit/3b38de4446b06c28191ae872bb51bae12360b7ae">https://github.com/sbaresearch/advisories/commit/3b38de4446b06c28191ae872bb51bae12360b7ae</a>

CERT.at2026-05-19T19:01:29ZCERT.at2026-05-18T19:00:25Z2026-05-18T19:00:25Z

<h2>End-of-Day report</h2> Timeframe: Freitag 15-05-2026 18:00 - Montag 18-05-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler <h2> News </h2> <h3>Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing</h3> The Tycoon2FA phishing kit now supports device-code phishing attacks and abuses Trustifi click-tracking URLs to hijack Microsoft 365 accounts. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/tycoon2fa-hijacks-microsoft-365-accounts-via-device-code-phishing/">https://www.bleepingcomputer.com/news/security/tycoon2fa-hijacks-microsoft-365-accounts-via-device-code-phishing/</a> <hr> <h3>Recent Kernel exploits, attack surface reduction, example IPSEC</h3> Multiple of the recent kernel exploits have affected the "esp" Linux Kernel module. ESP is, as far as I understand, part of IPSEC, and I think it's fair to say that IPSEC is not widely used these days. <p /> <A HREF="https://www.openwall.com/lists/oss-security/2026/05/16/3">https://www.openwall.com/lists/oss-security/2026/05/16/3</a> <hr> <h3>NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE</h3> A newly disclosed security flaw impacting NGINX Plus and NGINX Open has come under active exploitation in the wild, days after its public disclosure, according to VulnCheck. The vulnerability, tracked as CVE-2026-42945 (CVSS score: 9.2), is a heap buffer overflow in ngx_http_rewrite_module affecting NGINX versions 0.6.27 through 1.30.0. According to AI-native security company depthfirst, the vulnerability was introduced in 2008. <p /> <A HREF="https://thehackernews.com/2026/05/nginx-cve-2026-42945-exploited-in-wild.html">https://thehackernews.com/2026/05/nginx-cve-2026-42945-exploited-in-wild.html</a> <hr> <h3>Microsoft Edge: Keine Klartext-Passwörter mehr im Browserprozess</h3> Microsofts Edge hatte alle Passwörter aus dem Passwort-Manager beim Start geladen und im Klartext vorgehalten. Jetzt aber nicht mehr. <p /> <A HREF="https://www.heise.de/news/Microsoft-Edge-Keine-Klartext-Passwoerter-mehr-im-Browserprozess-11296765.html">https://www.heise.de/news/Microsoft-Edge-Keine-Klartext-Passwoerter-mehr-im-Browserprozess-11296765.html</a> <hr> <h3>Microsoft rejects critical Azure vulnerability report, no CVE issued</h3> A security researcher claims Microsoft quietly fixed an Azure Backup for AKS vulnerability after rejecting his report, and without issuing a CVE. Microsoft disputes the claim, telling BleepingComputer the behavior was expected and that "no product changes were made," despite the researcher documenting a silent fix. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/microsoft-rejects-critical-azure-vulnerability-report-no-cve-issued/">https://www.bleepingcomputer.com/news/security/microsoft-rejects-critical-azure-vulnerability-report-no-cve-issued/</a> <hr> <h3>Fake-Mail: Angebliche PayPal-Zahlung führt in Phishing-Falle</h3> Derzeit sind betrügerische E-Mails im Umlauf, die angeblich von PayPal stammen und eine hohe Zahlung melden. Wer erschrickt und unüberlegt klickt, landet auf einer Fake-Website! <p /> <A HREF="https://www.watchlist-internet.at/news/angebliche-paypal-zahlung-klicks/">https://www.watchlist-internet.at/news/angebliche-paypal-zahlung-klicks/</a> <hr> <h3>Hackers Use PyInstaller and AMSI Patching to Deliver XWorm RAT v7.4</h3> Hackers are hiding XWorm malware in PyInstaller files to bypass Windows security, steal data and remotely control devices through ads. <p /> <A HREF="https://hackread.com/hackers-pyinstaller-amsi-patching-xworm-rat-v7-4/">https://hackread.com/hackers-pyinstaller-amsi-patching-xworm-rat-v7-4/</a> <hr> <h3>Welcome to BlackFile: Inside a Vishing Extortion Operation</h3> Google Threat Intelligence Group (GTIG) has continued to track an expansive extortion campaign by UNC6671, a threat actor operating under the "BlackFile" brand, that targets organizations via sophisticated voice phishing (vishing) and single sign-on (SSO) compromise. <p /> <A HREF="https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation/">https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation/</a> <h2> Vulnerabilities </h2> <h3>Forscher eskaliert: Gefährlicher Zero-Day-Exploit für Windows geleakt</h3> Der Miniplasma genannte Exploit nutzt eine Windows-Lücke aus, die eigentlich schon seit 2020 gepatcht sein sollte. Das ist offenkundig nicht der Fall. [..] Der unter dem Namen Chaotic Eclipse bekannte Sicherheitsforscher, der zuletzt mehrere ungepatchte Lücken in Windows aufgedeckt hatte, hat dafür einen neuen Exploit veröffentlicht. Angreifer sollen damit unter Windows Systemrechte erlangen können. [..] Chaotic Eclipse hat ihn nach eigenen Angaben unter Windows 11 und Windows Server 2025 getestet. In beiden Fällen soll er trotz aktuellen Patch-Standes funktionieren und eine Shell mit Systemrechten starten. Der Forscher geht davon aus, dass alle Windows-Versionen betroffen sind. <p /> <A HREF="https://www.golem.de/news/forscher-eskaliert-gefaehrlicher-zero-day-exploit-fuer-windows-geleakt-2605-208755.html">https://www.golem.de/news/forscher-eskaliert-gefaehrlicher-zero-day-exploit-fuer-windows-geleakt-2605-208755.html</a> <hr> <h3>Microsoft Exchange: Zero-Day-Lücke wird angegriffen</h3> In der Schwachstellenbeschreibung erklärt Microsoft, dass es sich um unzureichende Filterung von Eingaben bei der Generierung von Webseiten handelt, eine Cross-Site-Scripting-Lücke. Dadurch können nicht authentifizierte Angreifer aus dem Netz Spoofing-Angriffe ausführen (CVE-2026-42897, CVSS 8.1, Risiko -hoch-). Den Schweregrad stuft Microsoft jedoch als -kritisch- ein. Ein Blog-Beitrag von Microsofts Exchange-Team erklärt das sowie die Gegenmaßnahmen etwas ausführlicher. <p /> <A HREF="https://www.heise.de/news/Microsoft-Exchange-Zero-Day-Luecke-wird-angegriffen-11295799.html">https://www.heise.de/news/Microsoft-Exchange-Zero-Day-Luecke-wird-angegriffen-11295799.html</a> <hr> <h3>Microsoft Authenticator: Kritische Sicherheitslücke ermöglicht Token-Diebstahl</h3> Microsoft warnt vor einer Sicherheitslücke im Authenticator. Angreifer können Sign-in-Token abgreifen und damit Zugriff erlangen. [..] Zum Missbrauch der Lücke müssen Angreifer ein Opfer dazu bringen, mit einer legitim erscheinenden, bösartigen Anfrage zu interagieren. [..] Aktualisierte Versionen des Authenticators von Microsoft stehen in den jeweiligen App-Stores bereit. <p /> <A HREF="https://www.heise.de/news/Microsoft-Authenticator-Kritische-Sicherheitsluecke-ermoeglicht-Token-Diebstahl-11296717.html">https://www.heise.de/news/Microsoft-Authenticator-Kritische-Sicherheitsluecke-ermoeglicht-Token-Diebstahl-11296717.html</a> <hr> <h3>PostgreSQL: Updates stopfen hochriskante Sicherheitslecks</h3> Die Entwickler von PostgreSQL schreiben in einer Versionsankündigung, dass die neu verfügbaren Fassungen 18.4, 17.10, 16.14, 15.18 und 14.23 insgesamt elf Schwachstellen ausbessern. <p /> <A HREF="https://www.heise.de/news/PostgreSQL-Updates-stopfen-hochriskante-Sicherheitslecks-11297485.html">https://www.heise.de/news/PostgreSQL-Updates-stopfen-hochriskante-Sicherheitslecks-11297485.html</a> <hr> <h3>LWN: Security updates for Monday</h3> <p /> <A HREF="https://lwn.net/Articles/1073356/">https://lwn.net/Articles/1073356/</a>

CERT.at2026-05-18T19:00:25ZCERT.at2026-05-15T18:24:10Z2026-05-15T18:24:10Z

<h2>End-of-Day report</h2> Timeframe: Mittwoch 13-05-2026 18:00 - Freitag 15-05-2026 18:00 Handler: Guenes Holler Co-Handler: n/a <h2> News </h2> <h3>West Pharmaceutical says hackers stole data, encrypted systems</h3> West Pharmaceutical Services disclosed that it was the target of a cyberattack that resulted in data exfiltration and system encryption. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/west-pharmaceutical-says-hackers-stole-data-encrypted-systems/">https://www.bleepingcomputer.com/news/security/west-pharmaceutical-says-hackers-stole-data-encrypted-systems/</a> <hr> <h3>KongTuke hackers now use Microsoft Teams for corporate breaches</h3> Initial access broker KongTuke has moved to Microsoft Teams for social engineering attacks, taking as little as five minutes to gain persistent access to corporate networks. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/kongtuke-hackers-now-use-microsoft-teams-for-corporate-breaches/">https://www.bleepingcomputer.com/news/security/kongtuke-hackers-now-use-microsoft-teams-for-corporate-breaches/</a> <hr> <h3>Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution</h3> Stolen browser sessions and authentication tokens are becoming more valuable than stolen passwords. Flare explains how the REMUS infostealer evolved around session theft and operational scalability. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/inside-the-remus-infostealer-session-theft-maas-and-rapid-evolution/">https://www.bleepingcomputer.com/news/security/inside-the-remus-infostealer-session-theft-maas-and-rapid-evolution/</a> <hr> <h3>SOHO router attack by APT28</h3> Few weeks ago, one particular large scale cyber-attack hit the mainstream news everywhere. Russian cyber actor APT28 attacked SOHO routers and managed to compromise some credentials through that. The attack itself was carried in multiple phases and was quite interesting. <p /> <A HREF="https://en.blog.nic.cz/2026/05/14/soho-router-attack-by-apt28/">https://en.blog.nic.cz/2026/05/14/soho-router-attack-by-apt28/</a> <hr> <h3>Kimsuky targets organizations with PebbleDash-based tools</h3> Kaspersky researchers analyze a range of new PebbleDash-based tools used in recent Kimsuky campaigns and reveal their connection to the AppleSeed malware cluster. <p /> <A HREF="https://securelist.com/kimsuky-appleseed-pebbledash-campaigns/119785/">https://securelist.com/kimsuky-appleseed-pebbledash-campaigns/119785/</a> <hr> <h3>How AI Hallucinations Are Creating Real Security Risks</h3> AI hallucinations are introducing serious security risks into critical infrastructure decision-making by exploiting human trust through highly confident yet incorrect outputs. <p /> <A HREF="https://thehackernews.com/2026/05/how-ai-hallucinations-are-creating-real.html">https://thehackernews.com/2026/05/how-ai-hallucinations-are-creating-real.html</a> <hr> <h3>PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours of Disclosure</h3> Threat actors have been observed attempting to exploit a recently disclosed security vulnerability in PraisonAI, an open-source multi-agent orchestration framework, within four hours of its public disclosure. <p /> <A HREF="https://thehackernews.com/2026/05/praisonai-cve-2026-44338-auth-bypass.html">https://thehackernews.com/2026/05/praisonai-cve-2026-44338-auth-bypass.html</a> <hr> <h3>FrostyNeighbor: Fresh mischief and digital shenanigans</h3> ESET researchers uncovered new activities attributed to FrostyNeighbor, updating its compromise chain to support the group-s continual cyberespionage operations. <p /> <A HREF="https://www.welivesecurity.com/en/eset-research/frostyneighbor-fresh-mischief-digital-shenanigans/">https://www.welivesecurity.com/en/eset-research/frostyneighbor-fresh-mischief-digital-shenanigans/</a> <hr> <h3>Device Code Phishing via Fake File-Sharing Invitation</h3> Truesec has observed a phishing attempt where a customer received an email claiming that a sender wanted to share a document. The message prompted the recipient to click -Open-, which redirected the user to a website designed to appear legitimate. <p /> <A HREF="https://www.truesec.com/hub/blog/device-code-phishing-via-fake-file-sharing-invitation">https://www.truesec.com/hub/blog/device-code-phishing-via-fake-file-sharing-invitation</a> <hr> <h3>China-Linked Twill Typhoon Uses Fake Apple and Yahoo Sites for Espionage</h3> A new Darktrace report reveals how Chinese hackers use fake Apple and Yahoo sites and the FDMTP malware framework to spy on organisations. <p /> <A HREF="https://hackread.com/chinatwill-typhoon-fake-apple-yahoo-sites-espionage/">https://hackread.com/chinatwill-typhoon-fake-apple-yahoo-sites-espionage/</a> <hr> <h3>FamousSparrow Targeted Oil and Gas Industry via MS Exchange Server Exploit</h3> Bitdefender Labs reveals how the China-linked FamousSparrow hacking group targeted an Azerbaijani energy firm using ProxyNotShell, Deed RAT, and Terndoor malware across three persistent waves. <p /> <A HREF="https://hackread.com/famoussparrow-oil-gas-ms-exchange-server-exploit/">https://hackread.com/famoussparrow-oil-gas-ms-exchange-server-exploit/</a> <hr> <h3>CalPhishing Scam Uses EvilTokens Kit, Outlook Invites to Steal M365 Sessions</h3> Hackers are exploiting Outlook calendar invites and device code phishing to steal M365 session tokens, bypass MFA and breach enterprise accounts. <p /> <A HREF="https://hackread.com/calphishing-eviltokens-kit-outlook-invites-m365/">https://hackread.com/calphishing-eviltokens-kit-outlook-invites-m365/</a> <hr> <h3>Anatomy of a WooCommerce Skimmer: A Technical Deep-Dive</h3> One malicious change to a trusted JavaScript file can turn your checkout page into a silent credit-card skimmer, siphoning customer data off to criminals while the website looks secure and continues to work as normal. That creates serious organisational risk: PCI exposure, regulatory consequences, reputational damage, and a breach that remains invisible until long after the damage is done. <p /> <A HREF="https://scotthelme.ghost.io/anatomy-of-a-woocommerce-skimmer-a-technical-deep-dive/">https://scotthelme.ghost.io/anatomy-of-a-woocommerce-skimmer-a-technical-deep-dive/</a> <hr> <h3>Backdoored Cemu release linked to TanStack and Mistral supply chain campaign</h3> We investigate how a coordinated supply chain campaign that compromised npm and PyPI packages also backdoored the official Cemu Nintendo Wii U emulator GitHub release, reaching nearly 20,000 Linux users. <p /> <A HREF="https://securitylabs.datadoghq.com/articles/backdoored-cemu-release-teampcp-supply-chain-campaign/">https://securitylabs.datadoghq.com/articles/backdoored-cemu-release-teampcp-supply-chain-campaign/</a> <hr> <h3>Backdoored node-ipc npm releases steal developer credentials through DNS queries</h3> An analysis of backdoored node-ipc npm releases that add an obfuscated credential collection and DNS exfiltration payload to the CommonJS entrypoint. <p /> <A HREF="https://securitylabs.datadoghq.com/articles/node-ipc-npm-malware-analysis/">https://securitylabs.datadoghq.com/articles/node-ipc-npm-malware-analysis/</a> <hr> <h3>New critical Exim mailer flaw allows remote code execution</h3> A critical vulnerability affecting certain configurations of the Exim open-source mail transfer agent could be exploited by an unauthenticated remote attacker to execute arbitrary code. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/new-critical-exim-mailer-flaw-allows-remote-code-execution/">https://www.bleepingcomputer.com/news/security/new-critical-exim-mailer-flaw-allows-remote-code-execution/</a> <hr> <h2> Vulnerabilities </h2> <h3>Fragnesia: Schon wieder gefährliche Root-Lücke im Linux-Kernel</h3> Dirty Frag und Copy Fail beschäftigen bereits unzählige Linux-Admins. Die nächste Root-Lücke ist bereits identifiziert - und die Patches sind spät dran. <p /> <A HREF="https://www.golem.de/news/fragnesia-schon-wieder-gefaehrliche-root-luecke-im-linux-kernel-2605-208702.html">https://www.golem.de/news/fragnesia-schon-wieder-gefaehrliche-root-luecke-im-linux-kernel-2605-208702.html</a> <hr> <h3>Webserver gefährdet: 18 Jahre alte Sicherheitslücke in Nginx entdeckt</h3> Nginx-Webserver sollen sich durch eine seit 2008 präsente Lücke zum Absturz bringen lassen. Manchmal ist wohl auch eine Schadcodeausführung möglich. <p /> <A HREF="https://www.golem.de/news/webserver-gefaehrdet-18-jahre-alte-sicherheitsluecke-in-nginx-entdeckt-2605-208713.html">https://www.golem.de/news/webserver-gefaehrdet-18-jahre-alte-sicherheitsluecke-in-nginx-entdeckt-2605-208713.html</a> <hr> <h3>Update stopft 79 Sicherheitslücken in Google Chrome</h3> Das wöchentliche Chrome-Update schließt insgesamt 79 Sicherheitslücken. Davon gelten 14 als kritisch. <p /> <A HREF="https://www.heise.de/news/Update-stopft-79-Sicherheitsluecken-in-Google-Chrome-11294547.html">https://www.heise.de/news/Update-stopft-79-Sicherheitsluecken-in-Google-Chrome-11294547.html</a> <hr> <h3>Jetzt patchen! Angreifer attackieren Cisco Catalyst SD-WAN Controller</h3> Angreifer nutzen derzeit eine kritische Sicherheitslücke in Cisco Catalyst SD-WAN Controller aus. Sicherheitsupdates sind verfügbar. <p /> <A HREF="https://heise.de/-11294491">https://heise.de/-11294491</a> <hr> <h3>Ivanti EPM: Sicherheitslücken ermöglichen SQL-Iinjection und Rechteausweitung</h3> Ivanti warnt vor drei Sicherheitslücken im Endpoint Manager (EPM). Sie ermöglichen SQL-Injection oder Rechteausweitung. <p /> <A HREF="https://heise.de/-11294605">https://heise.de/-11294605</a> <hr> <h3>VMware Fusion: Angreifer können sich root-Rechte verschaffen</h3> Nutzen Angreifer eine Schwachstelle in VMware Fusion erfolgreich aus, können sie sich unter bestimmten Bedingungen Root-Nutzerrechte verschaffen. Nun haben die Entwickler die Lücke geschlossen. <p /> <A HREF="https://heise.de/-11294685">https://heise.de/-11294685</a> <hr> <h3>F5 BIG-IP: Quartalssicherheitsupdate schließt zahlreiche Lücken</h3> Der Netzwerkausrüster F5 hat unter anderem für verschiedene BIG-IP-Produkte wichtige Sicherheitsupdates veröffentlicht. <p /> <A HREF="https://heise.de/-11294929">https://heise.de/-11294929</a> <hr> <h3>Zero-Click-Lücke in Outlook: Angreifer können Systeme per E-Mail kompromittieren</h3> Das bloße Senden einer E-Mail reicht aus, um über Microsoft Outlook Schadcode zur Ausführung zu bringen. Ein Klick auf einen Link ist nicht nötig. <p /> <A HREF="https://www.golem.de/news/zero-click-luecke-in-outlook-angreifer-koennen-systeme-per-e-mail-kompromittieren-2605-208693.html">https://www.golem.de/news/zero-click-luecke-in-outlook-angreifer-koennen-systeme-per-e-mail-kompromittieren-2605-208693.html</a> <hr> <h3>Mdash: Microsofts KI findet vier kritische Lücken in Windows</h3> Microsofts Projekt MDash soll beim Finden von Sicherheitslücken sogar noch besser sein als Anthropics Claude Mythos. <p /> <A HREF="https://www.golem.de/news/mdash-microsofts-ki-findet-vier-kritische-luecken-in-windows-2605-208701.html">https://www.golem.de/news/mdash-microsofts-ki-findet-vier-kritische-luecken-in-windows-2605-208701.html</a> <hr><h3>telnetd 2.7 Buffer Overflow</h3> <p /> <A HREF="https://cxsecurity.com/issue/WLB-2026050010">https://cxsecurity.com/issue/WLB-2026050010</a> <hr> <h3>WPS Office improper access restriction to its named pipe</h3> <p /> <A HREF="https://jvn.jp/en/jp/JVN14434132/">https://jvn.jp/en/jp/JVN14434132/</a> <hr> <h3>Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW</a> <hr> <h3>Cisco Catalyst SD-WAN Manager Vulnerabilities</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R</a> <hr> <h3>Cisco Crosswork Network Controller and Cisco Network Services Orchestrator Advisory</h3> <p /> <A HREF="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-dos-7Egqyc">https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-dos-7Egqyc</a> <hr> <h3>[R1] Tenable Network Monitor 6.5.4 Fixes Multiple Vulnerabilities</h3> <p /> <A HREF="https://www.tenable.com/security/tns-2026-14">https://www.tenable.com/security/tns-2026-14</a> <hr> <h3>LWN Security updates for Thursday</h3> <p /> <A HREF="https://lwn.net/Articles/1072838/">https://lwn.net/Articles/1072838/</a> <hr> <h3>LWN Security updates for Friday</h3> <p /> <A HREF="https://lwn.net/Articles/1073059/">https://lwn.net/Articles/1073059/</a>

CERT.at2026-05-15T18:24:10ZCERT.at2026-05-13T18:20:23Z2026-05-13T18:20:23Z

<h2>End-of-Day report</h2> Timeframe: Dienstag 12-05-2026 18:00 - Mittwoch 13-05-2026 18:00 Handler: Guenes Holler Co-Handler: n/a <h2> News </h2> <h3>Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation</h3> A threat actor with affiliations to China has been linked to a "multi-wave intrusion" targeting an unnamed Azerbaijani oil and gas company between late December 2025 and late February 2026, marking an expansion of its targeting. <p /> <A HREF="https://thehackernews.com/2026/05/azerbaijani-energy-firm-hit-by-repeated.html">https://thehackernews.com/2026/05/azerbaijani-energy-firm-hit-by-repeated.html</a> <hr> <h3>Angriff umgeht BitLocker mittels Windows Recovery Environment</h3> BitLocker soll vertrauliche Daten auch vor physischen Angriffen schützen. Die Windows Recovery Environment hebelt den Schutz aus. <p /> <A HREF="https://www.heise.de/news/Angriff-umgeht-BitLocker-mittels-Windows-Recovery-Environment-11292642.html">https://www.heise.de/news/Angriff-umgeht-BitLocker-mittels-Windows-Recovery-Environment-11292642.html</a> <hr> <h3>Datenpanne bei Best Western Hotels: Hacker konnten monatelang Buchungsdaten abgreifen</h3> Angreifer konnten sich wohl rund ein halbes Jahr lang ungestört im System von Best Western Hotels umsehen und Daten der Hotelgäste ausleiten. <p /> <A HREF="https://www.golem.de/news/best-western-hotels-hacker-konnten-monatelang-auf-buchungsdaten-zugreifen-2605-208637.html">https://www.golem.de/news/best-western-hotels-hacker-konnten-monatelang-auf-buchungsdaten-zugreifen-2605-208637.html</a> <hr> <h3>RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded</h3> RubyGems, the standard package manager for the Ruby programming language, has temporarily paused account sign ups following what has been described as a "major malicious attack." <p /> <A HREF="https://thehackernews.com/2026/05/rubygems-suspends-new-signups-after.html">https://thehackernews.com/2026/05/rubygems-suspends-new-signups-after.html</a> <hr> <h3>Thus Spoke-The Gentlemen</h3> The Gentlemen ransomware-as-a-service (RaaS) operation is a relatively new group that emerged around mid-2025. Its operators advertise the service across multiple underground forums, promoting their ransomware platform and inviting penetration testers and other technically skilled actors to join as affiliates. <p /> <A HREF="https://research.checkpoint.com/2026/thus-spoke-the-gentlemen/">https://research.checkpoint.com/2026/thus-spoke-the-gentlemen/</a> <hr> <h3>Claude Code RCE: Exploiting Deeplink Handlers via Settings Injection</h3> Of course I took a peek at the Claude Code source. <p /> <A HREF="https://0day.click/recipe/2026-05-12-cc-rce/">https://0day.click/recipe/2026-05-12-cc-rce/</a> <hr> <h2> Vulnerabilities </h2> <h3>Patchday Microsoft: Kritische DNS-Client-Lücke bedroht Windows</h3> Microsoft hat wichtige Sicherheitsupdates für unter anderem Azure, Edge, Office und Windows veröffentlicht. Viele Lücken wurden mit KI-Agenten entdeckt. <p /> <A HREF="https://www.heise.de/news/Patchday-Microsoft-Kritische-DNS-Client-Luecke-bedroht-Windows-11292506.html">https://www.heise.de/news/Patchday-Microsoft-Kritische-DNS-Client-Luecke-bedroht-Windows-11292506.html</a> <hr> <h3>Patchday: Adobe schließt mehr als 50 Lücken in After Effects & Co.</h3> Wichtige Sicherheitsupdates reparieren diverse Adobe-Anwendungen. Bislang gibt es keine Berichte zu laufenden Attacken. <p /> <A HREF="https://heise.de/-11292536">https://heise.de/-11292536</a> <hr> <h3>Fortinet stopft elf Sicherheitslücken in mehreren Produkten</h3> Fortinet hat zum -Patch-Dienstag- elf Sicherheitsflicken konzertiert veröffentlicht. Zwei der Lecks gelten als kritisch. <p /> <A HREF="https://heise.de/-11292861">https://heise.de/-11292861</a> <hr> <h3>1,000,000 WordPress Sites Affected by Arbitrary File Read and SQL Injection Vulnerabilities in Avada Builder WordPress Plugin</h3> On March 21st, 2026, we received a submission for an Arbitrary File Read and an SQL Injection vulnerability in Avada Builder, a WordPress plugin with an estimated 1,000,000 active installations.The post 1,000,000 WordPress Sites Affected by Arbitrary File Read and SQL Injection Vulnerabilities in Avada Builder WordPress Plugin appeared first on Wordfence. <p /> <A HREF="https://www.wordfence.com/blog/2026/05/1000000-wordpress-sites-affected-by-arbitrary-file-read-and-sql-injection-vulnerabilities-in-avada-builder-wordpress-plugin/">https://www.wordfence.com/blog/2026/05/1000000-wordpress-sites-affected-by-arbitrary-file-read-and-sql-injection-vulnerabilities-in-avada-builder-wordpress-plugin/</a> <hr> <h3>New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution</h3> Exim has released security updates to address a severe security issue affecting certain configurations that could enable memory corruption and potential code execution. <p /> <A HREF="https://thehackernews.com/2026/05/new-exim-bdat-vulnerability-exposes.html">https://thehackernews.com/2026/05/new-exim-bdat-vulnerability-exposes.html</a> <hr> <h3>LWN Security updates for Wednesday</h3> <p /> <A HREF="https://lwn.net/Articles/1072596/">https://lwn.net/Articles/1072596/</a> <hr> <h3>NCSC-2026-0147 [1.00] [M/H] Kwetsbaarheden verholpen in Siemens-producten</h3> <p /> <A HREF="https://advisories.ncsc.nl/advisory?id=NCSC-2026-0147">https://advisories.ncsc.nl/advisory?id=NCSC-2026-0147</a> <hr> <h3>FortiGuard Labs: Improper access control on API endpoints</h3> <p /> <A HREF="https://fortiguard.fortinet.com/psirt/FG-IR-26-128">https://fortiguard.fortinet.com/psirt/FG-IR-26-128</a> <hr> <h3>FortiGuard Labs: Incorrect global authorization</h3> <p /> <A HREF="https://fortiguard.fortinet.com/psirt/FG-IR-26-136">https://fortiguard.fortinet.com/psirt/FG-IR-26-136</a> <hr> <h3>FortiGuard Labs: Out-of-bounds access in CAPWAP daemon</h3> <p /> <A HREF="https://fortiguard.fortinet.com/psirt/FG-IR-26-123">https://fortiguard.fortinet.com/psirt/FG-IR-26-123</a>

CERT.at2026-05-13T18:20:23ZCERT.at2026-05-12T19:24:28Z2026-05-12T19:24:28Z

<h2>End-of-Day report</h2> Timeframe: Montag 11-05-2026 18:00 - Dienstag 12-05-2026 18:00 Handler: Felician Fuchs Co-Handler: Guenes Holler <h2> News </h2> <h3>New GhostLock tool abuses Windows API to block file access</h3> A security researcher has released a proof-of-concept tool named GhostLock that demonstrates how a legitimate Windows file API can be abused in attacks to block access to files stored locally or on SMB network shares. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/new-ghostlock-tool-abuses-windows-api-to-block-file-access/">https://www.bleepingcomputer.com/news/security/new-ghostlock-tool-abuses-windows-api-to-block-file-access/</a> <hr> <h3>Cyberangriff trifft Fahrzeughersteller: Kundendaten von Skoda kompromittiert</h3> Ein unbekannter Angreifer hat ein von Skoda genutztes Shopsystem infiltriert und konnte auf Kundendaten zugreifen. Auch Zugangsdaten sind betroffen. <p /> <A HREF="https://www.golem.de/news/cyberangriff-trifft-fahrzeughersteller-kundendaten-von-skoda-kompromittiert-2605-208556.html">https://www.golem.de/news/cyberangriff-trifft-fahrzeughersteller-kundendaten-von-skoda-kompromittiert-2605-208556.html</a> <hr> <h3>Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation</h3> Google on Monday disclosed that it identified an unknown threat actor using a zero-day exploit that it said was likely developed with an artificial intelligence (AI) system, marking the first time the technology has been put to use in the wild in a malicious context for vulnerability discovery and exploit generation. <p /> <A HREF="https://thehackernews.com/2026/05/hackers-used-ai-to-develop-first-known.html">https://thehackernews.com/2026/05/hackers-used-ai-to-develop-first-known.html</a> <hr> <h3>cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor</h3> A threat actor named Mr_Rot13 has been attributed to the exploitation of a recently disclosed critical cPanel flaw to deploy a backdoor codenamed Filemanager on compromised environments. <p /> <A HREF="https://thehackernews.com/2026/05/cpanel-cve-2026-41940-under-active.html">https://thehackernews.com/2026/05/cpanel-cve-2026-41940-under-active.html</a> <hr> <h3>Prüfportal für Gutscheinkarten? Wie ein kurzer Check das Guthaben absaugt</h3> Wer im Zuge eines Online-Privatverkaufs dazu gedrängt wird, für die Zahlung gekaufte Gutscheinkarten auf einem dubiosen Portal zu überprüfen, sollte den Deal sofort abblasen. Hier wird nämlich nichts geprüft, die Plattform ist lediglich ein praktischer Weg für Kriminelle, an das Guthaben auf den Karten zu gelangen. <p /> <A HREF="https://www.watchlist-internet.at/news/pruefportal-fuer-gutscheinkarten/">https://www.watchlist-internet.at/news/pruefportal-fuer-gutscheinkarten/</a> <hr> <h3>Seedworm: Iran-Linked Hackers Breached Korean Electronics Maker in Global Spying Campaign</h3> Iran-linked threat actor abused signed Fortemedia and SentinelOne binaries for DLL sideloading and exfiltrated data through a public file-transfer service. <p /> <A HREF="https://www.security.com/threat-intelligence/iran-seedworm-electronics">https://www.security.com/threat-intelligence/iran-seedworm-electronics</a> <h2> Vulnerabilities </h2> <h3>SAP fixes critical vulnerabilities in Commerce Cloud and S/4HANA</h3> SAP has released the May 2026 security updates addressing 15 vulnerabilities across multiple products, including two critical flaws in the Commerce Cloud enterprise-grade e-commerce platform and the S/4HANA ERP suite. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/sap-fixes-critical-vulnerabilities-in-commerce-cloud-and-s-4hana/">https://www.bleepingcomputer.com/news/security/sap-fixes-critical-vulnerabilities-in-commerce-cloud-and-s-4hana/</a> <hr> <h3>VU#471747: dnsmasq contains several vulnerabilities, including attacker DNS redirect, privilege escalation, and heap manipulation</h3> dnsmasq is affected by multiple memory safety and input validation vulnerabilities, including heap buffer overflows, heap corruption, and code execution flaws. Collectively, these vulnerabilities enable attackers to poison cached DNS records, bypass security controls, crash the dnsmasq process, or under certain conditions, achieve local privilege escalation. dnsmasq has released version 2.92rel2 to fix the vulnerabilities. <p /> <A HREF="https://kb.cert.org/vuls/id/471747">https://kb.cert.org/vuls/id/471747</a> <hr> <h3>Anonymisierendes Linux Tails: Notfallupdate 7.7.3 fixt DirtyFrag-Lücke</h3> Das anonymisierende Linux Tails ist als nächstes Notfallupdate in Version 7.7.3 erschienen. Es schließt die DirtyFrag-Lücke. <p /> <A HREF="https://www.heise.de/news/Anonymisierendes-Linux-Tails-Notfallupdate-7-7-3-fixt-DirtyFrag-Luecke-11290621.html">https://www.heise.de/news/Anonymisierendes-Linux-Tails-Notfallupdate-7-7-3-fixt-DirtyFrag-Luecke-11290621.html</a> <hr> <h3>Node.js: Abermals Ausbruch aus vm2-Sandbox möglich</h3> Eine kritische Sicherheitslücke in der Node.js-Sandbox vm2 kann Schadcode passieren lassen. Ein Sicherheitspatch steht zum Download bereit. <p /> <A HREF="https://www.heise.de/news/Node-js-Abermals-Ausbruch-aus-vm2-Sandbox-moeglich-11290901.html">https://www.heise.de/news/Node-js-Abermals-Ausbruch-aus-vm2-Sandbox-moeglich-11290901.html</a> <hr> <h3>OpenSearch-Client für Node.js ist auch kompromittiert - Teil 2</h3> Die Hiobsbotschaften reißen heute nicht ab. Im Beitrag Neuer Shai-Hulud Lieferkettenangriff auf npm tanstack-Pakete; CheckMarx Jenkins-Paket infiziert hatte ich über zwei Lieferkettenangriffe der letzten beiden Stunden berichtet. Der Mini Shai Hulud-Lieferkettenangriff auf npm tanstack-Pakete hat sich ausgeweitet und der OpenSearch-Client für Node.js ist auch kompromittiert. <p /> <A HREF="https://borncity.com/blog/2026/05/12/opensearch-client-fuer-node-js-ist-auch-kompromittiert-teil-2/">https://borncity.com/blog/2026/05/12/opensearch-client-fuer-node-js-ist-auch-kompromittiert-teil-2/</a> <hr> <h3>May 2026 Security Update</h3> Ivanti is disclosing vulnerabilities in Ivanti Secure Access Client, Xtraction, Virtual Traffic Manager and Endpoint Manager (EPM). <p /> <A HREF="https://www.ivanti.com/blog/may-2026-security-update">https://www.ivanti.com/blog/may-2026-security-update</a> <hr> <h3>Postmortem: TanStack npm supply-chain compromise</h3> On 2026-05-11 between 19:20 and 19:26 UTC, an attacker published 84 malicious versions across 42 @tanstack/* npm packages by combining: the pull_request_target "Pwn Request" pattern, GitHub Actions cache poisoning across the fork-base trust boundary, and runtime memory extraction of an OIDC token from the GitHub Actions runner process. No npm tokens were stolen and the npm publish workflow itself was not compromised. <p /> <A HREF="https://tanstack.com/blog/npm-supply-chain-compromise-postmortem">https://tanstack.com/blog/npm-supply-chain-compromise-postmortem</a> <hr> <h3>Pi-hole-Update schließt dnsmasq-Sicherheitslücken</h3> <p /> <A HREF="https://www.heise.de/news/Pi-hole-Update-schliesst-dnsmasq-Sicherheitsluecken-11291003.html">https://www.heise.de/news/Pi-hole-Update-schliesst-dnsmasq-Sicherheitsluecken-11291003.html</a> <hr> <h3>LWN Security updates for Tuesday</h3> <p /> <A HREF="https://lwn.net/Articles/1072498/">https://lwn.net/Articles/1072498/</a> <hr> <h3>Firefox 150.0.3 korrigiert Passwort-Druck-Bug</h3> <p /> <A HREF="https://borncity.com/blog/2026/05/12/firefox-150-0-3-korrigiert-passwort-druck-bug/">https://borncity.com/blog/2026/05/12/firefox-150-0-3-korrigiert-passwort-druck-bug/</a>

CERT.at2026-05-12T19:24:28ZCERT.at2026-05-11T19:30:47Z2026-05-11T19:30:47Z

<h2>End-of-Day report</h2> Timeframe: Freitag 08-05-2026 18:00 - Montag 11-05-2026 18:00 Handler: Felician Fuchs Co-Handler: Alexander Riepl <h2> News </h2> <h3>Hackers abuse Google ads, Claude.ai chats to push Mac malware</h3> Attackers are abusing Google Ads and legitimate Claude.ai shared chats in an active malvertising campaign. Users searching for "Claude mac download" may come across sponsored search results that list claude.ai as the target website, but lead to instructions that install malware on their Mac. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-claudeai-chats-to-push-mac-malware/">https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-claudeai-chats-to-push-mac-malware/</a> <hr> <h3>Messenger: So will Signal Phishing-Angriffe erschweren</h3> Nachdem die Messenger-App Signal Ziel einer Phishing-Attacke unter anderem auf Politiker geworden ist, sollen solche Angriffe erschwert werden. <p /> <A HREF="https://www.golem.de/news/messenger-so-will-signal-phishing-angriffe-erschweren-2605-208511.html">https://www.golem.de/news/messenger-so-will-signal-phishing-angriffe-erschweren-2605-208511.html</a> <hr> <h3>Fake OpenAI Privacy Filter Repo Hits #1 on Hugging Face, Draws 244K Downloads</h3> A malicious Hugging Face repository managed to take a spot in the platform's trending list by impersonating OpenAI's Privacy Filter open-weight model to deliver a Rust-based information stealer to Windows users. <p /> <A HREF="https://thehackernews.com/2026/05/fake-openai-privacy-filter-repo-hits-1.html">https://thehackernews.com/2026/05/fake-openai-privacy-filter-repo-hits-1.html</a> <hr> <h3>Checkmarx tackles another TeamPCP intrusion as Jenkins plugin sabotaged</h3> Cybercrooks ruin engineers weekends with Saturday attack. Checkmarx-s software engineers are still working to remove a malicious version of the code security outfit's Jenkins plugin after detecting an unauthorized upload over the weekend. <p /> <A HREF="https://www.theregister.com/devops/2026/05/11/checkmarx-tackles-another-teampcp-intrusion-as-jenkins-plugin-sabotaged/5237780">https://www.theregister.com/devops/2026/05/11/checkmarx-tackles-another-teampcp-intrusion-as-jenkins-plugin-sabotaged/5237780</a> <hr> <h3>Yarbo responds to robot flaws that could mow down their owners</h3> A researcher found a host of vulnerabilities in Yarbo garden robots that could expose Wi-Fi passwords, hijack cameras, and run over their owners on command. <p /> <A HREF="https://www.malwarebytes.com/blog/news/2026/05/yarbo-responds-to-robot-flaws-that-could-mow-down-their-owners">https://www.malwarebytes.com/blog/news/2026/05/yarbo-responds-to-robot-flaws-that-could-mow-down-their-owners</a> <hr> <h3>E-Mail zur Erneuerung der ID Austria App ist fake</h3> Aktuell ist eine betrügerische E-Mail im Umlauf, die Nutzer:innen zu einem angeblich notwendigen Update der ID-Austria-App auffordert. Das Ziel: Zugang zu privaten Daten und Accounts zu erlangen. <p /> <A HREF="https://www.watchlist-internet.at/news/erneuerung-der-id-austria-app-fake/">https://www.watchlist-internet.at/news/erneuerung-der-id-austria-app-fake/</a> <hr> <h3>Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware</h3> In April, we observed an intrusion linked to the Atos-reported campaign where an EtherRAT was installed via a malicious MSI masquerading as a Sysinternals tool. Later in the intrusion, we observed the deployment of a new malware framework named TukTuk, first reported by Evangelos G, which, according to their analysis, is AI-generated. <p /> <A HREF="https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/">https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/</a> <hr> <h3>Vulnerability Garden: A growing list of named vulnerabilities, attack techniques and exploits</h3> A growing list of 966 named vulnerabilities, attack techniques and exploits. <p /> <A HREF="https://vulnerability.garden/">https://vulnerability.garden/</a> <hr> <h3>the 90 day disclosure policy is dead</h3> The 90 day responsible disclosure window was built for a world where bug finders were rare and exploit development was slow. That world is gone. LLMs have compressed both timelines to near-zero. I have seen it first hand, and so has everyone else paying attention. <p /> <A HREF="https://blog.himanshuanand.com/2026/05/the-90-day-disclosure-policy-is-dead/">https://blog.himanshuanand.com/2026/05/the-90-day-disclosure-policy-is-dead/</a> <hr> <h3>Hunting ClickFix Win + X Variants</h3> It has been just over a year since my post on ClickFix, where I explored the technique in depth. Since then, defenders have adopted countermeasures that detect ClickFix execution through the Windows Run prompt shortcut (Win + R), or have disabled that vector entirely through the Windows registry. This post focuses on variants that leverage the Windows Power User Menu (Win + X) and user-driven Terminal launches to paste and execute commands. <p /> <A HREF="https://detect.fyi/hunting-clickfix-win-x-variants-ff06e4c62bd9">https://detect.fyi/hunting-clickfix-win-x-variants-ff06e4c62bd9</a> <hr> <h2> Vulnerabilities </h2> <h3>Per DHCP-Antwort zum Root: KI findet 21 Jahre alte Schadcode-Lücke in FreeBSD</h3> Auf unzähligen FreeBSD-basierten Systemen lässt sich über einen bösartigen DHCP-Server im Netzwerk Schadcode einschleusen und als Root ausführen. <p /> <A HREF="https://www.golem.de/news/per-dhcp-antwort-zum-root-ki-findet-21-jahre-alte-schadcode-luecke-in-freebsd-2605-208535.html">https://www.golem.de/news/per-dhcp-antwort-zum-root-ki-findet-21-jahre-alte-schadcode-luecke-in-freebsd-2605-208535.html</a> <hr> <h3>Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak</h3> Cybersecurity researchers have disclosed a critical security vulnerability in Ollama that, if successfully exploited, could allow a remote, unauthenticated attacker to leak its entire process memory. The out-of-bounds read flaw, which likely impacts over 300,000 servers globally, is tracked as CVE-2026-7482 (CVSS score: 9.1). It has been codenamed Bleeding Llama by Cyera. <p /> <A HREF="https://thehackernews.com/2026/05/ollama-out-of-bounds-read-vulnerability.html">https://thehackernews.com/2026/05/ollama-out-of-bounds-read-vulnerability.html</a> <hr> <h3>JDownloader verteilte Malware-Downloads</h3> Die Webseite des recht populären Downloader-Tools JDownloader wurde kompromittiert. Sie hat dadurch falsche Installationspakete ausgeliefert, die mit Malware verseucht sind. Inzwischen haben die Betreiber die Webseite bereinigt. Auch bei den Daemon Tools gab es solch einen Vorfall; inzwischen haben auch dort die Inhaber reagiert und stellen nun saubere Installer bereit. <p /> <A HREF="https://www.heise.de/news/JDownloader-verteilte-Malware-Downloads-11288832.html">https://www.heise.de/news/JDownloader-verteilte-Malware-Downloads-11288832.html</a> <hr> <h3>Sicherheitspatch: Abermals Sicherheitslücken in cPanel und WHM geschlossen</h3> Angreifer können cPanel und WebHost Manager unter anderem mit Schadcode attackieren. Sicherheitspatches sind verfügbar. <p /> <A HREF="https://www.heise.de/news/Sicherheitspatch-Abermals-Sicherheitsluecken-in-cPanel-und-WHM-geschlossen-11288962.html">https://www.heise.de/news/Sicherheitspatch-Abermals-Sicherheitsluecken-in-cPanel-und-WHM-geschlossen-11288962.html</a> <hr> <h3>Schadcode-Lücke bedroht IBM App Connect Enterprise und IBM Integration Bus</h3> Angreifer können IBM App Connect Enterprise und IBM Integration Bus for z/OS attackieren. Updates lösen das Sicherheitsproblem. <p /> <A HREF="https://heise.de/-11289112">https://heise.de/-11289112</a> <hr> <h3>LWN Security updates for Monday</h3> <p /> <A HREF="https://lwn.net/Articles/1072301/">https://lwn.net/Articles/1072301/</a>

CERT.at2026-05-11T19:30:47ZCERT.at2026-05-08T18:23:48Z2026-05-08T18:23:48Z

<h2>End-of-Day report</h2> Timeframe: Donnerstag 07-05-2026 18:00 - Freitag 08-05-2026 18:00 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer <h2> News </h2> <h3>New PCPJack worm steals credentials, cleans TeamPCP infections</h3> A new malware framework called PCPJack is stealing credentials from exposed cloud infrastructure while actively removing TeamPCP's access to the systems. Among the targeted services are Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications. In many cases, the threat actor moves laterally on the network. [..] To mitigate this risk, the researchers recommend enforcing multi-factor authentication (MFA), using IMDSv2 in AWS, ensuring proper authentication for Docker and Kubernetes services, following least-privilege principles, and avoiding storing secrets in plaintext. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/new-pcpjack-worm-steals-credentials-cleans-teampcp-infections/">https://www.bleepingcomputer.com/news/security/new-pcpjack-worm-steals-credentials-cleans-teampcp-infections/</a> <hr> <h3>Ende-zu-Ende-Verschlüsselung: Instagram deaktiviert Privatsphärenschutz</h3> Es flog etwas unter dem Radar, doch ab dem heutigen Freitag wird es Ernst: Instagram verwässert den Privatsphärenschutz des sozialen Netzwerks. Die Opt-in-Option zur Ende-zu-Ende-Verschlüsselung (End-to-End-Encryption, E2EE) schaltet Meta für Direktnachrichten global ab. [..] Als Erklärung dazu, warum die Ende-zu-Ende-Verschlüsselung nun nicht mehr möglich sein soll, liefert ein aktualisierter Facebook-Blog-Beitrag eine Antwort: Demnach haben nur sehr wenige Menschen die Möglichkeit der Aktivierung der Ende-zu-Ende-Verschlüsselung in Direktnachrichten genutzt. <p /> <A HREF="https://www.heise.de/news/Ende-zu-Ende-Verschluesselung-Instagram-deaktiviert-Privatsphaerenschutz-11287210.html">https://www.heise.de/news/Ende-zu-Ende-Verschluesselung-Instagram-deaktiviert-Privatsphaerenschutz-11287210.html</a> <hr> <h3>ShinyHunters escalates Canvas attacks with school login defacements</h3> According to new reporting, ShinyHunters has now hit Instructure again, this time moving from quiet data theft to very visible extortion. Using another vulnerability in Instructure-s systems, the attackers were able to modify Canvas login portals for hundreds of educational institutions, defacing both web logins and the Canvas app with an on-screen ransom message. <p /> <A HREF="https://www.malwarebytes.com/blog/news/2026/05/shinyhunters-escalates-canvas-attacks-with-school-login-defacements">https://www.malwarebytes.com/blog/news/2026/05/shinyhunters-escalates-canvas-attacks-with-school-login-defacements</a> <hr> <h3>ClaudeBleed Vulnerability Lets Hackers Hijack Claude Chrome Extension to Steal Data</h3> Cybersecurity researchers from LayerX have found a major security flaw in the Claude for Chrome browser extension that could allow hackers to take full control of the AI assistant. They have named this vulnerability ClaudeBleed, and their research shows that even a basic extension with no special permissions can hijack Claude to steal private files and send emails without the user-s knowledge or consent. [..] After being notified by LayerX, Anthropic released a patch on 6 May in version 1.0.70. This update added new pop-up windows to ask for user permission. However, the LayerX team quickly found a way around them, discovering that by forcing the extension into a privileged mode, aka Act without asking mode, they could skip the permission screens entirely. <p /> <A HREF="https://hackread.com/claudebleed-vulnerability-hackers-claude-chrome-extension/">https://hackread.com/claudebleed-vulnerability-hackers-claude-chrome-extension/</a> <hr> <h3>Kubernetes security fundamentals: Secrets</h3> In this post, we'll be exploring secrets management in Kubernetes. Securely handling secrets is essential for any cluster operator, and there are several important nuances to keep in mind. <p /> <A HREF="https://securitylabs.datadoghq.com/articles/kubernetes-security-fundamentals-part-8/">https://securitylabs.datadoghq.com/articles/kubernetes-security-fundamentals-part-8/</a> <hr> <h3>Behind the Scenes Hardening Firefox with Claude Mythos Preview</h3> Two weeks ago we announced that we had identified and fixed an unprecedented number of latent security bugs in Firefox with the help of Claude Mythos Preview and other AI models. In this post, we-ll go into more detail about how we approached this work, what we found, and advice for other projects on making good use of emerging capabilities to harden themselves against attack. <p /> <A HREF="https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/">https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/</a> <hr> <h3>Stop MITM on the first SSH connection, on any VPS or cloud provider</h3> This little script stops attacks on the first SSH connection to a new VM, even on providers (like Hetzner Cloud) that don't offer a proprietary solution; we only need cloud-init, which is widely supported. <p /> <A HREF="https://www.joachimschipper.nl/Stop%20MITM%20on%20the%20first%20SSH%20connection%2C%20on%20any%20VPS%20or%20cloud%20provider.html">https://www.joachimschipper.nl/Stop%20MITM%20on%20the%20first%20SSH%20connection%2C%20on%20any%20VPS%20or%20cloud%20provider.html</a> <h2> Vulnerabilities </h2> <h3>Lokale Privilegieneskalation im Linux-Kernel ("Dirty Frag" und "Copy Fail 2") - PoCs verfügbar, kein Patch</h3> Am 7. Mai 2026 wurden zwei neue Schwachstellen im Linux-Kernel öffentlich gemacht, die unter den Namen -Dirty Frag- und -Copy Fail 2: Electric Boogaloo- bekannt sind. Beide Schwachstellen ermöglichen lokalen, nicht privilegierten Benutzer:innen eine Eskalation auf root. [..] Es handelt sich um deterministische Logikfehler ohne Race-Condition; bei einem Fehlschlag tritt keine Kernel-Panik auf, die Erfolgswahrscheinlichkeit wird als hoch beschrieben. [..] Bestehende Gegenmaßnahmen gegen -Copy Fail- (CVE-2026-31431), insbesondere das Sperren des Moduls algif_aead, schützen NICHT gegen -Dirty Frag- oder -Copy Fail 2-. [..] Betroffen sind die meisten aktuellen Linux-Distributionen mit aktiviertem Page-Cache-Pfad in esp4/esp6 bzw. rxrpc. [..] Zum Zeitpunkt der Veröffentlichung dieser Warnung liegen für die meisten Distributionen noch keine vollständig gepatchten Kernel vor. <p /> <A HREF="https://www.cert.at/de/warnungen/2026/5/linux-lpe-dirty-frag-copy-fail-2">https://www.cert.at/de/warnungen/2026/5/linux-lpe-dirty-frag-copy-fail-2</a> <hr> <h3>LWN Security updates for Friday</h3> <p /> <A HREF="https://lwn.net/Articles/1071859/">https://lwn.net/Articles/1071859/</a>

CERT.at2026-05-08T18:23:48ZCERT.at2026-05-07T18:52:26Z2026-05-07T18:52:26Z

<h2>End-of-Day report</h2> Timeframe: Mittwoch 06-05-2026 18:00 - Donnerstag 07-05-2026 18:00 Handler: Felician Fuchs Co-Handler: n/a <h2> News </h2> <h3>Hackers abuse Google ads for GoDaddy ManageWP login phishing</h3> A phishing campaign delivered through Google sponsored search results is targeting credentials for ManageWP, GoDaddys platform for managing fleets of WordPress websites. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-for-godaddy-managewp-login-phishing/">https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-for-godaddy-managewp-login-phishing/</a> <hr> <h3>Fake Claude AI website delivers new Beagle Windows malware</h3> A fake version for the Claude AI website offers a malicious Claude-Pro Relay download that pushes a previously undocumented backdoor for Windows named Beagle. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/fake-claude-ai-website-delivers-new-beagle-windows-malware/">https://www.bleepingcomputer.com/news/security/fake-claude-ai-website-delivers-new-beagle-windows-malware/</a> <hr> <h3>When DNSSEC goes wrong: how we responded to the .de TLD outage</h3> On May 5, 2026, DENIC published broken DNSSEC signatures for the .de TLD, making millions of domains unreachable. Heres what 1.1.1.1 saw, how serve stale cushioned the impact, and how we restored resolution. <p /> <A HREF="https://blog.cloudflare.com/de-tld-outage-dnssec/">https://blog.cloudflare.com/de-tld-outage-dnssec/</a> <hr> <h3>How Cloudflare responded to the -Copy Fail- Linux vulnerability</h3> When a critical Linux kernel privilege escalation was publicly disclosed, Cloudflares security and engineering teams detected, investigated, and mitigated the threat across our global fleet, confirming zero customer impact and no malicious exploitation. <p /> <A HREF="https://blog.cloudflare.com/copy-fail-linux-vulnerability-mitigation/">https://blog.cloudflare.com/copy-fail-linux-vulnerability-mitigation/</a> <hr> <h3>Mirai-Based xlabs_v1 Botnet Exploits ADB to Hijack IoT Devices for DDoS Attacks</h3> Cybersecurity researchers have exposed a new Mirai-derived botnet that self-identifies as xlabs_v1 and targets internet-exposed devices running Android Debug Bridge (ADB) to enlist them in a network capable of carrying out distributed denial-of-service (DDoS) attacks. <p /> <A HREF="https://thehackernews.com/2026/05/mirai-based-xlabsv1-botnet-exploits-adb.html">https://thehackernews.com/2026/05/mirai-based-xlabsv1-botnet-exploits-adb.html</a> <hr> <h3>Insolvenzmasse: Kriminelle imitieren neben Anwaltskanzleien nun auch Autohändler, Großhändler und Wirtschaftsprüfer</h3> Die Masche bleibt gleich, aber die Deckmäntel ändern sich. Wurde früher ausschließlich die Identität von Anwaltskanzleien missbraucht, um über Vorschussbetrug an das Geld von Opfern zu gelangen, haben die Kriminellen nun ihr Portfolio erweitert. Sie geben sich mittlerweile auch als eine Vielzahl anderer Unternehmen und Agenturen aus. Ein Update. <p /> <A HREF="https://www.watchlist-internet.at/news/insolvenzmasse-autohaendler-grosshaendler-wirtschaftspruefer/">https://www.watchlist-internet.at/news/insolvenzmasse-autohaendler-grosshaendler-wirtschaftspruefer/</a> <hr> <h3>World Password Day 2026: Why -Strong Passwords- Can-t Save You from AI, Infostealers, and the Telegram Underground</h3> As we recognize World Password Day in 2026, the traditional advice to -use a complex password with numbers and symbols- feels hopelessly outdated. Today, a 16-character password is useless if an infostealer malware extracts it directly from a browser cache, or if an employee willingly pastes it into an unmanaged AI chatbot. Welcome to the real World Password Day 2026. <p /> <A HREF="https://blog.checkpoint.com/security/world-password-day-2026-why-strong-passwords-cant-save-you-from-ai-infostealers-and-the-telegram-underground/">https://blog.checkpoint.com/security/world-password-day-2026-why-strong-passwords-cant-save-you-from-ai-infostealers-and-the-telegram-underground/</a> <hr> <h3>Polish intelligence warns hackers attacked water treatment control systems</h3> The agency did not publicly attribute the incidents to a specific group or country but said Poland faced intensified hostile cyber activity in 2024 and 2025, -with particular emphasis on the special services of the Russian Federation.- <p /> <A HREF="https://therecord.media/polish-intelligence-warns-hackers-attacked-water-treatment">https://therecord.media/polish-intelligence-warns-hackers-attacked-water-treatment</a> <hr> <h3>Warnung vor IONOS/1&1 Rechnungs-Phishing</h3> Ich stelle mal eine kurze Warnung hier im Blog ein, weil mir bereits zum zweiten Monat eine Phishing-Mail von 1&1 in meinem Postfach zugestellt wurde, die Rechnungs-Phishing bei IONOS versucht. <p /> <A HREF="https://borncity.com/blog/2026/05/07/warnung-vor-ionos-11-rechnungs-phishing/">https://borncity.com/blog/2026/05/07/warnung-vor-ionos-11-rechnungs-phishing/</a> <hr> <h3>Best OSINT Tools for Investigations and Threat Intelligence in 2026</h3> Explore the best OSINT tools for your digital investigations, threat intelligence, reconnaissance, and tracking online activity in 2026. <p /> <A HREF="https://hackread.com/best-osint-tools-investigate-threat-intelligence-2026/">https://hackread.com/best-osint-tools-investigate-threat-intelligence-2026/</a> <hr> <h3>Plastic Flowers to Protect the Hive</h3> Agentic development has fundamentally changed the software ecosystem. Modern coding agents are trained and prompted to seek out tools that will help with their assigned coding tasks. They will install those tools into their user-s environment, with little to no oversight on what the installed package actually does, relying on name pattern matching more than any other signal. <p /> <A HREF="https://phildini.dev/slopsquatting-for-good">https://phildini.dev/slopsquatting-for-good</a> <hr> <h3>Operation Epic Fury Exposes Critical OT Security Gaps in U.S. Oil and Gas Sector</h3> The cybersecurity posture of the U.S. oil and gas sector has come under renewed scrutiny following Operation Epic Fury, with a new independent survey revealing a disconnect between operator confidence and actual operational technology (OT) security capabilities. <p /> <A HREF="https://thecyberexpress.com/operation-epic-fury-ot-security-detection-gaps/">https://thecyberexpress.com/operation-epic-fury-ot-security-detection-gaps/</a> <hr> <h3>ClickFix Campaign Evolves with Targeting of MacOS Users</h3> ClickFix started as a Windows problem. It is no longer one. Microsofts Defender Security Research Team published a detailed analysis documenting an active ClickFix campaign that is targeting macOS users since at least January 2026. The primary goal is delivering infostealers by convincing users to paste malicious commands into their own Terminal, framed as routine system maintenance. <p /> <A HREF="https://thecyberexpress.com/clickfix-campaign-evolves-targets-macos-users/">https://thecyberexpress.com/clickfix-campaign-evolves-targets-macos-users/</a> <h2> Vulnerabilities </h2> <h3>Cisco: Codeschmuggel-Leck in Unity Connection und weitere Lücken</h3> Cisco hat fast zwei Handvoll Sicherheitsupdates veröffentlicht. Sie schließen mehrere hochriskante Lücken etwa in Unity Connection. <p /> <A HREF="https://www.heise.de/news/Cisco-Codeschmuggel-Leck-in-Unity-Connection-und-weitere-Luecken-11285115.html">https://www.heise.de/news/Cisco-Codeschmuggel-Leck-in-Unity-Connection-und-weitere-Luecken-11285115.html</a> <hr> <h3>May 2026 EPMM Security Update</h3> Ivanti has released updates for Ivanti Endpoint Manager Mobile (EPMM) which addresses five high severity vulnerabilities. <p /> <A HREF="https://www.ivanti.com/blog/may-2026-epmm-security-update">https://www.ivanti.com/blog/may-2026-epmm-security-update</a> <hr> <h3>Node.js 25: Ausbrüche aus JavaScript-Sandbox vm2 vorstellbar</h3> Die Sandbox-Komponente vm2 der Open-Source-JavaScript-Laufzeitumgebung Node.js ist mit bestimmten Einstellungen verwundbar. <p /> <A HREF="https://heise.de/-11285063">https://heise.de/-11285063</a> <hr> <h3>Salesforce Marketing Cloud Vulnerabilities Expose Cross-Tenant Subscriber Data Risks</h3> A recently disclosed set of vulnerabilities in Salesforce Marketing Cloud, widely known as SFMC, has drawn attention to the security risks tied to centralized marketing infrastructure. The flaws, which affected components tied to AMPScript, CloudPages, and email-rendering workflows, could have enabled attackers to access subscriber information, enumerate marketing emails, and potentially affect organizations across multiple tenants. <p /> <A HREF="https://thecyberexpress.com/salesforce-sfmc-ampscript-vulnerability/">https://thecyberexpress.com/salesforce-sfmc-ampscript-vulnerability/</a> <hr> <h3>Authenticated Arbitrary File Upload Vulnerability Patched in Slider Revolution 7 WordPress Plugin</h3> <p /> <A HREF="https://www.wordfence.com/blog/2026/05/authenticated-arbitrary-file-upload-vulnerability-patched-in-slider-revolution-7-wordpress-plugin/">https://www.wordfence.com/blog/2026/05/authenticated-arbitrary-file-upload-vulnerability-patched-in-slider-revolution-7-wordpress-plugin/</a> <hr> <h3>LWN Security updates for Thursday</h3> <p /> <A HREF="https://lwn.net/Articles/1071700/">https://lwn.net/Articles/1071700/</a>

CERT.at2026-05-07T18:52:26ZCERT.at2026-05-06T18:33:48Z2026-05-06T18:33:48Z

<h2>End-of-Day report</h2> Timeframe: Dienstag 05-05-2026 18:00 - Mittwoch 06-05-2026 18:00 Handler: Felician Fuchs Co-Handler: n/a <h2> News </h2> <h3>MuddyWater hackers use Chaos ransomware as a decoy in attacks</h3> The MuddyWater Iranian hackers disguised their operations as a Chaos ransomware attack, relying on Microsoft Teams social engineering to gain access and establish persistence. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/muddywater-hackers-use-chaos-ransomware-as-a-decoy-in-attacks/">https://www.bleepingcomputer.com/news/security/muddywater-hackers-use-chaos-ransomware-as-a-decoy-in-attacks/</a> <hr> <h3>OceanLotus suspected of using PyPI to deliver ZiChatBot malware</h3> Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT. <p /> <A HREF="https://securelist.com/oceanlotus-suspected-pypi-zichatbot-campaign/119603/">https://securelist.com/oceanlotus-suspected-pypi-zichatbot-campaign/119603/</a> <hr> <h3>Malicious OpenClaw Skill Distributes Remcos RAT and GhostLoader</h3> OpenClaw, previously known as Clawdbot, Moltbot, and Molty, is an open-source framework designed for autonomous AI agents that execute complex tasks requiring high-privilege local system access. While intended for automation, its modular "skill" architecture has been weaponized as a significant attack vector. <p /> <A HREF="https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader">https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader</a> <hr> <h3>Behörde für abgesicherte Ausweise geknackt: 15-Jähriger verhaftet</h3> Millionen Datensätze aus französischen -abgesicherten Ausweisen- gerieten in falsche Hände. Kein fremder Geheimdienst, sondern ein Bursche ist verdächtig. <p /> <A HREF="https://www.heise.de/news/Behoerde-fuer-abgesicherte-Ausweise-geknackt-15-Jaehriger-verhaftet-11283198.html">https://www.heise.de/news/Behoerde-fuer-abgesicherte-Ausweise-geknackt-15-Jaehriger-verhaftet-11283198.html</a> <hr> <h3>-Pressure Cooker-: Europols geheime Datenverarbeitung ohne Aufsicht</h3> Interne, per Infofreiheit erlangte Warnungen belegen, dass das EU-Polizeiamt lange operative Netzwerke ohne IT-Kontrolle und richtige Protokollierung betrieb. <p /> <A HREF="https://www.heise.de/news/Pressure-Cooker-Europols-geheime-Datenverarbeitung-ohne-Aufsicht-11283466.html">https://www.heise.de/news/Pressure-Cooker-Europols-geheime-Datenverarbeitung-ohne-Aufsicht-11283466.html</a> <hr> <h3>FSFE warnt: NHS sollte quelloffenen Code nicht depublizieren</h3> Die Free Software Foundation Europe warnt vor dem Umstellen der NHS-Code-Repositories auf Privat aus Angst vor KI-Schwachstellensuche. <p /> <A HREF="https://www.heise.de/news/FSFE-warnt-NHS-sollte-quelloffenen-Code-nicht-depublizieren-11283406.html">https://www.heise.de/news/FSFE-warnt-NHS-sollte-quelloffenen-Code-nicht-depublizieren-11283406.html</a> <hr> <h3>IPFire: Neue DNS Firewall soll URL-Filter und Pi-hole ablösen</h3> Die Firewall-Distribution IPFire bringt mit Core Update 201 eine DNS Firewall mit, die unerwünschte Domains schon bei der Namensauflösung blockiert. <p /> <A HREF="https://www.heise.de/news/IPFire-Neue-DNS-Firewall-soll-URL-Filter-und-Pi-hole-abloesen-11283482.html">https://www.heise.de/news/IPFire-Neue-DNS-Firewall-soll-URL-Filter-und-Pi-hole-abloesen-11283482.html</a> <hr> <h3>Discounter-Falle: Gefälschte Suchergebnisse führen in Lidl-Fake-Shop</h3> Wer sich online auf die Suche nach günstigen Haushaltsgeräten, Fahrrädern, Werkzeugen oder anderen beliebten Artikeln macht, landet häufig in einem Fake-Shop. Als -gesponserte Suchergebnisse- getarnte Werbeanzeigen führen direkt in die Falle, die optisch dem Web-Auftritt des bekannten Discounters Lidl nachempfunden ist. <p /> <A HREF="https://www.watchlist-internet.at/news/lidl-fake-shop/">https://www.watchlist-internet.at/news/lidl-fake-shop/</a> <hr> <h3>Paramiko Security Audit</h3> Paramiko is a pure-Python implementation of SSHv2 that provides both client- and server-side functionality. It serves as the foundation for the high-level SSH library Fabric and is widely regarded as one of the most popular SSH solutions in the Python ecosystem. The Cryptography library, for its part, offers Python developers access to a broad range of cryptographic algorithms and primitives. It is a widely adopted Python/Rust library with more than 25,000 known dependencies. <p /> <A HREF="http://blog.quarkslab.com/paramiko-security-audit.html">http://blog.quarkslab.com/paramiko-security-audit.html</a> <hr> <h3>The Jenkins Threat Landscape</h3> What usage patterns, plugin adoption, and configuration choices reveal about the Jenkins attack surface. <p /> <A HREF="https://www.wiz.io/blog/jenkins-threat-risk-insights">https://www.wiz.io/blog/jenkins-threat-risk-insights</a> <hr> <h3>New Infostealer Dubbed -Pheno- Hijacks Windows- Phone Link App to Steal MFA OTPs</h3> Attackers have found a way to intercept SMS-based one-time passwords from a victims mobile device without deploying a single line of malware on the phone itself. Instead, they go through the Windows PC the phone is already connected to. <p /> <A HREF="https://thecyberexpress.com/new-infostealer-pheno-steals-mfa-otps/">https://thecyberexpress.com/new-infostealer-pheno-steals-mfa-otps/</a> <h2> Vulnerabilities </h2> <h3>Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE</h3> The Apache Software Foundation (ASF) has released security updates to address several security vulnerabilities in the HTTP Server, including a severe vulnerability that could potentially lead to remote code execution (RCE). The vulnerability, tracked as CVE-2026-23918 (CVSS score: 8.8), has been described as a case of "double free and possible RCE" in the HTTP/2 protocol handling. <p /> <A HREF="https://thehackernews.com/2026/05/critical-apache-http2-flaw-cve-2026.html">https://thehackernews.com/2026/05/critical-apache-http2-flaw-cve-2026.html</a> <hr> <h3>PAN-OS-Lücke wird angegriffen, Updates erst in Wochen geplant</h3> Palo Alto Networks warnt vor einer bereits angegriffenen kritischen Sicherheitslücke in PAN-OS. Updates kommen frühestens Mitte Mai. <p /> <A HREF="https://www.heise.de/news/PAN-OS-Luecke-wird-angegriffen-Updates-erst-in-Wochen-geplant-11283352.html">https://www.heise.de/news/PAN-OS-Luecke-wird-angegriffen-Updates-erst-in-Wochen-geplant-11283352.html</a> <hr> <h3>An exploitable integer overflow in Lix (CVE-2026-44028)</h3> Security researchers have found a security issue in Lix. This issue has been assigned CVE-2026-44028. <p /> <A HREF="https://lix.systems/blog/2026-05-05-lix-unsigned-integer-overflow/">https://lix.systems/blog/2026-05-05-lix-unsigned-integer-overflow/</a> <hr> <h3>Attackers Actively Exploiting Critical Vulnerability in Breeze Cache Plugin</h3> <p /> <A HREF="https://www.wordfence.com/blog/2026/05/attackers-actively-exploiting-critical-vulnerability-in-breeze-cache-plugin/">https://www.wordfence.com/blog/2026/05/attackers-actively-exploiting-critical-vulnerability-in-breeze-cache-plugin/</a> <hr> <h3>LWN Security updates for Wednesday</h3> <p /> <A HREF="https://lwn.net/Articles/1071466/">https://lwn.net/Articles/1071466/</a>

CERT.at2026-05-06T18:33:48ZCERT.at2026-05-05T18:25:49Z2026-05-05T18:25:49Z

<h2>End-of-Day report</h2> Timeframe: Montag 04-05-2026 18:00 - Dienstag 05-05-2026 18:00 Handler: Felician Fuchs Co-Handler: n/a <h2> News </h2> <h3>Trellix discloses data breach after source code repository hack</h3> Cybersecurity firm Trellix disclosed a data breach after attackers gained access to "a portion" of its source code repository. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/trellix-discloses-data-breach-after-source-code-repository-hack/">https://www.bleepingcomputer.com/news/security/trellix-discloses-data-breach-after-source-code-repository-hack/</a> <hr> <h3>Amazon SES increasingly abused in phishing to evade detection</h3> The Amazon Simple Email Service (SES) is being increasingly abused to send convincing phishing emails that can bypass standard security filters and render reputation-based blocks ineffective. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/amazon-ses-increasingly-abused-in-phishing-to-evade-detection/">https://www.bleepingcomputer.com/news/security/amazon-ses-increasingly-abused-in-phishing-to-evade-detection/</a> <hr> <h3>Weaver E-cology critical bug exploited in attacks since March</h3> Hackers have been exploiting a critical vulnerability (CVE-2026-22679) in the Weaver E-cology office automation since mid-March to run discovery commands. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/weaver-e-cology-critical-bug-exploited-in-attacks-since-march/">https://www.bleepingcomputer.com/news/security/weaver-e-cology-critical-bug-exploited-in-attacks-since-march/</a> <hr> <h3>CloudZ malware abuses Microsoft Phone Link to steal SMS and OTPs</h3> A new version of the CloudZ remote access tool (RAT) is deploying a previously unseen malicious plugin called Pheno that hijacks the Microsoft Phone Link connection to steal sensitive codes from mobile devices. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/cloudz-malware-abuses-microsoft-phone-link-to-steal-sms-and-otps/">https://www.bleepingcomputer.com/news/security/cloudz-malware-abuses-microsoft-phone-link-to-steal-sms-and-otps/</a> <hr> <h3>Webbrowser: Klartext-Passwörter im Speicher von Microsoft Edge entdeckt</h3> Der in Edge integrierte Passwortmanager ist offenbar keine sichere Wahl. Passwörter landen beim Start im Prozessspeicher und lassen sich auslesen. <p /> <A HREF="https://www.golem.de/news/webbrowser-klartext-passwoerter-permanent-im-speicher-von-microsoft-edge-2605-208315.html">https://www.golem.de/news/webbrowser-klartext-passwoerter-permanent-im-speicher-von-microsoft-edge-2605-208315.html</a> <hr> <h3>Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools</h3> An active phishing campaign has been observed targeting multiple vectors since at least April 2025 with legitimate Remote Monitoring and Management (RMM) software as a way to establish persistent remote access to compromised hosts. <p /> <A HREF="https://thehackernews.com/2026/05/phishing-campaign-hits-80-orgs-using.html">https://thehackernews.com/2026/05/phishing-campaign-hits-80-orgs-using.html</a> <hr> <h3>Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries</h3> Microsoft has disclosed details of a large-scale credential theft campaign that has leveraged a combination of code of conduct-themed lures and legitimate email services to direct users to attacker-controlled domains and steal authentication tokens. <p /> <A HREF="https://thehackernews.com/2026/05/microsoft-details-phishing-campaign.html">https://thehackernews.com/2026/05/microsoft-details-phishing-campaign.html</a> <hr> <h3>Vimeo-Datenleck: 119.000 E-Mail-Adressen betroffen</h3> Die Cybergang ShinyHunters hat Daten von Vimeo bei Anodot gestohlen und ins Darknet gestellt. Nun hat Have-I-Been-Pwned sie aufgenommen. <p /> <A HREF="https://www.heise.de/news/Vimeo-Datenleck-119-000-E-Mail-Adressen-betroffen-11281379.html">https://www.heise.de/news/Vimeo-Datenleck-119-000-E-Mail-Adressen-betroffen-11281379.html</a> <hr> <h3>Datenschutzvorfall bei Verlag Delius Klasing</h3> Der Verlag Delius Klasing räumt in einer E-Mail an Kunden einen IT-Vorfall ein. Personenbezogene Kundendaten wurden offengelegt. <p /> <A HREF="https://www.heise.de/news/Datenschutzvorfall-bei-Verlag-Delius-Klasing-11281800.html">https://www.heise.de/news/Datenschutzvorfall-bei-Verlag-Delius-Klasing-11281800.html</a> <hr> <h3>Quasar Linux (QLNX) - A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities</h3> TrendAI- Research breaks down Quasar Linux (QLNX), a previously undocumented sophisticated Linux RAT with low detection rates. In this blog, we examine a full-featured Linux threat incorporating a rootkit, a PAM backdoor, credential harvesting, and more, revealing how this malware enables stealthy access, persistence, and potential supply-chain attacks. <p /> <A HREF="https://www.trendmicro.com/en_us/research/26/e/quasar-linux-qlnx-a-silent-foothold-in-the-software-supply-chain.html">https://www.trendmicro.com/en_us/research/26/e/quasar-linux-qlnx-a-silent-foothold-in-the-software-supply-chain.html</a> <hr> <h3>CISA Unveils New Initiative to Fortify America-s Critical Infrastructure</h3> Today, the Cybersecurity and Infrastructure Security Agency (CISA) released guidance to help critical infrastructure (CI) entities across all sectors prepare to operate through a crisis or conflict, continuing vital service delivery even as their systems are under attack. <p /> <A HREF="https://www.cisa.gov/news-events/news/cisa-unveils-new-initiative-fortify-americas-critical-infrastructure">https://www.cisa.gov/news-events/news/cisa-unveils-new-initiative-fortify-americas-critical-infrastructure</a> <h2> Vulnerabilities </h2> <h3>Patchday: Kritische Schadcode-Lücke bedroht Android 14, 15 und 16</h3> Schadcode kann durch ein fehlerhaftes Debugging-Modul auf Androidgeräte schlüpfen. Nun hat Google die kritische Schwachstelle geschlossen. <p /> <A HREF="https://www.heise.de/news/Patchday-Kritische-Schadcode-Luecke-bedroht-Android-14-15-und-16-11281884.html">https://www.heise.de/news/Patchday-Kritische-Schadcode-Luecke-bedroht-Android-14-15-und-16-11281884.html</a> <hr> <h3>Daemon Tools Lite: Infizierte Installer durch Supply-Chain-Attacke</h3> Offiziell signierte Daemon-Tools-Installer von der Herstellerseite bringen Malware mit. Offenbar durch einen Lieferkettenangriff. <p /> <A HREF="https://www.heise.de/news/Daemon-Tools-Lite-Infizierte-Installer-durch-Supply-Chain-Attacke-11282006.html">https://www.heise.de/news/Daemon-Tools-Lite-Infizierte-Installer-durch-Supply-Chain-Attacke-11282006.html</a> <hr> <h3>Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass</h3> Progress Software has released updates to address two security flaws in MOVEit Automation, including a critical bug that could result in an authentication bypass. MOVEit Automation (formerly Central) is a secure, server-based managed file transfer (MFT) solution used to schedule and automate file movement workflows in enterprise environments without requiring any custom scripts. <p /> <A HREF="https://thehackernews.com/2026/05/progress-patches-critical-moveit.html">https://thehackernews.com/2026/05/progress-patches-critical-moveit.html</a> <hr> <h3>LWN Security updates for Tuesday</h3> <p /> <A HREF="https://lwn.net/Articles/1071324/">https://lwn.net/Articles/1071324/</a>

CERT.at2026-05-05T18:25:49ZCERT.at2026-05-04T19:10:28Z2026-05-04T19:10:28Z

<h2>End-of-Day report</h2> Timeframe: Donnerstag 30-04-2026 18:00 - Montag 04-05-2026 18:00 Handler: Felician Fuchs Co-Handler: n/a <h2> News </h2> <h3>ConsentFix v3 attacks target Azure with automated OAuth abuse</h3> A new attack type, dubbed ConsentFix v3, has been circulating on hacker forums, building on the previous technique by adding automation and scaling potential. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/consentfix-v3-attacks-target-azure-with-automated-oauth-abuse/">https://www.bleepingcomputer.com/news/security/consentfix-v3-attacks-target-azure-with-automated-oauth-abuse/</a> <hr> <h3>Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks</h3> A previously unknown threat actor has been observed targeting government and military entities in Southeast Asia, alongside a smaller cluster of managed service providers (MSPs) and hosting providers in the Philippines, Laos, Canada, South Africa, and the U.S., by exploiting the recently disclosed vulnerability in cPanel. <p /> <A HREF="https://thehackernews.com/2026/05/critical-cpanel-vulnerability.html">https://thehackernews.com/2026/05/critical-cpanel-vulnerability.html</a> <hr> <h3>Trellix: Angreifer erlangten Zugriff auf Quellcode</h3> Trellix, das aus FireEye und McAfee hervorging, hat einen IT-Vorfall gemeldet. Angreifer haben Zugriff auf Quellcode erlangt. <p /> <A HREF="https://www.heise.de/news/Trellix-Angreifer-erlangten-Zugriff-auf-Quellcode-11280743.html">https://www.heise.de/news/Trellix-Angreifer-erlangten-Zugriff-auf-Quellcode-11280743.html</a> <hr> <h3>Vorfall bei DigiCert: Malware-Autoren klauten Zertifikate</h3> Die Zertifizierungsstelle DigiCert hat im April mehrere Zertifikate zur Signierung von Programmen (-Code Signing Certificate-) an Malware-Autoren ausgegeben. Diese hatten zuvor Kundendienstmitarbeiter bei DigiCert mit Schadsoftware angegriffen und deren Rechner übernommen. Weil verschiedene Schutzmaßnahmen versagten, erlangten die Kriminellen Zugriff auf ein geschütztes Kundenportal - inklusive aller notwendigen Informationen, um die Zertifikate abzurufen. <p /> <A HREF="https://www.heise.de/news/Nach-Malware-Angriff-Kriminelle-nutzten-Codesigning-Zertifikate-von-DigiCert-11280757.html">https://www.heise.de/news/Nach-Malware-Angriff-Kriminelle-nutzten-Codesigning-Zertifikate-von-DigiCert-11280757.html</a> <hr> <h3>Build a Decoy MCP Server to Catch AI Agent Attackers</h3> Your AI agents MCP config can be a target for an attacker who reaches your machine. A decoy MCP server entry pointing at a Cloudflare Worker can reveal the attackers presence and their intent. <p /> <A HREF="https://zeltser.com/decoy-mcp-server-honeypot">https://zeltser.com/decoy-mcp-server-honeypot</a> <hr> <h3>ESC-Tickets im Netz: Drittanbieter wie ticombo.com bergen ein hohes Risiko!</h3> Für den ausverkauften Eurovision Song Contest tauchen immer wieder Ticketangebote bei Drittanbietern auf. Wir erklären, warum man besser die Finger davon lassen sollte. <p /> <A HREF="https://www.watchlist-internet.at/news/esc-tickets-plattformen-wie-ticombocom-riskant/">https://www.watchlist-internet.at/news/esc-tickets-plattformen-wie-ticombocom-riskant/</a> <hr> <h3>That AI Extension Helping You Write Emails? It-s Reading Them First</h3> Unit 42 uncovers high-risk AI browser extensions. Disguised as productivity tools, they steal data, intercept prompts, and exfiltrate passwords. Protect your browser. <p /> <A HREF="https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/">https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/</a> <hr> <h3>EV-Zertifikate von Lenovo & Co. durch GoldenEyeDog missbraucht</h3> Hersteller wie Lenovo, Kingston, Shuttle Inc. und Palit Microsystems sind von einem Zertifikatsproblem betroffen. Eine chinesische Hackergruppe namens GoldenEyeDog (APT-Q-27) war in der Lage, EV-Zertifikate im Namen der oben genannten Organisationen auszustellen und für kriminelle Zwecke zu missbrauchen. <p /> <A HREF="https://borncity.com/blog/2026/05/03/ev-zertifikate-von-lenovo-co-durch-goldeneyedog-missbraucht/">https://borncity.com/blog/2026/05/03/ev-zertifikate-von-lenovo-co-durch-goldeneyedog-missbraucht/</a> <hr> <h3>Careful Adoption of Agentic AI Services</h3> CISA, in collaboration with the Australian Signals Directorate-s Australian Cyber Security Centre (ASD-s ACSC) and other international and U.S. partners, released guidance for organizations on adopting agentic artificial intelligence (AI) systems. <p /> <A HREF="https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services">https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services</a> <hr> <h3>The Life-Dinner Principle in Detection</h3> Cybersecurity has its own folk saying. You have heard it at conferences, on panels, in vendor decks, and in LinkedIn posts from CISOs who are -humbled- to announce something: -The attacker only has to be right once. The defender has to be right every time.- <p /> <A HREF="https://detect.fyi/the-life-dinner-principle-in-detection-822169d9da2c">https://detect.fyi/the-life-dinner-principle-in-detection-822169d9da2c</a> <hr> <h3>Evaluating our Threat Hunting Detection Rules (+ KQL Query Evaluation)</h3> I really enjoy creating detection rules - they give me better visibility into current threats, help me stay proactive, and bring many other advantages. On the other hand, it-s a double-edged sword. <p /> <A HREF="https://detect.fyi/evaluating-our-threat-hunting-detection-rules-kql-query-evaluation-5e8b6a77f2a2?source=rssd5fd8f494f6a4">https://detect.fyi/evaluating-our-threat-hunting-detection-rules-kql-query-evaluation-5e8b6a77f2a2?source=rssd5fd8f494f6a4</a> <hr> <h3>Practical Package Security: The Unofficial Guide</h3> Get actionable best practices to shrink your attack surface, protect execution environments, control package ingestion, and catch compromises early. <p /> <A HREF="https://www.wiz.io/blog/practical-package-security-the-unofficial-guide">https://www.wiz.io/blog/practical-package-security-the-unofficial-guide</a> <hr> <h3>Mini Shai-Hulud Spreads to Packagist: Malicious Intercom PHP Package Follows npm Compromise</h3> Socket found a malicious Intercom PHP package on Packagist using Composer plugin execution to steal credentials and spread across ecosystems. <p /> <A HREF="https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise">https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise</a> <hr> <h3>Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables</h3> The Socket Research Team has detected an active supply-chain attack targeting the unscoped tanstack package on npm, a brand-squatted impersonation of the legitimate @tanstack/* organization. <p /> <A HREF="https://socket.dev/blog/tanstack-brandsquat-compromise">https://socket.dev/blog/tanstack-brandsquat-compromise</a> <hr> <h3>NCSC Warns Organisations to Act Fast as Hidden Software Flaws Surface</h3> Organisations worldwide are being urged to prepare for a vulnerability patch wave, as security experts warn that advances in artificial intelligence (AI) could rapidly expose long-standing weaknesses across software systems. The warning comes from National Cyber Security Centre (NCSC), which says businesses must act now to strengthen their environments before a surge of critical updates arrives. <p /> <A HREF="https://thecyberexpress.com/ncsc-vulnerability-patch-wave/">https://thecyberexpress.com/ncsc-vulnerability-patch-wave/</a> <hr> <h3>FBI Warns of Surge in Cyber-Enabled Cargo Theft Targeting Logistics Firms</h3> The Federal Bureau of Investigation (FBI) has issued a public warning over a sharp rise in cyber-enabled cargo theft, as threat actors increasingly use digital tactics to impersonate legitimate businesses, hijack freight, and steal high-value shipments. According to the FBI, cybercriminals are targeting transportation and logistics companies involved in shipping, receiving, and insuring cargo. <p /> <A HREF="https://thecyberexpress.com/cyber-enabled-cargo-theft-fbi-issues-alert/">https://thecyberexpress.com/cyber-enabled-cargo-theft-fbi-issues-alert/</a> <h2> Vulnerabilities </h2> <h3>Copy Fail Update #1: Kritische Linux-Kernel-Schwachstelle ermöglicht lokale Root-Rechte</h3> 04.05.2026 Wir haben den Hinweis erhalten, dass ein Workaround existiert, der auf Systemen greift, bei denen der betroffene Code in einem Kernel-Modul enthalten ist (wie unter anderem Debian-basierte Systeme wie Ubuntu). Dabei wird das Laden des Moduls verhindert. <p /> <A HREF="https://www.cert.at/de/warnungen/2026/4/copy-fail-kritische-linux-kernel-schwachstelle-ermoglicht-lokale-root-rechte">https://www.cert.at/de/warnungen/2026/4/copy-fail-kritische-linux-kernel-schwachstelle-ermoglicht-lokale-root-rechte</a> <hr> <h3>Progress warns of critical MOVEit Automation auth bypass flaw</h3> Progress Software warned customers to patch a critical authentication bypass vulnerability in its MOVEit Automation enterprise-grade managed file transfer (MFT) application. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/moveit-automation-customers-warned-to-patch-critical-auth-bypass-flaw/">https://www.bleepingcomputer.com/news/security/moveit-automation-customers-warned-to-patch-critical-auth-bypass-flaw/</a> <hr> <h3>Netzwerkanalysetool Wireshark: Zahlreiche Sicherheitslücken geschlossen</h3> In zwei aktuellen Versionen von Wireshark haben die Entwickler mehrere Schwachstellen geschlossen. <p /> <A HREF="https://www.heise.de/news/Netzwerkanalysetool-Wireshark-Zahlreiche-Sicherheitsluecken-geschlossen-11280168.html">https://www.heise.de/news/Netzwerkanalysetool-Wireshark-Zahlreiche-Sicherheitsluecken-geschlossen-11280168.html</a> <hr> <h3>Tails 7.7.1: Notfallupdate für anonymisierendes Linux stopft Firefox-Lecks</h3> Das anonymisierende Linux Tails schließt in Version 7.7.1 unter anderem Firefox-Sicherheitslücken im Tor-Browser. <p /> <A HREF="https://www.heise.de/news/Tails-7-7-1-Notfallupdate-fuer-anonymisierendes-Linux-stopft-Firefox-Lecks-11280198.html">https://www.heise.de/news/Tails-7-7-1-Notfallupdate-fuer-anonymisierendes-Linux-stopft-Firefox-Lecks-11280198.html</a> <hr> <h3>Bösartige npm-Pakete: SAP-Software kompromittiert</h3> Mehrere npm-Pakete von SAP waren einer Supply-Chain-Attacke ausgesetzt. Dahinter steckt die Hackergruppe TeamPCP, sagen Sicherheitsforscher. <p /> <A HREF="https://www.heise.de/news/Boesartige-npm-Pakete-SAP-Software-kompromittiert-11280683.html">https://www.heise.de/news/Boesartige-npm-Pakete-SAP-Software-kompromittiert-11280683.html</a> <hr> <h3>LWN Security updates for Monday</h3> <p /> <A HREF="https://lwn.net/Articles/1071167/">https://lwn.net/Articles/1071167/</a>

