Timeframe: Donnerstag 12-11-2026 18:00 – Freitag 13-11-2026 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Katharina Siess
News
New N-able "4EverAble2Shell" zero-day exploited hours after PoC released
Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed "4EverAble2Shell" to compromise servers and deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, including 19 running the companys latest security update.
New worm-like SCKit malware targets MSPs in ScreenConnect attacks
A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians computers and compromise additional managed networks.
Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes
Kaspersky experts analyze a recent ransomware incident and discuss why the hypervisor layer remains difficult to monitor, what common access paths adversaries use to reach it, and how to protect your ESXi systems.
https://securelist.com/esxi-ransomware/121959/
Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)
In this diary, I've given a nickname to the macOS infostealer we've been seeing from the Macfinger ClickFix campaign. Based on the analysis of an example posted on the Huntress Cybersecurity Blog, I'm calling this macOS malware DownTheDRAIN infostealer.
https://isc.sans.edu/diary/rss/33518
Supermarkt-Angriffe: Danfoss-Kühlsteuerungen blieben trotz Updates angreifbar
Trotz zahlreicher Vorfälle mit Angriffen auf Steuerungen in Supermärkten und weiteren Angriffsversuchen wie etwa auf eine Blutbank in Frankreich hat der Hersteller es offenbar nicht geschafft, die Probleme vollständig auszuräumen, die die Steuergeräte verwundbar machen. In einer neuen Sicherheitsinformation fordert das Bundesamt für Sicherheit in der Informationstechnik (BSI) die Nutzer derartiger Steuerungen für Kühlanlagen deshalb erneut zum unverzüglichen Handeln auf. Dass das neueste Update mit der Versionsnummer 5.4.0 vom 12. November ebenfalls kompromittiert ist, kann das BSI allerdings nicht ausschließen.
A1-Phishing: Bank- und Kreditkartendaten in Gefahr – und ein Hoppala im letzten Schritt
Eine typische Phishing-Falle im Namen von A1 hat es auf IBAN und Kreditkartendaten abgesehen. Gelingen soll das über eine angeblich notwendige Verifizierung von Kundeninformationen. Im letzten Schritt biegt die Masche allerdings in eine unerwartete – und wohl auch unbeabsichtigte – Richtung ab.
https://www.watchlist-internet.at/news/a1-bank-kreditkartendaten-hoppala/
German parliament passes law giving spy agencies hacking, sabotage powers
In the biggest overhaul of the country-s spy laws of the postwar era, the Bundestag approved the bill by 308 votes to 190 – with 71 abstentions – months after Chancellor Friedrich Merz-s cabinet signed off on the draft.
https://therecord.media/german-parliament-passes-law-giving-spy-agencies-hacking-power
Hackers Abuse Microsoft SQL Servers to Deploy Monero Miner and Gh0st RAT
SEO: Fortinet discovered a campaign where attackers brute-force exposed Microsoft SQL Server installations and abuse T-SQL commands to-
https://hackread.com/hackers-abuse-microsoft-sql-servers-monero-miner-gh0st-rat/
Microsoft-365-Störung: Serverausfälle legen Teams, Exchange und Copilot lahm
Eine Störung bei Microsoft 365 beeinträchtigt weltweit zahlreiche Cloud-Dienste wie Exchange Online, Teams, SharePoint, Copilot und Defender XDR.
Vulnerabilities
Apache HTTP Server patches critical HTTP/2 remote code execution flaw
A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE). [..] Apache describes the problem as -Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.- [..] However, the numbers do not account for server configuration, which requires HTTP/2 to be enabled (default is off).
Check Point: CVE-2026-123039 – Local privilege escalation to root in the DynamicCLI process via local world-writable control socket
Gaia OS dynamic/extended CLI is served by a root process dynamic_server, which listens on a local
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Lesen Sie den originalen Artikel: