Tageszusammenfassung - 20.10.2026
End-of-Day report
Timeframe: Montag 19-10-2026 18:00 - Dienstag 20-10-2026 18:00 Handler: Katharina Siess Co-Handler: Guenes HollerNews
TeamUpdraft security incident: What customers need to know
Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website. Our team responded straight away and worked through the night to contain it - we closed the access route, signed out every account and replaced the keys and credentials that could have been affected. This page explains what happened, what we have already done to protect you, and the steps to take for each of our products.https://teamupdraft.com/blog/security-incident-october-2026/
Die Testphase für Amazon-Prime endet in 72 Stunden? Vorsicht, Phishing-Falle!
Der Absendername wirkt vertrauenswürdig, die Grafik höchst offiziell, der Ton ist freundlich. Angeblich endet die Testphase für ein Amazon-Prime-Abo in 72 Stunden, danach erfolgt die automatische Umwandlung in ein Zwei-Jahres-Abo. Will man diese verhindern, müsse man aktiv kündigen. Das Problem: Das Abo gibt es gar nicht. Die E-Mail und die dazugehörige Website wurden als Phishing-Falle konzipiert, die Kreditkartendaten abgreifen soll.https://www.watchlist-internet.at/news/testphase-amazon-prime-phishing/
OVHcloud CLI releases backdoored on GitHub to steal developer secrets
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware.Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware
Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader.https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html
ICANN testing tech to let law enforcement access non-public WHOIS info
Single sign-on to help address imminent threats to life, critical infrastructure, or kids.PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites
TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information. The post PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites appeared first on Wordfence.https://www.wordfence.com/blog/2026/10/updraftcentral-connection-key-compromise/
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)
October 19 Update: Unit 42 continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc). We-re also aware of public reporting attributing exploitation to threat actors using Settra ransomware.https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
subfinder - Passive Subdomain Enumeration Tool
Point subfinder at a domain and it asks dozens of online sources which hostnames they have seen under it, without sending a packet to the target itself. I ran the new 2.17.0 release against this site with no API keys. It returned 17 subdomains in 14 seconds, and when I looked them up in DNS on 13 October, only one resolved.https://www.darknet.org.uk/2026/10/subfinder-passive-subdomain-enumeration-tool/
MacOS Infostealer -adapts- to new Keychain Protection
A recent sample I-ve analyzed changed it-s behaviour depending on the macOS version it is running on.https://pberba.github.io/security/2026/10/20/amos-keychain/
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns
Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys.https://thehackernews.com/2026/10/go-issues-emergency-update-blocking.html
WordPress SEO plugin Rank Math compromised to backdoor websites
Some downloads of the Rank Math PRO WordPress plugin from the vendors official website carried malware that planted hidden backdoors in a supply-chain attack last week.Vulnerabilities
Werbeblocker Pi-hole: Update stopft Befehlsschmuggel-Lücke und mehr
Der Werbeblocker Pi-hole bessert mit einem Update zahlreiche Schwachstellen aus. Nutzerinnen und Nutzer sollten es rasch anwenden.Schwachstelle CVE-2026-109390 (CVSS v3.1 9.8) im AnyDesk-Client für Linux
Ich stelle mal eine Information hier ein, auf die ich nun von zwei Blog-Lesern hingewiesen wurde. Im AnyDesk-Client für Linux gibt es eine kritischen Schwachstelle CVE-2026-109390, die mit einem CVSS 3.1 Base Score von 9.8 bewertet wurde.eMudhra Intermediate CA Compromise
The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores. Users should update their browsers and operating systems to the latest versions as soon as possible.https://emudhra.we-have-a-problem.com/
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
"The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path," Siemens said in an advisory. "This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application." The issue has been patched in version 4.0.9.8. Huntress Labs researcher Jose Oregon has been credited with discovering and reporting the shortcoming.https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html
LWN Security updates for Tuesday
https://lwn.net/Articles/1101617/
TYPO3 Security Advisories 20.10.2026
https://news.typo3.com/security/
Security Vulnerabilities fixed in Firefox ESR 115.43.1
https://www.mozilla.org/en-US/security/advisories/mfsa2026-113/
Security Vulnerabilities fixed in Firefox ESR 153.5.1
https://www.mozilla.org/en-US/security/advisories/mfsa2026-112/
Security Vulnerabilities fixed in Firefox 158.0.1
https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/