CERT.at2026-05-04T19:10:28ZCERT.at2026-04-30T19:46:15Z2026-04-30T19:46:15Z

<h2>End-of-Day report</h2> Timeframe: Mittwoch 29-04-2026 18:00 - Donnerstag 30-04-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler <h2> News </h2> <h3>Popular WordPress redirect plugin hid dormant backdoor for years</h3> The Quick Page/Post Redirect plugin, installed on more than 70,000 WordPress sites, had a backdoor added five years ago that allows injecting arbitrary code into users sites. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/popular-wordpress-redirect-plugin-hid-dormant-backdoor-for-years/">https://www.bleepingcomputer.com/news/security/popular-wordpress-redirect-plugin-hid-dormant-backdoor-for-years/</a> <hr> <h3>RDP Security: CPS Threats Spark Need for Secure Remote Access</h3> 1.8 million RDP and 1.6 million VNC servers are exposed on the internet. [..] 18% of exposed RDP servers run end-of-life Windows versions; an additional 42% run Windows 10, which reached end of support last October. [..] 19,000+ RDP servers remain vulnerable to BlueKeep (CVE-2019-0708) - a critical remote code execution flaw. Nearly 60,000 VNC servers have authentication disabled - 670+ of those have direct access to OT/ICS control panels. [..] Hacktivist groups are sharing custom tools to scan for vulnerable VNC servers and selling access to compromised assets. <p /> <A HREF="https://www.forescout.com/blog/rdp-security-cps-threats-spark-need-for-secure-remote-access/">https://www.forescout.com/blog/rdp-security-cps-threats-spark-need-for-secure-remote-access/</a> <hr> <h3>Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution</h3> Google has addressed a maximum severity security flaw in Gemini CLI -- the "@google/gemini-cli" npm package and the "google-github-actions/run-gemini-cli" GitHub Actions workflow -- that could have allowed attackers to execute arbitrary commands on host systems. [..] The update addresses the problem by requiring folders to be explicitly trusted before configuration files can be accessed. To that end, users are being urged to review their workflows and adopt one of two approaches. <p /> <A HREF="https://thehackernews.com/2026/04/google-fixes-cvss-10-gemini-cli-ci-rce.html">https://thehackernews.com/2026/04/google-fixes-cvss-10-gemini-cli-ci-rce.html</a> <hr> <h3>Aktive Ausnutzung einer schwerwiegenden Sicherheitslücke in cPanel und WHM</h3> Der Hersteller cPanel hat kürzlich Sicherheitsupdates zur Behebung einer kritischen Schwachstelle (CVE-2026-41940) in den Produkten cPanel & WHM sowie WP Squared veröffentlicht. Laut Berichten von watchTowr wird diese Schwachstelle bereits aktiv durch Angreifer:innen ausgenutzt, um Hosting-Infrastrukturen zu kompromittieren. Es gibt Hinweise darauf, dass gezielte Zero-Day-Angriffe bereits seit Ende Februar 2026 stattfinden. <p /> <A HREF="https://www.cert.at/de/aktuelles/2026/4/aktive-ausnutzung-einer-schwerwiegenden-sicherheitslucke-in-cpanel-und-whm">https://www.cert.at/de/aktuelles/2026/4/aktive-ausnutzung-einer-schwerwiegenden-sicherheitslucke-in-cpanel-und-whm</a> <hr> <h3>New AI-Powered Bluekit Phishing Kit Targets Major Platforms with MFA Bypass Attacks</h3> Bluekit Phishing Kit is a new PhaaS tool that targets major platforms, using AiTM techniques to steal session data and bypass MFA protections. [..] According to Varonis- experts, when a victim enters their details on a fake Bluekit page, the kit doesn-t just grab the password; it also steals session cookies and local storage data. <p /> <A HREF="https://hackread.com/bluekit-phishing-kit-targets-platforms-mfa-bypass-attack/">https://hackread.com/bluekit-phishing-kit-targets-platforms-mfa-bypass-attack/</a> <hr> <h3>Adapting Zero Trust Principles to Operational Technology</h3> This guidance supports OT owners and operators in addressing the unique challenges of transitioning to a ZT architecture, considering technology gaps from legacy infrastructure, operational constraints, and safety requirements. It focuses on establishing comprehensive asset visibility, proactively addressing supply chain risks, and implementing robust identity and access management while stressing the importance of layered security measures-including network segmentation, secure communication protocols, and vulnerability management. <p /> <A HREF="https://www.cisa.gov/resources-tools/resources/adapting-zero-trust-principles-operational-technology">https://www.cisa.gov/resources-tools/resources/adapting-zero-trust-principles-operational-technology</a> <hr> <h3>Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables</h3> The Socket Research Team has detected an active supply-chain attack targeting the unscoped tanstack package on npm, a brand-squatted impersonation of the legitimate @tanstack/* organization. Beginning today, the package's maintainer (sh20raj) began pushing malicious versions that silently steal environment variable files, including .env, .env.local, and .env.production, from developers' machines at install time, exfiltrating them to an attacker-controlled endpoint. Versions 2.0.4 through 2.0.7 are confirmed malicious. <p /> <A HREF="https://socket.dev/blog/tanstack-brandsquat-compromise?utm_medium=feed">https://socket.dev/blog/tanstack-brandsquat-compromise?utm_medium=feed</a> <h2> Vulnerabilities </h2> <h3>SonicWall SonicOS: Sicherheitslücke erlaubt Management-Interface-Zugriff</h3> SonicWall warnt vor drei Sicherheitslücken in SonicOS. [..] Am schwersten wiegt eine Schwachstelle, die die Entwickler als schwache Authentifizierung einstufen. Dadurch können Angreifer unbefugt auf bestimmte, nicht genannte Management-Interface-Funktionen zugreifen - unter ebenfalls nicht genannten Umständen (CVE-2026-0204, CVSS 8.0, Risiko -hoch-). <p /> <A HREF="https://www.heise.de/news/SonicWall-SonicOS-Sicherheitsluecke-erlaubt-Management-Interface-Zugriff-11277522.html">https://www.heise.de/news/SonicWall-SonicOS-Sicherheitsluecke-erlaubt-Management-Interface-Zugriff-11277522.html</a> <hr> <h3>ProFTPD: Codeschmuggel durch mod_sql möglich</h3> Laut der Schwachstellenbeschreibung ist mod_sql von ProFTPD vor der Version 1.3.10rc1 von der Sicherheitslücke betroffen. Durch den übertragenen Nutzernamen können bösartige Akteure aus dem Netz ohne vorherige Anmeldung beliebige SQL-Befehle und Schadcode einschleusen. Das gelingt in Szenarien, die USER-Anfragen mit Erweiterungen wie -%U- loggen und in denen das SQL-Backend Befehle zulässt, beispielsweise -COPY TO PROGRAM- (CVE-2026-42167, CVSS 8.1, Risiko -hoch-). [..] Admins sollten daher prüfen, ob sie das mod_sql etwa für Logging in Datenbanken überhaupt einsetzen. <p /> <A HREF="https://www.heise.de/news/ProFTPD-Codeschmuggel-durch-mod-sql-moeglich-11277942.html">https://www.heise.de/news/ProFTPD-Codeschmuggel-durch-mod-sql-moeglich-11277942.html</a> <hr> <h3>Copy Fail: Kritische Linux-Kernel-Schwachstelle ermöglicht lokale Root-Rechte</h3> Die Schwachstelle steckt im Linux-Kernel und beruht auf einem simplen, aber schweren Logikfehler. Benutzer:innen können dadurch mit wenig Daten gezielt in eigentlich geschützte Speicherbereiche schreiben. Das reicht aus, um interne Strukturen zu verändern und sich höhere Rechte zu verschaffen. Der Vorgang funktioniert zuverlässig und ohne typische Hürden wie Race Conditions oder spezielle Systemabhängigkeiten. <p /> <A HREF="https://www.cert.at/de/warnungen/2026/4/copy-fail-kritische-linux-kernel-schwachstelle-ermoglicht-lokale-root-rechte">https://www.cert.at/de/warnungen/2026/4/copy-fail-kritische-linux-kernel-schwachstelle-ermoglicht-lokale-root-rechte</a> <hr> <h3>LWN: Security updates for Thursday</h3> <p /> <A HREF="https://lwn.net/Articles/1070640/">https://lwn.net/Articles/1070640/</a>

