Tageszusammenfassung - 28.10.2026
End-of-Day report
Timeframe: Dienstag 27-10-2026 18:00 - Mittwoch 28-10-2026 18:00 Handler: Guenes Holler Co-Handler: Alexander RieplNews
Code-execution flaw in UEFI firmware affects most servers on planet Earth
Critical flaw in EDK2 allows attackers to execute code early in the boot process.Microsoft releases Windows OOB updates to distrust eMudhra certificates
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates.Hackers hijack Convertr analytics script to steal payment card data
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers payment data during checkout.InfraTrust report warns of exploited flaws in critical network infrastructure
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk.ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week.Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root ..https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Googles Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability inhttps://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html
Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass
Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation.The list of eight vulnerabilities ..https://thehackernews.com/2026/10/adobe-fixes-8-critical-campaign-classic.html
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle ..https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems.The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to ..https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html
Microsoft Authenticator: Bösartige Apps konnten Zugangstoken abgreifen
Microsoft hat im Authenticator eine Sicherheitslücke geschlossen, durch die bösartige Apps hätten Zugangstoken abgreifen können.Vermeintliche ÖGK-Phishing-Warnung ist in Wahrheit eine Phishing-Falle
Die Österreichische Gesundheitskasse zählt zu den am häufigsten als Deckmantel verwendeten Institutionen des Landes, Warnungen vor den unzähligen Betrugsmaschen im Namen der ÖGK werden im Wochenrhythmus veröffentlicht. Diesen Umstand nutzen nun Kriminelle. Sie versenden Phishing-Nachrichten, in denen vor Phishing-Nachrichten gewarnt wird.https://www.watchlist-internet.at/news/oegk-phishing-warnung-falle/
Moldova investigates possible foreign involvement in major government cyberattack
Prime Minister Vasile Tofan said the incident may be part of a broader campaign targeting both citizens personal data and government digital infrastructure, according to local media reports.https://therecord.media/moldova-investigates-possible-foreign-involvement-cyberattacks
Silent Train: Volt Typhoon-s Sophisticated Infection Chain into US Targets Exposed
For years, government officials have described Volt Typhoon intrusions into US critical infrastructure as highly sophisticated, while providing few details to support the claim. Today, security researchers finally reveal some of the sophisticated tactics the Chinese group uses.Scanner Poses as 32 AI Bots to Find Credentials and Private Keys
A scanner impersonates 32 AI bots, including OpenAI and Claude crawlers, to search websites for exposed credentials, private keys and cloud configuration files.https://hackread.com/hackers-impersonate-ai-bots-hunt-exposed-credentials/
Angreifer können Veeam-Backup-Server manipulieren und MFA deaktivieren
Es sind wichtige Sicherheitsupdates für Veeam Backup & Replication und ONE erschienen. Bislang gibt es keine Hinweise auf laufende Attacken.Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets
Socket-s Threat Research Team identified a cluster of malicious Firefox extensions that impersonate well-known crypto wallets and steal recovery phrases and private keys. The extensions use Unicode homoglyphs to copy the names of Phantom, Jupiter, and Bitget, and they route stolen secrets to brand-named subdomains of a single ..https://socket.dev/blog/firefox-wallet-impersonators
Vulnerabilities
Security Vulnerabilities fixed in Thunderbird 153.6
https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/