End-of-Day report
Timeframe: Dienstag 03-11-2026 18:00 - Mittwoch 04-11-2026 18:00
Handler: Darius Morariu
Co-Handler: Michael Schlagenhaufer
News
Coolworld Kühlschränke für Blutkonserven in Frankreich von Temperatur-Hack betroffen
Momentan werden wir von den Ereignissen bei den Cyberangriffen auf Kühlschränke und Truhen in Europa überrollt. Betraf nach bisherigen Meldungen nur Lebensmittelsketten. Ich hatte für heute einen Artikel geplant, der auf die Gefahr für Labore und medizinische Einrichtungen hinweist. Nun wird bekannt, dass Coolworld, ein Dienstleister, der Blutkonserven für Frankreichs Kliniken aufbewahrt, vom Hack betroffen ist. [..] Zum Glück bemerkte ein Techniker diese Manipulation und konnte schlimmeres verhindern.
https://borncity.com/blog/2026/11/04/coolworld-kuehlschraenke-fuer-blutkonserven-in-frankreich-von-temperatur-hack-betroffen/
Hackers use n-day exploits in zero-click attacks on iOS, Android devices
The campaign used multiple high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria that delivered the same payload for profiling visitors and their devices. This initial stage allows the attacker to determine the browser version to deploy "platform-specific n-day exploit chains without user interaction."
https://www.bleepingcomputer.com/news/security/hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices/
Brisanter Fund: Adressen von mehr als 2.500 Fake-Shops entdeckt
Der Quelltext eines enttarnten Fake-Shops hielt einer besondere Überraschung parat. Er beinhaltete eine Liste mit deutlich mehr als 2.000 Domains weiterer betrügerischer Online-Portale. Ein nicht alltäglicher und deshalb umso spannenderer Einblick in die Arbeitsweise von Kriminellen und eine Bestätigung dafür, dass auch ihnen Fehler passieren.
https://www.watchlist-internet.at/news/liste-fake-shops/
CVE-2026-103089: When a Document ID Exposes Another Patient-s Records
An IDOR vulnerability in a medical web application [..] The application passed a numeric document ID to the server when requesting a link to a medical record. The server accepted a valid logged-in session without adequately verifying that the requested document belonged to that user. [..] Every request for a document needs a server-side check that the current user is allowed to access that exact document. If a separate download URL exists, the authorization must hold there as well.
https://medium.com/@follow.usagi/cve-2026-103089-when-a-document-id-exposes-another-patients-records-0288b32cd60b
The problem with shared Wi-Fi passwords at work
WPA2-PSK gives everyone the same Wi-Fi password. If that password is exposed, anyone with it can access the network until the password is changed. Replace shared Wi-Fi password authentication type (WPA2-PSK) with better Wi-Fi security protocol such as WPA2/3-Enterprise and use secure authentication methods such as certificate-based authentication to provide unique credentials for each user and device.
https://www.pentestpartners.com/security-blog/the-problem-with-shared-wi-fi-passwords-at-work/
Chrome 157 fixes 213 security issues, including 7 critical flaws
On November 3, Google issued Chrome 157 to the stable channel for Windows, Mac and Linux. The update is rolling out over the coming days and weeks.
https://www.malwarebytes.com/blog/bugs/2026/11/chrome-157-fixes-213-security-issues-including-7-critical-flaws
Wednesday, November 11, 2026 Security Releases
The Node.js project will release new versions of the 26.x, 24.x, 22.x releases lines on or shortly after, Wednesday, November 11, 2026 in order to address: The highest severity issue fixed in this release is HIGH.
https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
Vulnerabilities
SonicWall: End-Of-Life (EOL) SonicWall GMS Multiple Vulnerabilities
An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information. CVE-2026-109593, CVE-2026-109594
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019
Rails: Possible arbitrary file write and read in Active Storage image analysis
A Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process.
https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
Puppet: Pulling the right strings for RCE on a Puppet
RCE on the Puppet Server (CVE-2026-115731) [..] Puppet Host Impersonation (CVE-2026-115732) [..] The fixes were eventually released on November 3, 2026, at 17:00 UTC, accompanied by public security advisories from OpenVox and Perforce.
https://neodyme.io/en/blog/puppet_rce
Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VMs Memory
Two flaws in the Xen hypervisor allow a malicious guest virtual machine (VM) to read and write the memory of other VMs on the same host, including dom0. [..] All Xen versions from 4.6 onward are vulnerable, while 4.5 and earlier are not. The flaws are tracked as CVE-2026-102703 and CVE-2026-102704, under Xen advisory XSA-523.
https://thehackernews.com/2026/11/xen-hypervisor-flaws-let-one-malicious.html
Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. CVE-2026-76419
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5z
Cisco Identity Services Engine Authorization Bypass Vulnerability
A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate. CVE-2026-20241
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cert-mE9BD5GO
Cisco UCS Central Software Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. CVE-2026-76506
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucs-rce-LzHSFRDQ
LWN: Security updates for Wednesday
https://lwn.net/Articles/1105378/