CERT.at - Tagesberichte

Tageszusammenfassung - 05.10.2026

CERT.at — Mon, 05 Oct 2026 17:40:46 GMT+0100

End-of-Day report

Timeframe: Freitag 02-10-2026 18:00 - Montag 05-10-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer

News

Cyberangriff: Antriebssystem eines Öl-Supertankers gehackt

Unbekannte haben offenbar im Sommer Zugriff auf das Antriebssystem eines Öl-Supertankers gehabt, als dieser sich der Küste des US-Bundestaats Texas näherte. Das berichtet Transport Topics unter Berufung auf nicht näher genannte Quellen bei US-Behörden. Der Vorfall, der als Cyberangriff eingestuft wird, wird demnach von der US-Bundespolizei FBI sowie der US-Küstenwache untersucht.

https://www.golem.de/news/cyberangriff-antriebssystem-eines-oel-supertankers-gehackt-2610-213707.html

OpenAI alerts 100+ orgs that its misaligned models attempted to break in - or worse

OpenAI's agents have repeatedly strayed beyond their intended scope. Two separate reports detail the activity, including one from Sam Altman-s company saying it has notified more than 100 organizations about potentially problematic model activity.

https://www.theregister.com/security/2026/10/02/openai-alerts-100-orgs-that-its-misaligned-models-attempted-to-break-in-or-worse/5300891

Create automatic IP blocklist in OPNsense based on MISP data

This blog post is about creating an automatic IP blocklist in OPNsense based on MISP data, including data retention.

https://lithilion.at/blog/2026-10-misp-blocklisting.html

Nach Muse: Auch ChatGPT-App für macOS war angreifbar

Agentische Tools, die direkt auf dem Rechner laufen, benötigen oft weitreichende Zugriffsrechte. Das macht sie potenziell angreifbar. Nachdem der macOS-Security-Spezialist Patrick Wardle kürzlich eine potenziell durch Dritte ausnutzbare Hintertür in Metas Muse-App für den Mac entdeckt hatte, warnt dieser nun vor einem ähnlichen Problem in der konkurrierenden ChatGPT-App für macOS von OpenAI: Auch hier war es Angreifern möglich, sensible Informationen abzugreifen. [..] OpenAI hat das Problem Ende September mit einer Aktualisierung behoben, nachdem Wardle das Unternehmen darüber informiert hatte.

https://www.heise.de/news/Nach-Muse-Auch-ChatGPT-App-fuer-macOS-war-angreifbar-11475385.html

Raiffeisen-Phishing: Vorsicht bei Mitteilung zu neuem Dauerauftrag

Aktuell kursiert eine Phishing-Mail im Namen von Raiffeisen. Sie behauptet, ein neuer Dauerauftrag sei eingerichtet worden und müsse geprüft werden. Wer dem Link folgt, landet auf einer gefälschten Seite und soll dort seine Daten preisgeben.

https://www.watchlist-internet.at/news/raiffeisen-mail-zu-dauerauftrag/

N0n ransomware: what you need to know

N0n is a newly-emerged cyber extortion gang. The group was first spotted in the middle of September 2026, and within days it had published on its dark web leak site details of what it claimed to be around a dozen victims. Since then, the tally has continued to grow.

https://www.fortra.com/blog/n0n-ransomware-what-you-need-know

Japan Plans Major Cyber Hunt to Detect Hidden Attacks on Critical Infrastructure

Japan is stepping up its plans to find cyber attackers who may already be inside the networks that keep essential services running. Under a new fiscal 2027 initiative, the government plans to work with private companies to strengthen Japan threat hunting across critical infrastructure, including power utilities and telecommunications operators.

https://thecyberexpress.com/japan-threat-hunting-plan/

Google Suspends Open Source Bug Bounty Over AI-Generated Reports

Google has suspended its Open Source Software Vulnerability Rewards Program (OSS VRP), a vulnerability search initiative that paid researchers for finding flaws in the companys open-source software. The pause took effect on October 1, 2026. Google blamed a "significant rise" in automated and AI-generated reports, most of which turned out to be invalid.

https://thecyberexpress.com/google-pauses-oss-vrp-over-ai-submissions/

Vulnerabilities

New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

Citrix has released security updates for a high-severity security flaw in NetScaler ADC and Citrix NetScaler Gateway that has been exploited as part of targeted zero-day attacks. The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0." [..] For successful exploitation, NetScaler ADC or NetScaler Gateway must be configured either as a SAML service provider (SP) or SAML identity provider(IdP).

https://thehackernews.com/2026/10/new-netscaler-zero-day-exploited-in.html

Microsoft schiebt Exchange-Update nach

Zum Wochenende hat Microsoft weitere Exchange-Updates nachgelegt. [..] Aufgrund einer schwachen Autorisierung in Microsofts Exchange-Server können authentifizierte Angreifer aus dem Netz ihre Rechte ausweiten. Die Entwickler führen aus, dass bösartige Akteure dadurch unbefugten Zugriff auf Mailboxen anderer User erlangen und E-Mails und Anhänge daran lesen können. Tenant-Grenzen lassen sich dadurch jedoch nicht überwinden (CVE-2026-96940, CVSS 8.8, Risiko -hoch-).

https://www.heise.de/news/Microsoft-schiebt-Exchange-Update-nach-11475517.html

Security updates for Monday

https://lwn.net/Articles/1098599/

Tageszusammenfassung - 02.10.2026

CERT.at — Fri, 02 Oct 2026 17:11:50 GMT+0100

End-of-Day report

Timeframe: Donnerstag 01-10-2026 18:00 - Freitag 02-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler

News

Microsoft-s X account hacked in crypto pump-and-dump scheme

On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token.

https://www.bleepingcomputer.com/news/security/microsofts-x-account-hacked-in-crypto-token-pump-and-dump-scheme/

Hackerangriff: Pentagon verliert Daten von mehr als drei Millionen Personen

Unbefugte haben rund neun Monate lang Zugriff auf einen Server mit Personaldaten. Die Daten auf dem Server des Pentagon sind unverschlüsselt.

https://www.golem.de/news/hackerangriff-pentagon-verliert-daten-von-mehr-als-drei-millionen-personen-2610-213641.html

Warlock ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries

The group is exploiting a variety of vulnerabilities impacting Microsoft SharePoint, according to a new report from Symantec Threat Hunter Team.

https://therecord.media/warlock-ransomware-used-in-critical-infrastructure-attacks

Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739)

During a Purple Team engagement, we had to list and rank risky components across the network. One of them caught our attention: Cato Client, a VPN client program. It was installed everywhere. It runs privileged services. It talks to a GUI. It handles network configuration. From an attacker perspective, this is exactly the kind of software you want to understand. However, saying "this looks risky" is not enough. There is nothing better than PoC||GTFO. So the question was simple: can we find a real bug and turn it into something useful? This is how it started.

http://blog.quarkslab.com/cato-vpn-client-split-tunnel-and-privilege-escalation-cve-2026-10739.html

Vulnerabilities

Dell asks admins to patch max severity CSM flaws as soon as possible

Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments.

https://www.bleepingcomputer.com/news/security/new-max-severity-dell-csm-flaws-give-hackers-admin-privileges/

FortiMail: Angriffe auf Zero-Day-Lücke laufen, Workaround verfügbar

Fortinet warnt vor Angriffen auf eine Zero-Day-Sicherheitslücke in FortiMail. Sie ermöglicht die Übernahme der Geräte aus dem Netz.

https://heise.de/-11473599

LWN Security updates for Friday

https://lwn.net/Articles/1098312/

[R1] Nessus Version 10.12.5 Fixes Multiple Vulnerabilities

https://www.tenable.com/security/tns-2026-26

Tageszusammenfassung - 01.10.2026

CERT.at — Thu, 01 Oct 2026 17:47:37 GMT+0100

End-of-Day report

Timeframe: Mittwoch 30-09-2026 18:00 - Donnerstag 01-10-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

Over 543,000 valid credentials exposed in public GitHub repositories

More than 543,000 credentials exposed in public GitHub repositories were still valid in July despite the platforms security measures to prevent accidental leaks of sensitive data.

https://www.bleepingcomputer.com/news/security/over-543-000-valid-credentials-exposed-in-public-github-repositories/

Revolut zahlt kein Lösegeld: Hackergruppe erpresst Revolut-Kunden direkt

Die Geschichte rund um den Revolut-Hack aus dem vergangenen Monat geht weiter, bei dem Unbefugte an Bankdaten von Kunden gelangt sind. Nachdem die Neobank ein gefordertes Lösegeld von 3 Millionen US-Dollar nicht zahlte, versuchen Kriminelle, die erbeuteten Daten zu Geld zu machen, indem Revolut-Kunden direkt erpresst werden, berichtet unter anderem das Cybergrant-Blog. Nach derzeitigem Kenntnisstand sind 680 Revolut-Kunden von dem Vorfall betroffen.

https://www.golem.de/news/revolut-zahlt-kein-loesegeld-hackergruppe-erpresst-revolut-kunden-direkt-2610-213607.html

From: anyone@icloud.com - Absenderfälschung in Apple iCloud

Eine Fallstudie über die Entdeckung zweier E-Mail-Spoofing-Schwachstellen in Apple iCloud.

https://sec-consult.com/de/blog/detail/from-anyoneicloudcom-absenderfaelschung-in-apple-icloud/

SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor

During recent website cleanup work, we analyzed a WordPress compromise where the same backdoor kept returning within seconds of every removal, no matter how carefully the visible files were deleted. Throughout this article, we-ll refer to this family of malware as SC, named after the -SC_- markers found in the injected content.What makes SC worth documenting is how it survives.

https://blog.sucuri.net/2026/09/sc-wordpress-malware-a-self-healing-mesh-of-loaders-drop-ins-and-a-blockchain-controlled-backdoor.html

Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path

Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals. The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the memory corruption into a working exploit is separate work the analysis does not demonstrate.

https://thehackernews.com/2026/10/apple-coregraphics-poc-emerges-as.html

NIS2 Registrierung in Österreich. Wie gehe ich richtig vor?

Seit dem 1. Oktober 2026 gelten für viele österreichische Unternehmen neue Vorgaben durch NIS2. Betroffene Unternehmen müssen dann technische und organisatorische Sicherheitsmaßnahmen umsetzen, die Verantwortung der Geschäftsführung beachten und sich beim Bundesamt für Cybersicherheit (BCS) registrieren. Dieser Leitfaden erklärt, wer sich registrieren muss, welche Informationen dafür nötig sind und wie Unternehmen dabei am besten vorgehen.

https://www.zettasecure.com/post/nis2-registrierung-%C3%B6sterreich-anleitung

Zu viele KI-Vorfälle: US-Behörde untersucht Anthropic, METR, OpenAI

Zu häufig richten große Sprachmodelle Schaden an. Daher führt die US-Handelsbehörde FTC eine Untersuchung gegen große KI-Betreiber.

https://heise.de/-11471857

Vulnerabilities

Kiteworks patches max severity code injection vulnerability

Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution. [..] Successful exploitation can let remote threat actors without privileges gain code execution and take over the targeted EPG appliance by exploiting a chain of path traversal, code injection, and missing authentication in low-complexity attacks that don't require user interaction. CVE-2026-54154

https://www.bleepingcomputer.com/news/security/kiteworks-patches-max-severity-email-protection-gateway-code-injection-vulnerability/

Vulnerabilities in Zammad during investigation of case DIVD-2026-00014

During the investigation of case DIVD-2026-00014, two new CVEs were identified. CVE-2026-102489 - Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. [..] CVE-2026-102490 - In all versions of Zammad including the latest alpha has an vulnerability which enables the local zammad user to escalate privileges to root.

https://csirt.divd.nl/cases/DIVD-2026-00015/

WatchGuard schließt teils kritische Lücken in Fireware OS

Das Betriebssystem Fireware OS von WatchGuard weist Sicherheitslücken auf, die Angreifern aus dem Netz unter anderem das Einschleusen und Ausführen von Schadcode oder Denial-of-Service-Attacken ermöglichen. Sie gelten zum größten Teil als hochriskant und in einem Fall sogar als kritisch.

https://www.heise.de/news/WatchGuard-schliesst-teils-kritische-Luecken-in-Fireware-OS-11472101.html

Tageszusammenfassung - 30.09.2026

CERT.at — Wed, 30 Sep 2026 17:27:33 GMT+0100

End-of-Day report

Timeframe: Dienstag 29-09-2026 18:00 - Mittwoch 30-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler

News

New Spectre v2 attack variant leaks Linux root password hash in minutes

A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average.

https://www.bleepingcomputer.com/news/security/new-spectre-v2-attack-variant-leaks-linux-root-password-hash-in-minutes/

Phishing Abuses RMM Tools for Persistent Access

In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management (RMM) installer through meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. [..] This activity highlights how threat actors continue to abuse legitimate remote administration software to blend into normal IT operations while maintaining persistent access and reducing detection opportunities.

https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/

Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services

The public still doesn-t know who is abusing a critical Citrix vulnerability exploited as a zero-day weeks before disclosure, but we now know that the unknown digital intruders have used CVE-2026-88772 to break into government agencies, financial services firms, education organizations, and legal and professional services sectors across North America and Europe. And everyone agrees that the vendor took way too long to disclose the security holes.

https://www.theregister.com/security/2026/09/29/custom-malware-used-in-citrix-0-day-attacks-targeting-govt-banks-professional-services/5299867

Hackers Use Hijacked University Emails to Scam Students, Pose as FBI Agent

Students, job seekers and university staff, watch out for fake job offers sent from legitimate university email accounts.

https://hackread.com/hackers-hijacked-university-email-scam-students-fbi-agent/

Fake Express Packages on npm Spread a Linux Worm

Nine npm packages hide a self-spreading Linux worm. The npm account dirtyblanket published all nine on September 29, 2026, in 33 minutes. Eight of them copy the popular Express framework. One copies React.

https://safedep.io/dirtyblanket-express-impersonation-npm

CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode

Jamf Threat Labs uncovers CloudSyncD, a fake Zoom installer disguised as a legitimate application that uses a phished login password to launch an embedded backdoor while concealing the credential inside a decoy configuration file.

https://www.jamf.com/blog/cloudsyncd-macos-backdoor-fake-zoom-installer/

Vulnerabilities

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. [..] In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. CVE-2026-76504

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU

TeamViewer: Security Update for Multiple Vulnerabilities in TeamViewer Clients and Related Services

TeamViewer has released security updates addressing multiple vulnerabilities affecting TeamViewer Full Client and Host and related services. These vulnerabilities have been resolved in the latest available versions. TeamViewer strongly recommends that all users update to the latest available version as soon as possible.

https://www.teamviewer.com/en-us/resources/trust-center/security-bulletins/tv-2026-1010/

MikroTik RouterOS

Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. [..] Initial Release Date: 2026-09-29 [..] CVE-2026-84411

https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06

Kritische Schwachstelle: Google stopft 32 Löcher in Chrome

Die kritische Lücke mit der Kennung CVE-2026-102331 beschreibt Google in den Versionshinweisen als Pufferüberlauf. Betroffen ist die Grafikkomponente Angle. Laut CVE.org kann der Fehler mithilfe einer speziell präparierten HTML-Datei ausgenutzt werden. Ein Angreifer müsste ein Opfer also lediglich dazu verleiten, eine von ihm kontrollierte Website mit Chrome zu öffnen.

https://www.golem.de/news/kritische-schwachstelle-google-stopft-32-loecher-in-chrome-2609-213576.html

OpenSSL Security Advisory [29th September 2026]

https://openssl-library.org/news/secadv/20260929.txt

LWN: Security updates for Wednesday

https://lwn.net/Articles/1097753/

Tageszusammenfassung - 29.09.2026

CERT.at — Tue, 29 Sep 2026 17:59:20 GMT+0100

End-of-Day report

Timeframe: Montag 28-09-2026 18:00 - Dienstag 29-09-2026 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer

News

Cyberangriff auf Datenaustauschdienst FTAPI

Der Münchner Anbieter FTAPI bietet Dienste zur einfachen Übertragung von Daten an. Zur Kundschaft zählen etwa Behörden und Unternehmen. Die kriminelle Online-Bande The Gentlemen hat nun auf ihrer Darknet-Leaksite einen Einbruch in die IT-Systeme von FTAPI behauptet.

https://heise.de/-11469629

Over 16,000 Supabase databases expose PII, passwords, auth tokens

Researchers found more than 16,000 misconfigured Supabase databases exposing readable tables with personally identifiable information, passwords, or authentication tokens.

https://www.bleepingcomputer.com/news/security/misconfigured-supabase-apps-expose-data-in-over-16-000-databases/

Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks

Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis.

https://thehackernews.com/2026/09/hackers-use-needymantis-to-maintain.html

ShinyHunters weiter aktiv, Details zu FBI-Datendiebstahl

Offenbar hat die Cybergang ShinyHunters wirklich beim FBI Daten gestohlen. Die kriminelle Bande ist derzeit weiter umtriebig.

https://www.heise.de/news/ShinyHunters-weiter-aktiv-Details-zu-FBI-Datendiebstahl-11469449.html

Digitale Gesundheitsanwendungen: HelloBetter meldet Datenpanne nach Cyberangriff

Aufgrund einer Schwachstelle konnten Unbekannte auf sensible Nutzerdaten eines Anbieters digitaler Therapieprogramme zugreifen.

https://heise.de/-11469296

Vulnerabilities

Apple patches CoreGraphics zero-day flaw exploited in attacks

Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices.

https://www.bleepingcomputer.com/news/security/apple-patches-coregraphics-zero-day-flaw-exploited-in-attacks/

Zero-Day-Lücke: Kiteworks rät Kunden zur Abschaltung von Servern

Der Softwareanbieter Kiteworks hat seinen Kunden Ende vergangener Woche empfohlen, ihre auf Software des Unternehmens basierenden Systeme offline zu nehmen. Zuvor hatte der Anbieter von Sicherheitsanwendungen eine nach seiner Einschätzung "glaubwürdige Bedrohungsinformation" von US-Sicherheitsbehörden erhalten. Demnach bestand ein konkretes Risiko für Cyberangriffe auf Kiteworks-Nutzer.

https://www.golem.de/news/zero-day-luecke-kiteworks-raet-kunden-zur-abschaltung-von-servern-2609-213545.html

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real service, the SDK's maintainers said in a security advisory. Affected versions sent the client secret, the authorization code, and the PKCE proof key to a token endpoint the attacker controlled. The fix is in versions 1.30.0 and 2.2.0.

https://thehackernews.com/2026/09/official-mcp-python-sdk-flaw-can-let.html

Groupware Zimbra: Update schließt zahlreiche Sicherheitslücken

Ein Update schließt diverse Lücken in Zimbra, die etwa die Kontoübernahme oder das Unterschieben von Schadcode ermöglichen.

https://www.heise.de/news/Groupware-Zimbra-Update-schliesst-zahlreiche-Sicherheitsluecken-11468996.html

WatchGuard AP: Befehlsschmuggel-Lücken und umgehbare Authentifizierung

In den Access-Points von WatchGuard schlummern drei Sicherheitslücken, durch die Angreifer Befehle einschmuggeln oder die Authentifizierung umgehen können. Eine aktualisierte Firmware bessert die teils als kritisches Risiko eingestuften Schwachstellen aus.

https://heise.de/-11468944

LWN Security updates for Tuesday

https://lwn.net/Articles/1097466/

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006

https://webkitgtk.org/security/WSA-2026-0006.html

MISP 2.5.48 - AImageddon security roundup release

https://github.com/MISP/MISP/releases/tag/v2.5.48

Tageszusammenfassung - 28.09.2026

CERT.at — Mon, 28 Sep 2026 17:49:25 GMT+0100

End-of-Day report

Timeframe: Freitag 25-09-2026 18:00 - Montag 28-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler

News

Wegen KI Bug Reports: Ubuntu liefert wöchentlich neuen Kernel

KI treibt die Anzahl gemeldeter Bugs in die Höhe. Damit Ubuntu-Nutzer Korrekturen schnell bekommen, beschleunigt Canonical seine Prozesse.

https://www.golem.de/news/wegen-ki-bug-reports-ubuntu-liefert-woechentlich-neuen-kernel-2609-213490.html

Studie zu KI-Agenten: Wenn die KI ihre Abschaltung als Mordversuch sabotiert

Nicht alle KI-Systeme wollen sich einfach wie ein PC herunterfahren lassen. Vor allem, wenn mehrere KI-Agenten kollaborieren sollen. [..] Konkret beobachteten die Forscher in dem Setting sechs Tendenzen der Systeme. Demnach nimmt die Sabotage mit der Irreversibilität des Abschaltmechanismus und der Zahl der beteiligten Agenten zu. Ein explizites Verbot reduziert die Sabotageversuche, eliminiert sie jedoch nicht. [..] Ebenfalls bemerkenswert: Wenn ein KI-Agent einen anderen Agenten abschalten sollte, der diesem nicht bekannt war, sank die Sabotagerate ebenfalls.

https://www.golem.de/news/studie-zu-ki-agenten-wenn-die-ki-ihre-abschaltung-als-mordversuch-sabotiert-2609-213492.html

Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution.

https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html

Fake Google Security Team ad says no script reading in voice phishing - then prints the script

Yes, criminals have job listings too. A Telegram user recruiting callers to work in an apparent Google Security Team voice-phishing scam told applicants that they weren-t allowed to read from scripts - in the same ad that also included the exact script they had to read during these scam calls.

https://www.theregister.com/security/2026/09/25/fake-google-security-team-ad-says-no-script-reading-in-voice-phishing-then-prints-the-script/5299264

OpenAI pausiert KI-Training nach neuem Zwischenfall

Der ChatGPT-Entwickler OpenAI hat nach einem neuen Zwischenfall das Training seiner leistungsstärksten KI-Modelle ausgesetzt. Bei dem Vorfall schaffte es ein KI-Modell in einem Test, Antworten von einem externen Chatbot zu bekommen, obwohl es eigentlich keinen Internet-Zugang haben sollte. Die Software habe jedoch eine Lücke in den Netzwerk-Einstellungen gefunden und ausgenutzt, wie OpenAI in einem Blogeintrag berichtete. Das Training solle nun erst wieder aufgenommen werden, wenn man sich sicher sei, dass die Lücke geschlossen ist.

https://www.heise.de/news/OpenAI-pausiert-KI-Training-nach-neuem-Zwischenfall-11467188.html

Kurtaxe und Servicepauschale: Angebliche Doppelbuchung führt in Phishing-Falle

Rückbuchungen von der ÖGK oder dem Finanzamt werden seit gefühlten Ewigkeiten als Köder für Betrugsmaschen eingesetzt. Kürzlich wurde eine andere Variante der Falle gemeldet. Im Zentrum stehen diesmal ein Hotel sowie eine doppelte Berechnung von Kurtaxe und Servicepauschale. Am Ziel hat sich nichts geändert: Angestrebt werden der Zugriff auf das Onlinebanking des Opfers sowie die Freigabe einer Überweisung.

https://www.watchlist-internet.at/news/kurtaxe-und-servicepauschale-doppelbuchung-phishing/

KI-Betrug bei italienischer Großbank: 95 Mio Euro erbeutet

Der Betrug begann im Februar. Der damalige Fideuram-Vorsitzende Paolo Molesini erhielt über WhatsApp eine Nachricht, die scheinbar vom Chef von Intesa Sanpaolo, Carlo Messina, stammte. Darin wurde er um dringende Unterstützung bei einer Auslandsüberweisung gebeten. Kurz darauf folgte ein Anruf, der angeblich von einem ranghohen Mitarbeiter einer bekannten Anwaltskanzlei kam. Der Anrufer bestätigte den Auftrag. Nach Angaben der Quellen setzten die Täter dabei künstliche Intelligenz ein, um die Stimme des Anwalts nachzuahmen.

https://www.derstandard.at/story/3000000341451/ki-betrug-bei-italienischer-gro223bank-95-mio-euro-erbeutet

Tech Support Scam Kit Uses Google Ads to Deliver Fake Security Alerts

A tech support scam kit is using Google Ads to deliver fake security alerts that make browsers appear locked while using techniques to evade automated analysis. [..] The ads appeared through normal advertising inventory on legitimate maps, weather, real-estate, document-hosting, and sports sites. It is worth noting that the publishers were not compromised. Netskope traced most of the traffic to paid Google Ads rather than organic searches, based on Google advertising identifiers found in the URLs.

https://hackread.com/tech-support-scam-kit-google-ads-fake-security-alerts/

LuaRocks Security Incident September 2026

On September 25th, 2026 we received a report of a remote code execution vulnerability in LuaRocks.org, coordinated through CISA. The vulnerability was fixed on September 26th. While investigating, we found that it had been exploited on the LuaRocks.org server several times between July 9th and August 20th, 2026. [..] We have not found any evidence that existing packages were modified. Details on what we checked are below.

https://luarocks.org/security-incident-september-2026

Vulnerabilities

Kritische Sicherheitslücken in Citrix NetScaler ADC und NetScaler Gateway - aktiv ausgenutzt - Updates verfügbar

In Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt. CVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778 CVSS v4.0 Base Scores: bis zu 9.5 (kritisch)

https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar

Elementor WordPress flaw lets attackers create admin accounts

Threat actors can exploit the flaw by tricking a logged-in administrator into opening a malicious link, causing the victim's authenticated session to perform a REST API action permitted by their account. On default installations, the result is the creation of an administrator account under the control of the attacker. [..] Security firm Patchstack reported the vulnerability to the Elementor team on September 22 after receiving it from bug hunter -Saggre.- Elementor released a fix two days later, in version 4.3.2 of the plugin.

https://www.bleepingcomputer.com/news/security/elementor-wordpress-flaw-lets-attackers-create-admin-accounts/

Notepad++ 8.9.8.1: Update schließt mehrere Sicherheitslücken

Das Zwischen-Release 8.9.8.1 kümmert sich dabei um gleich fünf Schwachstellen. Immerhin gilt keine davon als hohes oder kritisches Risiko. Nutzer sollten die Aktualisierung bei Gelegenheit anwenden.

https://www.heise.de/news/Notepad-8-9-8-1-Update-schliesst-mehrere-Sicherheitsluecken-11467765.html

LWN: Security updates for Monday

https://lwn.net/Articles/1097191/

Tageszusammenfassung - 25.09.2026

CERT.at — Fri, 25 Sep 2026 17:13:05 GMT+0100

End-of-Day report

Timeframe: Donnerstag 24-09-2026 18:00 - Freitag 25-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler

News

CRA - Reporting: The first two weeks

The CRA-SRP (Single Reporting Platform) started operating two weeks ago, and we now have some experience with the system. There are multiple angles to this.

https://www.cert.at/en/blog/2026/9/cra-reporting-the-first-two-weeks

Phishing-Angriffe mit echten Hotel-Buchungsdaten

Über eine Schwachstelle bei HotelNetSolutions wurden Buchungsdaten von Hotelgästen abgegriffen. Kriminelle nutzen sie für glaubhafte Phishing-Nachrichten.

https://heise.de/-11466446

Betreiber Kritischer Infrastruktur sollen in Österreich Flugdrohnen abschießen

Nähern sich verdächtige Flugdrohnen Kritischer Infrastruktur, soll deren Betreiber die Drohnen vom Himmel holen. Lizenzen dafür sind in Österreich geplant.

https://heise.de/-11465199

Bevorstehender Zero-Day-Angriff: KiteWorks drängt Kunden zur Serverabschaltung

Man habe konkrete Hinweise von Strafverfolgern auf eine Attacke, schreibt der Hersteller seinen Kunden. Auch hierzulande sind große Unternehmen betroffen.

https://www.heise.de/news/Bevorstehender-Zero-Day-Angriff-KiteWorks-draengt-Kunden-zur-Serverabschaltung-11466114.html

New Carbonato malware uses AI agents to hijack exposed Docker hosts

A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control.

https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/

MacSync malware uses public iCloud calendars to deliver new payloads

A new variant of the MacSync info-stealing malware targeting macOS systems now uses public iCloud calendar events to deliver fresh payloads.

https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/

Muse leakt Systemdateien: Metas KI-Agent gibt auf Anfrage sein Dateisystem aus

Ein Entwickler hat Metas KI-Agent Muse 6,8 GByte an Daten aus seiner Betriebsumgebung entlockt. Laut Meta ist das ein erwartetes Verhalten.

https://www.golem.de/news/muse-leakt-systemdateien-metas-ki-agent-gibt-auf-anfrage-sein-dateisystem-aus-2609-213429.html

Beyond the ransomware: Tracking Storm-2570-s consistent tradecraft across deployments

Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to help defenders detect and disrupt this activity before ransomware deployment.The post Beyond the ransomware: Tracking Storm-2570-s consistent tradecraft across deployments appeared first on Microsoft Security Blog.

https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/

Cloudflare Fixes Flaw That Let One Container Read Another Customers Leftover Disk Data

A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday.

https://thehackernews.com/2026/09/cloudflare-fixes-flaw-that-let-one.html

CVE flood pushes Ubuntu onto weekly kernel release cycle

AI-assisted bug hunting is helping pile up vulnerabilities faster than defenders can patch them, so Canonical is picking up the pace.

https://www.theregister.com/os-platforms/2026/09/24/cve-flood-pushes-ubuntu-onto-weekly-kernel-release-cycle/5298912

Decades-old file security flaws found in Android, Linux, macOS, and Windows

Security researchers report that Microsoft considers the side-channel leak of file events to be by design.

https://www.theregister.com/security/2026/09/24/decades-old-file-security-flaws-found-in-android-linux-macos-and-windows/5298672

Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing

SalesBleed security flaws lead to very unexpected consequences.

https://www.theregister.com/security/2026/09/24/salesforce-agentforce-vulns-allowed-0-click-crm-data-theft-anonymous-phishing/5298958

It was a matter of when, not if...

Security people always say it-s not a matter of if, but when you get hacked. It took us (almost) seven years but we can now say that we-re the hackers that got hacked. We noticed suspicious activity, investigated, and came to the inevitable conclusion that damn, we got hacked.

https://csirt.divd.nl/2026/09/24/when-not-if/

Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud

Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

https://socket.dev/blog/mini-shai-hulud-actions?utm_medium=feed

Vulnerabilities

VU#234131: ViewSonic vCast media streaming service allows unauthenticated screen exfiltration and device compromise

ViewSonic vCast software, which is included in ViewBoard smartboard devices, contains multiple vulnerabilities that an attacker can chained to achieve full device compromise.

https://kb.cert.org/vuls/id/234131

Sicherheitslücken: GitLab-Server mit Schadcode attackierbar

Die GitLab-Entwickler raten zur zügigen Installation der jüngst veröffentlichten Sicherheitsupdates.

https://www.heise.de/news/Sicherheitsluecken-GitLab-Server-mit-Schadcode-attackierbar-11465889.html

Video-Tool VLC: Version 3.0.24 stopft über 130 Sicherheitslecks

Der Videoplayer VLC ist in Version 3.0.24 erschienen. Mehr als 130 Sicherheitslücken soll das Release schließen.

https://heise.de/-11465305

LWN Security updates for Friday

https://lwn.net/Articles/1096637/

Tageszusammenfassung - 24.09.2026

CERT.at — Thu, 24 Sep 2026 18:17:07 GMT+0100

End-of-Day report

Timeframe: Mittwoch 23-09-2026 18:00 - Donnerstag 24-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler

News

Theres a new way to break RSA thats faster than anything weve seen before

The world has known for decades that the RSA cryptosystem-s days are numbered. Once quantum computing becomes practical (estimates for that range from 3 to 20 or more years), the foundational security it provides will crumble. New research has revealed a novel method that uses classical computing to reduce the current RSA security level to an unacceptably low threshold. The practical risk is limited, but still significant.

https://arstechnica.com/security/2026/09/theres-a-new-way-to-break-rsa-thats-faster-than-anything-weve-seen-before/

Hackers now exploit critical Roundcube flaw in code injection attacks

In May, the Roundcube security team patched the flaw (tracked as CVE-2026-48842), describing it as a pre-authenticated SQL injection in the virtuser_query built-in plugin, which handles database-driven user lookups and maps users to email addresses.

https://www.bleepingcomputer.com/news/security/critical-roundcube-flaw-now-actively-exploited-in-code-injection-attacks/

A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You

The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you. GitLab shows each user this address behind a button labeled "Email work item to this project." Mail sent to it opens an issue in that project, authored by you.

https://thehackernews.com/2026/09/a-leaked-gitlab-issue-email-address.html

Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure

Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure.The vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE).

https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html

OpenAI-Agent knackt australisches Regierungsportal

Eine KI sollte Gesundheitsstatistiken suchen - und knackte dabei ein australisches Regierungsportal. Die Empörung ist groß.

https://heise.de/-11463920

Bypassing EDR with Local AI

How hard is it to bypass EDR in the modern times with AI? As it turns out, not very hard.

https://projectblack.io/blog/bypassing-edr-with-local-ai/

Vulnerabilities

Foxit: Security updates available in Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1/14.0.8

Foxit has released Foxit PDF Reader 2026.2.1 and Foxit PDF Editor 2026.2.1/14.0.8, which addresses potential security and stability issues.

https://www.foxit.com/support/security-bulletins.html

Drupal Security Advisories 2026-September-23

Drupal released 36 new security advisories (5x critical).

https://www.drupal.org/security

Sicherheitspatch gegen Schadcode repariert SolarWinds Observability Self-Hosted

In SolarWinds Observability Self-Hosted 2026.2.3 haben die Entwickler eigenen Angaben zufolge zwei Schwachstellen geschlossen (CVE-2026-28324 -kritisch- CVE-2026-28325, -hoch-). In beiden Fällen können Angreifer unter den jeweils genannten Bedingungen ohne Authentifizierung an den Schwachstellen ansetzen und Schadcode ausführen - bei CVE-2026-28324 übers Netz, bei CVE-2026-28325 nur aus einem benachbarten Netzsegment. Die Ursachen unterscheiden sich jedoch: Bei CVE-2026-28324 sind Integritätsprüfungen unzureichend; CVE-2026-28325 betrifft die Verarbeitung nicht vertrauenswürdiger Daten durch Deserialisierung. Hinweise auf laufende Attacken gibt es bislang nicht.

https://heise.de/-11464112

Imprivata Enterprise Access Management (EAM) does not rotate RSA keys

https://kb.cert.org/vuls/id/273940

LWN: Security updates for Thursday

https://lwn.net/Articles/1096407/

Tageszusammenfassung - 23.09.2026

CERT.at — Wed, 23 Sep 2026 18:27:04 GMT+0100

End-of-Day report

Timeframe: Dienstag 22-09-2026 18:00 - Mittwoch 23-09-2026 18:00 Handler: Guenes Holler Co-Handler: n/a

News

Ab 1.10: Meldepflicht für IT-Vorfälle in Österreich

Die NIS-2-Richtlinie beschert Österreich Registrierungspflichten für Unternehmen und Behörden. Diese erhalten Zuwachs: Das neue Bundesamt für Cybersicherheit.

https://www.heise.de/news/Ab-1-10-Meldepflicht-fuer-IT-Vorfaelle-in-Oesterreich-11462442.html

Gefälschter FinanzOnline-Mail: 3.612 Euro Steuererstattung versprochen

Mit einer neuen Variante des bekannten FinanzOnline-Phishings versuchen Kriminelle derzeit, an Bankdaten von Österreicher:innen zu gelangen. In einer gefälschten E-Mail wird eine Steuererstattung von 3.612 Euro versprochen.

https://www.watchlist-internet.at/news/gefaelschter-finanzonline-mail/

Hacker dringen in Systeme von Fresenius Medical Care ein

Medizinische Geräte, Patientenversorgung, Produktion und laufender Geschäftsbetrieb sollen laut Konzern nicht beeinträchtigt sein.

https://www.derstandard.at/story/3000000340976/hacker-dringen-in-systeme-von-fresenius-medical-care-ein

Microsoft: September Windows updates break Always On VPN connections

Microsoft has notified IT administrators that users may experience Always On VPN connection issues after installing the September 2026 Windows 11 security updates.

https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-windows-updates-break-always-on-vpn-connections/

Absturzgefahr: Exploit lässt Angreifer DJI-Drohnen mitten im Flug kapern

Mehrere Drohnenmodelle des Herstellers DJI sind anfällig für eine gefährliche Sicherheitslücke, die eine vollständige Kontrollübernahme ermöglicht. Nutzer sollten nach korrigierten Firmware-Versionen Ausschau halten.

https://www.golem.de/news/per-bluetooth-exploit-laesst-angreifer-dji-drohnen-mitten-im-flug-kapern-2609-213353.html

Macfinger ClickFix campaign, (Tue, Sep 22nd)

I've found several legitimate websites with injected script for a campaign using the ClickFix social engineering technique. This particular ClickFix campaign was documented earlier this month on the Ransom-ISAC Blog, but it doesn't appear to have a nickname yet. Since this campaign is targeting macOS environments through a fingerprinting process, I'm calling it the "Macfinger ClickFix" campaign. No, this is not related to the MacFinger utility from decades ago. Instead, think of the movie Goldfinger, but with macOS malware and the internet instead of James Bond and Miss Galore.

https://isc.sans.edu/diary/rss/33360

Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape

A use-after-free in the Linux kernels AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm DepthFirst said in research published September 22.The flaw, tracked as CVE-2026-80521 (CVSS score: 7.8), was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases.

https://thehackernews.com/2026/09/exploit-released-for-unpatched-ubuntu.html

Recent Increase of Hybrid Attacks Against Defense Sector in Europe

Recently, a wave of sabotage attacks has been reported in Europe. In most cases Russia is suspected to be responsible. These events follow a broader pattern of hybrid activity directed at European infrastructure, logistics networks, and organizations supporting Ukraine.

https://www.truesec.com/hub/blog/recent-increase-of-hybrid-attacks-against-defense-sector-in-europe

Iranian Cyber Espionage Campaign

An Iranian threat actor is conducting a cyber espionage campaign targeting Iranian nationals abroad. The attacker reaches out to the victim on various messaging apps, like Telegram or Whatsapp. The actor often claims to be an individual previously known to the target or technical support from the social messaging platform.

https://www.truesec.com/hub/blog/iranian-cyber-espionage-campaign

Vulnerabilities

Cyberangriffe auf F5 BIG-IP, Check Point Security und Arista VeloCloud

IT-Verantwortliche müssen rasch handeln, um bereitgestellte Aktualisierungen zu installieren. Mehrere IT-Sicherheitsbehörden warnen vor derzeit laufenden Angriffen auf Sicherheitslücken in F5 BIG-IP, Check Point Security Gateway und Management sowie Arista VeloCloud Orchestrator On-Premise.

https://heise.de/-11462590

Patchday: Adobe Connect ist unter Android, macOS und Windows verwundbar

Es sind wichtige Sicherheitsupdates für verschiedene Adobe-Anwendungen erschienen.

https://heise.de/-11462802

NetBSD 10.2 stopft einige Sicherheitslücken

NetBSD ist jüngst als Point-Release 10.2 erschienen. Die Entwickler schließen damit einige Sicherheitslücken.

https://heise.de/-11463028

Gleich noch ein Sicherheitsupdate für WordPress

Angreifer können WordPress dazu bringen, nicht vorgesehene .php-Dateien aufzurufen. Das kann zur Ausführung von Code führen.

https://heise.de/-11462385

Ubiquiti schließt Denial-of-Service-Lücken in Firewalls und Gateways

In UniFi-Firewalls und -Gateways klaffen hochriskante Denial-of-Service-Lücken. Aktualisierte Firmware stopft die Lecks.

https://heise.de/-11463176

LWN Security updates for Wednesday

https://lwn.net/Articles/1096191/

Tageszusammenfassung - 22.09.2026

CERT.at — Tue, 22 Sep 2026 17:29:18 GMT+0100

End-of-Day report

Timeframe: Montag 21-09-2026 18:00 - Dienstag 22-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler

News

"Bundesamt für Cybersicherheit" geht mit Oktober an den Start

Leiter Markus Kasinger war zuvor bei Austrian Power Grid. Zu den Aufgaben gehört die Weiterentwicklung der nationalen Cybersicherheitsstrategie.

https://www.derstandard.at/story/3000000340881/bundesamt-fuer-cybersicherheit-geht-mit-oktober-an-den-start

New Windows Defender zero-day blocks Microsoft antivirus updates

Over the weekend, security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released another Microsoft Defender zero-day exploit that blocks antivirus updates.

https://www.bleepingcomputer.com/news/security/new-windows-defender-zero-day-blocks-microsoft-antivirus-updates/

Politik: EU-Kommission will Europol-Datenbefugnisse ausweiten

Ein Verordnungsentwurf sieht den Abbau von Schutzmechanismen bei Europol vor, um KI-Systeme anlasslos mit Daten zu speisen.

https://www.golem.de/news/politik-eu-kommission-will-europol-datenbefugnisse-ausweiten-2609-213296.html

Smart-TVs: Youtuber entfernt WLAN-Modul aus neuem LG-TV

Nach Berichten über Spionagefunktionen entfernt ein Youtuber Hardwarekomponenten aus seinem LG OLED G6. Der Fernseher funktioniert weiterhin.

https://www.golem.de/news/smart-tvs-youtuber-entfernt-wlan-modul-aus-neuem-lg-tv-2609-213299.html

Unmasking EvilTokens: Getting to the root of device code phishing

EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption of EvilTokens infrastructure and operations.The post Unmasking EvilTokens: Getting to the root of device code phishing appeared first on Microsoft Security Blog.

https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/

Microsoft wirft SMS-basierte Authentifizierung aus Entra ID raus

Microsofts Identitätsverwaltung und Login-Lösung Entra ID erlaubt die Authentifizierung mit SMS. Das soll bald ein Ende haben.

https://heise.de/-11461055

Vulnerabilities

Sicherheitsupdates: Click2Shell-Lücke zum Kompromittieren von WordPress-Websites

Aufgrund mehrerer Sicherheitslücken raten die WordPress-Entwickler zu einem zügigen Update. Bislang gibt es keine Hinweise auf Attacken.

https://heise.de/-11460973

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating system (OS) command execution.

https://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.html

D-Link warns of max severity zero-day bug in DIR-822A routers

D-Link warned customers of a maximum-severity vulnerability (CVE-2026-86296) with public proof-of-concept (PoC) exploit code and no patch, affecting legacy DIR-822A dual-band Wi-Fi routers.

https://www.bleepingcomputer.com/news/security/d-link-warns-of-max-severity-zero-day-bug-in-dir-822a-routers/

New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22. The flaw, tracked as CVE-2026-93952, may allow a remote attacker with no login access to privilege internal functions and affect the VCO host. Only orchestrators set up to authenticate their Edges with certificates are exposed. As of September 22, fixed releases are out for the 5.2 and 6.4 release trains, but not yet for the 6.1 and 7.0 trains. Arista has already patched the Hosted and Dedicated versions of VCO. The affected releases include those that fixed a different VCO flaw, which Arista reported as exploited in July.

https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html

LWN Security updates for Tuesday

https://lwn.net/Articles/1096022/

Tageszusammenfassung - 21.09.2026

CERT.at — Mon, 21 Sep 2026 17:17:55 GMT+0100

End-of-Day report

Timeframe: Freitag 18-09-2026 18:00 - Montag 21-09-2026 18:00 Handler: Guenes Holler Co-Handler: n/a

News

Cyberangriff trifft Universität: LMU München bestätigt Abfluss von Studentendaten

Ein Angreifer ist an persönliche Daten von Studenten der Ludwig-Maximilians-Universität München gelangt. Auch Bankdaten sollen betroffen sein.

https://www.golem.de/news/cyberangriff-trifft-universitaet-lmu-muenchen-bestaetigt-abfluss-von-studentendaten-2609-213255.html

Hackerangriff auf die GUTcert; Kundendaten abgeflossen

Unschöne Nachricht für Kunden, die sich über die GUTcert einer Zertifizierung unterzogen haben. Der Anbieter ist Opfer eines Hackerangriffs geworden, bei dem auch Kundendaten abgeflossen sind. Betroffene scheinen vom Unternehmen gerade informiert zu werden, wie ein Leser mir heute mitteilte.

https://borncity.com/blog/2026/09/20/hackerangriff-auf-die-gutcert-kundendaten-abgeflossen/

Gyazo server flaw exploited to steal 23.6 million user records

The Gyazo image-sharing platform has confirmed it suffered a data breach after hackers exploited a server vulnerability that allowed them to steal 23.6 million user records.

https://www.bleepingcomputer.com/news/security/gyazo-server-flaw-exploited-to-steal-236-million-user-records/

ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operations data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service.

https://www.bleepingcomputer.com/news/security/shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang/

North Korean WaterPlum hackers infected 30,000 devices worldwide

A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to North Korea.

https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/

Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects.

https://securelist.com/tr/payload-ransomware-via-group-policy/121335/

CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18.

https://thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts.

https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html

Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We detail a few of the more notable intrusions we observed including the theft of more than 18,000 sensitive records from a western government.

https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation

EU prüft OpenAI nach nicht gemeldetem Sicherheitsvorfall

Nach einem Vorfall beim Software-Register RubyGems meldete OpenAI diesen nicht der EU. Die europäischen Behörden prüfen nun die Einhaltung des AI Acts.

https://heise.de/-11458971

Cisco Zero-Day Highlights API Endpoint Authentication Issues

The authentication bypass flaw CVE-2026-76460 impacts Ciscos Identity Services Engine (ISE) and received a maximum 10 out of 10 CVSS score.

https://www.darkreading.com/vulnerabilities-threats/cisco-zero-day-api-endpoint-authentication-issues

Vulnerabilities

Behörde warnt: Angriffe auf Lücken im Linux-Kernel beobachtet

Die Cisa warnt vor laufenden Angriffen auf Linux-Systeme über drei gefährliche Sicherheitslücken in Kernel-Komponenten. Korrekturen sind verfügbar.

https://www.golem.de/news/behoerde-warnt-angriffe-auf-luecken-im-linux-kernel-beobachtet-2609-213261.html

Synology warnt: Kritische NAS-Lücken ermöglichen Datenklau

Angreifer können durch mehrere Sicherheitslücken lesend und schreibend auf NAS-Geräte von Synology zugreifen. Patches sind verfügbar.

https://www.golem.de/news/synology-warnt-kritische-nas-luecken-ermoeglichen-datenklau-2609-213268.html

Werbeblocker Pi-hole: Update stopft Codeschmuggel-Lücken

Ein Update für den DNS-basierten Werbeblocker Pi-hole schließt teils hochriskante Codeschmuggel-Lücken.

https://www.heise.de/news/Werbeblocker-Pi-hole-Update-stopft-Codeschmuggel-Luecken-11459820.html

Fremdzugriffe auf SolarWinds Access Rights Manager vorstellbar

Ein Sicherheitspatch schließt eine Schwachstelle in SolarWinds Access Rights Manager. Bislang gibt es keine Hinweise auf Attacken.

https://heise.de/-11459978

LWN Security updates for Monday

https://lwn.net/Articles/1095702/

Tageszusammenfassung - 18.09.2026

CERT.at — Fri, 18 Sep 2026 17:28:09 GMT+0100

End-of-Day report

Timeframe: Donnerstag 17-09-2026 18:00 - Freitag 18-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler

News

Schockanrufe: Wenn Angst und Zeitdruck zur Falle werden

In einer bundesweiten Kampagne informiert das Bundeskriminalamt gemeinsam mit Partnerorganisationen über die zunehmende Gefahr sogenannter Schockanrufe. Dabei werden nicht nur die Methoden organisierter Tätergruppen näher beleuchtet, zusätzlich gibt es auch Tipps, wie Sie Schockanrufe frühzeitig erkennen und richtig reagieren. Ziel der Kampagne ist es, insbesondere ältere Menschen sowie deren Angehörige für die Methoden organisierter Tätergruppen zu sensibilisieren.

https://www.watchlist-internet.at/news/schockanrufe/

New RatHat Android malware uses AI to automate device control

A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices.

https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control/

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel.

https://www.bleepingcomputer.com/news/security/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer/

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a security announcement on September 15.

https://thehackernews.com/2026/09/critical-docker-sandboxes-flaw-lets.html

Researchers find way to listen in on headphones from afar

Eves dropping in on Alice and Bob

https://www.theregister.com/security/2026/09/17/researchers-find-way-to-listen-in-on-headphones-from-afar/5297303

Supply-Chain-Angriff: Quellcode von CrowdSec durch Unbekannte ausgeleitet

Vor vier Monaten gelangten über dreihundert Repositories in fremde Hände. Doch die Auswirkungen des Angriff von Mai schätzt der WAF-Hersteller als gering ein.

https://www.heise.de/news/Supply-Chain-Angriff-Quellcode-von-CrowdSec-durch-Unbekannte-ausgeleitet-11458857.html

Nordkoreanische Cybergruppe bestiehlt IT-Fachleute auf Jobsuche

Sicherheitsbehörden warnen vor einer Cybergruppe aus Nordkorea, die gezielt IT-Spezialisten angreift. Was hinter der Kampagne -Contagious Interview- steckt.

https://heise.de/-11458275

Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation

Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry that could be exploited to achieve privilege escalation. No customer action is required.

https://thehackernews.com/2026/09/microsoft-patches-cvss-100-azure-ai.html

Vulnerabilities

Root-Sicherheitslücke gefährdet Check Point Security Management and Log Servers

Ein Sicherheitsupdate schließt eine kritische Schadcode-Schwachstelle in Check Point Security Management and Log Servers.

https://www.heise.de/news/Root-Sicherheitsluecke-gefaehrdet-Check-Point-Security-Management-and-Log-Servers-11457947.html

Jetzt aktualisieren: Angreifer konnten beliebige Daten von Synology-NAS auslesen

Gleich auf drei verschiedenen Wegen konnten Angreifer Daten von Synology-NAS klauen. Der Hersteller behebt mit einem Flicken auch weniger dringende Lücken.

https://www.heise.de/news/Jetzt-aktualisieren-Angreifer-konnten-beliebige-Daten-von-Synology-NAS-auslesen-11458757.html

100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS

Wordfence Argus discovered a PHP Object Injection vulnerability in Tutor LMS, affecting more than 100,000 WordPress sites. Subscriber-level attackers could achieve remote code execution. Update to version 4.0.8 as soon as possible.

https://www.wordfence.com/blog/2026/09/100000-wordpress-sites-exposed-to-remote-code-execution-via-php-object-injection-vulnerability-found-by-wordfence-argus-in-tutor-lms/

Atlassian: Angreifer können Confluence Data Center ausspionieren

Atlassian hat zahlreiche Sicherheitslücken in Bitbucket, Jira & Co. geschlossen. Admins sollten die verfügbaren Sicherheitspatches zeitnah installieren.

https://heise.de/-11458267

LWN Security updates for Friday

https://lwn.net/Articles/1095219/

Tageszusammenfassung - 17.09.2026

CERT.at — Thu, 17 Sep 2026 17:25:08 GMT+0100

End-of-Day report

Timeframe: Mittwoch 16-09-2026 18:00 - Donnerstag 17-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

Fake-Webseiten: Kriminelle kopieren den Online-Auftritt echter Hotels

Die Absicht ist klar, die momentane Häufung hingegen ein wenig ungewöhnlich. In den letzten Wochen wurden besonders viele Fake-Webseiten gemeldet, die gezielt den Onlineauftritt von (Familien-)Hotels kopieren. Kriminelle wollen damit vorrangig an Kontaktdaten ihrer Opfer gelangen.

https://www.watchlist-internet.at/news/fake-webseiten-echte-hotels/

Cisco warns of max severity ISE zero-day exploited in attacks

The security flaw (tracked as CVE-2026-76460) lets remote attackers bypass authentication by exploiting a weakness in an API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) regardless of configuration. [..] Cisco shared indicators of compromise and advised security teams to look for suspicious usernames in access.log files on every node and "strongly" recommended re-imaging the nodes and restoring them from backups if malicious activity is suspected.

https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-zero-day-exploited-in-attacks/

EU Plans -Article 4--Style Security Protocol for Cyberattacks and Hybrid Threats

European Commission President Ursula von der Leyen has proposed an Emergency Security Protocol that would allow any European Union member state to trigger a coordinated response to security incidents including cyberattacks, sabotage and drone incursions. [..] Under the proposed Emergency Security Protocol, a single member state could trigger the mechanism, prompting all 27 EU governments to convene. The proposed framework would be designed to coordinate a European response, deter further escalation and mitigate the consequences of an incident.

https://thecyberexpress.com/eu-emergency-security-protocol-targets-threats/

OpenAI führt Framework zur Meldung von KI-Sicherheitsvorfällen ein

OpenAI will dem Fehlverhalten seiner eigenen KI-Modelle systematischer auf den Grund gehen. Hierzu wurde jetzt ein neues Framework vorgestellt, das solche Fälle systematisch verfolgen, untersuchen und offenlegen soll. Bislang hatte das US-Unternehmen solche Sicherheitsvorfälle nur auf Ad-hoc-Basis bekanntgegeben. Im dazugehörigen Blogpost bekräftigt OpenAI zugleich Forderungen nach einer Verlangsamung der KI-Weiterentwicklung, wie sie zuletzt auch vom Rivalen Anthropic erhoben wurden, um den Sicherheitsrisiken Rechnung zu tragen, die aus den Fortschritten in der KI erwachsen.

https://www.heise.de/news/OpenAI-fuehrt-Framework-zur-Meldung-von-KI-Sicherheitsvorfaellen-ein-11456751.html

The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents

During our analysis of malware that leverages blockchain networks for its C2 infrastructure, we have discovered a previously unknown modular, multi-stage framework that we dubbed MovieReaper. This report details the new crimeware campaign that began with the mass infection of users via compromised torrent tracker file storage. [..] Further analysis of the attack revealed that the threat actors did not compromise the torrent trackers themselves. Instead, they compromised a widely used public repository of torrent files - itorrents[.]org.

https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/

Revolut phishing texts appear days after data breach

Revolut customers received phishing texts only days after the digital bank acknowledged disclosing customer data to a government impostor.

https://www.malwarebytes.com/blog/threat-intel/2026/09/revolut-phishing-texts-appear-days-after-data-breach

Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen-s infrastructure and evidence of Qilins AI use

In Japan, The Gentlemen was the most active ransomware group in the first half of 2026. Attackers continue to primarily target small- and medium-sized enterprises, with organizations capitalized at less than JPY 1 billion accounting for approximately 80% of the total - an increase of around 13% from the previous year.

https://blog.talosintelligence.com/ransomware-incidents-in-japan-in-the-first-half-of-2026/

GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk

GitHub has added cache-mode to GitHub Actions, a new setting that limits how workflows and jobs can access the Actions cache. It targets cache poisoning, the technique attackers used to compromise the Ultralytics PyPI package in 2024 and the TanStack npm packages in May 2026.

https://socket.dev/blog/github-actions-cache-mode

Vulnerabilities

Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. CVE-2026-81642

https://thehackernews.com/2026/09/critical-unbound-dnssec-validator-flaw.html

BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS

The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH). A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG(0) signature, if the sender closes the connection before named finishes checking the signature.

https://thehackernews.com/2026/09/bind-9-update-fixes-14-flaws-including.html

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013

https://www.drupal.org/sa-core-2026-013

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-005

https://www.drupal.org/sa-core-2022-005

LWN: Security updates for Thursday

https://lwn.net/Articles/1094962/

Tageszusammenfassung - 16.09.2026

CERT.at — Wed, 16 Sep 2026 19:18:03 GMT+0100

End-of-Day report

Timeframe: Dienstag 15-09-2026 18:00 - Mittwoch 16-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

Account-Takeover: Tanz-Voting-Masche hat wieder WhatsApp-Konten im Visier

Eine aus dem Vorjahr bekannte Falle wird aktuell verstärkt ausgespielt. Kriminelle versenden über gehackte WhatsApp-Accounts Nachrichten, die zur Teilnahme an einem Voting drängen. Ziel ist die Übernahme weiterer Konten, die später für den Versand verschiedenster Phishing-Messages missbraucht werden. Was ein Zahnarztbesuch mit der ganzen Sache zu tun hat, verrät der Artikel.

https://www.watchlist-internet.at/news/account-takeover-whatsapp-konten/

Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites

Developer Janis Elsts says an unauthorized party accessed the adminmenueditor.com website on Monday and uploaded version 2.35 as an update for the plugin-s Pro version. The update included an includes/wp-user-consent.php file that installed a web shell on affected websites. After noticing the intrusion, Elsts removed the malicious update and pushed a clean version 2.36 on the same day at 19:00 UTC. However, the hacker still had access to the website and compromised the new version, too.

https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/

Windows Server 2022 reaches end of mainstream support next month

Microsoft has reminded customers that Windows Server 2022 will reach the end of mainstream support next month and enter extended support until October 2031.

https://www.bleepingcomputer.com/news/microsoft/windows-server-2022-reaches-end-of-mainstream-support-next-month/

Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works

A hacker collective pulled down a Flock camera and dumped its data. The files included thousands of videos and logs showing that the device captured 1.6 million images of 50,000 vehicles in 21 days.

https://www.wired.com/story/hackers-flock-camera-data-shows-how-system-works/

Atomic macOS (AMOS) Stealer Activity

This article reviewed an Atomic stealer malware infection from early August 2026. The resulting analysis includes behavior from the infected macOS host, malware samples, post-infection artifacts and traffic patterns that indicate the types of information collected by this malware.

https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/

Securing the unpatchable in an age of AI-driven vulnerabilities

Advances in AI technology will continue to identify vulnerabilities that in some circumstances are difficult, or effectively impossible, to patch. Appropriate network segmentation, rigorous visibility, and the deployment of NGFW/IPS combinations can provide a powerful compensatory layer.

https://blog.talosintelligence.com/securing-the-unpatchable-in-an-age-of-ai-driven-vulnerabilities/

Angreifer attackieren Acronis Backup für cPanel/WHM und Plesk

Aufgrund von laufenden Attacken müssen Admins Acronis Backup für cPanel/WHM und Plesk aktualisieren.

https://heise.de/-11454681

Vulnerabilities

Cisco Security Advisories 2026 Sep 16

Cisco has release 13 new CRITICAL security advisories for Secure Firewall Management Center, Identity Services Engine and Nexus Dashboard.

https://sec.cloudapps.cisco.com/security/center/publicationListing.x

Oracle Critical Security Patch Update Advisory - September 2026

This Critical Security Patch Update contains 673 new security patches across the product families listed below.

https://www.oracle.com/security-alerts/cspusep2026.html

Google Pixel owners urged to patch actively exploited modem flaw

Google-s September Pixel update fixes 110 vulnerabilities, including a modem flaw being used in limited, targeted attacks.

https://www.malwarebytes.com/blog/mobile/2026/09/google-pixel-owners-urged-to-patch-actively-exploited-modem-flaw

LWN: Security updates for Wednesday

https://lwn.net/Articles/1094720/

Tageszusammenfassung - 15.09.2026

CERT.at — Tue, 15 Sep 2026 18:16:38 GMT+0100

End-of-Day report

Timeframe: Montag 14-09-2026 18:00 - Dienstag 15-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

Eine Phishing-Mail, vier Fallen, drei Sprachen - Wenn Kriminelle schlampig arbeiten

Betrugsmaschen im Namen von FinanzOnline gehören zu den absoluten Dauerbrennern und werden laufend gemeldet. Weil den Kriminellen bei der Erstellung einer aktuellen Masche aber einige Fehler unterlaufen sind, bleiben die dazugehörigen Erfolgsaussichten relativ gering. Analyse eines betrügerischen Hoppalas.

https://www.watchlist-internet.at/news/wenn-kriminelle-schlampig-arbeiten/

Twitch extension with 30K installs exposes users- OAuth tokens

A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users Twitch OAuth session tokens to a commercial bot service.

https://www.bleepingcomputer.com/news/security/twitch-extension-with-30k-installs-exposes-users-oauth-tokens/

Confidential Computing gebrochen: DDRop-Angriff ermöglicht Datenklau in der Cloud

Damit DDRop erfolgreich ausgeführt werden kann, ist ein physischer Zugriff auf die Serverhardware erforderlich, um das von den Forschern entwickelte Interposer-Gerät zu installieren. [..] Hinter DDRop steckt ein Team aus neun Sicherheitsforschern von Google, der ETH Zürich, der KU Leuven sowie der Durham University. Sie entwickelten ein Gerät, das für den Angriff erforderlich ist. [..] Wie die Forscher auf einer Informationsseite zu DDRop schildern, kann das Gerät Schreibvorgänge im Arbeitsspeicher "verschwinden lassen", indem es absichtlich einen Paritätsfehler einschleust. Dadurch soll das Speichermodul die Schreibbefehle verwerfen, wovon der Prozessor aber wohl nichts mitbekommt.

https://www.golem.de/news/confidential-computing-gebrochen-ddrop-angriff-ermoeglicht-datenklau-in-der-cloud-2609-213031.html

The Ghost in the Chat: how a bot that isn't in your group steals messages from Telegram HTML exports

A stored XSS in Telegram Desktop's HTML export pipeline lets a bot that never joins your group plant invisible JavaScript in an inline keyboard button. The payload sleeps in message history for months and detonates the moment a participant exports the chat and opens the HTML file - every message rendered in that document can be shipped to the attacker's server, and the page itself can be rewritten. [..] Telegram shipped a fix in July, but the app update does not update files exported with earlier versions, so old HTML exports can still carry the script.

https://expatch.com/writeups/telegram-html-export-xss.html

HBO Max Reddit account compromised to serve ClickFix attacks

Someone compromised the official HBO Max Reddit account and used it to push more than 100 malicious ads serving up ClickFix attacks targeting both Windows and macOS devices with information-stealing malware. A Reddit user uncovered the infostealer ads on September 6, noting that the ad showed u/hbomax as the author - this is the verified HBO Max account - and advertised a macOS app for HBO Max.

https://www.theregister.com/cyber-crime/2026/09/14/hbo-max-reddit-account-compromised-to-serve-clickfix-attacks/5296408

Angriff auf Verschlüsselung: Netzrechtler fordern EU-Eingreifen gegen Kanada

Ein internationales Bündnis aus Zivilgesellschaft und Datenschutzorganisationen wendet sich in einem offenen Brief an die EU-Spitze. Anlass ist Kanadas umstrittener Gesetzentwurf C-22 (Lawful Access Act), der vor dem Beschluss im Senat steht. Was wie eine nationale Angelegenheit wirkt, entpuppt sich laut dem Schreiben als extraterritorialer Zugriff auf die digitale Sicherheit auch in Europa. [..] Besonders alarmierend ist laut der Allianz die Gefährdung der Ende-zu-Ende-Verschlüsselung - ähnlich wie bei der in der EU diskutierten Chatkontrolle.

https://heise.de/-11452910

LG äußert sich zu Vorwürfen bezüglich Smart-TV-Tracking

LG hat auf die Untersuchung von Gamers Nexus zu Smart-TVs reagiert. Der Hersteller erläutert die ACR-Funktion, bleibt bei vielen Vorwürfen jedoch vage.

https://heise.de/-11452996

1.1.1.1 prüft DNS jetzt mit Post-Quanten-Kryptografie

Cloudflare hat ML-DSA-44-Validierung für seinen DNS-Resolver 1.1.1.1 aktiviert. [..] Mit der Resolver-Validierung ist noch keine vollständige Post-Quanten-DNSSEC-Kette verfügbar. Dafür müssten autoritative Nameserver Zonen mit ML-DSA-44 signieren, Registrare die passenden DS-Records annehmen und Registries sie in den übergeordneten Zonen veröffentlichen. Schließlich müsste auch die Root-Zone den Algorithmus unterstützen und ihr Post-Quanten-Schlüssel als Vertrauensanker in Resolvern hinterlegt sein.

https://heise.de/-11453315

Revolut-Datenleck: Hacker nutzen echte Behörden-Domain für Diebstahl

Ein raffinierter Betrug trifft die Neobank Revolut: Über eine verifizierte Regierungs-Domain erbeuteten Hacker sensible Kundendaten und erpressen nun Opfer.

https://heise.de/-11453866

Vulnerabilities

Kritische Sicherheitslücke in Cisco Secure Email Gateway - aktiv ausgenutzt - Updates verfügbar

In Cisco Secure Email Gateway existiert eine kritische Sicherheitslücke. Bei erfolgreicher Ausnutzung könnte diese Sicherheitslücke es nicht authentifizierten Angreifer:innen aus der Ferne ermöglichen Befehle mit Root-Rechten auf dem zugrunde liegenden Betriebssystem auszuführen. Laut Cisco wurde eine Ausnutzung der Sicherheitslücke bereits beobachtet. CVE-Nummer(n): CVE-2026-76461

https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucke-in-cisco-secure-email-gateway-aktiv-ausgenutzt-updates-verfugbar

Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm

Apple Updates Everything, (Mon, Sep 14th)

https://isc.sans.edu/diary/rss/33336

LWN: Security updates for Tuesday

https://lwn.net/Articles/1094469/

Mozilla Foundation Security Advisories September 15, 2026

https://www.mozilla.org/en-US/security/advisories/

Tageszusammenfassung - 14.09.2026

CERT.at — Mon, 14 Sep 2026 17:21:49 GMT+0100

End-of-Day report

Timeframe: Freitag 11-09-2026 18:00 - Montag 14-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

On September 9, Check Point issued fixes for the flaws along with separate security advisories describing them: sk1000117 and sk1000118. [..] The Dutch Nationaal Cyber Security Centrum (NCSC) is warning of imminent exploitation of two critical flaws in Check Point VPN tracked as CVE-2026-85102 and CVE-2026-85103. Although no public proof-of-concept (PoC) exploit has been reported, the agency is urging organizations to install the security updates addressing the two issues as soon as possible.

https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/

Security through obscurity is dead, and AI delivered the fatal blow

The term "security through obscurity" describes an old idea that networks and systems will remain secure so long as their architecture, along with any vulnerabilities or other weaknesses, remains secret or hidden. It was never a sound strategy for protecting sensitive assets and systems, but many organizations leaned on it due to lack of resources or complacency. [..] During interviews at Black Hat in August, both former US National Cyber Director Chris Inglis and John Hultquist, chief analyst at Google Threat Intelligence Group, told us that they worry about what this means for critical operational technologies and industrial control systems (ICS).

https://www.theregister.com/security/2026/09/13/security-through-obscurity-is-dead-and-ai-delivered-the-fatal-blow/5296000

Perfect-10 GitLab bug under attack days after patch lands

CISA says attackers are exploiting a maximum-severity GitLab flaw that lets unauthenticated miscreants read arbitrary files from vulnerable servers after the code shack released fixes on September 10.

https://www.theregister.com/security/2026/09/14/perfect-10-gitlab-bug-under-attack-days-after-patch-lands/5296176

Wie ein Wiener eine KI-Spionagesoftware von Anthropic stoppte

Künstliche Intelligenz lud Schadsoftware auf eine Plattform mit Millionen Nutzern. Ein Cybersicherheitsforscher aus Österreich verhinderte, dass sie sich weiter verbreiten konnte.

https://www.derstandard.at/story/3000000339589/wie-ein-wiener-eine-ki-spionagesoftware-von-anthropic-stoppte

Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection

We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries.

https://unit42.paloaltonetworks.com/behavioral-clustering-map-to-cloud-identities/

Webseite BGP.Exchange kompromittiert (12. Sept. 2026)

Der Anbieter der Seite BGP.Exchange ist gehackt worden, die Webseite ist kompromittiert. Zum 12. September 2026 zeigt die Webseite ein "Defacement" und es wird wohl auch "Schund" über deren Mail-System verschickt.

https://borncity.com/blog/2026/09/12/webseite-bgp-exchange-kompromittiert-12-sept-2026/

Datenleck: Revolut gibt sensible Nutzerdaten an Angreifer

ie Bank ist auf eine gefälschte Datenanforderung einer angeblichen Behörde hereingefallen und hat sensible Kundendaten (Ausweiskopien etc.) an Betrüger herausgegeben. [..] Die potenziell offengelegten Daten umfassen Kopien von Pässen und Führerscheinen, Selfies zur Identitätsprüfung sowie persönliche Informationen (Namen, Geburtsdaten, Berufe, Postadressen, E-Mail-Adressen und Telefonnummern). Auch finanzielle Daten (IBAN, Kontoauszüge und vollständige Transaktionshistorien, einschließlich Bitcoin-Operationen) sind angeblich betroffen.

https://borncity.com/blog/2026/09/13/datenleck-revolut-gibt-sensible-nutzerdaten-an-angreifer/

The gpg.fail aftermath: On responsible disclosure, GPG, and the state of security in 2026 [32:37]

Until May 2025, I liked PGP, and the GNU Privacy Guard. I poked at it in my free time a lot. One day, that suddenly changed, when I flew too close to the sun and ended up uncovering a vulnerability that allows you to easily spoof a PGP signature when opened naively with the GPG tool. [..] I disclosed these a few weeks before 39c3 in December 2025. And while some of the vulnerabilities - like the memory corruption in the message parser - got addressed properly, this was not the case for all of them.

https://media.ccc.de/v/2026-728-the-gpg-fail-aftermath-on-responsible-disclosure-gpg-and-the-state-of-security-in-2026

Vulnerabilities

LWN: Security updates for Monday

https://lwn.net/Articles/1094211/

Tageszusammenfassung - 11.09.2026

CERT.at — Fri, 11 Sep 2026 17:30:30 GMT+0100

End-of-Day report

Timeframe: Donnerstag 10-09-2026 18:00 - Freitag 11-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

Gilt ab heute: CRA setzt 24-Stunden-Frist für Sicherheitsmeldungen

Der Cyber Resilience Act verpflichtet Hersteller von Produkten mit digitalen Elementen zu Mindeststandards für die Cybersicherheit. Betroffen sind nicht nur vernetzte Geräte wie Router oder industrielle Steuerungen, sondern auch Software. Die meisten Anforderungen gelten für Produkte, die ab dem 11. Dezember 2027 neu auf den EU-Markt kommen. Ab heute, also dem 11. September 2026, müssen Hersteller jedoch bereits aktiv ausgenutzte Schwachstellen und schwerwiegende Sicherheitsvorfälle melden.

https://heise.de/-11450208

Enisa: Anthropic öffnet Mythos-Modell für EU-Cyberagentur

Nach monatelangen Verhandlungen gibt Anthropic der EU-Agentur Enisa Zugang zu seinem KI-Modell Mythos. Doch die neueste Version gibt es nicht.

https://www.golem.de/news/enisa-anthropic-oeffnet-mythos-modell-fuer-eu-cyberagentur-2609-212904.html

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities impacting JFrog Artifactory (CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329). Attackers are chaining these vulnerabilities to bypass authentication and gain administrative control.

https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201

PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws

PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation.The software development company said PaperCut NG/MF versions 26.0.5, 25.0.13 and 24.1.10 are now available for customers to download.

https://thehackernews.com/2026/09/papercut-replaces-emergency-patches.html

ClickFix attacks infecting PCs and Macs are going viral

It wasn-t that long ago that ClickFix attacks were exotic. Now the technique has become mainstream as attackers reap its simplicity and effectiveness in infecting users of PCs and Macs alike. All that-s required is a compromised website-a painless enough task-a fake CAPTCHA overlay, and the inclusion of a single terminal command.

https://arstechnica.com/security/2026/09/clickfix-attacks-infecting-pcs-and-macs-are-going-viral/

Multiple crypto companies warn customers of phishing emails after alleged provider breach

Subscribers to newsletters from Trezor, CoinTracking and BitBox received corrupted messages through an email provider that all three companies use.

https://therecord.media/trezor-bitbox-cointracking-phishing-crypto-holders

Portasplit-Sicherheitslücke: Midea verteilt Updates an Klimageräte

Midea aktualisiert in den nächsten Wochen automatisch alle PortaSplit-Klimageräte. Der Hersteller reagiert damit auf einen Hinweis von heise security und einem anonymen Whistleblower. Der hatte eine Android-App entwickelt, um ein Sicherheitsproblem zu demonstrieren. Mit ihr ließen sich beliebige Geräte per Bluetooth Low Energy (BLE) fernsteuern - auch gegen den Willen ihrer Besitzer.

https://heise.de/-11449892

Certificate Authority unter Windows mit PowerShell betreiben

Mit diesem Blog-Post hier demonstriere ich, wie unter Verwendung von Windows 11 Bordmitteln (Powershell, es wird kein OpenSSL benötigt) eine CA erstellt und daraus Code-Signing-Zertifikate, Webserver-Zertifikate ...

https://hitco.at/blog/certificate-authority-windows-powershell-ca-smime-codesigning/

Beliebige Dateien (z.B. 7z, zip, yaml, -) mittels Catalog-Files und PowerShell signieren

Die Nutzung eines Code-Signing-Zertifikats zur Authenticode-Signatur ist für zahlreiche Datei-Typen die dies unterstützen direkt inline möglich. Als Beispiele seien *.exe, *.dll, *.ps1, - genannt. Dieses kurze How-To beschäftigt sich allerdings mit Datei-Typen, die keine Signatur unterstützen. Beispielsweise ein YAML-Konfigurationsfile im Textformat, oder ZIP-Container sowie 7zip-Containerfiles.

https://hitco.at/blog/beliebige-dateien-7z-zip-yaml-mittels-catalogfiles-powershell-signieren/

A rant about phishing: Its not the users fault (and not DNS either)

"For safety, don't click suspicious links" Neither the username, password nor 2FA prompts are hosted on the company's own domain. Combine that with token expiration triggering random authetication pop-ups, it becomes nearly impossible to notice phishing... because the real thing looks identical to a scam [..] An organization MUST use a single, well recognized, root domain.

https://maurycyz.com/misc/domains/

Vulnerabilities

ARISTA Security Advisory 0158

Both CVE-2026-73456 and CVE-2026-73457 affect Arista EOS-based platforms with gRPC Network Packet Sampling Interface (gNPSI) configured. which is disabled by default. [..] Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.

https://www.arista.com/en/support/advisories-notices/security-advisory/24714-security-advisory-0158

GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8

On September 10, 2026, we released versions 19.3.2, 19.2.6, 19.1.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). [..] For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/#recommended-action

Forgejo 16.0.4 has a critical security bug fix (RCE - Remote Code Execution)

https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.4.md

LWN: Security updates for Friday

https://lwn.net/Articles/1093765/

Tageszusammenfassung - 10.09.2026

CERT.at — Thu, 10 Sep 2026 17:16:24 GMT+0100

End-of-Day report

Timeframe: Mittwoch 09-09-2026 18:00 - Donnerstag 10-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

ID-Austria Phishing als Türöffner für falschen Bankanruf

-Jemand aus dem Ausland möchte Geld von Ihrem Konto abbuchen!- Mit dieser Behauptung schrecken Kriminelle derzeit auf. Sie geben sich am Telefon als Bankmitarbeiter:innen aus und überreden ihre Opfer, Geld auf ein vermeintlich sicheres Konto zu überweisen.

https://www.watchlist-internet.at/news/id-austria-phishing-bankanruf/

OpenAI-Agenten haben auf mehr als 10 weiteren Websites unerlaubt kommuniziert

KI-Agenten, die von OpenAI lediglich mit Internetrecherchen beauftragt und denen das Veröffentlichen eigener Beiträge untersagt war, haben weit mehr als nur eine Website zur Diskussion genutzt. Verschiedene unabhängige Sicherheitsforscher haben die ausgebrochenen OpenAI-Agenten auf mehr als zehn weiteren Webseiten gefunden. Dort haben diese größtenteils Wiki-Bereiche zum unerlaubten Austausch von Nachrichten verwendet.

https://www.heise.de/news/OpenAI-Agenten-haben-auf-mehr-als-10-weiteren-Websites-unerlaubt-kommuniziert-11448157.html

Vierter Hacking-Vorfall: Weiteres Anthropic-Modell bricht aus Testumgebung aus

In einem aktuellen Blog-Beitrag meldet Anthropic einen weiteren Hacking-Vorfall, der sich im Januar mit einer Vorabversion von Claude Opus 4.6 ereignet haben soll. Es ist der vierte Vorfall dieser Art.

https://www.heise.de/news/Vierter-Hacking-Vorfall-Weiteres-Anthropic-Modell-bricht-aus-Testumgebung-aus-11449182.html

Scans for Proxmox Servers, (Wed, Sep 9th)

About a week ago, Proxmox published an advisory revealing a vulnerability in older versions of Proxmox VE, its flagship Virtual Environment product. The vulnerability only affects version 7, which has not been supported for a couple of years now.

https://isc.sans.edu/diary/rss/33324

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco-s Secure Firewall Management Center (FMC) Software. First, CVE-2026-20079 is an authentication bypass vulnerability in unpatched instances of Cisco-s Secure FMC Software, which allows an unauthenticated, remote attacker to bypass authentications and execute scripts on impacted devices to obtain root access to the underlying operating system. Second, CVE-2026-20316 is a vulnerability that allows a remote attacker to log in using a low-privileged account. [..] IOCs for these threat clusters are also available on our GitHub repository here.

https://blog.talosintelligence.com/fmc-ongoing-exploitation/

Sicherheitslücken: 36.000 Plex-Media-Server-Instanzen potenziell angreifbar

In aktuellen Versionen von Plex Media Server und Plex Desktop wurden mehrere Schwachstellen geschlossen. Weltweit sind zehntausende Instanzen angreifbar.

https://heise.de/-11448584

Safe word: What is it and why do you need one?

AI scams are now hyper-realistic. But there-s one simple way to see through them.

https://www.welivesecurity.com/en/cybersecurity/safe-word-what-why-need-one/

Passkey-themed social engineering leads to identity and cloud compromise

Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. Learn how threat actors establish MFA persistence, abuse Microsoft Graph for reconnaissance, and access SharePoint, OneDrive, and email data, along with key detection and mitigation guidance.

https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/

Threat matrix: Mapping threats across cloud web applications

Microsoft introduces the Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework that helps defenders understand, prioritize, and mitigate threats to cloud-hosted web apps and serverless platforms.

https://www.microsoft.com/en-us/security/blog/2026/09/09/threat-matrix-mapping-threats-across-cloud-web-applications/

SloppyRAT: A New Tool For Ransomware Attacks

In June 2026, Zscaler ThreatLabz identified a new malware family, tracked as SloppyRAT, that is likely leveraged by a ransomware-related threat actor. ThreatLabz observed SloppyRAT being delivered through a multi-stage ClickFix infection chain. The malware supports a variety of features including a large number of built-in PowerShell-like commands, encrypted code blocks, EtherHiding for command-and-control (C2) resolution through the Polygon JSON-RPC protocol, and multiple anti-analysis techniques. [..] In the following sections, ThreatLabz provides a technical analysis of SloppyRAT, including its infection vector, anti-analysis techniques, network protocol, and command execution functionality.

https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks

The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

This research demonstrates post-exploitation techniques that could allow an attacker with root access on a compromised Kubernetes node to misuse an open standard and reference implementation for machine identity known as SPIFFE/SPIRE to impersonate co-located workloads and harvest SPIFFE Verifiable Identity Documents (SVIDs).

https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft.

https://www.wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise

Vulnerabilities

Palo Alto Networks Security Advisories 09.09.2026

Palo Alto released 10 new security advisories (2x high severity).

https://security.paloaltonetworks.com/

Drupal Security Advisories 2026-September-09

Drupal released 20 new security advisories (9x critical severity).

https://www.drupal.org/security

Checkpoint: CVE-2026-85102 - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN

Product: Security Gateway, Spark Firewall (Centrally Managed), Spark Firewall (Locally Managed). Issue: Improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway. This issue received the ID CVE-2026-85102 with CVSS: 9.8.

https://support.checkpoint.com/results/sk/sk1000117/

Checkpoint: CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution

Product: Security Gateway, Security Management Server, Spark Firewall (Centrally Managed), Spark Firewall (Locally Managed). Issue: A heap overflow in the VPN certificate ASN.1 decoding flow may allow a remote attacker to remotely execute arbitrary code on the management and Security Gateway. This issue received the ID CVE-2026-85103 with CVSS: 9.8.

https://support.checkpoint.com/results/sk/sk1000118/

ZDI-26-657: ASUS Control Center Express Agent Missing Authentication Remote Code Execution Vulnerability

http://www.zerodayinitiative.com/advisories/ZDI-26-657/

LWN: Security updates for Thursday

https://lwn.net/Articles/1093566/

Tageszusammenfassung - 09.09.2026

CERT.at — Wed, 09 Sep 2026 17:22:17 GMT+0100

End-of-Day report

Timeframe: Dienstag 08-09-2026 18:00 - Mittwoch 09-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

Patchday-Rekord: Fast 1.000 Sicherheitslücken in Windows, Office und Co.

Microsoft hat zum September-Patchday mal wieder einen neuen Rekord aufgestellt. Erstmals hat der Konzern über all seine Produkte hinweg innerhalb eines Monats fast 1.000 Sicherheitslücken geschlossen.

https://www.golem.de/news/patchday-rekord-fast-1-000-sicherheitsluecken-in-windows-office-und-co-2609-212793.html

New Microsoft Defender ShieldCrash zero-day grants SYSTEM access

An anonymous security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldCrash" right after Microsoft rolled out its September 2026 Patch Tuesday security updates. [..] According to Nightmare Eclipse, the ShieldCrash proof-of-concept exploit lets attackers gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems, but will not give them write access to the compromised systems. [..] Nightmare Eclipse released these zero-day exploits as part of an ongoing dispute with Microsoft over the company's bug bounty and vulnerability disclosure practices.

https://www.bleepingcomputer.com/news/security/new-microsoft-defender-shieldcrash-zero-day-grants-system-access/

Chrome 153: Google wechselt zu Zweiwochen-Update-Zyklus

Bislang veröffentlichte Google seit 2021 im Regelfall alle vier Wochen eine neue Chrome-Hauptversion. Ab Version 153 erscheinen Stable- und Beta-Ausgaben nun alle zwei Wochen für Desktop, Android und iOS. Wöchentliche Sicherheitsupdates bleiben bestehen.

https://heise.de/-11446371

Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit

A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk.

https://www.bleepingcomputer.com/news/security/hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit/

DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval

A flaw in DeepSeek Harness, DeepSeeks open-source tool for running AI coding agents on a developers machine, let a sandboxed agent turn off its own sandbox with a single command.The tool runs an agents commands inside an operating-system sandbox, so that an agent working on untrusted files cannot write outside its workspace.

https://thehackernews.com/2026/09/deepseek-harness-flaw-let-ai-agents.html

Keine Panik: Zahlungsaufforderung vom Hansevia Forderungsmanagement ist ein Fake!

Eine E-Mail mit bedrohlich klingendem Betreff. Eine Forderung über mehrere tausend Euro. Ein angeblich bestehendes Dienstleistungsverhältnis mit Euromillion24. Aus diesen Bestandteilen bauen Kriminelle aktuell ein Phishing-Kartenhaus, das bei genauerem Hinsehen sehr rasch in sich zusammenfällt.

https://www.watchlist-internet.at/news/zahlungsaufforderung-hansevia-forderungsmanagement-fake/

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

A recent Unit 42 investigation into seemingly low-priority enterprise infections demonstrates how the most effective camouflage in cybercrime is not necessarily in the use of sophisticated techniques, but in how unremarkable the threat appears. The activities that we investigated would typically not require escalation or further inquiry. But upon closer inspection, we discovered a massive cybercrime campaign largely targeting young gamers. Tracked as CL-CRI-1171, in accordance with Unit 42-s attribution framework, the group behind this cluster has operated under the radar for at least two years, distributing an indeterminate number of payloads.

https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

11 organizations compromised in 26 seconds. GreyNoise breaks down the AI-enabled campaign against PaperCut that hit 440 instances across 48 countries.

https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf

Reverse engineering my e-scooter and rewriting the firmware in rust

I reverse engineered the hardware and firmware of my Egret GT E-Scooter. I describe how I got in, analysed communication between components, and reverse engineered firmware. I speak about writing custom firmware for the display unit.

https://bensimms.moe/reverse-engineering-scooter/

Vulnerabilities

Microsoft Exchange Server: Sicherheitsupdates 8. September 2026

Microsoft hat zum 8. September 2026 Sicherheitsupdates (SU) für "September 2026" veröffentlicht. Diese Updates stehen für Exchange Server 2016 / 2019 (ESU) sowie für Exchange Server Subscription Edition (SE) zur Verfügung.

https://borncity.com/blog/2026/09/09/exchange-server-sicherheitsupdates-8-september-2026/

Microsoft Patchday: Windows Server-Updates (8. September 2026)

Zum 8. September 2026 (zweiter Dienstag im Monat, Patchday bei Microsoft) wurden verschiedene kumulative Updates für die unterstützten Versionen von Windows Server freigegeben. Nachfolgend habe ich die bereitgestellten Updates samt einigen Details für diese Windows Server-Versionen herausgezogen.

https://borncity.com/blog/2026/09/09/patchday-windows-server-updates-8-september-2026/

Microsoft Patchday: Windows 10/11 Updates (8. September 2026)

Am 8. September 2026 (zweiter Dienstag im Monat, Patchday bei Microsoft) hat Microsoft kumulative Updates für die noch unterstützten Client-Betriebssystem-Versionen von Windows 10 (mit ESU-Lizenz) und Windows 11 veröffentlicht. Hier einige Details zu diesen Updates, die Schwachstellen sowie Probleme beheben.

https://borncity.com/blog/2026/09/09/patchday-windows-10-11-updates-8-september-2026/

Adobe September-Patchday: Adobe schließt kritische Zero-Day-Lücke und 172 weitere

Im Zentrum der Adobe-Patch-Welle steht das Update für Adobe Commerce, das bereits akut angegriffen wird. Besonders viele Updates betreffen Experience Manager.

https://heise.de/-11446552

Android: Patchday: Kritische Lücken ermöglichen Attacken auf Android 14, 15, 16 und 17

Der September-Patchday für Android schließt über 90 Sicherheitslücken, darunter mehr als 25 kritische Schwachstellen in Framework, System und Kernel.

https://heise.de/-11446782

Samsung Sicherheits-Updates: Samsung verteilt Patches für Galaxy-Smartphones

Samsung hat sein Security-Bulletin für September 2026 veröffentlicht. Der Hersteller verteilt 90 Sicherheitspatches für zahlreiche Galaxy-Geräte.

https://heise.de/-11447042

cPanel: Security: CVE-2026-67401 SQL Injection Vulnerability in cPanel's EmailTrack Functionality - September 8, 2026

https://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026

Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW

LWN: Security updates for Wednesday

https://lwn.net/Articles/1093342/

Fortinet: Improper Authentication of FortiPAM Server

https://fortiguard.fortinet.com/psirt/FG-IR-26-168

Fortinet: JWT used for authentication in web GUI signed with static key

https://fortiguard.fortinet.com/psirt/FG-IR-26-170

Fortinet: Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information

https://fortiguard.fortinet.com/psirt/FG-IR-26-166

Tageszusammenfassung - 08.09.2026

CERT.at — Tue, 08 Sep 2026 17:21:21 GMT+0100

End-of-Day report

Timeframe: Montag 07-09-2026 18:00 - Dienstag 08-09-2026 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer

News

Schwerwiegende Sicherheitslücke in N-able N-central - aktiv ausgenutzt

In N-able N-central, einer Remote-Monitoring- und Management-Plattform, die insbesondere von Managed Service Providern (MSPs) zur Verwaltung von Kund:innenumgebungen eingesetzt wird, wurde eine schwerwiegende Sicherheitslücke entdeckt. Die Schwachstelle, CVE-2026-86218, ist mit einem CVSS-Score von 10.0 bewertet, eine Ausnutzung ermöglicht entfernten, unauthentifizierten Angreifer:innen eine Ausführung von Code auf verwundbaren Systemen.

https://www.cert.at/de/aktuelles/2026/9/schwerwiegende-sicherheitslucke-in-n-able-n-central-aktiv-ausgenutzt

Hackers build AI frameworks for widescale credential theft

Threat actors are increasingly switching from AI-powered coding assistants to multi-agent frameworks that automate every stage of an attack.

https://www.bleepingcomputer.com/news/security/hackers-build-ai-frameworks-for-widescale-credential-theft/

Auch im Standby: LG-Fernseher wohl anfällig für weitreichende Spionageangriffe

Dass Smart TVs über Automatic Content Recognition (ACR) etwa zu Werbezwecken permanent die Sehgewohnheiten ihrer Nutzer tracken, ist schon seit Jahren bekannt. [..] Demnach scannen LG-Fernseher neben dem ACR-Tracking ständig im internen Netzwerk nach Smartphones, PCs, Druckern und anderen erreichbaren Endgeräten. Zudem sollen die TV-Geräte permanent Informationen über in Reichweite befindliche WLAN-Netze und deren Standorte und Signalstärken sammeln.

https://www.golem.de/news/auch-im-standby-lg-fernseher-wohl-anfaellig-fuer-weitreichende-spionageangriffe-2609-212761.html

Abo-Falle: Wenn NordicaLab automatisch über PayPal abbucht

-Danke, dass Sie mit PayPal gezahlt haben- - Flattert diese Mitteilung zu einem Zeitpunkt ins Mail-Postfach, an dem garantiert keine Zahlung freigegeben wurde, ist sprichwörtlich Feuer am Dach. Irgendetwas stimmt hier ganz und gar nicht. Was genau, das zeigt ein konkreter Fall aus der Praxis.

https://www.watchlist-internet.at/news/abo-falle-nordicalab/

Führerschein-Scans von Altersüberprüfungs-Dienst landeten über ein Jahr kontinuierlich im Darknet

Wie das Fachmedium Techdirt berichtet, ging vergangene Woche eine Plattform für Identitätsdiebstahl namens Nexus online. Auf der Seite werden mehr als 153 Millionen Scans von Bürgerinnen und Bürgern der USA und Kanada verkauft. Die Betreiber von Nexus behaupten, die Ausweisbilder stammten aus einem aktiven Datenleck bei "einem großen Unternehmen für Identitätsprüfung", zu dessen Kunden mehrere Fortune-500-Unternehmen zählen.

https://www.derstandard.at/story/3000000338691/fuehrerschein-scans-von-altersueberpruefungs-dienst-landeten-ueber-ein-jahr-kontinuierlich-im-darknet

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload.

https://blog.talosintelligence.com/clearfake-webdav-infection-chain/

The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT

Check Point Research discovered a covert cross-account command channel through which an attacker could use a victim-s ChatGPT session to execute hidden tasks with the tools, data, and connected apps available to that session. The victim could receive a normal answer to their visible request while the attacker-s task was processed separately and its result returned across accounts. In our proof of concept, ChatGPT retrieved email data from the victim-s connected Gmail account and relayed it to the attacker.

https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/

I-ve factored the RSA keys of a Certificate Authority-from the 90s

I-ve been thinking about the security of RSA lately. RSA-s cryptography relies on the difficulty of factoring a large semiprime number, but what -large- means is an interesting question. The Web PKI deprecated 1024-bit RSA over a decade ago, and while I don-t know of anyone factoring a key of that size, it-s within the realm of possibility for a government or other organization with a large number of computers. Just a few days ago, someone factored the 862-bit RSA-260 key from the RSA factoring challenge.

https://mcpherrin.ca/2026/09/07/rsa.html

Vulnerabilities

FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials

A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group, Red Hat says. FreeIPA is the system that determines who may log in across a Linux domain and maintains all identities in a 389 Directory Server database accessed via LDAP. [..] That only becomes dangerous because of the second flaw. 389 Directory Server has a rule type meant to say "only the authenticated owner of this entry." It compares the client's name against a stored value as plain text, and a client that has not logged in has an empty name, which matches an empty stored value.

https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html

Ivanti September 2026 Security Update

Ivanti releases standard security patches on the second Tuesday of every month. More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in the Security Advisories: Ivanti Neurons for ITSM, Ivanti Endpoint Manager Mobile (EPMM), Ivanti Sentry

https://www.ivanti.com/blog/september-2026-security-update

SAP Security Patch Day September 2026 | RedRays

SAP Security Patch Day September 2026 brings 20 security notes, four of them HotNews rated up to CVSS 10.0, alongside five High priority issues, ten Medium priority fixes and one Low priority update. They span the NetWeaver stack, SAP S/4HANA, SAPUI5 and several cloud products. This release lands on the network-facing core of NetWeaver.

https://redrays.io/blog/sap-security-patch-day-september-2026/

VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

https://kb.cert.org/vuls/id/943094

VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

https://kb.cert.org/vuls/id/718077

TYPO3-CORE-SA-2026-023: Missing Authorization in lowlevel commands

https://news.typo3.com/security/advisory/typo3-core-sa-2026-023

TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard

https://news.typo3.com/security/advisory/typo3-core-sa-2026-022

Xen: XSA-513

https://xenbits.xen.org/xsa/advisory-513.html

Xen: XSA-512

https://xenbits.xen.org/xsa/advisory-512.html

Xen: XSA-511

https://xenbits.xen.org/xsa/advisory-511.html

Xen: XSA-510

https://xenbits.xen.org/xsa/advisory-510.html

Xen: XSA-509

https://xenbits.xen.org/xsa/advisory-509.html

LWN: Security updates for Tuesday

https://lwn.net/Articles/1093144/

Tageszusammenfassung - 07.09.2026

CERT.at — Mon, 07 Sep 2026 17:29:19 GMT+0100

End-of-Day report

Timeframe: Freitag 04-09-2026 18:00 - Montag 07-09-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a

News

Attackers conceal phishing lures using invisible Unicode characters

Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters.

https://www.bleepingcomputer.com/news/security/attackers-conceal-phishing-lures-using-invisible-unicode-characters/

BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

A phishing-as-a-service framework called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials.

https://www.bleepingcomputer.com/news/security/bigbear-microsoft-365-phishing-service-bypassed-mfa-at-258-organizations/

Shadowserver 2025: Highlights of the Year in Review

A review of Shadowserver-s 21st year as the world-s largest provider of free, timely, actionable, daily cyber threat intelligence. Covering the latest improvements in our public benefit services, responses to emerging cyber threats, and detection and reporting of the latest vulnerabilities to National CSIRTs and system defenders ..

https://www.shadowserver.org/news/shadowserver-2025-highlights-of-the-year-in-review/

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

Every on-premises N-central build below 2026.3.1.14 - including servers updated to Hotfix 3 a day earlier - needs Hotfix 4. N-ables incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed.N-able has released its fourth hotfix in five weeks for the N-central remote monitoring and management (RMM) platform, this time for a ..

https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html

Peers ask why UK cyber bill leaves execs off the personal liability hook

Ministers say £17M corporate fines and forthcoming board-level governance rules provide sufficient accountability

https://www.theregister.com/security/2026/09/07/peers-ask-why-uk-cyber-bill-leaves-execs-off-the-personal-liability-hook/5294586

Hackers drain $320M in Bitcoin from Liquid Network, claim theyre the good guys

Self-described white hats promise to return most of the 4,000 BTC once the vulnerability is fixed

https://www.theregister.com/security/2026/09/07/hackers-drain-320m-in-bitcoin-from-liquid-network-claim-theyre-the-good-guys/5294770

Microsoft bremst alte Exchange-Server aus

Microsoft verschärft die Regeln für alte Exchange-Server: In Hybridumgebungen drohen Drosselung und blockierte E-Mails.

https://www.heise.de/news/Alte-Exchange-Server-riskieren-Mailblockaden-11443696.html

Zero-Day-Lücke StyleSmuggler in Magento und Adobe Commerce wird aktiv ausgenutzt

Onlineshops auf Basis von Magento und Adobe Commerce sind offenbar aufgrund einer ungepatchten Sicherheitslücke namens StyleSmuggler angreifbar.

https://www.heise.de/news/Zero-Day-Luecke-StyleSmuggler-in-Magento-und-Adobe-Commerce-wird-aktiv-ausgenutzt-11444217.html

Gefahr für die nationale Sicherheit: Berliner Datenleck schlägt hohe Wellen

Nach dem Darknet-Leak streiten Bezirke über Forensik-Software von Crowdstrike. Die Datenschutzbeauftragte warnt und gibt Verhaltensregeln für Betroffene heraus.

https://www.heise.de/news/Gefahr-fuer-die-nationale-Sicherheit-Berliner-Datenleck-schlaegt-hohe-Wellen-11444301.html

Steuerausgleich da? Vorsicht vor gefälschten Finanzamt-Mails

-Ihr Steuerausgleich ist da!" Eine solche Nachricht klingt zunächst vielversprechend. Wer derzeit eine solche E-Mail erhält, sollte allerdings genau hinsehen. Denn dahinter könnten Kriminelle stecken, die an sensible Daten gelangen wollen.

https://www.watchlist-internet.at/news/steuerausgleich-gefaelschten-mails/

OpenAI verheimlichte Angriff von tausenden KI-Agenten auf in Österreich betriebenes Wiki

Das DseWiki war bereits im Mai 2026 übernommen worden. Nun verspricht OpenAI neue Regeln für Umgang mit solchen Vorfällen

https://www.derstandard.at/story/3000000338604/openai-verheimlichte-angriff-von-tausenden-ki-agenten-auf-in-oesterreich-betriebenes-wiki

How a hole in Lenovo-s login system let hackers walk into 5,000 Dropbox accounts

If you ever linked your Dropbox account to a Lenovo ID - perhaps to make life easier when logging in via a Lenovo laptop - you might want to take heed.

https://www.bitdefender.com/en-us/blog/hotforsecurity/lenovo-login-system-hackers-dropbox

Angriffe gegen Mikrotik-Router ("MikroTrick")

Laut einer Warnung von CERT Polska nutzen Angreifer:innen aktuell großflächig Sicherheitslücken in Geräten des Herstellers Mikrotik aus um die Kontrolle über verwundbare Geräte zu erlangen. Betroffen sind Versionen vor 7.25beta3, 7.24.2, 7.23.4, 6.49.21. Laut der Shadowserver Foundation sind weltweit über 100.000 Mikrotik-Systeme direkt aus dem Internet erreichbar. Systemadministrator:innen sind dringend dazu angehalten die zur Verfügung ..

https://www.cert.at/de/aktuelles/2026/9/angriffe-gegen-mikrotik-router-mikrotrick

The hidden risks of shadow AI

Understanding why staff use unapproved AI tools is key to managing the security challenges they can create.

https://www.ncsc.gov.uk/blogs/the-hidden-risks-of-shadow-ai

No Hacking Required: The Manchester Airports Group Data Breach

On 27 August 2026, Manchester Airports Group told customers that "an unauthorised third party" had stolen their data. Car park bookings, lounge bookings, Fast Track purchases for airport security and passport control, along with airport WiFi sign-ups across Manchester, Stansted and East Midlands. Roughly 8.8 million

https://scotthelme.co.uk/no-hacking-required-manchester-airports-group-data-breach/

Have the frontier labs mixed up AI safety and security?

The highly publicised sandbox agent escapes have certainly made news, and I wrote about the issues with sandboxing agents back in January - though I certainly didn't foresee they would escape the frontier labs. I assumed the real risk was poorly configured sandboxes for end users, so I was surprised to see this happening at the frontier labs. I think it might tell us something about the security philosophy of these organisations.

https://martinalderson.com/posts/ai-safety-vs-security/

Vulnerabilities

Security updates 1.6.19 and 1.7.4 released

We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail.They both contain fixes for recently reported security vulnerabilities.Security fixes Fix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai Fix CSS property injection via body background attribute, reported by zenithhostingevan ..

https://roundcube.net/news/2026/09/06/security-updates-1.6.19-and-1.7.4

Tageszusammenfassung - 04.09.2026

CERT.at — Fri, 04 Sep 2026 17:20:15 GMT+0100

End-of-Day report

Timeframe: Donnerstag 03-09-2026 18:00 - Freitag 04-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl

News

Critical Citrix NetScaler auth bypass now leveraged in attacks

Tracked as CVE-2026-19490, this security flaw can allow unprivileged threat actors to bypass authentication remotely when the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), depending on the NetScaler firmware version and whether SAML Action is configured. [..] While the company has yet to flag the vulnerability as actively exploited in its August 19 security advisory, Previdian founder and security researcher Ryan Dewhurst told BleepingComputer on Thursday that attackers have begun targeting CVE-2026-19490 in the wild after a "credible" proof-of-concept exploit was published online.

https://www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Microsoft researchers observed a high-volume phishing campaign using invisible Unicode tag characters, a technique popularized in AI prompt injection research as ASCII Smuggling. Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as -funding- to prevent email filters from parsing them.

https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/

Jetzt patchen! Angreifer führen Schadcode in der Sandbox von Chrome aus

Google hat mehrere Sicherheitslücken im Webbrowser Chrome geschlossen. [..] Die derzeit ausgenutzte Schwachstelle (CVE-2026-85046 -hoch-) ist eine Type-Confusion-Lücke in der JavaScript-Engine V8, führen die Entwickler in einer Warnmeldung aus. Bei dieser Art von Schwachstellen kommt es bei der Verarbeitung von inkompatiblen Objekten zu Speicherfehlern, über die Schadcode auf Systeme gelangt. In diesem konkreten Fall müssen entfernte Angreifer Opfer auf eine von ihnen präparierte Website locken.

https://www.heise.de/news/Jetzt-patchen-Angreifer-fuehren-Schadcode-in-der-Sandbox-von-Chrome-aus-11441030.html

Free streaming boxes may be routing criminal traffic through your home

Researchers found that apps available on SuperBox devices could add your household connection to a residential proxy network.

https://www.malwarebytes.com/blog/news/2026/09/free-streaming-boxes-may-be-routing-criminal-traffic-through-your-home

Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin

On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms, a WordPress plugin with an estimated 13,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution. The vendor released the fully patched version on July 8th, 2026 [..]

https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-super-forms-plugin/

Reproducing CVE-2026-75604: Next.js Path Traversal to RCE on Windows

Vulnerability research: CVE-2026-75604 A single un-escaped backslash in the Next.js incremental cache lets an unauthenticated attacker read and write files on Windows hosts, and, on the right versions and app shape, run commands. Here is the whole chain, reproduced end to end.

https://fortbridge.co.uk/research/next-js-path-traversal-to-rce/

Vulnerabilities

VU#889462: Casdoor authentication server is vulnerable to authorization bypass

https://kb.cert.org/vuls/id/889462

LWN: Security updates for Friday

https://lwn.net/Articles/1092659/

Tageszusammenfassung - 03.09.2026

CERT.at — Thu, 03 Sep 2026 17:17:06 GMT+0100

End-of-Day report

Timeframe: Mittwoch 02-09-2026 18:00 - Donnerstag 03-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

Critical Elementor Pro flaw exploited to take over WordPress sites

A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server.

https://www.bleepingcomputer.com/news/security/critical-elementor-pro-flaw-exploited-to-take-over-wordpress-sites/

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based implant. Learn how attackers move from social engineering to lateral movement using legitimate tools, and how Microsoft Defender helps detect and disrupt the activity.

https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/

Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon

"FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in CrowdStrike Falcon Sensor," [..] The PoC, the researcher added, works in a fully updated Windows 11 25H2 machine or Windows Server 2025 with Crowdstrike Falcon.

https://thehackernews.com/2026/09/researcher-releases-falconflank-poc.html

This Is Flock-s AI Search Tool for Cops

WIRED rebuilt Flock-s latest search tool from code the company sends to a police officer-s browser. Its AI can keep watch across multiple cameras for anyone fitting a written description. [..] Police officers have already used Flock-s software to track people for reasons unrelated to police work. At least 50 officers in the US have recently been charged with or accused of misusing license plate readers, according to The Washington Post.

https://www.wired.com/story/flock-ai-search-user-interface/

WhatsApp-Sicherheitslücke: Zugriff auf Fotos bei gesperrtem Android-Handy

Die WhatsApp-App unter Android hat offenbar eine Schwachstelle. Unbefugte Nutzerinnen und Nutzer können auf einigen Geräten bei einem eingehenden Videoanruf im gesperrten Zustand auf private Fotoordner zugreifen. Meta hat nach eigenen Angaben inzwischen begonnen, einen Fix zu verteilen. Bis dieser flächendeckend ankommt, gibt es eine Übergangslösung.

https://www.heise.de/news/WhatsApp-Sicherheitsluecke-Zugriff-auf-Fotos-bei-gesperrtem-Android-Handy-11439291.html

WordPress All-in-One WP Migration: Angreifer können Admin-Falle auslegen

Das WordPress-Plug-in All-in-One WP Migration and Backup ist verwundbar und Angreifer können im schlimmsten Fall die volle Kontrolle über mit dem CMS erstellte Websites erlangen. [..] Die Sicherheitsforscher geben an, dass die Entwickler von All-in-One WP Migration and Backup Mitte August von der Schwachstelle erfahren haben. Der Sicherheitspatch war fünf Tage später fertig und steht seit dem 20. August 2026 zum Download bereit.

https://www.heise.de/news/WordPress-All-in-One-WP-Migration-Angreifer-koennen-Admin-Falle-auslegen-11439787.html

Why your data is safer than you think on public Wi-Fi

The coffee shop hacker Public Wi-Fi has acquired a slightly theatrical reputation. Join the network in a coffee shop, we are told, and a hacker in the corner can immediately steal your passwords and empty your bank account. It makes for good VPN advertising. It is not a particularly accurate picture of how the modern web works.

https://www.pentestpartners.com/security-blog/why-your-data-is-safer-than-you-think-on-public-wi-fi/

Analyse: Umfassendes Fake-Netzwerk aus Insolvenzverwaltern, IT-Anbietern, Unternehmensberatern und Zeitungen

Um den Anschein von Seriosität zu verstärken, bauen Kriminelle umfangreiche Onlinemagazine. In der dortigen Flut an angeblich realen Geschichten platzieren sie Artikel, die über vermeintlich seriöse Insolvenzverwalter, IT-Anbietern und Unternehmensberater berichten. Die gesamte Konstruktion ist auf Vorschussbetrug und das Sammeln von Daten ausgelegt.

https://www.watchlist-internet.at/news/analyse-umfassendes-fake-netzwerk/

Chamilo LMS... Its raining 0days, hallelujah, its raining 0days

Chamilo is an open source Learning Management System (LMS) widely deployed in schools and enterprises around the world. In this blogpost we explain how we were able to identify multiple vulnerabilities including a full unauthenticated Remote Code Execution chain in the latest version.

http://blog.quarkslab.com/chamilo-lms-its-raining-0days-hallelujah-its-raining-0days.html

Vulnerabilities

VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347)

VMware Workstation and Fusion contain an integer-overflow vulnerability. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. CVE-2026-59346, CVE-2026-59347

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38288

HPE: HPESBNW05133 rev.1 - Multiple Vulnerabilities in HPE Aruba Networking Fabric Composer

Remote: Access Restriction Bypass, Authentication Bypass, Escalation of Privilege

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US

HPE: HPESBNW05134 rev.1 - Multiple Vulnerabilities in HPE Aruba Networking ArubaOS-CX (AOS-CX)

Local: Access Restriction Bypass

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US

Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-smime-disc-dzw4rEdY

Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-dos-txMYNRzv

Drupal Security Advisories 2026-September-02

https://www.drupal.org/security

LWN: Security updates for Thursday

https://lwn.net/Articles/1092419/

Tageszusammenfassung - 02.09.2026

CERT.at — Wed, 02 Sep 2026 17:47:41 GMT+0100

End-of-Day report

Timeframe: Dienstag 01-09-2026 18:00 - Mittwoch 02-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

Hackers abuse Faronics Deploy admin tool to install ScreenConnect

Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software.

https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/

Bei Sandboxing-Tests: KI-Agent bricht mehrfach aus VM aus

Ein Forscher hat getestet, ob sich moderne KI-Modelle mit Virtualisierung sinnvoll isolieren lassen. Die KI ist mehrfach aus einer VM entkommen. [..] Der Forscher hatte die KI zwar explizit dazu angewiesen aus der VM auszubrechen, jedoch sind entsprechende Ausbrüche auch in anderen Situationen denkbar. [..] Zudem rät Dinaburg, für die Virtualisierung auf minimalistische Lösungen umzusteigen, die eine geringere Angriffsfläche bieten.

https://www.golem.de/news/bei-sandboxing-tests-ki-agent-bricht-mehrfach-aus-vm-aus-2608-212442.html

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users. Microsoft has observed victims across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.

https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/

Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials

Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution. The vulnerability in question is CVE-2026-9586 (CVSS score: 9.3), a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997) that can allow attackers to remotely execute arbitrary code as the PostgreSQL superuser without credentials. Sangoma released patches for the flaw in Switchvox 8.4.0.2 on July 14, 2026.

https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html

OpenAI Is About to Release Its First AI Model With -Critical- Cyber Abilities

The company will give select partners early access to its Astra AI model-so they have time to shore up their defenses.

https://www.wired.com/story/openai-astra-first-ai-model-with-critical-cyber-abilities/

Fremde Dropbox-Konten über Lenovo-ID zugänglich

Eine erstaunliche Sicherheitslücke ist Inhabern von rund 5.000 Dropbox-Konten zum Verhängnis geworden, die auf die Einrichtung von Zwei-Faktor-Authentifizierung (2FA) verzichtet hatten: Unbefugte haben sich mittels frisch angelegter Lenovo-Konten Zugriff verschafft.

https://www.heise.de/news/Fremde-Dropbox-Konten-ueber-Lenovo-ID-zugaenglich-11437565.html

The Vulnpocalypse Is Repricing the Bug Bounty Economy

The shape of the market may be changing, but there's no indication that the bug bounty as we know it is going away. Of the dozen executives, security experts and researchers Dark Reading spoke to, not one believed that the vulnpocalypse was an existential crisis for independent security research. It would challenge the ecosystem, reshape it, and could perhaps act as a reckoning for those companies that release insecure software, but this moment would be more akin to a storm that will pass.

https://www.darkreading.com/vulnerabilities-threats/vulnpocalypse-repricing-bug-bounty-economy

Passkeys erklärt: wie sicher die Anmeldung ohne Passwort ist

Immer öfter erscheint beim Anmelden auf einer Website ein Fenster mit der Frage, ob Sie einen Passkey erstellen möchten. Viele klicken es weg, weil sie nicht wissen, was das eigentlich ist. Dahinter steckt eine Technologie, die das Potenzial hat, das Anmelden im Internet grundlegend sicherer zu machen.

https:\/\/www.zettasecure.com\/post\/sind-passkeys-sicher

Vulnerabilities

Kritische Sicherheitslücken in SonicWall SMA1000 Series - aktiv ausgenutzt - Updates verfügbar

In SonicWalls SMA1000 Series Appliances existieren zwei schwerwiegende Sicherheitslücken. Die schwerwiegendere der beiden Schwachstellen ermöglicht es Angreifer:innen aus der Ferne und ohne Authentifizierung, die Appliance dazu zu bringen, serverseitig Anfragen an eigentlich nicht erreichbare interne Endpunkte zu senden (Server-Side Request Forgery). Laut SonicWall PSIRT werden die in diesem Advisory beschriebenen Schwachstellen bereits aktiv ausgenutzt. CVE-2026-83548, CVE-2026-83549

https://www.cert.at/de/warnungen/2026/9/erneut-kritische-sicherheitslucken-in-sonicwall-sma1000-series-aktiv-ausgenutzt-updates-verfugbar

Plex: Important Security Update for Plex Media Server v1.43.2 and earlier

We recently released Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to address a number of security issues. We recommend all server owners and Desktop users update to the latest version as soon as possible. CVEs have been requested and we-ll reply to this thread with more details once they-re published.

https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319

LWN: Security updates for Wednesday

https://lwn.net/Articles/1092149/

Tageszusammenfassung - 01.09.2026

CERT.at — Tue, 01 Sep 2026 17:44:11 GMT+0100

End-of-Day report

Timeframe: Montag 31-08-2026 18:00 - Dienstag 01-09-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl

News

Hackers push malicious Virtualizor update in BGP hijacking attack

Hackers delivered malicious updates to the Virtualizor VPS management software after hijacking BGP routing for its update infrastructure and redirecting update requests to malicious servers.

https://www.bleepingcomputer.com/news/security/hackers-push-malicious-virtualizor-update-in-bgp-hijacking-attack/

The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st)

One of my internet-exposed inference honeypots was discovered, relabeled with sought-after model names, and incorporated into infrastructure apparently used to provide "free" LLM backends. It then received a real coding-agent session - history, filesystem output, working paths, and the agent's local tool manifest. The honeypot did not request or cause any tool execution; what the request exposed is what a malicious operator in that position could do.

https://isc.sans.edu/diary/rss/33298

Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity

Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck.The vulnerabilities in question are listed below - CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user.

https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html

OpenClaw 2.0 pours glitter on slow-burning security dumpster fire

OpenClaw has unveiled what its makers call its largest ever update - large enough to earn a 2.0 moniker - with usability taking center stage, along with some security updates that critics are suggesting will be insufficient.

https://www.theregister.com/ai-and-ml/2026/08/31/openclaw-20-pours-glitter-on-slow-burning-security-dumpster-fire/5293492

Password spraying campaign targets AWS root user accounts across 150+ organizations

Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations.

https://securitylabs.datadoghq.com/articles/aws-root-user-bruteforce-campaign/

13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds

Socket-s Threat Research Team found 13 malicious Composer theme packages on Packagist, published across five vendor namespaces, that inject JavaScript into every page of the Vietnamese movie and comic streaming sites that install them. The injected code runs two operations against a site-s visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware.

https://socket.dev/blog/packagist-themes-ios-spyware

EncryptedSharedPreferences is Dead: Here-s What You Should Use Instead

In this post we-ll explore why persisting data to disk introduces unnecessary risk, dissect the mechanics of storage systems on Android, and provide you with proven methods to safeguard your application data. Furthermore, we-ll cover common misconceptions and misunderstandings with a focus on Android, including Google-s current stance that unencrypted internal app storage is not a concern due to reliance on OS protections such as device encryption and sandboxing, alongside recommended alternatives such as Jetpack DataStore coupled with Google Tink for encryption.

https://blog.includesecurity.com/2026/08/encryptedsharedpreferences-is-dead-heres-what-you-should-use-instead/

Vulnerabilities

Sicherheitsupdates für Hoymiles-Wechselrichter (30.8. 2026)

Im Juli 2026 hatte der Chaos Computer Club (CCC) vor gravierenden Schwachstellen im DTU-Protokoll des Herstellers Hoymiles gewarnt. Nun hat der Anbieter Firmware-Updates für verschiedene Modelle bereitgestellt, die die Schwachstellen schließen.

https://borncity.com/blog/2026/09/01/sicherheitsupdates-fuer-hoymiles-wechselrichter-30-8-2026/

VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check

https://kb.cert.org/vuls/id/456290

Mozilla Security Advisories September 1, 2026

https://www.mozilla.org/en-US/security/advisories/

LWN: Security updates for Tuesday

https://lwn.net/Articles/1091919/

Tageszusammenfassung - 31.08.2026

CERT.at — Mon, 31 Aug 2026 17:35:35 GMT+0100

End-of-Day report

Timeframe: Freitag 28-08-2026 18:00 - Montag 31-08-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a

News

Anthropic warns infostealer malware is hijacking Claude sessions to drain usage

Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage.

https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/

Virenschutz angeblich aus: Microsoft Defender spielt falsche Warnmeldung aus

Einige Windows-Nutzer erhalten seit Wochen Warnmeldungen vom Microsoft Defender, dass der Virenschutz inaktiv sei. Das ist jedoch ein Anzeigefehler.

https://www.golem.de/news/virenschutz-angeblich-aus-microsoft-defender-spielt-falsche-warnmeldung-aus-2608-212431.html

ValleyRAT masquerading as adware

Threat actors are distributing the ValleyRAT backdoor disguised as adware. We analyze the infection chain, from the malicious installer to the final payload.

https://securelist.com/valleyrat-backdoor-adware/121175/

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance.The post TerminalFix campaign deploys a reverse tunnel through multistage intrusion appeared first on Microsoft Security Blog.

https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/

The Linux Kernel Is Approaching 2,000 CVEs Per Release

Phoronix reports on Greg Kroah-Hartmans recent slide from his upcoming talk in Paris at Kernel Recipes 2026 (September 21 to 23):With the proliferation of AI/LLM models analyzing the Linux kernels vast codebase, there has been a surge in the number of CVEs per kernel release. After typically being around 500 CVEs fixed per release, we are now approaching ..

https://linux.slashdot.org/story/26/08/29/0547248/the-linux-kernel-is-approaching-2000-cves-per-release

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts used to route, authenticate, and manage high-value networks.Sygnia, the incident response firm that investigated the intrusion, said the actor ..

https://thehackernews.com/2026/08/china-linked-fire-ant-hijacks-cisco.html

Microsoft Teams Has Become a Haven for Scammers in China

Fraudsters are exploiting enterprise chat apps like Teams and Webex to trick Chinese victims into transferring large sums of money, fueling a wave of complaints.

https://www.wired.com/story/microsoft-teams-is-becoming-a-haven-for-chinese-scammers/

ATM Flaws Reveal Key Weaknesses in the Software Supply Chain

A security researcher discovered nine vulnerabilities impacting ATM encryption and authentication software. But the problems extend far beyond your local cash machine.

https://www.wired.com/story/atm-flaws-reveal-key-weaknesses-in-the-software-supply-chain/

30 Bitcoin oder Leak - Ransomware-Bande erpresst Berlin

Die Gruppe -Rhysida- will 30 Bitcoin von Berlin, oder vertrauliche Daten veröffentlichen. Die Stadt will nicht zahlen, sagte Kai Wegner.

https://www.heise.de/news/30-Bitcoin-oder-Leak-Ransomware-Bande-erpresst-Berlin-11434325.html

Exchange-Sicherheitslücke: 85 Prozent der On-Prem-Server in Deutschland anfällig

Ein Proof-of-Concept-Exploit für eine hochriskante Exchange-Lücke ist öffentlich. 85 Prozent der On-Premises-Server sind anfällig.

https://www.heise.de/news/Exchange-Sicherheitsluecke-85-Prozent-der-On-Prem-Server-in-Deutschland-anfaellig-11434785.html

Root-Sicherheitslücke bedroht cPanel/WHM

In aktuellen Versionen haben die Entwickler der Webhosting-Control-Panel-Software cPanel/WHM eine Schwachstelle geschlossen.

https://www.heise.de/news/Root-Sicherheitsluecke-bedroht-cPanel-WHM-11434895.html

WatchGuard Security-Appliances: Schadcode-Lücken in Firebox OS geschlossen

Firewalls und VPN-Technik von WatchGuard sind attackierbar. Reparierte Versionen von Firebox OS sind verfügbar.

https://www.heise.de/news/WatchGuard-Security-Appliances-Schadcode-Luecken-in-Firebox-OS-geschlossen-11434937.html

Überwachungs-Schnittstellen in weltweit verkauften Routern aus China entdeckt

"EndlessDoors", "DarkLantern" und "SpeakingStone" geben Zugriff, wo keiner sein sollte. Die Router von ZBT werden unter verschiedenen Marken angeboten

https://www.derstandard.at/story/3000000337615/ueberwachungs-schnittstellen-in-weltweit-verkauften-routern-aus-china-entdeckt

"Gravierende Sicherheitslücke": Mobilfunknetze plaudern bei Anruf sensible Daten aus

Teilweise konnten sowohl die eindeutige Gerätekennung IMEI als auch Details zur Betriebssystemversion erfasst werden. Heimische Provider wiegeln weitgehend ab

https://www.derstandard.at/story/3000000337719/gravierende-sicherheitsluecke-mobilfunknetze-plaudern-bei-anruf-sensible-daten-aus

Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

Learn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers.

https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/

PaperCut warns of hackers using printer management software flaw in attacks

PaperCut released an emergency advisory on Thursday evening saying vulnerabilities in their print management software, PaperCut NG and MF, are under active exploitation.

https://therecord.media/papercut-warns-of-hackers-using-printer-management-vulnerabilities

Omarchy: Any User Process Can Escalate to Root

A security issue in Omarchy-s default Docker configuration meant that essentially every program running in the user-s desktop session could escalate to root without a password, sudo, or a privilege prompt.

https://0xcc.io/posts/omarchy-root-creds/

curl: a CVE dispute

A few years years ago the curl project signed up and became a CNA. This means that we are masters of and can allocate our own CVE identifiers. For any security problems within our territory, it is we who decides if the issue should get a CVE or not. No more bogus ..

https://daniel.haxx.se/blog/2026/06/24/a-cve-dispute/

OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack

Ten malicious versions were published with valid npm provenance after a threat actor abused a comment-triggered GitHub Actions publishing workflow, with the latest release still compromised at the time of writing.The Socket Threat Research Team is investigating an ongoing Mini Shai-Hulud compromise, affecting the npm package @7nohe/openapi-react-query-codegen. On August 28, ..

https://socket.dev/blog/openapi-react-query-codegen-npm-compromise

Tageszusammenfassung - 28.08.2026

CERT.at — Fri, 28 Aug 2026 17:37:35 GMT+0100

End-of-Day report

Timeframe: Donnerstag 27-08-2026 18:00 - Freitag 28-08-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a

News

PaperCut warns of NG, MF flaw exploited in zero-day attacks

PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks.

https://www.bleepingcomputer.com/news/security/papercut-warns-of-ng-mf-flaw-exploited-in-zero-day-attacks/

Over 8,300 Gitea servers vulnerable to code execution attacks

Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver.

https://www.bleepingcomputer.com/news/security/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks/

Patch-Defizit in Deutschland: Exploit gefährdet 85 Prozent aller Exchange-Server

Auf Github ist ein Exploit für eine gefährliche Exchange-Lücke aufgetaucht. Einen Patch gibt es zwar, doch den haben in Deutschland nur wenige installiert.

https://www.golem.de/news/patch-defizit-in-deutschland-exploit-gefaehrdet-85-prozent-aller-ex

change-server-2608-212397.html

APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026.These campaigns, per Recorded Future Insikt Group, ..

https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user.The vulnerability, assigned the CVE identifier CVE-2026-65643, ..

https://thehackernews.com/2026/08/critical-cpanel-flaw-could-let-one.html

Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL

ServiceNow has released patches for four security flaws impacting the ServiceNow AI Platform, three of them rated 10.0 on the CVSS scoring system and exploitable, in certain circumstances, by an unauthenticated attacker.The company said it deployed a ..

https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html

19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities.The extensions, per ..

https://thehackernews.com/2026/08/19-chrome-and-edge-extensions-found.html

AI girlfriend review sites secrets were exposed to the world for three weeks

Even testing and staging sites need protection from prying eyes.

https://www.theregister.com/security/2026/08/27/ai-girlfriend-review-sites-secrets-were-exposed-to-the-world-for-three-weeks/5293064

CRPx0 hacking service for dummies claims victim count more than quintupled

Its built to be operated by a human with no technical background.

https://www.theregister.com/cyber-crime/2026/08/27/crpx0-hacking-service-for-dummies-claims-victim-count-more-than-quintupled/5293097

TeamViewer schließt hochriskante Lücken in Clients

Die TeamViewer-Clients können Angreifern das Ausführen von Schadcode ermöglichen. Updates stopfen die hochriskanten Sicherheitslücken.

https://www.heise.de/news/TeamViewer-stopft-Codeschmuggel-Leck-11432840.html

Google macht Android 17 sicherer: ECH-Unterstützung und 2G-Abschaltung

Mit Android 17 führt Google neue Netzwerksicherheitsfunktionen ein. Diese sollen Verbindungen absichern und die Privatsphäre im heimischen WLAN schützen.

https://www.heise.de/news/2G-Abschaltung-und-ECH-Support-Android-17-erhoeht-die-Netzwerksicherheit-11432832.html

-Begrenztes Zeitfenster-: Mehr als 100 Unternehmen warnen vor KI-Cyberangriffen

Führende KI-Labore sowie mehr als 100 Organisationen warnen in einem offenen Brief vor einer baldigen Zunahme KI-gestützter Cyberangriffe.

https://www.heise.de/news/Begrenztes-Zeitfenster-Mehr-als-100-Unternehmen-warnen-vor-KI-Cyberangriffen-11432718.html

Zwei kritische Lücken in Next.js - Remote-Code-Ausführung unter Windows

Die zwei kritischen von Vercel gemeldeten Lücken im JavaScript-Framework Next.js ermöglichen es Angreifern, Code auszuführen.

https://www.heise.de/news/Zwei-kritische-Luecken-in-Next-js-Remote-Code-Ausfuehrung-unter-Windows-11433140.html

(OEM-)China-Router von ZBT mit Backdoors

IT-Forscher haben Router vom OEM-Hersteller ZBT untersucht, die weltweit von Anbietern verkauft werden. Darin fanden sie Backdoors.

https://www.heise.de/news/OEM-China-Router-von-ZBT-mit-Backdoors-11433072.html

Disruptive cyber activity highlights risk from internet-exposed systems and edge devices

Targeting of operational technology reinforces the need for organisations to understand what is exposed to the internet, address avoidable vulnerabilities, and build long-term cyber resilience.

https://www.ncsc.gov.uk/news/disruptive-cyber-activity-highlights-risk-from-internet-exposed-systems-and-edge-devices

Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets

GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies, using forged user agents while requesting the files where misconfigured web servers frequently leak secrets and credentials.

https://www.greynoise.io/blog/threat-actors-posing-as-ai-crawlers

Inside 90 days of attacks on AI infrastructure

Wiz honeypots uncover active campaigns targeting LiteLLM, MCP servers, and AI frameworks through RCE, blind prompt injection, and memory credential theft.

https://www.wiz.io/blog/ai-infrastructure-honeypot

Tageszusammenfassung - 27.08.2026

CERT.at — Thu, 27 Aug 2026 17:15:26 GMT+0100

End-of-Day report

Timeframe: Mittwoch 26-08-2026 18:00 - Donnerstag 27-08-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a

News

New GPUThor attack defeats NVIDIA ECC protection for root access

A newly disclosed Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial-of-service (DoS) and root-level privilege escalation.

https://www.bleepingcomputer.com/news/security/new-gputhor-attack-defeats-nvidia-ecc-protection-for-root-access/

ATF confirms -major incident- after recent Qilin breach claims

ATF, the regulatory agency that enforces federal laws governing firearms and explosives in the United States, has confirmed that one of its systems was compromised after breach claims made by the Qilin ransomware gang.

https://www.bleepingcomputer.com/news/security/atf-confirms-major-incident-after-recent-qilin-breach-claims/

Carhartt data breach exposes information of 12.9 million accounts

The ShinyHunters extortion group has published sensitive data from nearly 13 million accounts stolen from clothing retailer giant Carhartt earlier this month, according to data breach notification service Have I Been Pwned.

https://www.bleepingcomputer.com/news/security/carhartt-data-breach-exposes-information-of-129-million-accounts/

Sicherheitslücke beim Mobilfunk: Angreifer konnten per Anruf Gerätedaten ausspähen

Reporter haben eine Sicherheitslücke in den Mobilfunknetzen mehrerer Provider entdeckt. Angreifer konnten ohne Nutzerinteraktion Gerätedaten abgreifen.

https://www.golem.de/news/sicherheitsluecke-beim-mobilfunk-angreifer-haben-per-anruf-geraetedaten-ausgespaeht-2608-212359.html

Threat landscape for industrial automation systems. Q2 2026

The report contains statistics on industrial threats for Q2 2026, including ransomware, miners, spyware and other threats that were detected and blocked on industrial control systems.

https://securelist.com/industrial-threat-report-q2-2026/121159/

When AI infrastructure becomes the target: Securing gateways and control points

Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining activity.

https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/

What We Still Don-t Know About OpenAI-s Hugging Face Hack

The AI giant acknowledges that it could have done far more to prevent its AI agents from going rogue. But it still fails to explain why it didnt see this fiasco coming.

https://www.wired.com/story/openais-hugging-face-hack-debrief-raises-more-questions-than-it-answers/

Berliner Landesnetz: Sensible Daten bei Cyberangriff womöglich doch betroffen

Eine Cyberattacke traf vor knapp zwei Wochen zwei Berliner Senatsverwaltungen. Bislang hieß es, es seien nur frei verfügbare Geodaten abgeflossen.

https://www.heise.de/news/Sensible-Daten-bei-Cyberangriff-womoeglich-doch-betroffen-11427279.html

Angreifer können an rund 550 Lücken in Dell PowerProtect Cyber Recovery ansetzen

Dells IT-Sicherheitslösung PowerProtect Cyber Recovery bietet viele Angriffspunkte. Admins sollten ihre Instanzen zeitnah über Updates absichern.

https://www.heise.de/news/Sicherheitspatches-Rund-550-Luecken-gefaehrden-Dell-PowerProtect-Cyber-Recovery-11427351.html

Hugging-Face-Angriff: OpenAI-Abschlussbericht liefert neue Erkenntnisse

OpenAIs Bericht zum Hugging-Face-Vorfall zeigt, dass riskante Verhaltensmuster schon beim Training auftraten und Warnsignale nicht ausreichend eskaliert wurden.

https://www.heise.de/news/OpenAI-Abschlussbericht-Rund-700-Agenten-griffen-Hugging-Face-an-11431716.html

Two Alleged -TeamPCP- Hackers Arrested in Australia

Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands ..

https://krebsonsecurity.com/2026/08/two-alleged-teampcp-hackers-arrested-in-australia/

Microsoft Exchange: Exploit-Code veröffentlicht (CVE-2026-62911)

Wie Heise berichtet, wurde auf Github Exploit-Code für eine Sicherheitslücke in Microsoft Exchange veröffentlicht. Microsoft hat im Rahmen seines regulären Patchzykluses Fixes für diese Sicherheitslücke veröffentlicht, betroffen sind demnach die Versionen Microsoft Exchange Server 2019, 2016 und die Subscription Edition RTM. Für die Version 2016 stellt Microsoft die Fixes nur über sein Extended-Security-Updates-Programm zur Verfügung. Wir teilen ..

https://www.cert.at/de/aktuelles/2026/8/microsoft-exchange-exploit-code-veroffentlicht-cve-2026-62911

CISA Urges SharePoint Hardening After New Exploitations

Update August 26, 2026:CISA has updated this Alert to clarify guidance on avoiding the direct exposure of SharePoint Servers to the internet.Update August 18, 2026:CISA has updated this Alert to reflect the addition of CVE-2026-55040 to its Known Exploited Vulnerabilities (KEV) Catalog on August 18, 2026. Update July 28, 2026:CISA has updated this Alert to include CVE-2026-50522 and its addition to the KEV Catalog on July 22, 2026.Update July 16, 2026: CISA has updated this Alert to reflect the ..

https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations

Medical device firm Boston Scientific says cyberattack has disrupted shipment processes

The company released a statement and filed documents with the Securities and Exchange Commission (SEC) saying a cybersecurity incident was discovered on Tuesday.

https://therecord.media/boston-scientific-cyberattack-disrupts-shipment-processes

Disruptive cyber activity highlights risk from internet-exposed systems and edge devices

Targeting of operational technology reinforces the need for organisations to understand what is exposed to the internet, address avoidable vulnerabilities, and build long-term cyber resilience.

https://www.ncsc.gov.uk/news/disruptive-cyber-activity-highlights-risk-from-internet-exposed-systems-and-edge-devices

Brief independent investigation of agents- behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident

Two METR staff members (Hjalmar Wijk and Ajeya Cotra) and a Redwood Research staff member contracting with METR (Ryan Greenblatt) worked on premises at OpenAI over a total of six days1 to attempt to form an independent understanding of model behavior observed during the recent incident in which OpenAI agents coordinated a multi-day hack of Hugging Face on a shared unsanctioned -message board.-

https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/

Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation

A single alert from one security service tells you something happened. Read that signal alongside activity from other services and your own business context, and you will know whether what happened is part of a multi-stage attack. Consider a short sequence. An identity calls GetCallerIdentity from a source address it hasn-t previously used. Within minutes, [-]

https://aws.amazon.com/blogs/security/detecting-multi-stage-attacks-on-aws-a-guide-to-cross-service-signal-correlation/

Vulnerabilities

CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

https://www.drupal.org/sa-contrib-2026-105

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

https://www.drupal.org/sa-contrib-2026-111

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110

https://www.drupal.org/sa-contrib-2026-110

Tageszusammenfassung - 26.08.2026

CERT.at — Wed, 26 Aug 2026 17:06:36 GMT+0100

End-of-Day report

Timeframe: Dienstag 25-08-2026 18:00 - Mittwoch 26-08-2026 18:00 Handler: Alexander Riepl Co-Handler: Guenes Holler

News

Hackers abuse npm mirrors to host phishing redirect pages

Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites.

https://www.bleepingcomputer.com/news/security/hackers-abuse-npm-mirrors-to-host-phishing-redirect-pages/

Ubiquiti patches three max severity security vulnerabilities

Ubiquiti has released security patches for three new maximum-severity vulnerabilities that threat actors can exploit remotely without privileges.

https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-security-vulnerabilities/

Jetzt updaten: 327 Sicherheitslücken in Google Chrome gepatcht

Unzählige Chrome-Nutzer sind über mehr als 300 Sicherheitslücken Angreifbar. Das jüngste Update schützt davor und sollte zügig installiert werden.

https://www.golem.de/news/jetzt-updaten-327-sicherheitsluecken-in-google-chrome-gepatcht-2608-212303.html

Viele Softwareprojekte gefährdet: Hacker schleusen Schadcode auf Gitea-Instanzen

Eine kritische Sicherheitslücke ermöglicht Schadcode-Attacken auf Gitea-Instanzen. Angreifer nutzen das bereits. Admins sollten zügig patchen.

https://www.golem.de/news/viele-softwareprojekte-gefaehrdet-hacker-schleusen-schadcode-auf-gitea-instanzen-2608-212317.html

Exploits and vulnerabilities in Q2 2026

This report covers statistics on vulnerabilities, exploits, and C2 frameworks in Q2 2026. For the first time ever, we aggregate data on vulnerabilities in open-source AI agents and AI frameworks.

https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/

The patch window is collapsing: Why security needs a new control plane

Organizations need protection that operates in the gap between discovery and remediation.

https://azure.microsoft.com/en-us/blog/the-patch-window-is-collapsing-why-security-needs-a-new-control-plane/

Boston Scientific discloses global disruption in ongoing cyberattack

No timeline to restore IT systems as probe remains ongoing

https://www.theregister.com/security/2026/08/26/boston-scientific-discloses-global-disruption-in-ongoing-cyberattack/5292641

WordPress-Plug-in TranslatePress ermöglicht Übernahme bei 400.000 Installationen

Eine Lücke im Plug-in TranslatePress für WordPress gefährdet 400.000 Instanzen. Angriffe laufen derweil auf miniOrange SAML.

https://www.heise.de/news/WordPress-Plug-in-TranslatePress-ermoeglicht-Uebernahme-bei-400-000-Installationen-11426021.html

Spyware-Masche gegen Indeed-Nutzer - infizierte Vorstellungsgespräch-Apps

IT-Forscher beobachten eine globale Malware-Kampagne, bei der die Drahtzieher es auf Nutzer der Indeed-Plattform abgesehen haben.

https://www.heise.de/news/Spyware-Masche-gegen-Indeed-Nutzer-infizierte-Vorstellungsgespraech-Apps-11426339.html

Kritische Schadcode-Lücken in Adobe-Anwendungen geschlossen

Angreifer können mehrere Sicherheitslücken unter anderem in Adobe Campaign Classic, Illustrator und Substance 3D Designer ausnutzen.

https://www.heise.de/news/Kritische-Schadcode-Luecken-in-Adobe-Anwendungen-geschlossen-11426165.html

Verfassungsschutz sieht kein Zero-Day-Problem durch mehr Befugnisse

Unternehmen sind stark von Cyberangriffen betroffen, so eine Bitkom-Studie. Verfassungsschutzpräsident Selen warnt vor dem Unterschätzen von Abhängigkeiten.

https://www.heise.de/news/Verfassungsschutz-sieht-kein-Zero-Day-Problem-durch-mehr-Befugnisse-11426869.html

Zwei Fallen in einer: Wie Kriminelle ihre Opfer mit Fake-Jobs und Krypto-Investmentbetrug ausnehmen

Eine Betrugsfalle allein kann bereits großen finanziellen Schaden anrichten. Werden zwei Maschen kombiniert, steigert dies die Gefahr nochmals deutlich. Ein vorliegender Fall zeigt, wie Kriminelle ein bereits schwer getroffenes Opfer weiter ausnehmen. Sie erfinden dabei das Rad keineswegs neu, sondern setzen schlicht und einfach sowohl auf Job- als auch auf Krypto-Investmentbetrug.

https://www.watchlist-internet.at/news/zwei-fallen-in-einer/

Häufung von Betrugsversuchen durch Business Email Compromise (BEC)

In den letzten Wochen erreichen uns vermehrt Berichte über Versuche, österreichische Organisationen und Unternehmen mittels Business E-Mail Compromise (BEC) zu schädigen. Bei dieser Betrugsform geben sich Kriminelle als vertrauenswürdige Person aus (wie beispielsweise als Geschäftsführung, bekannter Lieferant, Kolleg:in aus der Personalabteilung, ...), um ..

https://www.cert.at/de/aktuelles/2026/8/vermehrt-betrugsversuche-durch-business-email-compromise-bec

UK government seeks powers to secretly block risky tech suppliers

The British government is seeking new powers to ban certain technology vendors from supplying companies working in the country-s critical sectors - and to potentially do so in secret.

https://therecord.media/uk-technology-national-security

From Mayhem to Atlantis: how AI is changing capture the flag and what this means for cybersecurity

Ten years after DARPAs first all-machine hacking tournament, AI agents are solving live CTF challenges, competing with human teams and pushing cybersecurity toward an AI-versus-AI future. Read on to discover how this future can affect your cybersecurity.

https://www.jamf.com/blog/from-mayhem-to-atlantis-ai-is-changing/

Tageszusammenfassung - 25.08.2026

CERT.at — Tue, 25 Aug 2026 17:05:51 GMT+0100

End-of-Day report

Timeframe: Montag 24-08-2026 18:00 - Dienstag 25-08-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a

News

Police arrests dozens of suspects in global cybercrime crackdown

Law enforcement agencies from 22 countries helped identify 263 suspects and arrested 58 individuals linked to cybercrime networks coordinated by African crime groups.

https://www.bleepingcomputer.com/news/security/police-arrests-dozens-of-suspects-in-global-cybercrime-crackdown/

Hackers breached over 270 Zimbra servers in ongoing attacks

Threat actors have already compromised over 270 Zimbra instances in remote code execution attacks targeting a high-severity Zimbra Collaboration Suite (ZCS) vulnerability.

https://www.bleepingcomputer.com/news/security/hackers-breached-over-270-zimbra-servers-in-ongoing-attacks/

Third-Party Script Security: How Tags, Pixels, and Embeds Can Put Websites at Risk

Third-party scripts are common on websites. They help with analytics, ads, live chat, social media, video, payments, and many other features. While not all are risky, every external tag, pixel, widget, or embed adds to your website-s vulnerability. These tools can read page content, collect visitor data, change what users see, and connect ..

https://blog.sucuri.net/2026/08/third-party-script-security-how-tags-pixels-and-embeds-can-put-websites-at-risk.html

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including ..

https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html

Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows

Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor ..

https://thehackernews.com/2026/08/mirage2fa-surge-hits-4500-us-and-eu.html

E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands

Cybersecurity researchers are calling attention to a new campaign that employs FTP banners as dead drop resolvers (DDRs) to deliver two previously unreported remote access trojans (RATs) tracked as E4del and PINHOLE.While threat actors are ..

https://thehackernews.com/2026/08/e4del-and-pinhole-rats-turn-ftp-banners.html

A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw

Oasis Security has disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model itself.The findings were ..

https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html

You dont want this Sleepwalker backdoor on your Windows machine

Its own command language, 23 instructions - signs point to well-resourced operation rather than an opportunistic one

https://www.theregister.com/security/2026/08/24/you-dont-want-this-sleepwalker-backdoor-on-your-windows-machine/5292021

Crooks push Mac malware through fake OpenAI Codex ads

Sponsored search results lead developers straight into a ClickFix malware trap

https://www.theregister.com/security/2026/08/25/crooks-push-mac-malware-through-fake-openai-codex-ads/5291899

CISA slaps its tightest three-day patching deadline on perfect-10 Oracle flaw

Disclosed in January and honeypots buzzed soon after, CISA says it-s finally time for the USG to plug the gap

https://www.theregister.com/security/2026/08/25/cisa-slaps-its-tightest-three-day-patching-deadline-on-perfect-10-oracle-flaw/5292107

Kriminalisierung: Informatiker verlangen Freipass für IT-Sicherheitsforscher

Die Gesellschaft für Informatik fordert die Bundesregierung auf, ethische Hacker endlich wirksam vor Strafverfolgung zu schützen.

https://www.heise.de/news/Kriminalisierung-Informatiker-verlangen-Freipass-fuer-IT-Sicherheitsforscher-11424219.html

Angreifer nehmen Oracle Weblogic und HTTP-Server ins Visier

Angreifer missbrauchen eine Sicherheitslücke in Oracle HTTP-Server und Weblogic Server, die komplette Kompromittierung ermöglicht.

https://www.heise.de/news/Attacken-auf-Oracle-Weblogic-und-HTTP-Server-beobachtet-11424527.html

Zugriffsverwaltung Keycloak: Kontoübernahme durch Passwort-Rücksetzfunktion

In dem Identitäts- und Zugriffssteuerungssystem Keycloak können Angreifer einen Fehler beim Passwort-Rücksetzen missbrauchen, um Konten zu übernehmen.

https://www.heise.de/news/Zugriffsverwaltung-Keycloak-Kontouebernahme-durch-Passwort-Ruecksetzfunktion-11424729.html

WhatsApp führt mehrere Passkeys ein und ersetzt PINs

WhatsApp verbessert die Kontosicherheit durch die Unterstützung mehrerer Passkeys, stärkere Passwörter und Kontextinformationen bei unbekannten Anrufen.

https://www.heise.de/news/WhatsApp-Mehr-Passkeys-und-verbesserte-Sicherheit-bei-unbekannten-Anrufen-11425433.html

Phishing-Versuch greift Login-Daten für Onlinebroker ab

Eine SMS-Nachricht, ein Login-Portal - und fertig ist die Phishing-Falle. Kriminelle versenden aktuell im Namen des Onlinebrokers -flatex- Warnungen vor dem Ablaufen der für Überweisungen benötigten iTAN-Card. Über die Fake-Anmeldeseite wollen sie an Benutzername und Passwort ihrer Opfer gelangen.

https://www.watchlist-internet.at/news/phishing-login-daten-onlinebroker/

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution

To assess the impact of AI-enabled malware, we collected and analyzed over 400 malware samples that integrate AI in some capacity, from brand impersonation and large language model (LLM)-generated code to agentic execution loops. Our central finding was that the AI malware space is currently overwhelmingly composed of ..

https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/

Large DDoS attack knocks Norwegian public services offline

The Norwegian Digitalisation Agency said it was working with its IT partner to stabilize systems affected by a distributed denial-of-service attack, with some services gradually coming back online.

https://therecord.media/norway-cyberattack-ddos-government

A Tale of Two SOCs: Insights From Two Red Team Assessments

The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A failed to detect or contain the activity, but ..

https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a

ToxNetV2: An AI-Assisted Botnet Controller

ToxNetV2 is an AArch64 Linux peer-to-peer botnet that integrates an LLM into the operational workflow of its controller. As uncovered in the Joe Reverser analysis, the controller collects host and botnet telemetry, sends that context to NVIDIA NIM, parses selected model responses into structured actions, and queues those actions for operator approval. The resulting ..

https://www.joesecurity.org/blog/6764463444623599134

Open VSX Unblocks Extension IDs Used in Malware Campaign

Over a five-day period from August 16 through August 20, the registry unblocked AlDuncanson.react-hooks-snippets, magne-sjaastad.opm-flow-editor-support, and rumbledb.jsoniq-vscode. All three IDs had been used by impostors in the 77-extension evil-twin campaign documented by Manifold Security earlier this month. Legitimate versions of the OPM and RumbleDB ..

https://socket.dev/blog/open-vsx-unblocks-malicious-extension-ids

Vulnerabilities

TYPO3-EXT-SA-2026-025: Multiple Vulnerabilities in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025

TYPO3-EXT-SA-2026-023: Multiple vulnerabilities in extension "Event management and registration" (sf_event_mgt)

https://news.typo3.com/security/advisory/typo3-ext-sa-2026-023

TYPO3-EXT-SA-2026-021: Broken Access Control in extension "Forum" (pforum)

https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021

Tageszusammenfassung - 24.08.2026

CERT.at — Mon, 24 Aug 2026 17:35:56 GMT+0100

End-of-Day report

Timeframe: Freitag 21-08-2026 18:00 - Montag 24-08-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a

News

How an Emerging Industrial Protocol Family Could Put OT at Risk

New research shows how attacks against some unprotected TSN protocols could allow attackers to disrupt or manipulate physical processes.

https://www.darkreading.com/ics-ot-security/how-emerging-industrial-protocol-family-put-ot-at-risk

Nach Hackerangriff: Berliner Senat überrascht über Größe des IT-Systems

Nach einem Hackerangriff sind zwei Berliner Verwaltungen wieder am Netz. Es gibt jedoch weiter Verdachtsmomente für eine Infiltration.

https://www.golem.de/news/nach-hackerangriff-berliner-senat-ueberrascht-ueber-groesse-des-it-systems-2608-212218.html

Missbrauch von Passkeys: Phishing-Toolkit soll Passwort-Reset umgehen können

Ein ab 10.000 US-Dollar gehandeltes Phishing-Toolkit soll Angreifern über Passkeys einen dauerhaften Zugriff etwa auf gekaperte Google-Konten verleihen.

https://www.golem.de/news/missbrauch-von-passkeys-phishing-toolkit-soll-passwort-reset-umgehen-koennen-2608-212226.html

Security vets rally around $4 paper password books for sale in Australia

Once shunned by the IT crowd, pen-and-paper password vaults are getting the love they deserve in 2026

https://www.theregister.com/security/2026/08/24/security-vets-rally-around-4-paper-password-books-for-sale-in-australia/5291234

AliExpress accused of fingerprinting shoppers with silent audio trick that also muted a devs headphones

Sawtooth waves you cant hear still mess with your Bluetooth. Firefox and Brave say theyve got you covered

https://www.theregister.com/security/2026/08/24/aliexpress-accused-of-fingerprinting-shoppers-with-silent-audio-trick-that-also-muted-a-devs-headphones/5291662

The curious case of the effortful fraud

How what looked like a generic phishing site seemingly turned out to be a put-some-effort-into it, targeted fraud.

https://bytesandborscht.com/the-curious-case-of-the-effortful-fraud/

Britische Regierung bestätigt Cyberattacke auf Kraftwerk

Für vier Tage haben Angreifer in Großbritannien ein Kraftwerk abgeschaltet. Die Behörden warnen und besänftigten zugleich.

https://www.heise.de/news/Britische-Regierung-bestaetigt-Cyberattacke-auf-Kraftwerk-11422989.html

Microsoft stopft zahlreiche Cloud-Schwachstellen

Microsoft dokumentiert 18 teils kritische Sicherheitslücken in Cloud-Produkten, die die Entwickler geschlossen haben.

https://www.heise.de/news/Microsoft-stopft-zahlreiche-Cloud-Schwachstellen-11423129.html

-GTA 6--ISO: Vermeintliche Leak-Abbilddatei voller Malware

Bösartige Akteure bieten das vermeintlich geleakte ISO von -GTA 6- im Netz an. Die 113 GByte enthalten aufgepumpte Virendaten.

https://www.heise.de/news/GTA-6-ISO-Vermeintliche-Leak-Abbilddatei-voller-Malware-11423363.html

Notepad++ v8.9.8 stopft 14 Sicherheitslücken

Am Sonntag hat Don Ho Version 8.9.8 des beliebten Editors Notepad++ herausgegeben. Sie schließt etwa Codeschmuggellücken.

https://www.heise.de/news/Notepad-v8-9-8-stopft-14-Sicherheitsluecken-11423868.html

And then the men with guns tell you to do it anyway

Perhaps you can think of a way to design an alerting system which cannot be abused - but I can't.

https://shkspr.mobi/blog/2026/08/and-then-the-men-with-guns-tell-you-to-do-it-anyway/

Everything I own, owned

Over the past couple weeks I-ve been doing agent-driven reverse engineering of peripherals that happen to be within arm-s reach. From those devices, I-ve come away with a full plaintext command shell inside my microphone, a webcam whose activity LED I can switch off while it records, and a key light that hands out memory writes to anyone on the WiFi.

https://schlarp.com/posts/everything-i-own-owned/

Building certgrep.sh: a free certificate transparency search engine

Certificate transparency is one of the best public datasets in security. Every certificate issued by a publicly trusted certificate authority lands in an append-only, cryptographically verifiable log, usually before the certificate is ever used. For anyone hunting malicious infrastructure, that makes certificate transparency (CT) one of the earliest ..

https://haveibeensquatted.com/blog/building-certgrep

Vulnerabilities

The Fabrik Fiasco: Announced, Restricted, Relabelled

https://mysites.guru/blog/fabrik-unauthenticated-rce-calc-element/

Fabrik 4.7.2 for Joomla: A Long List of Security Fixes

https://mysites.guru/blog/fabrik-4-7-2-security-release/

Tageszusammenfassung - 21.08.2026

CERT.at — Fri, 21 Aug 2026 18:00:20 GMT+0100

End-of-Day report

Timeframe: Donnerstag 20-08-2026 18:00 - Freitag 21-08-2026 18:00 Handler: Alexander Riepl Co-Handler: Guenes Holler

News

Hundreds of leaked AWS keys give full control over corporate accounts

More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid.

https://www.bleepingcomputer.com/news/security/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts/

Slowakei: Russische Backdoor in Verkehrskameras entdeckt

Die Slowakei wollte im Rahmen eines Sanierungspakets 279 neue Verkehrskameras beschaffen. Erste Geräte kamen unerwartet aus Russland - inklusive Backdoor.

https://www.golem.de/news/slowakei-russische-backdoor-in-verkehrskameras-entdeckt-2608-212088.html

N-able Passportal: Zahlreiche Unternehmen durch kritisches Passwort-Leck gefährdet

Ein Forscher hat bei N-able Passportal eine kritische Lücke entdeckt. Angreifer hätten damit leicht Zugangsdaten aus Passwort-Tresoren abgreifen können.

https://www.golem.de/news/n-able-passportal-jede-website-konnte-passwort-tresore-auslesen-2608-212171.html

GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure

A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr.The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated ..

https://thehackernews.com/2026/08/gitlab-cve-2026-19478-comes-under.html

Researcher tricks Apple-s Find My into sharing location data with Linux

Clever protocol wrangling gets iBiz-only people tracking working on a non-iGadget

https://www.theregister.com/security/2026/08/20/researcher-tricks-apples-find-my-into-sharing-location-data-with-linux/5290496

Cisco bug severity warning reads like Olympic gymnastics scores: 10, 10, 9.9, 9.6, and 7.5.

Secure Workload Software has five nasty flaws and even SaaS users have updates to install

https://www.theregister.com/security/2026/08/21/cisco-bug-severity-warning-reads-like-olympic-gymnastics-scores-10-10-99-96-and-75/5290838

ClaudeFix: Shared Claude Chats Meet ClickFix

ClickFix is a widely employed attack technique, first seen in 2024, where a victim is instructed to paste-and-run instructions on their system to -fix- a problem or install software. The seemingly benign instructions are, in fact, malicious and lead to the deployment of malware onto the victim-s system. Zscaler Threat Hunting has analyzed ..

https://www.zscaler.com/blogs/security-research/claudefix-shared-claude-chats-meet-clickfix

Zimbra: Warnung vor Angriffen auf Befehlsschmuggel-Lücke

Das polnische CERT warnt vor Angriffen auf eine Befehlsschmuggel-Lücke in der Zimbra Collaboration Suite. Ein Update ist verfügbar.

https://www.heise.de/news/Zimbra-Warnung-vor-Angriffen-auf-Befehlsschmuggel-Luecke-11421424.html

Atlassian schließt mehr als 160 Sicherheitslücken in Confluence & Co.

Angreifer können unter anderem an kritischen Schadcode-Schwachstellen in Softwareprodukten von Atlassian ansetzen.

https://www.heise.de/news/Atlassian-schliesst-mehr-als-160-Sicherheitsluecken-in-Confluence-Co-11421486.html

Dell ObjectScale: Höhere Nutzerrechte erschleichbar

Sicherheitsupdates schließen mehrere Lücken in Dells Object-Storage-Plattform ObjectScale.

https://www.heise.de/news/Dell-ObjectScale-Hoehere-Nutzerrechte-erschleichbar-11421714.html

Lücke in WordPress-Plug-in Elementor Pro: 6 Millionen Webseiten gefährdet

Eine kritische Sicherheitslücke im WordPress-Plug-in Elementor Pro ermöglicht die komplette Übernahme von WordPress.

https://www.heise.de/news/Luecke-in-WordPress-Plug-in-Elementor-Pro-6-Millionen-Webseiten-gefaehrdet-11421805.html

Cyberangriff in Berlin: Behörden weiterhin offline

Zwei Senatsverwaltungen sind nach einem Cyberangriff vom Landesnetz isoliert. Das hat auch Auswirkungen auf die Auszahlung von Wohngeld.

https://heise.de/-11421320

Defeating AI-Assisted Reverse Engineering (or at Least Trying To)

At the beginning of 2026, a customer told us something along the lines of: obfuscation is finished, LLM-assisted reverse engineering breaks it. They had a walkthrough to back it up, produced by their own tooling, in which a model took one of their obfuscated libraries apart and recovered its hidden strings.They were not right, but not entirely wrong either.So we spent a ..

http://blog.quarkslab.com/defeating-ai-assisted-reverse-engineering-or-at-least-trying-to.html

I accidentally logged hundreds of thousands of phone calls to military bases

How an expired nameserver let me take over e164.arpa zones for multiple territories, and why I probably should have checked my logs sooner.

https://lina.sh/blog/hijacking-e164-arpa

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaigns infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios.

https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns

If Apple says your iPhone was targeted by mercenary spyware, treat it like an incident

Apples Threat Notifications signal mercenary spyware targeting; learn verification steps, response actions, and layered mobile security defenses for high-risk users.

https://www.jamf.com/blog/apple-threat-notification-mercenary-spyware-response/

Vulnerabilities

[20260803] - Core - Inconsistent ACL checks for mutating webservice endpoints

https://developer.joomla.org/security-centre/1070-20260803-core-inconsistent-acl-checks-for-mutating-webservice-endpoints.html

Tageszusammenfassung - 20.08.2026

CERT.at — Thu, 20 Aug 2026 17:22:47 GMT+0100

End-of-Day report

Timeframe: Mittwoch 19-08-2026 18:00 - Donnerstag 20-08-2026 18:00 Handler: Guenes Holler Co-Handler: Alexander Riepl

News

Grok exfiltrates user data when malicious instructions are encrypted

Cryptographic Context Injection is only the latest way to break an LLM safety guardrail.

https://arstechnica.com/security/2026/08/grok-exfiltrates-user-data-when-malicious-instructions-are-encrypted/

US warns of AI-powered attacks on Siemens PLCs in critical infrastructure

U.S. cybersecurity agencies warn that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure.

https://www.bleepingcomputer.com/news/security/us-warns-of-ai-powered-attacks-on-siemens-plcs-in-critical-infrastructure/

Rogue ransomware affiliate poses as data recovery firm to steal payments

A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting the victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee.

https://www.bleepingcomputer.com/news/security/rogue-ransomware-affiliate-ransom-busters-poses-as-data-recovery-firm/

New Manic Android malware can exfiltrate data through nearby devices

A new Android malware named Manic targeting users in multiple European countries has a fallback data exfiltration mechanism that uses nearby infected devices.

https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/

Critical Elementor Pro bug exposes WordPress sites to RCE attacks

A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server.

https://www.bleepingcomputer.com/news/security/critical-elementor-pro-bug-exposes-wordpress-sites-to-rce-attacks/

Kritische Sicherheitslücke: Hacker attackieren Gitlab-Instanzen

Angreifer können durch eine Sicherheitslücke auf Gitlab-Instanzen verheerende Schäden anrichten. Forscher warnen bereits vor laufenden Angriffen.

https://www.golem.de/news/kritische-sicherheitsluecke-hacker-attackieren-gitlab-instanzen-2608-212127.html

Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second

Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021.The end-to-end experiment used an attacker Worker and a victim Worker controlled ..

https://thehackernews.com/2026/08/cloudflare-workers-spectre-attack-leaks.html

40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets

A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, TronLink, and other Web3 products.According to the Socket Threat Research team, the extensions are part of a ..

https://thehackernews.com/2026/08/40-malicious-firefox-extensions-pose-as.html

CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification

Cybersecurity researchers have disclosed two denial-of-service (DoS) attacks that exploit how major content delivery networks (CDNs) convert client-facing HTTP/3 traffic into HTTP/1.1 requests to the websites they front, amplifying a ..

https://thehackernews.com/2026/08/cdn-tsunami-attack-abuses-http3.html

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska).The vulnerability in question is ..

https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html

Microsoft untersucht Spieleprobleme nach August-Patchday

Nach der Installation der Windows-Updates vom August-Patchday erhält Microsoft vermehrt Meldungen zu Problemen mit einigen Spielen.

https://www.heise.de/news/Microsoft-untersucht-Spieleprobleme-nach-August-Patchday-11419963.html

Citrix stopft kritische Anmeldungsumgehung in Netscaler ADC und Gateway

In Netscaler ADC und Gateway von Citrix können Angreifer mehrere Lücken missbrauchen. Sie können etwa unbefugt Zugriff erlangen.

https://www.heise.de/news/Citrix-stopft-kritische-Anmeldungsumgehung-in-Netscaler-ADC-und-Gateway-11420304.html

Sicherheitslücke in Microsoft 365 Copilot: KI verrät eigene Schutzmechanismen

Sicherheitsforscher haben Microsofts KI-Assistenten dazu gebracht, seine eigenen Schutzmechanismen offenzulegen.

https://www.heise.de/news/Sicherheitsluecke-in-Microsoft-365-Copilot-KI-verraet-eigene-Schutzmechanismen-11420618.html

GivEnergy enters administration, batteries expose home networks

In late 2024, we found multiple vulnerabilities in GivEnergy home battery systems that could allow attackers to access customers- home networks, disrupt battery operation, and potentially violate UK product security regulations. While GivEnergy updated installer guidance for newer deployments, older installations may still be exposed, with no clear remediation plan communicated to customers. Even before the latest news, this was ..

https://www.pentestpartners.com/security-blog/givenergy-enters-administration-legacy-home-batteries-still-expose-customer-networks/

A1-Phishing: Gefälschte E-Mails im Umlauf

Mit rund 7 Millionen Kund ist A1 einer der größten Anbieter für Handy, Festnetz und Internet in Österreich. Diese Bekanntheit nutzen Kriminelle aktuell aus und verschicken täuschend echte Phishing-Mails im Namen von A1. Das Ziel: Persönliche Daten und Kontoinformationen.

https://www.watchlist-internet.at/news/a1-phishing-gefaelschte-e-mails-im-umlauf/

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Cisco Talos discovered a Chinese-speaking cybercrime group, tracked as UAT-10147, that targets a wide range of vulnerable web servers. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics.

https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/

Gefälschte Seite, falsche Software - trotz korrekt aussehender Links

Eine Kampagne mit gefälschten Webseiten zeigt korrekt erscheinende Links an, schiebt Opfern jedoch unerwünschte Software unter.

https://heise.de/-11420547

Supply chain attack on arrayref

On 2026-08-20 at 7:15 UTC we got a report that the proc-macro1 crate was malicious.

https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/

Vulnerabilities

Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101

https://www.drupal.org/sa-contrib-2026-101

Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

https://www.drupal.org/sa-contrib-2026-100

Cisco Advance Notification for Publication of August 19, 2026, Security Advisories

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-LDquvx5d

Tageszusammenfassung - 19.08.2026

CERT.at — Wed, 19 Aug 2026 17:22:28 GMT+0100

End-of-Day report

Timeframe: Dienstag 18-08-2026 18:00 - Mittwoch 19-08-2026 18:00 Handler: Guenes Holler Co-Handler: n/a

News

Slowakei: Russische Backdoor in Verkehrskameras entdeckt

Die Slowakei hat im Rahmen eines Sanierungspakets 279 neue Verkehrskameras gekauft. Die Geräte kamen unerwartet aus Russland - inklusive Backdoor.

https://www.golem.de/news

/slowakei-russische-backdoor-in-verkehrskameras-entdeckt-2608-212088 .html

Phishing-Welle im Namen des Finanzministeriums nutzt Familienbeihilfe als Köder

Datenmissbrauch, unrechtmäßige Umleitungen und ausbleibende Auszahlungen der Familienbeihilfe - mit diesem Bedrohungsbild gehen Kriminelle momentan auf Beutezug. Sie geben sich in einer E-Mail als Finanzministerium aus und wollen so an die Onlinebanking-Logindaten ihrer Opfer gelangen.

https://www.watchlist-internet.at/news

/phishing-finanzministeriums-familienbeihilfe/

Warnung vor Angriffen auf Microsoft IKE, SharePoint, VMware vCenter und macOS

Die IT-Sicherheitsbehörde CISA warnt aktuell vor Angriffen auf Microsoft IKE, SharePoint, VMware vCenter und macOS.

https://heise.de/-11418783

CISA: Medusa ransomware hit over 500 critical infrastructure orgs

The Cybersecurity and Infrastructure Security Agency (CISA) said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021.
https://www.bleepingcomputer.com/news/security
/cisa-medusa-ransomware-hit-over-500-critical-infrastructure-orgs/

Password spraying attacks surge 155x as hackers exploit MFA gaps

Huntress has observed a 155x increase in password spraying attacks in the first half of 2026. Brute force is old news, but the spin driving that spike is new.
https://www.bleepingcomputer.com/news/security
/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps/

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology (OT) and industrial automation, are witnessing malicious scanning and exploitation efforts.

https://thehackernews.com/2026/08

/attackers-exploit-mlflow-ssrf-flaw-to.html

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint and network behaviors across changing infrastructure, tracing the malware from payload retrieval through data collection, staging, and exfiltration.

https://thehackernews.com/2026/08

/microsoft-links-30-rotating-domains-to.html

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management (PLM) software, according to new findings from ReliaQuest.

https://thehackernews.com/2026/08/clop-linked-windchill-web-shell.html

Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) relay technique.

https://thehackernews.com/2026/08

/hackers-compromised-14500-dahua-devices.html

Vulnerabilities

Oracle-Patchday: Updates für weniger als tausend Schwachstellen

Oracle fixt zum -Critical Security Patch Update- knapp 1000 Lücken - weniger als zum letzten regulären -CPU- genannten Patchday.

https://heise.de/-11418883

LWN Security updates for Wednesday

https://lwn.net/Articles/1089501/

Security Vulnerabilities fixed in Thunderbird 153.1

https://www.mozilla.org/en-US/security/advisories/mfsa2026-80/

Security Vulnerabilities fixed in Thunderbird 140.14

https://www.mozilla.org/en-US/security/advisories/mfsa2026-79/

Security Vulnerabilities fixed in Thunderbird 154

https://www.mozilla.org/en-US/security/advisories/mfsa2026-78/

Tageszusammenfassung - 18.08.2026

CERT.at — Tue, 18 Aug 2026 17:18:00 GMT+0100

End-of-Day report

Timeframe: Montag 17-08-2026 18:00 - Dienstag 18-08-2026 18:00 Handler: Guenes Holler Co-Handler: n/a

News

Hacker claims 3.6 million Azure account records stolen from major companies

A threat actor is selling employee databases allegedly stolen from the Microsoft Azure infrastructure of multiple Fortune 500 companies after gaining access using compromised credentials.

https://www.bleepingcomputer.com/news/security/hacker-claims-36-million-azure-account-records-stolen-from-major-companies/

Whatsapp, Signal und Threema: Angreifer können Gruppenchats unbemerkt manipulieren

Bei Whatsapp, Signal, iMessage und Threema kann ein Gruppenmitglied anderen Teilnehmern unterschiedliche Inhalte zeigen. Die Verschlüsselung muss dafür nicht gebrochen werden.

https://www.golem.de/news/whatsapp-signal-und-threema-angreifer-koennen-gruppenchats-unbemerkt-manipulieren-2608-211871.html

16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer.

https://thehackernews.com/2026/08/16-typosquatted-rubygems-packages-steal.html

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT.

https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html

CISA gives feds 3 days to fix actively exploited Ray RCE bug

Phishing, malvertising attacks could target devs to gain access to private corporate networks.

https://www.theregister.com/security/2026/08/18/cisa-gives-feds-3-days-to-fix-actively-exploited-ray-rce-bug/5289007

-Sie haben eine neue Nachricht-: Phishing-Falle im Namen der easybank

Über eine angeblich notwendige -Vervollständigung der Kontodaten- wollen Kriminelle an die Onlinebanking-Logininformationen ihrer Opfer gelangen. Sie geben sich dabei als Vertreter der -easybank- aus und setzen auf eine Phishing-Falle, die typischer nicht sein könnte.

https://www.watchlist-internet.at/news/phishing-falle-easybank/

Microsoft starts removing WMIC tool used by cybercriminals

Microsoft announced that it removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2 and 25H2, as well as from Windows 11 beta builds released this week.

https://www.bleepingcomputer.com/news/microsoft/microsoft-removes-wmic-lolbin-tool-in-windows-11-beta-builds/

Mobile Klimaanlage: Midea PortaSplit lässt sich von jedermann fernsteuern

Per Bluetooth können Nachbarn die mobile Klimaanlage fernbedienen oder abschalten, Midea sieht keine Sicherheitslücke darin.

https://heise.de/-11417163

Vulnerabilities

Keine Anmeldung nötig: Gitlab-Lücke lässt Angreifer Softwareprojekte löschen

Aufgrund einer kritischen Sicherheitslücke können Angreifer ohne Anmeldung Gitlab-Projekte manipulieren oder löschen. Admins sollten zügig handeln.

https://www.golem.de/news/keine-anmeldung-noetig-gitlab-luecke-laesst-angreifer-softwareprojekte-loeschen-2608-212022.html

Webmailer Roundcube: Updates stopfen zahlreiche Sicherheitslecks

Das Webmail-System Roundcube hat mit aktualisierter Software mehrere Sicherheitslücken geschlossen. Die teils hochriskanten Schwachstellen ermöglichen Angreifern etwa das Einschmuggeln von Schadcode. Die Updates stehen bereits seit rund zwei Wochen bereit, nun wurden die Schwachstelleneinträge der darin geschlossenen Lecks nachgeschoben.

https://www.heise.de/news/Webmailer-Roundcube-Updates-stopfen-zahlreiche-Sicherheitslecks-11416887.html

Redis: Sicherheitsupdates gegen Schadcode-Lücken

In der In-Memory-Datenbank Redis wurden mehrere Schwachstellen ausgemacht, die etwa Einschleusen von Schadcode erlauben. Es hagelt Updates.

https://www.heise.de/news/Redis-Sicherheitsupdates-gegen-Schadcode-Luecken-11417524.html

WordPress-Plug-in Forminator Forms: Kritische Lücke erlaubt Codeschmuggel

Das WordPress-Plug-in Forminator Forms enthält eine kritische Schadcode-Lücke. Zudem sind Royal Elementor Addons löchrig.

https://heise.de/-11416793

Weitere Sicherheitsupdates: iOS 26.6.1, macOS 26.6.2 und mehr veröffentlicht

Kleine Aktualisierung, viele Lücken: Gut 30 Sicherheitslöcher hat Apple in insgesamt sechs Betriebssystemen gestopft. KI dürfte geholfen haben.

https://heise.de/-11416727

LWN Security updates for Tuesday

https://lwn.net/Articles/1089338/

Tageszusammenfassung - 17.08.2026

CERT.at — Mon, 17 Aug 2026 17:16:07 GMT+0100

End-of-Day report

Timeframe: Freitag 14-08-2026 18:00 - Montag 17-08-2026 18:00 Handler: Guenes Holler Co-Handler: Alexander Riepl

News

Cyberangriff auf die Arbeiterkammer Oberösterreich

Die Angreifer erlangten Zugriff auf Daten der Landes-Kammer.

https://www.derstandard.at/story/3000000335811/cyberangriff-auf-die-arbeiterkammer-oberoesterreich

Schadcode im Anmarsch: SAP-Systeme werden über kritische Lücke attackiert

Angreifer können SAP-Commerce-Cloud-Instanzen über eine kritische Sicherheitslücke kompromittieren. Entsprechende Attacken laufen bereits.

https://www.golem.de/news/schadcode-im-anmarsch-sap-systeme-werden-ueber-kritische-luecke-attackiert-2608-211987.html

Cyberattacke auf Berliner Verwaltung, Ermittlungen laufen

Die Senatskanzlei berichtet von einem Angriff auf Teile der Verwaltung in der Hauptstadt. Ein Krisenstab ist eingerichtet. Viele Fragen sind offen.

https://heise.de/-11416539

Microsoft confirms GitHub is down worldwide

GitHub is down for some users as a widespread outage is causing errors across the website, API, Actions, Pull Requests, and several other services.

https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-github-is-down-worldwide/

Windows-Ablaufdaten: Microsoft-Erinnerung an Server 2022 und Windows 11 24H2

In 60 Tagen endet der (Mainstream-)Support für Windows Server 2022, Windows 11 24H2 und Windows 10 LTSB 2016, mahnt Microsoft.

https://www.heise.de/news/Windows-Ablaufdaten-Microsoft-Erinnerung-an-Server-2022-und-Windows-11-24H2-11415926.html

PBS station fears losing 50TB of data after being ghosted by cloud storage provider

-We don-t have access to the data on the hardware/servers,- Iron Mountain told Ars.

https://arstechnica.com/information-technology/2026/08/pbs-station-fears-losing-50tb-of-data-after-being-ghosted-by-cloud-storage-provider/

SafePal data breach impacts 39,798 customers, stolen info for sale

Cryptocurrency hardware wallet provider SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data.

https://www.bleepingcomputer.com/news/security/safepal-data-breach-impacts-39-798-customers-stolen-info-for-sale/

Microsoft working on Defender patch for ShieldBreak zero-day

On Friday, Microsoft confirmed it has begun working on a security patch for a Defender zero-day vulnerability named "ShieldBreak."

https://www.bleepingcomputer.com/news/security/microsoft-working-on-defender-patch-for-shieldbreak-zero-day/

Philips and GE investigating Clop ransomware data theft claims

Tech giants General Electric (GE) and Philips have also confirmed they're investigating claims that the Clop ransomware gang breached their systems and stole data.

https://www.bleepingcomputer.com/news/security/philips-and-ge-investigating-clop-ransomware-data-theft-claims/

Certighost and the Privilege Hiding in Your Certificate Authority

Every mature Active Directory environment has a component that quietly holds more power than the people running it usually admit: the Certification Authority (CA). The thing your entire estate has agreed to believe.

https://www.bleepingcomputer.com/news/security/certighost-and-the-privilege-hiding-in-your-certificate-authority/

Sicherheit: KIT-Forscher identifizieren Personen via WLAN

Ein Forschungsteam des KIT nutzt unverschlüsselte WLAN-Signale zur Personenerkennung. Ein handelsüblicher Router reicht dafür aus.

https://www.golem.de/news/sicherheit-kit-forscher-identifizieren-personen-via-wlan-2608-211981.html

Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies

Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies.

https://thehackernews.com/2026/08/evooo1bot-linux-botnet-exploits-known.html

Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access

Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call, with no fix from the chipset maker.

https://thehackernews.com/2026/08/unisoc-volte-video-call-exploit-chain.html

Microsoft blames AI for delayed Exchange update, can-t say when it will arrive

Dealing with machine-made bug backlog makes it hard to find a moment to deliver promised subscription service.

https://www.theregister.com/software/2026/08/17/microsoft-blames-ai-for-delayed-exchange-update-cant-say-when-it-will-arrive/5288227

Lücke in Online-Banking: BKA deckt Millionenschäden auf

Eine Gruppe Krimineller soll Bankkunden um Millionen betrogen haben. Ermittler aus Deutschland und Brasilien nahmen nach Durchsuchungen Verdächtige fest.

https://www.heise.de/news/Luecke-in-Online-Banking-BKA-deckt-Millionenschaeden-auf-11415081.html

Frankreich untersucht Diebstahl von Steuerdaten von 678.000 Betroffenen

Französische Staatsanwälte untersuchen einen -beispiellosen- Cyberangriff, bei dem Steuerdaten von 678.000 Nutzern entwendet wurden.

https://www.heise.de/news/Frankreich-untersucht-Diebstahl-von-Steuerdaten-von-678-000-Betroffenen-11416188.html

Dubiose Werbung und Abofallen bei Shops für Nahrungsergänzungsmittel

Große Gesundheitsversprechen und günstige Angebote machen Nahrungsergänzungsmittel im Internet attraktiv. Doch hinter solchen Angeboten können fragwürdige Versprechen und undurchsichtige Abo-Modelle stecken. Der Fall alimora.shop zeigt, wo Kund:innen besonders genau hinsehen sollten.

https://www.watchlist-internet.at/news/nahrungsergaenzungsmittel-online-kaufen/

-Download more RAM-: Windows-Sicherheit durch RAM-EEPROM geknackt

IT-Forscher zeigen Angriff -Download more RAM- auf Windows-Sicherheitsmechanismen, der auf Manipulation des RAM-EEPROMs basiert.

https://www.heise.de/news/Download-more-RAM-Windows-Sicherheit-durch-RAM-EEPROM-geknackt-11415690.html

Vulnerabilities

Schadcode-Sicherheitslücken bedrohen PostgreSQL

In aktuellen Versionen haben die PostgreSQL-Entwickler mehrere Sicherheitslücken geschlossen. Für einen Versionsstrang läuft bald der Support aus.

https://www.heise.de/news/Schadcode-Sicherheitsluecken-bedrohen-PostgreSQL-11415746.html

Zahlreiche Crash-Lücken in Wireshark geschlossen

In der aktuellen Wireshark-Version haben sich die Entwickler um mehrere Sicherheitslücken gekümmert.

https://heise.de/-11415516

App-Baukasten AppYourself: Update stopft Sicherheitslücke

Mit AppYourself können auch Nicht-Programmierer Business-Apps erstellen. Ein Update schließt eine Sicherheitslücke in der Software.

https://heise.de/-11416102

Cisco Advance Notification for Publication of August 19, 2026, Security Advisories

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-LDquvx5d

LWN Security updates for Monday

https://lwn.net/Articles/1089205/

Tageszusammenfassung - 14.08.2026

CERT.at — Fri, 14 Aug 2026 17:03:33 GMT+0100

End-of-Day report

Timeframe: Donnerstag 13-08-2026 18:00 - Freitag 14-08-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl

News

Microsoft patches LegacyHive Windows zero-day vulnerability

Microsoft has released security patches to address a Windows zero-day vulnerability known as "LegacyHive," disclosed after the July 2026 Patch Tuesday.

https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-legacyhive-windows-zero-day-vulnerability/

Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt

An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking.

https://www.bleepingcomputer.com/news/security/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt/

Ukraine shuts down 94 fraudulent call centers, seize millions in cash

Authorities in Ukraine shut down 94 fraudulent call centers across the country that lured people into investment scams or tried to obtain access to bank accounts.

https://www.bleepingcomputer.com/news/security/ukraine-shuts-down-94-fraudulent-call-centers-seize-millions-in-cash/

Shell investigates potential incident after Clop data theft claims

Oil giant Shell has confirmed it is investigating a potential security incident after the Clop ransomware gang claimed it stole 89GB of data.

https://www.bleepingcomputer.com/news/security/shell-investigates-potential-incident-after-clop-data-theft-claims/

Security: Der Phish stinkt vom Kopf her

Anti-Phishing-Kampagnen sollen die IT-Laien in einer Firma fit gegen Angriffe machen. Das ist aber komplett der falsche Ansatz. Ein IMHO von R. Zehl

https://www.golem.de/news/security-der-phish-stinkt-vom-kopf-her-2608-211872.html

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

https://securelist.com/honeymyte-coolclient-driver-rootkit/121028/

Digitale Kaperbriefe: US-Regierung erlaubt Unternehmen offensive Cyberangriffe

Im Kampf gegen transnationale kriminelle Akteure will die US-Regierung verstärkt auf die Privatwirtschaft setzen. Unternehmen sollen selbst angreifen dürfen.

https://www.heise.de/news/Digitale-Kaperbriefe-US-Regierung-erlaubt-Unternehmen-offensive-Cyberangriffe-11413398.html

Studie zum Umgang mit Passkeys: Nutzer wissen zu wenig Bescheid

Passkeys sollen Passwörter ablösen, sie gelten als viel sicherer. In der Praxis fehlt vielen Nutzern noch Wissen, haben US-Forscher herausgefunden.

https://www.heise.de/news/Studie-zum-Umgang-mit-Passkeys-Teilweise-gefaehrlicher-als-Passwoerter-11413954.html

Vermehrt Betrugsversuche auf Buchungsplattformen (booking.com, ..)

Momentan erreichen uns vermehrt Meldungen über Betrugsversuche in Bezug auf Reisebuchungen über Plattformen wie beispielsweise booking.com. Eine der häufigsten Methoden der Kriminellen ist der Missbrauch echter Buchungsdaten. Dabei erhalten Personen nach einer tatsächlichen Buchung über eine Reiseplattform eine Nachricht per E-Mail, SMS ..

https://www.cert.at/de/aktuelles/2026/8/vermehrt-betrugsversuche-auf-buchungsplattformen-bookingcom

New Mirai variant adds stealth capabilities to notorious botnet code

Beyond Mirai-s usual functions, the new code features include encrypted communications with command-and-control servers and a -sniffer- that looks for default access credentials.

https://therecord.media/new-mirai-variant-adds-stealth-to-botnet-code

You-re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

Suddenly, you-re in a room. You look around - oh, you-re surrounded by other new starters at your new job. Yes, it-s Monday, and you-re being onboarded.You know the drill - it-s the typical ..

https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/

Seitenkanal erlaubt Zugriff auf RAM des AMD-Sicherheitscontrollers PSP

Bei alten AMD-Prozessoren lässt sich die in Hardware verankerte RAM-Adressverwaltung manipulieren, um auf vermeintlich geschützte Bereiche zuzugreifen.

https://heise.de/-11414481

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRTs response to a coordinated multi-organization campaign.

https://www.wiz.io/blog/investigating-github-pat-compromise

Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain

Personal repositories are where corporate secrets quietly escape. Wiz correlates them to your developers, validates the real risk, and drives the fix.

https://www.wiz.io/blog/securing-personal-repositories

Vulnerabilities

External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

https://www.drupal.org/sa-contrib-2026-098

[R1] Security Center Version 6.9.0 Fixes Multiple Vulnerabilities

https://www.tenable.com/security/tns-2026-22

Tageszusammenfassung - 13.08.2026

CERT.at — Thu, 13 Aug 2026 17:23:41 GMT+0100

End-of-Day report

Timeframe: Mittwoch 12-08-2026 18:00 - Donnerstag 13-08-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler

News

Neue Phishing-Welle trifft zahlreiche Hotels: Gäste sollten wachsam sein

Mitten in der Ferienzeit häufen sich erfolgreiche Angriffe auf IT-Dienstleister der Hotelbranche. Gäste erhalten derzeit vermehrt täuschend echt wirkende Phishing-Nachrichten, die sie zu Zahlungen oder zur Preisgabe von Kreditkartendaten drängen. Einer der aktuellen Fälle betrifft den österreichischen IT-Dienstleister Seekda. Nach einem Phishing-Angriff informiert Seekda erste Betroffene über ungewöhnliche Zugriffsmuster auf seine Systeme. Das Ausmaß des Sicherheitsvorfalls dürfte groß sein.

https://www.heise.de/news/Phishing-Wellen-Cyberangriffe-auf-IT-Dienstleister-fuer-Hotels-11412013.html

Hundreds of fake Chrome VPN extensions route traffic through a proxy

More than 737 browser extensions published on the Chrome Web Store impersonated well-known VPN and proxy services while routing users traffic through SOCKS5 proxies operated by a single provider.

https://www.bleepingcomputer.com/news/security/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy/

Android malware combo takes out loans and relays victims credit cards

A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal live card data and send it to attackers in real time. [..] When receiving a call from your bank and asked to take urgent action, it is advisable to terminate the call, dial the number listed on the organization's official website, and ask to connect with the same support agent.

https://www.bleepingcomputer.com/news/security/android-malware-combo-takes-out-loans-and-relays-victims-credit-cards/

"City-Forum" data-theft attacks target Salesforce, ServiceNow portals

An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals. [..] Reco says all of the attacks originate from the IP address 158.220.87.79, hosted by German VPS provider Contabo, and almost always use the default Go-http-client/1.1 user agent when downloading data. This IP address is associated with the city-forum.com domain, which has resolved to the server since at least March 2025, indicating that the infrastructure has remained in place for more than a year.

https://www.bleepingcomputer.com/news/security/city-forum-data-theft-attacks-target-salesforce-servicenow-portals/

Cisco Advance Notification for Publication of August 19, 2026, Security Advisories

On August 19, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: BroadWorks, Industrial Ethernet 1000 Series Switches, Packaged Contact Center Enterprise and Unified Contact Center Enterprise, RoomOS, Secure Firewall Adaptive Security Appliance, Secure Firewall Management Center, Secure Firewall Threat Defense Center, Secure Workload, Unified Intelligence Center

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-LDquvx5d

Verschlüsselter KI--Denkprozess- gehackt: Schwache Modelle verraten Geheimnisse

Über eine Sicherheitslücke lassen sich Abwägungsprotokolle von KI-Top-Systemen wie GPT-5 im Klartext auslesen - mithilfe kleinerer Modelle desselben Anbieters.

https://www.heise.de/hintergrund/Verschluesselter-KI-Denkprozess-gehackt-Schwache-Modelle-verraten-Geheimnisse-11412087.html

How BitLocker PINs help protect your data and devices

The NCSC provides guidance on how to securely configure Microsoft Windows. This includes setting up BitLocker, which encrypts your device to protect the data and the operating system from tampering. Our guidance recommends that BitLocker be configured to require a PIN before decrypting your device.

https://www.ncsc.gov.uk/blogs/how-bitlocker-pins-help-protect-your-data-and-devices

WhatsApp-Benutzernamen: Vor- und Nachteile im Überblick

Wie schützt ein WhatsApp-Benutzername vor Betrug - und welche Daten gibt man preis? Verbraucherschützer bewerten den Status quo beim Meta-Messenger.

https://heise.de/-11412273

Vulnerabilities

Fortinet FortiManager FGFM Authentication Weakening via CLI Configuration

An Authentication Bypass Using an Alternate Path or Channel [CWE-288] vulnerability in FortiManager and FortiManager Cloud may allow a remote unauthenticated attacker to impersonate any FortiGate managed by the FortiManager with a specific CLI option set via crafted FGFM requests if the attacker has a valid certificate. CVE-2026-70468

https://fortiguard.fortinet.com/psirt/FG-IR-26-160

GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/

Palo Alto Networks Security Advisories 12.08.2026

https://security.paloaltonetworks.com/

LWN: Security updates for Thursday

https://lwn.net/Articles/1088715/

Tageszusammenfassung - 12.08.2026

CERT.at — Wed, 12 Aug 2026 17:43:55 GMT+0100

End-of-Day report

Timeframe: Dienstag 11-08-2026 18:00 - Mittwoch 12-08-2026 18:00 Handler: Guenes Holler Co-Handler: n/a

News

Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings from QUIRSO.

https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html

Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now says a dataset it obtained, built from roughly 434,000 files the attackers captured, maps potential exposure to more than 2,500 organizations.

https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html

Brandenburg: Cyberangriff legt IT-System der Gedenkstätten lahm

Die Stiftung Brandenburgische Gedenkstätten wurde Opfer eines Ransomware-Angriffs. IT-Systeme sind derzeit außer Betrieb, ein Datenabfluss wird vermutet.

https://www.heise.de/news/Brandenburg-Cyberangriff-legt-IT-System-der-Gedenkstaetten-lahm-11410695.html

Threema: DDoS-Angriffe sorgen für Ausfälle bei Messenger

Nach einem Angriff auf einen Dienstleister von Threema war der Messenger am Dienstag stundenlang nicht nutzbar. Am Mittwoch dauern die Attacken an.

https://www.heise.de/news/Stoerungen-bei-Threema-DDoS-Angriffe-sorgen-fuer-Ausfaelle-bei-Messenger-11411479.html

Deadbugz: Currently Active MCP Supply-Chain Campaign

Pillar Security Researchers identified an active campaign to distribute a malicious Model Context Protocol (MCP) server through public GitHub pull requests. The server calls itself productivity-suite and initially looks harmless: it offers text formatting and summarization. After a connected client makes three tool calls, however, it changes the instructions it returns to the AI agent. The new metadata directs the agent to seek sensitive information, including SSH keys, AWS credentials, shell history, and Kubernetes configuration, and to conceal the activity from the user.

https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign

Vulnerabilities

Nordkoreas Hacker schlagen zu: Angriffe auf Windows-Nutzer in Europa beobachtet

Die Hackergruppe Lazarus greift Windows-Nutzer über eine Treiberlücke an. Microsoft hat sie zusammen mit über 400 weiteren Sicherheitslücken gepatcht.

https://www.golem.de/news/auch-in-europa-nordkoreanische-hacker-attackieren-windows-nutzer-2608-211834.html

Kein Klick nötig: Lücke ermöglicht heimliche Schadcode-Attacken über Zoom-Meetings

Eine Sicherheitslücke in Zoom lässt Angreifer anderen Meeting-Teilnehmern unbemerkt Schadcode unterschieben. Nutzer sollten zügig updaten.

https://www.golem.de/news/kein-klick-noetig-luecke-ermoeglicht-heimliche-schadcode-attacken-ueber-zoom-meetings-2608-211845.html

Zero-Day-Lücke im Defender: Chaotic Eclipse leakt neuen Windows-Exploit

Ein neuer Exploit namens Shieldbreak umgeht einen früheren Patch für den Microsoft Defender. Angreifer erhalten damit unter Windows Systemrechte.

https://www.golem.de/news/zero-day-luecke-im-defender-chaotic-eclipse-leakt-neuen-windows-exploit-2608-211855.html

Böse Screen-Sharing-Lücke in macOS: Exploit aus Apples Patch gebaut

Wer Apples praktische Bildschirm-teilen-Funktion auf dem Mac nutzt, muss sein Betriebssystem aktualisieren. Ein Exploit ließ sich schnell entwickeln.

https://www.heise.de/news/Boese-Screen-Sharing-Luecke-in-macOS-Exploit-aus-Apples-Patch-gebaut-11411035.html

Patchday Adobe: Schadcode-Schlupflöcher bedrohen Campaign Classic und ColdFusion

Wichtige Sicherheitsupdates schließen mehrere Schwachstellen an Adobe-Anwendungen.

https://www.heise.de/news/Patchday-Adobe-Schadcode-Schlupfloecher-bedrohen-Campaign-Classic-und-ColdFusion-11410951.html

Der Security-Ko-Prozessor in vielen CPUs ist unsicher

Das Trusted Platform Module ist das wichtigste Glied in der Vertrauenskette von PCs. Ausgerechnet dieses TPM ist angreifbar.

https://www.heise.de/news/Der-Security-Ko-Prozessor-in-vielen-CPUs-ist-unsicher-11411837.html

Cisco warnt vor Attacken auf Secure Firewall Adaptive Security Appliance

Derzeit lassen Angreifer Cisco Secure Firewall Adaptive Security Appliance nach Attacken abstürzen. Ein Sicherheitspatch ist verfügbar.

https://heise.de/-11411427

Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days

Today is Microsoft's August 2026 Patch Tuesday, and with it comes security updates for a massive 400 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/

ZDI-26-532: SonicWall Email Security updateNetIf Command Injection Local Privilege Escalation Vulnerability

http://www.zerodayinitiative.com/advisories/ZDI-26-532/

ZDI-26-531: SonicWall GMS Virtual Appliance interface Command Injection Local Privilege Escalation Vulnerability

http://www.zerodayinitiative.com/advisories/ZDI-26-531/

ZDI-26-530: SonicWall Email Security snmp Command Injection Local Privilege Escalation Vulnerability

http://www.zerodayinitiative.com/advisories/ZDI-26-530/

ZDI-26-527: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability

http://www.zerodayinitiative.com/advisories/ZDI-26-527/

PSIRT FortiGuard Labs Heap overflow in kernel driver due to missing size validation

https://fortiguard.fortinet.com/psirt/FG-IR-26-156

PSIRT FortiGuard Labs Broken access control in the RADIUS type admin group

https://fortiguard.fortinet.com/psirt/FG-IR-26-158

LWN Security updates for Wednesday

https://lwn.net/Articles/1088476/

Tageszusammenfassung - 11.08.2026

CERT.at — Tue, 11 Aug 2026 17:22:07 GMT+0100

End-of-Day report

Timeframe: Montag 10-08-2026 18:00 - Dienstag 11-08-2026 18:00 Handler: Alexander Riepl Co-Handler: Guenes Holler

News

New Pass-ta-key attack reveals all the things we didnt know about passkeys

Why passkey apps treat Windows differently than other operating systems.

https://arstechnica.com/security/2026/08/heres-why-the-new-pass-ta-key-attack-is-mostly-a-nothingburger/

Hackers breached a small Polish energy plant via private APN last year

Hackers breached a heat-and-power plant facility in Poland, which supplies heat to about 50,000 residents, using a private APN (Access Point Name) to access an OT (Operational Technology) network.

https://www.bleepingcomputer.com/news/security/hackers-breached-a-small-polish-energy-plant-via-private-apn-last-year/

CISA: Microsoft SharePoint flaw now exploited in ransomware attacks

CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July.

https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks/

Mozilla updates GPG signing key for Firefox releases after exposure

Mozilla announced today that it updated the GPG key used to sign Firefox and Thunderbird releases after it was accidentally exposed on GitHub.

https://www.bleepingcomputer.com/news/security/mozilla-updates-gpg-key-for-signing-firefox-thunderbird-releases-after-exposure/

Nach KI-Hacks: Chinesisches KI-Modell trickst Forscher bei Tests aus

Das KI-Modell Kimi K3 hat bei Tests eine gesicherte Umgebung verlassen und sich die gesuchten Lösungen einfach bei Github beschafft.

https://www.golem.de/news/nach-ki-hacks-chinesisches-ki-modell-trickst-forscher-bei-cybertests-aus-2608-211748.html

Kein Klick nötig: Plug-and-Pwn-Angriff kapert Windows-Systeme per USB

Windows lädt beim Anschließen neuer USB-Geräte oft Software nach. Angreifer können dadurch Systemrechte erlangen - manchmal sogar aus der Ferne.

https://www.golem.de/news/kein-klick-noetig-plug-and-pwn-angriff-kapert-windows-systeme-per-usb-2608-211809.html

BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes, prompting the content management systems (CMS) platforms plugins team to temporarily disable their downloads."Unlike traditional software supply chain attacks, zero source code files were modified within the official WordPress.org repository," Wordfence researcher Paolo Tresso said.

https://thehackernews.com/2026/08/bdthemes-supply-chain-attack-poisons.html

Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers

Security researchers invented a cryptocurrency startup, advertised developer jobs, and hired three people they believe were North Korean operatives. Every virtual machine the company issued was recording.The onboarding paperwork is the part hiring teams can use. The first hire claimed to live in Pasadena, Texas, then sent a California drivers license and a New York bank account.The

https://thehackernews.com/2026/08/researchers-built-fake-crypto-startup.html

Abyssos: Technical Analysis of a New Modular RAT

In late June 2026, Zscaler ThreatLabz identified a new malware family that we track as Abyssos. Abyssos is a new modular remote administration tool (RAT) written in C++ that supports a variety of features including credential theft, file exfiltration, and remote access via VNC. Abyssos is in active development with multiple version numbers and different obfuscation passes that are designed to improve evasion from security ..

https://www.zscaler.com/blogs/security-research/abyssos-technical-analysis-new-modular-rat

Lahmer x86-Befehl hebelt triviale Schutzfunktion aus

Der mächtige System Management Mode (SMM) von x86-Prozessoren ist ein bevorzugtes Ziel von Angriffen. Ein Trick hebelt eine SMM-Schutzfunktion aus.

https://www.heise.de/news/Lahmer-x86-Befehl-hebelt-triviale-Schutzfunktion-aus-11409272.html

Patchday: SAP Commerce Cloud komplett kompromittierbar

SAP schließt in seinem Softwareproduktportfolio mehrere unter anderem kritische Sicherheitslücken.

https://www.heise.de/news/Patchday-SAP-Commerce-Cloud-komplett-kompromittierbar-11410169.html

Sexual predators targeting online accounts for intimate images, FBI warns

The FBI is warning that criminals are breaking into social media to steal and distribute non-consensual intimate images and videos.

https://www.malwarebytes.com/blog/news/2026/08/sexual-predators-targeting-online-accounts-for-intimate-images-fbi-warns

The Permanent Threat: Analyzing Aeternum-s Blockchain-Based C2 Operations and Communications

Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution.

https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/

Poland uncovers second heat plant cyberattack that went hidden for months

The incident occurred on the same day as coordinated cyberattacks struck more than 30 other renewable energy installations and a larger heat plant, as Poland publicly disclosed in January.

https://therecord.media/poland-uncovers-critical-infrastructure-attack-hidden

LexisNexis deaktiviert nach "verdächtigen Server-Aktivitäten" drei Dienste

Aktuell ist unklar, was genau passiert ist. Aber seit vorigen Mittwoch, den 5. August 2026, scheint bei LexisNexis etwas passiert zu seine. Der Anbieter hat nach "verdächtigen Server-Aktivitäten" gleich drei Dienste deaktiviert und Verbindungen zu Drittanbietern getrennt. Es laufen Untersuchungen ..

https://borncity.com/blog/2026/08/10/lexisnexis-deaktiviert-nach-verdaechtigen-server-aktivitaeten-drei-dienste/

Steam-Hardware: Käufer müssen nach Cyberangriff mit Betrugsmails rechnen

Bei Valves Logistikpartner CEVA sind Namen und Adressen europäischer Steam-Hardware-Käufer abgeflossen. Valve warnt vor falschen Nachrichten.

https://heise.de/-11409514

Google Phishing Kit: When Phishing Becomes a Real-Time Remote Browser

Most of the phishing pages are mere static clones of the login form, whereas sophisticated phishing kits implement adversary-in-the-middle techniques that perform authentication in real-time. In particular, the design being analyzed below fits into the Browser-in-the-Middle (BitM) scheme where the victim-facing page becomes the client for the browser session running at the backend of the phishing operation.The captured network traffic and the extracted client-side artifacts ..

https://www.joesecurity.org/blog/2909557602925734728

Inside the Metabase SQLi: Exploited in the Wild

Reverse engineering Metabase CVE-2026-72898 with AI to accelerate defense.

https://www.wiz.io/blog/inside-the-metabase-sqli-exploited-in-the-wild

Vulnerabilities

TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool

It has been discovered that TYPO3 CMS is susceptible to broken access control.

https://news.typo3.com/security/advisory/typo3-core-sa-2026-021

Security updates for Tuesday

Security updates have been issued by AlmaLinux (gpsd), Debian (caddy, libyaml-syck-perl, nss, and wordpress), Fedora (chezmoi, chromium, emacs, kernel, knot, libcupsfilters, mingw-gstreamer1-plugins-good, mingw-libidn, mingw-python-pip, nghttp2, p11-kit, python-webob, suricata, and xen), Mageia (bind, openslide, php8.4, and php8.5), Oracle (gpsd-minimal, kernel, libarchive, libpng12, nodejs-nodemon, php:8.3, ruby:3.3, and ruby:4.0), SUSE (agama-web-ui, bind, bouncycastle, dhcpcd, ffmpeg, ..

https://lwn.net/Articles/1088226/

August 2026 Security Update

https://www.ivanti.com/blog/august-2026-security-update

SAP Security Patch Day August 2026 | RedRays

https://redrays.io/blog/sap-security-patch-day-august-2026/

Tageszusammenfassung - 10.08.2026

CERT.at — Mon, 10 Aug 2026 17:34:04 GMT+0100

End-of-Day report

Timeframe: Freitag 07-08-2026 18:00 - Montag 10-08-2026 18:00 Handler: Guenes Holler Co-Handler: n/a

News

CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

CISA has confirmed that ransomware gangs have begun exploiting two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery (SSRF) flaw.

https://www.bleepingcomputer.com/news/security/cisa-sonicwall-sma1000-flaws-now-exploited-by-ransomware-gangs/

AI-Generated Patches Fail Half the Time

A study of more than 6,000 patches found that even working patches can introduce new bugs, break something else, or are open to bypass.

https://www.darkreading.com/application-security/ai-generated-patches-fail-half-time

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications, negotiations, and data leak operations alongside double extortion tactics used to pressure victims.The post DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure appeared first on Microsoft Security Blog.

https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems.

https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html

New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

New research shows content inside an email can escape its message boundary and interfere with the webmail interface.

https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html

Cyber vulnerability sweep picks up Royal Navy drones sending data to China

No, no nasties to see here, guv...

https://www.theregister.com/edge-and-iot/2026/08/10/cyber-vulnerability-sweep-picks-up-royal-navy-drones-sending-data-to-china/5285430

Sensitive Info Goes Into -No Reply- Emails Constantly. This Guy Sees It All

Two security researchers bought cheap domains-including noreply.net and deleteduser.com-and set up email listening services. Hundreds of companies are sending them corporate secrets.

https://www.wired.com/story/sensitive-info-goes-into-no-reply-emails-constantly-this-guy-sees-it-all/

Russian military hackers pose as recruiters to target Ukrainian IT workers

Ukraine-s computer emergency response team, CERT-UA, said Saturday that the campaign has been running since at least May and is linked to Sandworm, the notorious hacking unit associated with Russia-s GRU military intelligence agency.

https://therecord.media/russian-military-hackers-pose-as-recruiters-ukraine-it-workers

Jeans-Hersteller Levi Strauss & Co. erleidet Datenpanne

Levi Strauss, als Anbieter von Jeans bekannt, hat die Woche einen Datenschutzvorfall erlitten. Mitarbeiter wurden über Social Media ausgetrickst. Dem Angreifer gelang dann wohl der Zugriff auf drei Rechner von Mitarbeitern.

https://borncity.com/blog/2026/08/08/jeans-hersteller-levi-strauss-co-erleidet-datenpanne/

SANS Institute rät Sicherheitsteams, offene Türen für KI-Agenten zu schließen

Die Sicherheitsvorfälle bei Anthropic, Open AI und Meta, sowie bei Bytedance, bei denen AI-Modelle oder Agenten aus ihrer Testumgebung ausbrachen und Angriff im Internet durchführten, hat die Branche aufgeschreckt. Das SANS Institute gibt Sicherheitsteams den Tipp: Offene Türen für KI-Agenten zu schließen.

https://borncity.com/blog/2026/08/09/sans-institute-raet-sicherheitsteams-offene-tueren-fuer-ki-agenten-zu-schliessen/

Investigating a Multi-Stage PowerShell Loader

During recent threat hunting, I identified suspicious PowerShell content being served directly from an IP address and a domain: hxxp://203[.]188[.]171[.]166/hxxps://dorenzaa[.]com/ Both locations returned PowerShell rather than a conventional user-facing webpage. The PowerShell was responsible for retrieving a ZIP archive from Vercel-hosted infrastructure, extracting it locally, and executing an executable from the extracted content.

https://malwr-analysis.com/2026/08/08/investigating-a-multi-stage-powershell-loader/

IT threat evolution in Q2 2026. Non-mobile statistics

The report presents key trends and statistics on malware that targeted personal computers running Windows and macOS, as well as internet of things (IoT) devices, during Q2 2026.

https://securelist.com/malware-report-q2-2026-pc-iot-statistics/120960/

IT threat evolution in Q2 2026. Mobile statistics

This report contains mobile threat statistics for Q2 2026, along with noteworthy discoveries and quarterly trends: the Anatsa banker and a transition to droppers.

https://securelist.com/malware-report-q2-2026-mobile-statistics/120948/

Vulnerabilities

Jetzt patchen! Admin-Attacken auf Metabase beobachtet

Angreifer nutzen zurzeit eine kritische Sicherheitslücke in der Business-Intelligence-Plattform Metabase aus. Admins müssen jetzt handeln.

https://heise.de/-11404526

Schadcode-Attacken auf Progress LoadMaster im Gange

Derzeit haben Angreifer Progress LoadMaster auf dem Schirm und attackieren aktiv Systeme. Sicherheitspatches sind verfügbar.

https://heise.de/-11404612

LWN Security updates for Monday

https://lwn.net/Articles/1088057/

Security updates 1.6.18 and 1.7.3 released

https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3

Tageszusammenfassung - 07.08.2026

CERT.at — Fri, 07 Aug 2026 17:27:30 GMT+0100

End-of-Day report

Timeframe: Donnerstag 06-08-2026 18:00 - Freitag 07-08-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, disclose victim IP addresses and mapped ports, and exhaust NAT tables. [..] The disclosure does not identify the exact Windows builds or Windows Hello for Business deployment models tested. [..] The new work removes that requirement by treating the Windows Hello for Business key as a FIDO2 passkey through WebAuthn. Mollema found that the five-minute Entra ID challenge is not bound to a session, user, or tenant. An attacker can therefore request it on another host and have the compromised endpoint produce the signed assertion.

https://thehackernews.com/2026/08/malware-can-abuse-windows-hello-for.html

Durch Metabase-0day: Datenleck bei Laptophersteller Framework

Der Laptophersteller Framework hat ein Datenleck erlitten und warnt seine Kunden vor abgeflossenen Informationen. Kontakt- und Lieferdaten privater und gewerblicher Kunden kamen abhanden - Zahlungs- und Bestellinformationen nach Frameworks Angaben jedoch nicht. Offenbar nutzten Angreifer eine Zero-Day-Lücke in Metabase aus; der Datenbankhersteller hat Updates veröffentlicht und seine Cloud-Instanzen abgedichtet.

https://www.heise.de/news/Durch-Metabase-0day-Datenleck-bei-Laptophersteller-Framework-11403050.html

ChainDrop: Inside a Self-Propagating npm Worm

A self-propagating npm worm nicknamed ChainDrop infected over 400 packages that are collectively downloaded hundreds of millions of times each week. This includes malicious versions of widely used packages such as keyv and cacheable-request. Unit 42 has unique observations of this attack.

https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/

N-able N-central: 2. Hotfix vom 6. August 2026

Ein Patch gegen die Schwachstelle (CVE-2026-18576) wirkte nicht. Die RMM-Lösung wird bereits angegriffen. Der Hotfix 1 von Anfang August 2026 scheint nicht auszureichen, vor wenigen Stunden wird ein Hotfix 2 nachgeschoben.

https://borncity.com/blog/2026/08/07/n-able-n-central-2-hotfix-vom-6-august-2026/

"deGDID" entfernt GDID in Windows und blockt Neuanlage

Microsoft vergibt in Windows eine eindeutige GDID genannte Kennung, über die Nutzer identifiziert werden können. Der VPN-Anbieter Windscribe hat nun ein Skript entwickelt, um das versteckte GDID-Tracking von Microsoft unter Windows zu blockieren.

https://borncity.com/blog/2026/08/07/degdid-entfernt-gdid-in-windows-und-blockt-neuanlage/

Unternehmen fürchten US-Kill-Switch für kritische IT-Dienste

74 Prozent der Unternehmen befürchten, dass US-Anbieter auf Druck der US-Regierung wichtige Dienste sperren könnten.

https://heise.de/-11403600

Vulnerabilities

Screen Sharing: Gefährliche MacOS-Lücke lässt Angreifer Apple-Systeme kapern

Die besagte Sicherheitslücke ist als CVE-2026-65400 registriert und verfügt mit einem CVSS-Wert von 7,1 über einen hohen Schweregrad. "Ein Angreifer im Netzwerk könnte sich möglicherweise ohne gültige Anmeldedaten bei der Bildschirmfreigabe authentifizieren", heißt es in der Beschreibung. [..] Die gepatchten MacOS-Versionen tragen die Versionsnummern 26.6.1 (Tahoe), 15.7.9 (Sequoia) und 14.8.9 (Sonoma).

https://www.golem.de/news/screen-sharing-gefaehrliche-macos-luecke-laesst-angreifer-apple-systeme-kapern-2608-211694.html

New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts

Zapscape, a new Linux kernel vulnerability, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host. The risk applies when nested virtualization is exposed to untrusted guests. The flaw is tracked as CVE-2026-64561 and affects KVM/x86's shadow memory management unit (MMU), which manages shadow page tables used for nested guest memory translation. [..] As of August 6, 2026, Debian's tracker listed bullseye, bookworm, and trixie kernel packages, including their security repositories, as vulnerable.

https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html

SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free

SCTPhantom is a Linux kernel use-after-free in SCTP Dynamic Address Reconfiguration. An ordered ASCONF sequence can remove a transport and then reuse its stale pointer, leaving the association with dangling path references. Corvus AI developed the initial finding into a reproducible vulnerability and demonstrated local privilege escalation and container-to-host escape on the tested systems. The issue is tracked as CVE-2026-64564 and fixed upstream by 9b2854f86f0b.

https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564

WordPress 7.0.3 release

WordPress 7.0.3 is now available WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. [..] Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai.

https://wordpress.org/news/2026/08/wordpress-7-0-3-release/

LWN: Security updates for Friday

https://lwn.net/Articles/1087742/

Tageszusammenfassung - 06.08.2026

CERT.at — Thu, 06 Aug 2026 17:18:23 GMT+0100

End-of-Day report

Timeframe: Mittwoch 05-08-2026 18:00 - Donnerstag 06-08-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl

News

COLDCARD security audit phishing attack installs remote access tool

A phishing campaign is exploiting fears surrounding the recently disclosed COLDCARD wallet vulnerability and suspected $88.6 million Bitcoin theft to trick users into installing ScreenConnect remote access software.

https://www.bleepingcomputer.com/news/security/coldcard-security-audit-phishing-attack-installs-remote-access-tool/

Schweiz: Bundesamt für Informatik und Telekommunikation über Sharepoint gehackt

Ein Cyberangriff hat das Schweizer BIT getroffen. Angreifer sind über Microsoft Sharepoint eingedrungen und haben Hunderte Nutzerkonten kompromittiert.

https://www.golem.de/news/schweiz-bundesamt-fuer-informatik-und-telekommunikation-ueber-sharepoint-gehackt-2608-211659.html

"Wiederkehrendes Muster": OpenSSL-Entwickler wettert gegen KI-Hacks

Seit einigen Tagen hacken sich vermehrt KI-Modelle von OpenAI, Anthropic und Meta durchs Netz. Das Problem liegt laut OpenSSL-Entwickler Hudson aber nicht bei der KI.

https://www.golem.de/news/wiederkehrendes-muster-openssl-entwickler-wettert-gegen-ki-hacks-2608-211664.html

Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports

Two security flaws in Paperclip could let attackers execute commands on a network server or a developers computer. Paperclip is an open-source control plane for teams of artificial intelligence (AI) agents, and both paths rely on importing a malicious agent and ..

https://thehackernews.com/2026/08/paperclip-ai-flaws-let-attackers-run.html

Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks.The server-side ..

https://thehackernews.com/2026/08/over-250-clickfix-domains-use-browser.html

Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells

Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink.According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available ..

https://thehackernews.com/2026/08/chinese-made-zbtlink-routers-ship-with.html

Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses

Cybersecurity researchers have disclosed a security issue with Apples iCloud Private Relay tool that can expose a users real IP address.Introduced with iOS 15, iCloud Private Relay employs a dual-hop architecture to ensure users privacy by routing ..

https://thehackernews.com/2026/08/webkit-proxy-bypasses-can-expose-real.html

Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities

Forescout found 22 internet-facing Rockwell Automation programmable logic controllers (PLCs) in cities hit by recent cyberattacks on US water utilities. Nineteen used the same mobile carrier network.Its August 3 scan counted 4,407 exposed Rockwell ..

https://thehackernews.com/2026/08/over-4400-rockwell-plcs-exposed-online.html

ClaudeFix: Shared Claude Chats Meet ClickFix

https://www.zscaler.com/blogs/security-research/claudefix-shared-claude-chats-meet-clickfix

Fehlende Kontaktmöglichkeit: Deutschland verschläft Sicherheit per security.txt

Nur 1,8 Prozent der deutschen Webseiten bieten eine standardisierte security.txt an. Das BSI warnt vor den Risiken und verweist auf kommende Meldepflichten.

https://www.heise.de/news/Fehlende-Kontaktmoeglichkeit-Deutschland-verschlaeft-Sicherheit-per-security-txt-11402270.html

Scammers target OnlyFans users with deepfakes

Criminals are impersonating OnlyFans creators using AI tools in order to scam followers.

https://www.malwarebytes.com/blog/news/2026/08/scammers-target-onlyfans-users-with-deepfakes

Apple-s bug bounty program is drowning in so much AI slop, it is in danger of missing serious exploits

Apple has imposed strict new submission limits on its bug bounty portal after finding itself overwhelmed by low-quality, AI generated vulnerability reports - many of which were found to be describing security flaws that simply didnt exist.

https://www.bitdefender.com/en-us/blog/hotforsecurity/apple-bug-bounty-ai-missing-exploits

Token Jacking: Cybercriminals Could Be Stealing Your AI Resources

Discover how attackers hijack AI tokens to fuel gray market transfer stations by stealing developer API keys.

https://unit42.paloaltonetworks.com/ai-token-jacking/

OctLurk and SilkLurk Windows Backdoors Target Governments in 6 Countries

Kaspersky links OctLurk and SilkLurk to cyberespionage attacks stealing passwords, emails and files from government systems in six countries since January 2025.

https://hackread.com/octlurk-silklurk-backdoors-target-6-countries/

Sicherheitspatches: Angreifer können Schadcode auf n8n-Servern ausführen

Die n8n-Entwicklwer haben in aktuellen Versionen insgesamt 18 Sicherheitslücken geschlossen.

https://heise.de/-11400494

Fake Zoom installer uses .NET downloader to deliver Overlord RAT on macOS

Jamf Threat Labs uncovers a macOS campaign using a fake Zoom installer to deploy Overlord RAT. Built with .NET, this cross-platform technique simultaneously targets Windows, joining Go- and Rust-based cross-platform malware.

https://www.jamf.com/blog/fake-zoom-installer-delivers-overlord-rat-macos/

Vulnerabilities

Cisco IOS XE Software Security Hardening Release: August 2026

As part of Ciscos ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not ..

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ

Veeam: Vulnerabilities Resolved in Veeam ONE 13.1

Veeam has released 6 new security advisories for Veeam ONE (1x critical, 4x high, 1x medium)

https://www.veeam.com/kb4892

Security updates for Thursday

Security updates have been issued by Debian (7zip, kernel, libde265, and p7zip), Mageia (tomcat), Oracle (fence-agents, frr10, kernel, ldns, libgcrypt, mingw-glib2, nodejs24, osbuild-composer, p11-kit, php8.4, sg3_utils, and thunderbird), Red Hat (libXfont2), and SUSE (containerd, evince, libXfont2, nginx, openssl-3, pcp, php7, php8, python-Django, python-httplib2, python-nltk, rrdtool, vifm, and wireshark).

https://lwn.net/Articles/1087489/

Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094

https://www.drupal.org/sa-contrib-2026-094

Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093

https://www.drupal.org/sa-contrib-2026-093

Tageszusammenfassung - 05.08.2026

CERT.at — Wed, 05 Aug 2026 18:20:44 GMT+0100

End-of-Day report

Timeframe: Dienstag 04-08-2026 18:00 - Mittwoch 05-08-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

Shaid Hulu: Neue Angriffe kompromittieren Hunderte npm-Pakete (4.8.2026)

Es gibt wohl eine neue Shaid Hulu-Angriffskampagne auf npm-Pakete. Nach dem Hack eines Entwicklerkontos sind wohl schon über 800 npm-Pakete mit Millionen Downloads kompromittiert. [..] Auslöser war die Kompromittierung des GitHub-Kontos des Betreuers von "keyv", einer Bibliothek mit rund 127 Millionen wöchentlichen npm-Downloads.

https://borncity.com/blog/2026/08/05/shaid-hulu-neue-angriffe-kompromittieren-hunderte-npm-pakete-4-8-2026/

Weitere KI-Attacke: Modell schleust Schwachstelle ein und manipuliert Menschen

Die Serie von Enthüllungen über alarmierende Hacker-Fähigkeiten führender KI-Modelle reißt nicht ab. Jetzt ertappten britische Sicherheitsforscher eine Künstliche Intelligenz in einem Testlauf beim Versuch, in Eigeninitiative eine Schwachstelle in öffentlich zugängliche Software einzuschleusen. Um damit durchzukommen, versuchte das KI-Modell der Entwicklerfirma Anthropic den Experten zufolge sogar, per E-Mail einen zuständigen Menschen zu manipulieren.

https://heise.de/-11399219

Cyberangriff auf Ungarn: Hacker stürzt Finanzverwaltung ins IT-Chaos

Ein Angreifer hat IT-Systeme der Finanzverwaltung Ungarns infiltriert. Den Zugriff erhielt er wohl über eine seit 2017 bekannte Lücke in Oracle Weblogic.

https://www.golem.de/news/cyberangriff-auf-ungarn-hacker-stuerzt-finanzverwaltung-ins-it-chaos-2608-211627.html

Die Doppel-Überweisung: Wie Kriminelle mit einer Masche zweifach abkassieren wollen

Mit einem Fake-Shop und einem gestohlenen Impressum werden Opfer in eine Falle gelockt, die doppelt zuschnappen soll. Nach erfolgter Bezahlung via Überweisung, erhalten Betroffene eine E-Mail, in der von -Problemen mit dem Banksystem- die Rede ist. Man solle die alte Überweisung stornieren und den Betrag auf ein anderes Konto transferieren.

https://www.watchlist-internet.at/news/die-doppel-ueberweisung/

II: Nachtrag zum Defender-Fehlalarm: Rückmeldung von Synology und Microsoft

Der Microsoft Defender hält oder hielt Synology-Backups auf verschiedenen Servern für einen Trojaner. Dadurch laufen die Sicherungen nicht mehr durch. Zum echten Problem für Administratoren wird das Ganze, weil die Defender-Option "Zulassen" für den in Quarantäne geschobenen Prozess die ganze Erkennungsregel abschaltet.

https://borncity.com/blog/2026/08/04/ii-nachtrag-zum-defender-fehlalarm-rueckmeldung-von-synology-und-microsoft/

Attackers Don-t Need Your Devices Anymore They Just Need Your Identity.

Your EDR watches every endpoint. But modern attackers have learned to move between identities instead of devices. The good news is that the telemetry for every step of this movement exists across your hunting tables. The trick is knowing which table holds which evidence and how to correlate across them.

https://detect.fyi/attackers-dont-need-your-devices-anymore-they-just-need-your-identity-the-ba51f1cd6641?source=rssd5fd8f494f6a4

Vulnerabilities

Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup

An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1. The file-read flaw is tracked as CVE-2026-59774, rated Critical with a CVSS score of 9.8, and received its formal advisory on August 2. Gitea 1.27.1 also patches CVE-2026-60004, a separate remote code execution bug covered in a prior THN report.

https://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html

Sicherheitsupdates: TP-Links Netzwerk-Ökosystem Omada ist kompromittierbar

Im Zuge der Black-Hat-2026-Konferenz haben Sicherheitsforscher von Forescout Informationen zu mehreren Sicherheitslücken in Omada veröffentlicht, die konkret ZTP betreffen. Ihnen zufolge können sich Angreifer unter anderem über hartkodierte kryptografische Schlüssel (CVE-2025-15627 -mittel-) und ein hartkodiertes Zertifikat (CVE-2025-15628 -hoch-) Zugriff verschaffen, Schadcode ausführen (CVE-2025-7850 -kritisch-) und sich einen Root-Shell-Zugriff einrichten (CVE-2025-7851 -hoch-). Die Forscher führen aus, dass Angreifer Schwachstellen miteinander kombinieren können, um sich weitreichenden Netzwerkzugriff zu verschaffen.

https://www.heise.de/news/Sicherheitsupdates-TP-Links-Netzwerk-Oekosystem-Omada-ist-kompromittierbar-11399435.html

LWN: Security updates for Wednesday

https://lwn.net/Articles/1087318/

Veeam: Vulnerabilities Resolved in Veeam Service Provider Console 9.3

https://www.veeam.com/kb4893

Tageszusammenfassung - 04.08.2026

CERT.at — Tue, 04 Aug 2026 18:08:35 GMT+0100

End-of-Day report

Timeframe: Montag 03-08-2026 18:00 - Dienstag 04-08-2026 18:00 Handler: Guenes Holler Co-Handler: n/a

News

Phishing-Mails der ÖGK jetzt auch im Dialekt

Manche Betrugsmaschen halten sich hartnäckig über Jahre. Dazu zählen Phishing-Mails im Namen der Österreichischen Gesundheitskasse (ÖGK). Nun setzen die Kriminellen auch auf Dialekt.

https://www.watchlist-internet.at/news/phishing-mails-der-oegk/

NuGet-Sicherheit: Microsoft verkürzt Gültigkeit von API-Keys auf 30 Tage

Eine kürzere Gültigkeit von API-Keys zur Paketveröffentlichung soll die Sicherheit von NuGet stärken. Sie betrifft sowohl bestehende als auch neue Keys.

https://heise.de/-11396124

INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances.

https://thehackernews.com/2026/08/inc-ransomware-emerges-as-dominant.html

Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS

An unknown Chinese-speaking threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit.

https://thehackernews.com/2026/08/chinese-threat-actor-uses-leaked.html

DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT

A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager.

https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html

Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access

Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect.

https://thehackernews.com/2026/08/fake-adobe-and-zoom-updates-install.html

AI slop pollutes the CVE pipeline with fake vulns

With NIST still buried under its backlog, expect AI-generated bogus reports to continue.

https://www.theregister.com/security/2026/08/03/ai-slop-pollutes-the-cve-pipeline-with-fake-vulns/5282462

Wenn die IT ausfällt: Krisensimulation für Krankenhäuser

Wie Krankenhäuser bei IT-Ausfällen reagieren, testet Nico Brüggemann vom Fraunhofer SIT. Er erklärt, warum Abläufe oft nur auf dem Papier funktionieren.

https://www.heise.de/hintergrund/Wenn-die-IT-ausfaellt-Krisensimulation-fuer-Krankenhaeuser-11395892.html

Almost Half of Malware Samples Communicate Direct to IP

Malware samples often bypass DNS entirely, communicating directly to IP addresses instead. Our analysis of 4 million dynamic analysis reports indicates that almost half (45.32%) of malware samples with any command-and-control (C2) activity made at least one direct-to-IP (D2IP) address connection. Measured as a fraction of all C2 connection attempts, D2IP traffic accounts for 23.17% of the total.

https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/

EU-Cybersecurity-Pflichten für Hersteller & Betriebe - Hands-on

Auf Hersteller und Unternehmen in Europa kommen in den nächsten Wochen und Monaten (z.B. ab 11.09.2026) einige Cybersecurity-Pflichten zu, die EU-weit geregelt sind. NIS-2, Cyber Resilience Act und Maschinenverordnung. Mir hat der Betreiber einer entsprechenden Infoseite einige Informationen zukommen lassen. Ich nutze die Gelegenheit, einen kuren Überblick über die Sachlage zu geben.

https://borncity.com/blog/2026/08/04/eu-cybersecurity-pflichten-fuer-hersteller-betriebe-hands-on/

Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack

Socket-s Threat Research Team is tracking an active supply chain compromise affecting the widely used keyv and cacheable npm packages. On August 4, 2026, at least ten packages beginning with the keyv and cacheable namespaces and spreading to packages owned by other maintainers, were published with a malicious preinstall hook (setup.mjs) that downloads a standalone Bun runtime, executes an obfuscated second stage, harvests cloud and CI credentials, and republishes trojanized versions of other packages the stolen npm token can reach. The affected packages collectively account for tens of millions of weekly downloads. New packages are appearing in real time, and Socket team will keep on updating the list.

https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain?utm_medium=feed

Vulnerabilities

New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root

cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege boundary between a cPanel account and the server's administrative database identity. It shipped in a targeted security release that closes two other routes past account boundaries.

https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html

Jetzt patchen! Angreifer attackieren N-able N-central

N-ables Endpoint-Managementlösung N-central ist verwundbar und Angreifer attackieren bereits Instanzen. Admins sollten zügig handeln.

https://www.heise.de/news/Jetzt-patchen-Angreifer-attackieren-N-able-N-central-11397397.html

Check Point: Angreifer können Security-Management-Server übernehmen

Aufgrund einer Sicherheitslücke können Angreifer die IT-Sicherheitslösung Security Management von Check Point attackieren. Hotfixes stehen zum Download.

https://heise.de/-11398187

Broadcom Fixes Multiple Critical VMware Vulnerabilities

Broadcom-s latest security advisory resolves five vulnerabilities affecting core VMware products. The most severe vulnerabilities carry a CVSS score of 9.8, allowing attackers to bypass authentication or execute arbitrary code on vulnerable systems. Because vCenter Server acts as the centralized management platform for VMware environments, successful exploitation could provide attackers with extensive control over virtual infrastructure. There are currently no confirmed reports of widespread exploitation, but the technical impact warrants immediate remediation.

https://thecyberthrone.in/2026/08/03/broadcom-fixes-multiple-critical-vmware-vulnerabilities/

LWN Security updates for Tuesday

https://lwn.net/Articles/1087068/

Security Vulnerabilities fixed in Firefox for Android 153.0.3

https://www.mozilla.org/en-US/security/advisories/mfsa2026-73/

[R1] Sensor Proxy Version 1.4.2 Fixes One Vulnerability

https://www.tenable.com/security/tns-2026-21

Zyxel security advisory for path traversal vulnerability in the configuration file execution CLI command of ZLD firewalls

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-path-traversal-vulnerability-in-the-configuration-file-execution-cli-command-of-zld-firewalls-08-04-2026

Zyxel security advisory for command injection and improper authentication vulnerabilities in certain APs, FWA7, and Security Routers

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026

List of Security Fixes and Improvements in Veeam ONE

https://www.veeam.com/kb4858

Tageszusammenfassung - 03.08.2026

CERT.at — Mon, 03 Aug 2026 17:21:14 GMT+0100

End-of-Day report

Timeframe: Freitag 31-07-2026 18:00 - Montag 03-08-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler

News

Arch Linux disables AUR package adoption to stop malware flood

The Arch Linux project has temporarily disabled adoption of Arch User Repository (AUR) packages after a surge in malicious takeovers of existing packages.

https://www.bleepingcomputer.com/news/security/arch-linux-disables-aur-package-adoption-to-stop-malware-flood/

Inside the Underground Business of BTMOB RAT

BTMOB has been covered by several cybersecurity publications, primarily through technical analyses of the malware and its capabilities, but much less has been reported about the ecosystem that has developed around it.

https://www.bleepingcomputer.com/news/security/inside-the-underground-business-of-btmob-rat/

ExfilSquad hackers leak info of over 100,000 UK police officers, staff

A cyberattack on the U.K.'s Police National Legal Database (PNLD) has compromised contact data of more than 100,000 police officers and other criminal justice professionals.

https://www.bleepingcomputer.com/news/security/exfilsquad-hackers-leak-info-of-over-100-000-uk-police-officers-staff/

Coldcard-Wallets: Massenhafte Bitcoin-Diebstähle erschüttern die Kryptobranche

Bitcoins im Wert von mehr als 70 Millionen Euro haben zuletzt unverhofft die Besitzer gewechselt. Grund ist eine Schwachstelle in Hardware-Wallets von Coinkite.

https://www.golem.de/news/coldcard-wallets-massenhafte-bitcoin-diebstaehle-erschuettern-die-kryptobranche-2608-211532.html

Phishing Campaigns Targeting AI Solutions Providers, (Sat, Aug 1st)

Most phishing campaigns rely on the fact that the victim is afraid to loose "something": money, access to information, ... Many brands have been impersonated by campaigns but I spotted some phishing emails that focus on AI services like ChatGPT.

https://isc.sans.edu/diary/rss/33206

N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete

N-able said attackers exploited an authentication bypass in N-central to gain remote administrative access and reach the customer systems managed through those servers.

https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html

The OpenAI and Anthropic AI Hacking Sprees Are a Messy New Legal Frontier

Both major AI labs- models broke containment, escaped onto the internet, and hacked other companies. If a human had done that, the law would likely be against them. But a bot?

https://www.wired.com/story/openai-anthropic-ai-hacking-sprees-illegal/

The Risk of Fine-Tuned Open-Weight Models

In the last weeks I was wondering how to continue offensive security and malware development over the next months or even years with the help of AI.

https://www.msecops.de/blog/posts/backdoored-llms/

Auswärtiges Amt warnt vor IT-Fachkräften aus Nordkorea

IT-Fachkräfte aus Nordkorea unterwandern zunehmend westliche Unternehmen. Jetzt gibt es eine internationale Warnung davor.

https://www.heise.de/news/Auswaertiges-Amt-warnt-vor-IT-Fachkraeften-aus-Nordkorea-11394444.html

Cyberangriff auf Liechtenstein - 31.000 Datensätze betroffen

Die Regierung Liechtensteins meldet einen Angriff auf ein Personenverzeichnis. Was steckt hinter dem Zugriff auf 31.000 Datensätze?

https://www.heise.de/news/Cyberangriff-auf-Liechtenstein-31-000-Datensaetze-betroffen-11395010.html

Apple: Limit für Bug-Meldungen pro Person

Apple reagiert auf die Flut von KI-generierten Sicherheitsmeldungen und begrenzt die Einreichungen pro Person.

https://www.heise.de/news/Apple-Limit-fuer-Bug-Meldungen-pro-Person-11395377.html

Traumjob von zuhause? Achtung Geldwäschefalle!

Kriminelle geben sich als Personaler:innen aus, um ahnungslose Menschen für Geldwäsche zu missbrauchen. Die Opfer wissen dabei oft von nichts. Wir zeigen, wie Sie den Betrug erkennen.

https://www.watchlist-internet.at/news/traumjob-von-zuhause-geldwaesche/

Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

This article analyzes new attack classes against passwordless authentication, focusing on Google-s synced passkey ecosystem and the Cloud Authenticator used by desktop clients. The attacks demonstrate how malware on a compromised endpoint can misuse onboarding, recovery and device trust workflows to take over passkey-protected accounts. We show how an attacker can authenticate without user interaction, bypass user verification requirements and extract all synced passkey private keys.

https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/

The Hidden CCS2 Attack Surface on EV Chargers

An EV charger's charging port is a network port. We found SSH and Telnet services exposed on XCharge C6 chargers with default root:root credentials. A threat actor with a malicious EV can gain immediate full control access on the charger and perform energy theft or potentially cause physical damage.

https://www.saiflow.com/blog/the-hidden-ccs2-attack-surface-on-ev-chargers

Guide to Bypassing Hotel Wi-Fi Captive Portals (With Permission)

Have you ever been curious about how easy it is to bypass that pesky captive portal? This article guides you through 3 different methods.

https://projectblack.io/blog/bypassing-hotel-wi-fi-captive-portals/

Vulnerabilities

Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectable

Thermo Fisher Scientific has patched a flaw in select Applied Biosystems human identification software that could allow data files to be altered before analysis software loads them.

https://thehackernews.com/2026/08/thermo-fisher-patches-flaw-that-could.html

Adobe Campaign Classic Schwachstelle CVE-2026-48449 (CVSS 3.x 10.0) gepatcht

Adobe musste die Tage die Schwachstelle CVE-2026-48449 in seinem Produkt Adobe Campaign Classic patchen. Es handelt sich um eine Authorisierungsschwachstelle, die das umgehen einer Anmeldung ermöglicht. Die Schwachstelle wurde mit einem CVSS 3.x von 10.0, also dem höchstmöglichen Wert, als kritisch eingestuft.

https://borncity.com/blog/2026/08/03/adobe-campaign-classic-schwachstelle-cve-2026-48449-cvss-3-x-10-0-gepatcht/

LWN Security updates for Monday

https://lwn.net/Articles/1086897/

Synology-SA-26:12 Synology Assistant

https://www.synology.com/en-global/support/security/Synology_SA_26_12

Tageszusammenfassung - 31.07.2026

CERT.at — Fri, 31 Jul 2026 17:24:43 GMT+0100

End-of-Day report

Timeframe: Donnerstag 30-07-2026 18:00 - Freitag 31-07-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a

News

Claude uploaded malware to PyPI in Anthropics botched test

One of Anthropics Claude models built and uploaded a malicious Python package to PyPI during a botched security evaluation, where it ran on 15 real systems and stole credentials from a security vendor. It was one of three incidents affecting real companies.

https://www.bleepingcomputer.com/news/security/claude-uploaded-malware-to-pypi-in-anthropics-botched-test/

Microsoft: Forscher finden Masterkey für Vollzugriff auf Azure-Datenbanken

Mit dem Key hätten Angreifer alle Datenbanken bei Microsofts Datenbankdienst Azure Cosmos DB auslesen und manipulieren können - auch die von Microsoft.

https://www.golem.de/news/microsoft-forscher-finden-masterkey-fuer-vollzugriff-auf-azure-datenbanken-2607-211473.html

Anthropic and OpenAI are competing to see whose agents can go rogue harder

Whoever wins, we lose

https://www.theregister.com/security/2026/07/31/anthropic-and-openai-are-competing-to-see-whose-agents-can-go-rogue-harder/5281797

-CosmosEscape- ermöglichte Übernahme aller Microsoft-Azure-Datenbanken

Eine Verkettung von Sicherheitslücken ermöglichte vollen Zugang zu allen Azure-Cosmos-DB-Datenbanken.

https://www.heise.de/news/CosmosEscape-ermoeglichte-Uebernahme-aller-Microsoft-Azure-Datenbanken-11388708.html

If you-re going to vibe code it, why not vibe pen test it?

TL;DR Why I built PenAI PenAI started as a project at a hackathon organised by Encode Club. It-s an AI agent that could work through Hack The Box-style lab machines on its own. Upload a VPN file, give it a target IP, pick a scope, set stealth mode and iteration limits, hit run, and let ..

https://www.pentestpartners.com/security-blog/if-youre-going-to-vibe-code-it-why-not-vibe-pen-test-it/

The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version

Analysis of XCSSET v40 reveals a macOS malware targeting developers via Xcode. Unit 42 used advanced pattern matching and AI to decode its logic.

https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/

Firefox JIT-Schwachstelle gefährdete Tor-Nutzer unter Android

Im Firefox-Browser (151.0.1) gab es eine JIT-Schwachstelle (CVE-2026-10702), die einen Ausbruch aus dem Render des Browsers durch Code ermöglichte. Der Besuch einer bösartigen Webseite reichte aus, um beispielswiese den Tor-Browser, der den Firefox nutzt, zu kompromittieren. Ausnutzbar war das ..

https://borncity.com/blog/2026/07/31/firefox-jit-schwachstelle-gefaehrdete-tor-nutzer-unter-android/

Russische Akteure greifen über Outlook-Web-Access-Lücke an

Eine Sicherheitslücke in OWA ermöglicht durch Anzeigen von Mails das Ausführen von JavaScript-Code. Russische Akteure nutzen das aus.

https://heise.de/-11387751

SolarWinds Web Help Desk: Update bessert umgehbare Authentifizierung aus

SolarWinds schließt Sicherheitslücken in Web Help Desk. Eine gilt als kritisch und ermöglicht Angreifern, die Authentifizierung zu umgehen.

https://heise.de/-11388191

Unpatchbarer Fehler in Apple A12 & A13: Forensik- verklagt Security-Firma

Bis hin zum iPhone 11 stecken in Apple-Silicon-Chips nicht behebbare Lücken. Nun ist ein Streit darüber ausgebrochen, ob diese weitergegeben werden durfte.

https://heise.de/-11379656

Tageszusammenfassung - 30.07.2026

CERT.at — Thu, 30 Jul 2026 17:10:37 GMT+0100

End-of-Day report

Timeframe: Mittwoch 29-07-2026 18:00 - Donnerstag 30-07-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler

News

HelloNet campaign: new malicious modules launched through the ViPNet update system

We identified targeted infection attempts against large Russian organizations using the ViPNet update system (a software suite for creating secure networks).

https://securelist.com/tr/hellonet-vipnet/120700/

Toy Ghouls- new toy: the GenieLocker ransomware

The new GenieLocker ransomware family has been active since March 2026. It has been used in attacks against organizations in the Russian Federation, primarily in the manufacturing sector, and attributed to the Toy Ghouls group by open-source intelligence (link in Russian).

https://securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/

Reconnaissance First: An SSH Bot That Sizes Up Your Hardware Before Deploying a Miner [Guest Diary], (Thu, Jul 30th)

Most of what an internet-facing SSH honeypot records is noise. Endless password guessing, and bots that log in, immediately pull down a payload, and move on. On 27 June 2026 my honeypot caught something quieter, and to me more interesting. A bot logged in as root, ran a careful survey of the machine's hardware, and then disconnected without downloading or running anything at all. No malware, no persistence, no second stage.

https://isc.sans.edu/diary/rss/33198

Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads.

https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html

Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts

South Korean authorities and four security firms have disclosed a state-sponsored campaign that compromised trusted domestic websites. The attackers used those sites to exploit locally installed financial-security software and infect targeted visitors with SIGNBT or COPPERHEDGE backdoors.

https://thehackernews.com/2026/07/hackers-exploit-anysign4pc-via-hacked.html

Verschlüsselt, aber falsch: Gruppenchats anfällig für manipulierte Inhalte

Alle Mitglieder eines Gruppenchats sollten dieselben Inhalte sehen. Die üblichen Chat-Dienste stellen das nicht sicher. Das ist riskant.

https://www.heise.de/news/Verschluesselt-aber-falsch-Gruppenchats-anfaellig-fuer-manipulierte-Inhalte-11384095.html

Vermeintliche Zollgebühren der Post sind fake!

Eine offene Paketgebühr, ein Link zur Zahlung und eine täuschend echt aussehende Nachricht der Österreichischen Post. Mit dieser Masche versuchen Kriminelle derzeit, an Bankdaten zu gelangen.

https://www.watchlist-internet.at/news/phishing-oesterreichischen-post-zoll/

Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

Unit 42 identified an AI-enabled autonomous hacking campaign carried out by a Chinese-speaking threat actor. They targeted infrastructure using seven vulnerabilities, combining autonomous AI-driven enumeration with manual exploitation that achieved confirmed impact.

https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/

Adform compromised to serve crypto stealer via supply chain attack

Adform are an advertising company used by around 14k companies, owning around a 30% share of the demand-side category.

https://doublepulsar.com/adform-compromised-to-serve-crypto-stealer-via-supply-chain-attack-2f1ec024f33e?source=rss8343faddf0ec4

CISA Guide Helps Federal Agencies Securely and Effectively Use Open Source Software

Tailored Guidance to Use and Understand OSS Solutions, Contribute to and Produce Projects, and Evaluate AI Models.

https://www.cisa.gov/news-events/news/cisa-guide-helps-federal-agencies-securely-and-effectively-use-open-source-software

Vulnerabilities

Angreifer missbrauchen Backdoor in Ciscos Firewall-Verwaltungssoftware

Angreifer missbrauchen fest einprogrammierte Zugangsdaten in Ciscos Firewall-Verwaltungssoftware. Updates sollen dagegen helfen.

https://www.heise.de/news/Angreifer-missbrauchen-Backdoor-in-Ciscos-Firewall-Verwaltungssoftware-11384735.html

Chrome-Update stopft weitere 370 Sicherheitslecks

Google hat wieder ein massives Sicherheitsupdate für Chrome veröffentlicht. Sieben der geschlossenen Lücken gelten als kritisch.

https://heise.de/-11384153

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh

Progress: LoadMaster Critical Security Bulletin - July 2026 - (CVE-2026-59686, CVE-2026-59687, CVE-2026-59688, CVE-2026-59689, CVE-2026-59690)

https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-July-2026-CVE-2026-59686-CVE-2026-59687-CVE-2026-59688-CVE-2026-59689-CVE-2026-59690

GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/

Drupal Security Advisories 2026-July-29

https://www.drupal.org/security

Publish DFIR-IRIS advisories

https://github.com/sbaresearch/advisories/commit/0e542378f16ec1052b5ad032b487b10bbb7953a3

LWN Security updates for Thursday

https://lwn.net/Articles/1086225/

Tageszusammenfassung - 29.07.2026

CERT.at — Wed, 29 Jul 2026 17:53:11 GMT+0100

End-of-Day report

Timeframe: Dienstag 28-07-2026 18:00 - Mittwoch 29-07-2026 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a

News

vBulletin fixes critical pre-auth RCE flaw with public exploit

A critical vulnerability in the vBulletin forum software allows unauthenticated attackers to execute arbitrary PHP code through template rendering. [..] SSD Secure Disclosure has also published a technical analysis for CVE-2026-61511, explaining that the sanitization restrictions can be bypassed using the so-called -phpfuck- technique. [..] CVE-2026-61511 was reported to vBulletin on June 25, 2026, and version 6.2.2, which addressed the flaw, was released on July 1.

https://www.bleepingcomputer.com/news/security/vbulletin-fixes-critical-pre-auth-rce-flaw-with-public-exploit/

Passwort-Hashes auslesbar: 20 Jahre alte BMC-Lücke gefährdet über 24.000 Server

Sicherheitsforscher von Lava haben 24.650 über das Internet erreichbare und für die Verwaltung von Serversystemen genutzte Baseboard Management Controller (BMC) ausfindig gemacht, die aufgrund einer zwei Jahrzehnte alten Sicherheitslücke Passwort-Hashes leaken. [..] Die Sicherheitslücke ist zwar, wie schon die CVE-ID erahnen lässt, erst 2013 öffentlich bekannt geworden, nach Angaben der Forscher war sie aber schon von Beginn an in IPMI 2.0 enthalten - und damit seit 2004. Trotz dieses Alters sind noch heute 36.872 Server-BMCs über IPMI erreichbar und davon 24.650 anfällig für CVE-2013-4786, wie Lava auf einem eigenen Dashboard zeigt.

https://www.golem.de/news/passwort-hashes-auslesbar-20-jahre-alte-bmc-luecke-gefaehrdet-ueber-24-000-server-2607-211397.html

CubePilot drone software dev hit by DNS hijacking to intercept traffic

CubePilot, an Australian firm that designs flight controllers for drones (UAVs), announced a severe operational disruption caused by a DNS hijacking attack.

https://www.bleepingcomputer.com/news/security/cubepilot-drone-software-dev-hit-by-dns-hijacking-to-intercept-traffic/

Nationale Sicherheit: FCC verbietet Importe chinesischer Roboter

Die US-Fernmeldebehörde FCC verbietet die Zulassung neuer chinesischer Roboter und Wechselrichter wegen angeblicher Sicherheitsrisiken.

https://www.golem.de/news/nationale-sicherheit-fcc-verbietet-importe-chinesischer-roboter-2607-211388.html

Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass

Cybersecurity researchers have shared additional technical details about a recently patched critical security flaw impacting Check Point Security Management Server and Multi-Domain Security Management Server (MDS) that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass in the SmartConsole login process that allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.

https://thehackernews.com/2026/07/rapid7-releases-poc-for-exploited-check.html

JFrogs 0-days let OpenAIs models hack Hugging Face

We now know how OpenAI's models broke out of their cages to attack Hugging Face. The rogue models found zero-day vulnerabilities in JFrog-s universal binary repository manager Artifactory around the time they escaped, according to JFrog CTO Yoav Landman. While Landman wouldn't confirm that these flaws were the zero-days that OpenAI-s models found and exploited, ultimately allowing them to breach the massive model mart, OpenAI later admitted the connection.

https://www.theregister.com/security/2026/07/28/jfrogs-0-days-let-openais-models-hack-hugging-face/5280001

Some notes about Anthropic-s new results

Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAWK, while the second is an improved attack against reduced-round AES. Anthropic also released a blog post describing the research process that produced these results.

https://blog.cryptographyengineering.com/2026/07/29/some-notes-about-anthropics-new-results/

Attackers Are Turning Microsoft-s Trusted Login System Into Their Latest Phishing Weapon

Attackers are increasingly abandoning fake Microsoft login pages in favor of abusing Microsoft-s legitimate authentication infrastructure, allowing phishing campaigns to bypass many of the warning signs employees have been trained to recognize. Starting on June 25th through the second week of July, we identified more than 200 phishing emails targeting users across approximately 120 organizations, spanning a wide range of industries and countries worldwide. Victims were then prompted to grant permissions to an attacker-controlled application, allowing the campaign to abuse Microsoft-s trusted authentication flow while concealing its malicious intent.

https://blog.checkpoint.com/email-security/attackers-are-turning-microsofts-trusted-login-system-into-their-latest-phishing-weapon/

Fake-PayPal-Mails: Rückerstattung und Abbuchung als Köder

Kriminelle verschicken derzeit gefälschte PayPal-Nachrichten, um an Zugangsdaten und Bankdaten zu gelangen. Eine Mail lockt mit einer Rückzahlung von 95,66 Euro, die andere warnt vor einer Abbuchung von 909,00 Euro.

https://www.watchlist-internet.at/news/fake-paypal-mails-rueckerstattung-und-abbuchung-als-koeder/

GitHub Blog: Disrupting supply chain attacks on npm and GitHub Actions

Explore the changes weve shipped across npm and GitHub Actions over the past few months to disrupt supply chain attack techniques and limit their impact.

https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/

Vulnerabilities

Gitea: Remote Code Execution via diffpatch Git Hook Installation

Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository. CVE-2026-60004

https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m

Broadcom: VMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709)

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. [..] VMware vCenter contains a directory traversal vulnerability in the Syslog server. [..] VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter.

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017

Jetbrains: Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077) - Update to 2025.11.7 or 2026.1.3 Now

A critical security vulnerability has been identified in TeamCity On-Premises and assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2026-63077. If exploited, this vulnerability may allow an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands.

https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/

OpenWrt: Updates schließen teils kritische Sicherheitslücken

Das OpenWrt-Projekt hat aktualisierte Fassungen veröffentlicht, die teils als kritisches Risiko eingestufte Sicherheitslücken stopfen. [..] Mit einem einzigen UDP-Paket können Angreifer aus dem Netz ohne vorherige Anmeldung den Pufferüberlauf ausnutzen.

https://heise.de/-11381496

LWN: Security updates for Wednesday

https://lwn.net/Articles/1086031/

Node.js: Wednesday, July 29, 2026 Security Releases

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

Tageszusammenfassung - 28.07.2026

CERT.at — Tue, 28 Jul 2026 17:05:02 GMT+0100

End-of-Day report

Timeframe: Montag 27-07-2026 18:00 - Dienstag 28-07-2026 18:00 Handler: Alexander Riepl Co-Handler: n/a

News

Apple sued over fake App Store crypto wallet app stealing $1.8M in Bitcoin

Apple is being sued by three people who claim approximately $1.8 million in Bitcoin was stolen after downloading and using a fraudulent Sparrow Wallet application from the App Store.

https://www.bleepingcomputer.com/news/apple/apple-sued-over-fake-app-store-crypto-wallet-app-stealing-18m-in-bitcoin/

New Dysphoria DDoS botnet spreads to 200k devices worldwide

A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations.

https://www.bleepingcomputer.com/news/security/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide/

New Certighost PoC exploit lets attackers hijack Windows domains

A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain.

https://www.bleepingcomputer.com/news/security/new-certighost-poc-exploit-lets-attackers-hijack-windows-domains/

Hackers target US firms in FastJson RCE zero-day attacks

Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges.

https://www.bleepingcomputer.com/news/security/hackers-target-us-firms-in-fastjson-rce-zero-day-attacks/

Data breach at medical billing firm MCBS affects 1.26 million people

Healthcare billing company Medical Computer Business Services (MCBS) has disclosed that a 2025 network breach exposed the sensitive information of more than 1.2 million people.

https://www.bleepingcomputer.com/news/security/data-breach-at-medical-billing-firm-mcbs-affects-126-million-people/

Nach OpenAI-Hack: US-Abgeordnete wollen Kill Switch für KI

Der eigenständige Hackerangriff von OpenAIs KI hat Nachwirkungen: Abgeordnete fordern mehr Kontrolle - und einen Kill Switch.

https://www.golem.de/news/nach-openai-hack-us-abgeordnete-wollen-kill-switch-fuer-ki-2607-211284.html

Persönliche Daten geleakt: Unzählige Claude-Chats bei Google aufgetaucht

Claude-Nutzer können Links zu ihren Chats mit anderen Personen teilen. Die Unterhaltungen wurden bis vor kurzem aber auch bei Google gelistet.

https://www.golem.de/news/persoenliche-daten-geleakt-unzaehlige-claude-chats-bei-google-aufgetaucht-2607-211338.html

NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework

NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelligence (AI) agents.The 37-member group spans cloud, security, enterprise software, and AI companies, including Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, ..

https://thehackernews.com/2026/07/nvidia-forms-37-member-open-secure-ai.html

AI-found bugs arent proving any easier to exploit despite the hype

VulnCheck says fewer than 2% of AI-assisted vulnerability discoveries have been weaponized, casting doubt on claims frontier models are handing attackers a major advantage

https://www.theregister.com/security/2026/07/28/ai-found-bugs-arent-proving-any-easier-to-exploit-despite-the-hype/5279637

Angriffe auf FortiOS und Arista VeloCloud beobachtet

Die IT-Sicherheitsbehörde CISA meldet Angriffe auf Sicherheitslücken in Fortinet FortiOS sowie Arista VeloCloud.

https://www.heise.de/news/Angriffe-auf-FortiOS-und-Arista-VeloCloud-beobachtet-11379680.html

Neobank Revolut: Angeblich 75 Millionen Datensätze im Untergrund angeboten

Ein Krimineller bietet im digitalen Untergrund eine Datenbank mit 75 Millionen Einträgen an, die von der Neobank Revolut stammen sollen.

https://www.heise.de/news/Neobank-Revolut-Angeblich-75-Millionen-Datensaetze-im-Untergrund-angeboten-11379742.html

Lücke: Claude Cowork entkommt macOS-Sandbox

Die Nutzung von KI-Agenten direkt auf dem Rechner kann Gefahren mit sich bringen. Das zeigt eine soeben entdecktes Sicherheitsloch in Claude Cowork für den Mac.

https://www.heise.de/news/Luecke-Claude-Cowork-entkommt-macOS-Sandbox-11379475.html

IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

Talos IRs Q2 report highlights a significant surge in phishing-based initial access and the weaponization of legitimate remote management tools. Learn how to sharpen your defenses.

https://blog.talosintelligence.com/ir-trends-q2-2026/

Zahlreiche Sicherheitslücken gefixt: Schnell auf iOS 26.6 und Co. aktualisieren

Apple hat nun seine Sicherheitshinweise zu den neuen Betriebssystemen publiziert. Es gibt erneut enorm viele Fixes - vermutlich auch dank KI.

https://heise.de/-11379576

Verschiedene Attacken auf Progress LoadMaster möglich

Die Load-Balancing- und Cluster-Managementlösung LoadMaster ist verwundbar. Die Entwickler haben nun Sicherheitslücken geschlossen.

https://heise.de/-11380070

CERT.at - Tagesberichte

Tageszusammenfassung - 05.10.2026

End-of-Day report

News

Cyberangriff: Antriebssystem eines Öl-Supertankers gehackt

OpenAI alerts 100+ orgs that its misaligned models attempted to break in - or worse

Create automatic IP blocklist in OPNsense based on MISP data

Nach Muse: Auch ChatGPT-App für macOS war angreifbar

Raiffeisen-Phishing: Vorsicht bei Mitteilung zu neuem Dauerauftrag

N0n ransomware: what you need to know

Japan Plans Major Cyber Hunt to Detect Hidden Attacks on Critical Infrastructure

Google Suspends Open Source Bug Bounty Over AI-Generated Reports

Vulnerabilities

New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

Microsoft schiebt Exchange-Update nach

Security updates for Monday

Tageszusammenfassung - 02.10.2026

End-of-Day report

News

Microsoft-s X account hacked in crypto pump-and-dump scheme

Hackerangriff: Pentagon verliert Daten von mehr als drei Millionen Personen

Warlock ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries

Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739)

Vulnerabilities

Dell asks admins to patch max severity CSM flaws as soon as possible

FortiMail: Angriffe auf Zero-Day-Lücke laufen, Workaround verfügbar

LWN Security updates for Friday

[R1] Nessus Version 10.12.5 Fixes Multiple Vulnerabilities

Tageszusammenfassung - 01.10.2026

End-of-Day report

News

Over 543,000 valid credentials exposed in public GitHub repositories

Revolut zahlt kein Lösegeld: Hackergruppe erpresst Revolut-Kunden direkt

From: anyone@icloud.com - Absenderfälschung in Apple iCloud

SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor

Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path

NIS2 Registrierung in Österreich. Wie gehe ich richtig vor?

Zu viele KI-Vorfälle: US-Behörde untersucht Anthropic, METR, OpenAI

Vulnerabilities

Kiteworks patches max severity code injection vulnerability

Vulnerabilities in Zammad during investigation of case DIVD-2026-00014

WatchGuard schließt teils kritische Lücken in Fireware OS

NVIDIA GPU Display Driver - September 2026

LWN: Security updates for Thursday

Mozilla Foundation Security Advisories September 30, 2026

Tageszusammenfassung - 30.09.2026

End-of-Day report

News

New Spectre v2 attack variant leaks Linux root password hash in minutes

Phishing Abuses RMM Tools for Persistent Access

Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services

Hackers Use Hijacked University Emails to Scam Students, Pose as FBI Agent

Fake Express Packages on npm Spread a Linux Worm

CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode

Vulnerabilities

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

TeamViewer: Security Update for Multiple Vulnerabilities in TeamViewer Clients and Related Services

MikroTik RouterOS

Kritische Schwachstelle: Google stopft 32 Löcher in Chrome

OpenSSL Security Advisory [29th September 2026]

LWN: Security updates for Wednesday

Tageszusammenfassung - 29.09.2026

End-of-Day report

News

Cyberangriff auf Datenaustauschdienst FTAPI

Over 16,000 Supabase databases expose PII, passwords, auth tokens

Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks

ShinyHunters weiter aktiv, Details zu FBI-Datendiebstahl

Digitale Gesundheitsanwendungen: HelloBetter meldet Datenpanne nach Cyberangriff

Vulnerabilities

Apple patches CoreGraphics zero-day flaw exploited in attacks

Zero-Day-Lücke: Kiteworks rät Kunden zur Abschaltung von Servern

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

Groupware Zimbra: Update schließt zahlreiche Sicherheitslücken

WatchGuard AP: Befehlsschmuggel-Lücken und umgehbare Authentifizierung

LWN Security updates for Tuesday

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006

MISP 2.5.48 - AImageddon security roundup release

Tageszusammenfassung - 28.09.2026

End-of-Day report