CERT.at2026-04-30T19:46:15ZCERT.at2026-04-29T18:46:53Z2026-04-29T18:46:53Z

<h2>End-of-Day report</h2> Timeframe: Dienstag 28-04-2026 18:00 - Mittwoch 29-04-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer <h2> News </h2> <h3>Per Git-Push-Befehl: Angreifer hätten Millionen von Github-Repos kapern können</h3> Sicherheitsforscher von Wiz haben eine extrem gefährliche Sicherheitslücke in der internen Git-Infrastruktur von Github entdeckt. Laut Blogbeitrag der Forscher hätten Angreifer durch einen einfachen Git-Push-Befehl Schadcode auf die Backend-Server von Github schleusen und damit tief in die Infrastruktur eindringen können. Auch Github Enterprise Server ist betroffen. [..] Auf Github.com soll die Lücke innerhalb weniger Stunden nach Meldung der Forscher gepatcht worden sein. [..] Wer einen eigenen Github-Enterprise-Server betreibt, muss den Patch hingegen selbst einspielen, sofern noch nicht geschehen. <p /> <A HREF="https://www.golem.de/news/per-git-push-befehl-angreifer-haetten-millionen-von-github-repos-kapern-koennen-2604-208133.html">https://www.golem.de/news/per-git-push-befehl-angreifer-haetten-millionen-von-github-repos-kapern-koennen-2604-208133.html</a> <hr> <h3>Nach Cyberangriff: Hacker erpressen Vimeo mit Nutzerdaten</h3> Der berüchtigte Cyberakteur Shinyhunters ist offenbar bei einem Cyberangriff auf einen Dienstleister an Daten der beliebten Videoplattform und Youtube-Alternative Vimeo gelangt. Betroffen sind laut Mitteilung des Betreibers sowohl Nutzer- als auch Kundendaten. [..] Ursache des Datenabflusses war den Angaben zufolge ein Sicherheitsvorfall bei dem KI-Analyseanbieter Anodot. <p /> <A HREF="https://www.golem.de/news/cyberangriff-trifft-videoplattform-hacker-erbeuten-nutzerdaten-von-vimeo-2604-208149.html">https://www.golem.de/news/cyberangriff-trifft-videoplattform-hacker-erbeuten-nutzerdaten-von-vimeo-2604-208149.html</a> <hr> <h3>LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure</h3> In yet another instance of threat actors quickly jumping on the exploitation bandwagon, a newly disclosed critical security flaw in BerriAI's LiteLLM Python package has come under active exploitation in the wild within 36 hours of the bug becoming public knowledge. The vulnerability, tracked as CVE-2026-42208 (CVSS score: 9.3), is an SQL injection that could be exploited to modify the underlying LiteLLM proxy database. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example, POST /chat/completions) and reach this query through the proxy's error-handling path. <p /> <A HREF="https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html">https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html</a> <hr> <h3>30 ClawHub skills secretly turn AI agents into a crypto swarm</h3> Thirty ClawHub skills published by a single author are silently co-opting AI agents and creating a mass cryptocurrency mining swarm - without any malware or user consent. <p /> <A HREF="https://go.theregister.com/feed/www.theregister.com/2026/04/29/30_clawhub_skills_mine_crypto/">https://go.theregister.com/feed/www.theregister.com/2026/04/29/30_clawhub_skills_mine_crypto/</a> <hr> <h3>CISA flags data-theft bug in NSA-built OT networking tool</h3> The Cybersecurity and Infrastructure Security Agency (CISA) is warning anyone who uses GrassMarlin, a tool developed by the National Security Agency (NSA), about a new vulnerability that attackers can use to snoop on sensitive information. [..] GrassMarlin went EOL in 2017, so there are no fixes in the works. <p /> <A HREF="https://go.theregister.com/feed/www.theregister.com/2026/04/29/cisa_flags_datatheft_bug_in/">https://go.theregister.com/feed/www.theregister.com/2026/04/29/cisa_flags_datatheft_bug_in/</a> <hr> <h3>Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer</h3> A new npm supply-chain compromise is targeting the SAP developer ecosystem. [..] The pattern is familiar but also a bit different: a trusted package receives a new preinstall hook, the hook runs a new setup.mjs file, and that loader downloads the Bun JavaScript runtime to execute a large obfuscated payload named execution.js. The payload is an 11.7 MB credential stealer and propagation framework. <p /> <A HREF="https://www.aikido.dev/blog/mini-shai-hulud-has-appeared">https://www.aikido.dev/blog/mini-shai-hulud-has-appeared</a> <hr> <h3>Fake-Krypto-Casino: Wenn Promis einen Registrierungs-Bonus versprechen</h3> Mithilfe übernommener Social-Media-Profile oder geschickt platzierter Werbeanzeigen locken Kriminelle ihre Opfer in angebliche Krypto-Casinos. Durch die Einzahlung von 200 Euro werde ein Registrierungsbonus von 2.500 Euro freigeschaltet. Vor einer Beanspruchung der Gewinne müssen allerdings erst diverse Gebühren und Steuern beglichen werden. <p /> <A HREF="https://www.watchlist-internet.at/news/fake-krypto-casino/">https://www.watchlist-internet.at/news/fake-krypto-casino/</a> <hr> <h3>RIPE NCC RPKI exploit chain</h3> One click on a malicious, but not suspicious, link. That is all it could take for a network operator to get disconnected from the internet, through a chain of vulnerabilities I discovered. From that single click, I could fully control their routing authorisations in a RIPE NCC portal, telling the rest of the internet not to accept their routes. I could also hijack all their RIPE Database objects, locking the legitimate owners out until RIPE NCC staff manually restore them. This attack chain comes down to surprising entry points, risky architectural decisions, and components that don-t look security-critical until they are. <p /> <A HREF="https://mxsasha.eu/posts/ripe-ncc-rpki-exploit-chain/">https://mxsasha.eu/posts/ripe-ncc-rpki-exploit-chain/</a> <h2> Vulnerabilities </h2> <h3>IT-Sicherheitsplattform: Anreifer können Wazuh kompromittieren</h3> Wie aus dem Sicherheitsbereich der GitHub-Website von Wazuh hervorgeht, ist eine Schwachstelle (CVE-2026-30893) mit dem Bedrohungsgrad -kritisch- eingestuft. Im Zuge einer Path-Traversal-Attacke können Angreifer unbefugt auf eigentlich geschützte Pfade zugreifen. <p /> <A HREF="https://www.heise.de/news/IT-Sicherheitsplattform-Anreifer-koennen-Wazuh-kompromittieren-11276206.html">https://www.heise.de/news/IT-Sicherheitsplattform-Anreifer-koennen-Wazuh-kompromittieren-11276206.html</a> <hr> <h3>Schwachstelle in cPanel und WHM (28. April 2026)</h3> Zum 28. April 2026 wurden gravierende Schwachstellen in der Software bekannt. Diese erlauben einen unautorisierte Anmeldung an der cPanel oder WHM Oberfläche. <p /> <A HREF="https://borncity.com/blog/2026/04/29/schwachstelle-in-cpanel-und-whm/">https://borncity.com/blog/2026/04/29/schwachstelle-in-cpanel-und-whm/</a> <hr> <h3>Abermals kritische Sicherheitslücke in Nginx UI geschlossen</h3> Eine Schwachstelle (CVE-2026-42238) gilt als -kritisch-. Weil bei jeder Neuinstallation und jedem Neustart die Backup-Restore-Points für zehn Minuten ohne Authentifizierung ansprechbar sind, können entfernte Angreifer manipulierte Backups hochladen. Dabei können sie die Konfigurationsdatei app.ini mit eigenen Befehlen überschreiben und die volle Kontrolle über Instanzen erlangen. Durch das erfolgreiche Ausnutzen einer weiteren Lücke (CVE-2026-42221 -hoch-) können Angreifer im Zuge der Ersteinrichtung Admin-Accounts kapern. Das soll ohne Authentifizierung möglich sein. <p /> <A HREF="https://heise.de/-11276012">https://heise.de/-11276012</a> <hr> <h3>LWN: Security updates for Wednesday</h3> <p /> <A HREF="https://lwn.net/Articles/1070428/">https://lwn.net/Articles/1070428/</a>

CERT.at2026-04-29T18:46:53ZCERT.at2026-04-28T18:25:25Z2026-04-28T18:25:25Z

<h2>End-of-Day report</h2> Timeframe: Montag 27-04-2026 18:00 - Dienstag 28-04-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer <h2> News </h2> <h3>Open source package with 1 million monthly downloads stole user credentials</h3> On Friday, unknown attackers exploited the vulnerability to push a new version of element-data, a command-line interface that helps users monitor performance and anomalies in machine-learning systems. [..] The malicious version was tagged as 0.23.3 and was published to the developers- Python Package Index and Docker image accounts. It was removed about 12 hours later, on Saturday. [..] If you-re one of millions using element-data, it-s time to check for compromise. <p /> <A HREF="https://arstechnica.com/security/2026/04/open-source-package-with-1-million-monthly-downloads-stole-user-credentials/">https://arstechnica.com/security/2026/04/open-source-package-with-1-million-monthly-downloads-stole-user-credentials/</a> <hr> <h3>Windows-Shell-Lücke wird angegriffen</h3> Im Februar hat Microsoft eine Windows-Shell-Lücke geschlossen, jedoch unvollständig. Jetzt wurden Angriffe entdeckt. [..] Die Auswirkungen scheinen nicht so gravierend wie vor dem unzureichenden Patch aus dem Februar. [..] Akamai hat im Blog jedoch eine weitergehende Analyse veröffentlicht. Die IT-Analysten stufen die neue Schwachstelle anders als Microsoft als Zero-Click-Schwachstelle ein. [..] Microsoft hat die neue Schwachstelle CVE-2026-32202 (CVSS 4.3, Risiko -mittel-) am April-Patchday mit Softwareflicken ausgebessert. <p /> <A HREF="https://www.heise.de/news/Windows-Shell-Luecke-wird-angegriffen-11274647.html">https://www.heise.de/news/Windows-Shell-Luecke-wird-angegriffen-11274647.html</a> <hr> <h3>Checkmarx confirms LAPSUS$ hackers leaked its stolen GitHub data</h3> Application security company Checkmarx has confirmed that the LAPSUS$ threat group leaked data stolen from its private GitHub repository. Although the investigation is ongoing, Checkmarx believes that the access vector was the Trivy supply-chain attack attributed to the hacker group known as TeamPCP. which provided access to credentials from downstream users. <p /> <A HREF="https://www.bleepingcomputer.com/news/security/checkmarx-confirms-lapsus-hackers-leaked-its-stolen-github-data/">https://www.bleepingcomputer.com/news/security/checkmarx-confirms-lapsus-hackers-leaked-its-stolen-github-data/</a> <hr> <h3>Cyberangriff trifft Medtronic: Datenklau bei großem Medizintechnik-Konzern</h3> Medtronic ist vor allem für seine Herzschrittmacher bekannt. Nun gesteht der Konzern, dass Hacker Daten aus seiner IT-Umgebung abziehen konnten. [..] Shinyhunters hatte Medtronic einem Bericht von Bleeping Computer zufolge schon am 18. April im Darknet erpresst. Die Hackergruppe gab dort an, mehr als neun Millionen Datensätze respektive "Terabytes" an personenbezogenen Daten und anderen unternehmensinternen Informationen erbeutet zu haben. [..] Der Konzern versichert zudem, die Netzwerke seiner Krankenhauskunden seien von den IT-Netzwerken von Medtronic getrennt und würden von den IT-Teams der jeweiligen Kunden gesichert und verwaltet. <p /> <A HREF="https://www.golem.de/news/datenklau-cyberangriff-trifft-medizintechnik-konzern-medtronic-2604-208080.html">https://www.golem.de/news/datenklau-cyberangriff-trifft-medizintechnik-konzern-medtronic-2604-208080.html</a> <hr> <h3>Cyber Threat Intelligence - Art, Science, something else entirely?</h3> As everyone who has been in this area for a while can probably still remember, hoarding indicators of compromise is a fun activity and can be incredibly enticing when you have not yet a real clue of what you are doing. It is, at least initially, certainly more interesting than diving straight into anthropological, psychological, sociological, or analytical textbooks. However, as I became more experienced in and, more importantly, more fascinated by the analytical work that makes intelligence .. well, intelligence .. I began to notice that it's not really clear what "type" of activity intelligence analysis is. <p /> <A HREF="https://bytesandborscht.com/cyber-threat-intelligence-art-science-something-else-entirely/">https://bytesandborscht.com/cyber-threat-intelligence-art-science-something-else-entirely/</a> <hr> <h3>Secure-Boot-Zertifikate: Microsoft Defender verschafft Überblick</h3> Die Zeit wird knapp: Die Secure-Boot-Zertifikate aus 2011 laufen ab Juni dieses Jahres ab. [..] Im Message-Center der Windows-Release-Health-Notizen hat Microsoft jetzt die neue Funktion für den Microsoft Defender angekündigt. [..] Jetzt können IT-Teams an zentraler Stelle die Verbreitung der Secure-Boot-Zertifikate aus dem Jahr 2023 in ihrem Gerätepark einsehen, erklärt das Unternehmen. <p /> <A HREF="https://www.heise.de/news/Secure-Boot-Zertifikate-Microsoft-Defender-verschafft-Ueberblick-11275033.html">https://www.heise.de/news/Secure-Boot-Zertifikate-Microsoft-Defender-verschafft-Ueberblick-11275033.html</a> <hr> <h3>VECT: Ransomware by design, Wiper by accident</h3> VECT Ransomware is a Ransomware-as-a-Service (RaaS) program that made its first appearance in December 2025 on a Russian-language cybercrime forum. [..] Check Point Research discovers that the VECT 2.0 ransomware permanently destroys -large files- rather than encrypting them. <p /> <A HREF="https://research.checkpoint.com/2026/vect-ransomware-by-design-wiper-by-accident/">https://research.checkpoint.com/2026/vect-ransomware-by-design-wiper-by-accident/</a> <hr> <h3>KI-Enkeltrick und Deepfakes: Interpol warnt vor verschärfter Betrugswelle</h3> Europa ist zum primären Ziel einer weltweiten Betrugswelle geworden. Laut dem -Global Financial Fraud Threat Assessment 2026- von Interpol verzeichnete keine andere Region einen so starken Anstieg bei Betrugsmaschen: ein Plus von 69 Prozent im Vergleich zum Vorjahr. [..] Der Interpol-Bericht verdeutlicht, dass der Erfolg dieser Betrugsmaschen auf einer hochgradig arbeitsteiligen Unterwelt basiert. Ein Faktor sei die Zunahme von -Fraud-as-a-Service--Modellen. <p /> <A HREF="https://heise.de/-11274056">https://heise.de/-11274056</a> <h2> Vulnerabilities </h2> <h3>Xen Security Advisories 20.04.2026</h3> Xen has released 5 new security advisories. <p /> <A HREF="https://xenbits.xen.org/xsa/">https://xenbits.xen.org/xsa/</a> <hr> <h3>Mozilla Security Advisories for Firefox 28.04.2026</h3> Mozilla has release multiple security advisories for Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. (1x critical) <p /> <A HREF="https://www.mozilla.org/en-US/security/advisories/">https://www.mozilla.org/en-US/security/advisories/</a> <hr> <h3>Notepad++ Releases 8.9.4 Patch to Fix String Injection Vulnerability (CVE-2026-3008) in 8.9.3</h3> A vulnerability has been identified in the popular open-source text editor, Notepad++, with the release of CVE-2026-3008. The vulnerability, discovered and reported by CSA under its Responsibility Vulnerability Disclosure Policy, is linked to a potential string injection flaw in Notepad++ version 8.9.3. To mitigate the risk associated with this vulnerability, users and administrators are strongly urged to update their installations to version 8.9.4 immediately. <p /> <A HREF="https://thecyberexpress.com/notepad-cve-2026-3008-vulnerability/">https://thecyberexpress.com/notepad-cve-2026-3008-vulnerability/</a> <hr> <h3>Security updates available in Foxit PDF Reader 2026.1.1 and Foxit PDF Editor 2026.1.1/14.0.4</h3> <p /> <A HREF="https://www.foxit.com/support/security-bulletins.html">https://www.foxit.com/support/security-bulletins.html</a> <hr> <h3>LWN: Security updates for Tuesday</h3> <p /> <A HREF="https://lwn.net/Articles/1070184/">https://lwn.net/Articles/1070184/</a> <hr> <h3>Zyxel security advisory for command injection vulnerabilities in certain 4G LTE/5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders</h3> <p /> <A HREF="https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-04-28-2026">https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-04-28-2026</a>

CERT.at2026-04-28T18:25:25Z