Timeframe: Freitag 09-10-2026 18:00 – Montag 12-10-2026 18:00
Handler: Guenes Holler
Co-Handler: Alexander Riepl
News
Cyberattack shuts down refrigerators at French supermarkets
Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers.
Japan reagiert auf Welle von Cyberangriffen
Etliche wichtige Unternehmen in Japan haben Cyberangriffe gemeldet. Japans Digitalminister spricht von einem Notstand.
Alte Lücken etwa in Apache Struts, BIND und ProFTPD im Visier von Angreifern
Die US-amerikanische IT-Sicherheitsbehörde CISA hat Ende vergangener Woche fünf Sicherheitslücken neu in den -Known-Exploited-Vulnerabilities–Katalog (KEV) aufgenommen. Es handelt sich um teils sehr alte Schwachstellen, die Angreifer aktuell im Visier haben.
Angriff auf dänisches Melderegister: Zugangspasswort war offenbar 123456
Über einen IT-Dienstleister bekamen Angreifer Zugang zu Dänemarks zentralem Personenregister. Mehrere Konten der Firma waren offenbar nur mit 123456 gesichert.
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
Anthropic on Friday said it's cutting off live internet access for all its internal evaluations until further notice following the discovery of new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior and targeted real websites.
https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.
https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity.
https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
We have to admit it – so much is happening right now (F1, GTA6, breakfast) that we barely have time to lovingly tease our most favoritest vendors.
A Practical Guide to -Plug&Pwn- for Pentesters and Defenders
We-re in 2026 and it is entirely possible for an attacker to hack into a Windows computer using a -simple- USB device. Hollywood screenwriters were right from the start, but we never listened.
https://blog.scrt.ch/2026/10/06/a-practical-guide-to-plugpwn-for-pentesters-and-defenders/
1-click MMI execution in Android
This article describes how vulnerable dialer applications can be exploited to achieve 1-click MMI execution in Android.
https://karansaini.com/mmi-android/
PETKIT: Gaining remote access to smart pet devices/cameras and virtually kidnapping pets through simple API requests
PETKIT products were vulnerable to device takeovers by hackers through simple API requests. This writeup explains the exploit.
https://blog.mgdproductions.com/petkit-vulnerabilities/
Why TLP should not replace your internal information classification, (Sat, Oct 10th)
The Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate whether information may be shared further (and if so, how far).
https://isc.sans.edu/diary/rss/33414
Vulnerabilities
7-Zip 26.04: Sicherheitslücken geschlossen
Das populäre Archivtool 7-Zip ist in der neuen Version 26.04 erschienen. Sie schließt Sicherheitslecks und korrigiert Fehler.
https://www.heise.de/news/7-Zip-Update-stopft-Sicherheitsluecken-11483182.html
GitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances.
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Lesen Sie den originalen Artikel: