End-of-Day report
Timeframe: Mittwoch 08-04-2026 18:00 - Donnerstag 09-04-2026 18:00
Handler: Michael Schlagenhaufer
Co-Handler: n/a
News
PDF öffnen reicht: Ungepatchte Lücke in Adobe Reader seit Monaten ausgenutzt
Angreifer nutzen seit Ende 2025 eine Zero-Day-Lücke in Adobe Reader aus, um Daten abzugreifen und Schadcode einzuschleusen. [..] Der Exploit funktioniert laut Li auch mit der neuesten Adobe-Reader-Version. Adobe soll bereits über die Zero-Day-Lücke informiert worden sein. Bis ein Fix zur Verfügung steht, dürften aber noch ein paar Tage vergehen.
https://www.golem.de/news/pdf-oeffnen-reicht-ungepatchte-luecke-in-adobe-reader-seit-monaten-ausgenutzt-2604-207376.html
13-year-old bug in ActiveMQ lets hackers remotely execute commands
Security researchers discovered a remote code execution (RCE) vulnerability in Apache ActiveMQ Classic that has gone undetected for 13 years and could be exploited to execute arbitrary commands. The flaw was uncovered using the Claude AI assistant, which identified an exploit path by analyzing how independently developed components interact. [..] The researcher reported the vulnerability to Apache maintainers on March 22, and the developer addressed it on March 30 in ActiveMQ Classic versions 6.2.3 and 5.19.4.
https://www.bleepingcomputer.com/news/security/13-year-old-bug-in-activemq-lets-hackers-remotely-execute-commands/
Hackers use pixel-large SVG trick to hide credit card stealer
A massive campaign impacting nearly 100 online stores using the Magento e-commerce platform hides credit card-stealing code in a pixel-sized Scalable Vector Graphics (SVG) image. When clicking the checkout button, the victim is shown a convincing overlay that can validate card details and billing data.
https://www.bleepingcomputer.com/news/security/hackers-use-pixel-large-svg-trick-to-hide-credit-card-stealer/
Nicht nur Veracrypt: Auch VPN-Entwickler von Microsoft ausgesperrt
Offenkundig hat nicht nur der Veracrypt-Entwickler Probleme mit dem Zugriff auf sein Microsoft-Konto. Auch die Entwickler der VPN-Software Wireguard sowie des VPN-Dienstes Windscribe bestätigen auf X, aus ihren Accounts ausgesperrt worden zu sein. [..] Microsoft reagiert.
https://www.golem.de/news/nicht-nur-veracrypt-auch-vpn-entwickler-von-microsoft-ausgesperrt-2604-207360.html
Fileless In-Memory Loader Drops ScreenConnect
In February 2026, Zscaler ThreatLabz discovered an attack chain where attackers used a fake Adobe Acrobat Reader download to lure victims into installing ConnectWise-s ScreenConnect. While ScreenConnect is a legitimate remote access tool, it can be leveraged for malicious purposes. In this blog post, ThreatLabz examines the various stages of this attack, from the download lure to the in-memory loader used to reduce on-disk artifacts that could be used for detection and analysis.
https://www.zscaler.com/blogs/security-research/fileless-memory-loader-drops-screenconnect
Claude Code Can Be Manipulated via CLAUDE.md to Run SQL Injection Attacks
LayerX researchers have discovered how to bypass Claude Code-s safety rules using the CLAUDE.md file. This exploit allows anyone to automate SQL injection attacks and steal user credentials without writing any code.
https://hackread.com/claude-code-claude-md-sql-injection-attacks/
Kommentar: KI-FOMO frisst Sicherheit
KI-Systeme auf Basis großer Sprachmodelle bringen neue Arten von Sicherheitslücken und Risiken mit sich. [..] Doch so wichtig die Diskussion von neuen, vergleichsweise wenig erforschten Sicherheitsproblemen ist: Sie überdeckt leicht, dass KI-Systeme immer auch klassische Software enthalten - in der naturgemäß klassische Sicherheitslücken stecken.
https://heise.de/-11218162
CISA-Notbetrieb: Gehaltszahlungen für vergangene sechs Wochen versprochen
Noch immer ist das US-Heimatschutzministerium im Shutdown-Modus. Nun sollen die Mitarbeiter trotzdem Gehalt für sechs Wochen erhalten.
https://heise.de/-11250415
Unpatchable Vulnerabilities of Kubernetes: CVE-2020-8562
This is an interesting and somewhat subtle network vulnerability, which again shows how difficult it can be to secure the complex networking services provided by Kubernetes. Like our other unpatchable Kubernetes vulnerabilities, it won't be a significant issue for many Kubernetes clusters, but if you're running a managed Kubernetes service, it's definitely one to consider, as attackers might use it to probe your control plane network. In our next post, we'll be looking at the last of the four unpatchable CVEs in Kubernetes, CVE-2021-25740.
https://securitylabs.datadoghq.com/articles/unpatchable-kubernetes-vulnerabilities-cve-2020-8562/
TeamPCP Supply Chain Campaign: Update 007 - Cisco Source Code Stolen via Trivy-Linked Breach, Google GTIG Tracks TeamPCP as UNC6780, and CISA KEV Deadline Arrives with No Standalone Advisory, (Wed, Apr 8th)
This is the seventh update to the TeamPCP supply chain campaign threat intelligence report, "When the Security Scanner Became the Weapon" (v3.0, March 25, 2026). Update 006 covered developments through April 3, including the CERT-EU European Commission breach disclosure, ShinyHunters' confirmation of credential sharing, Sportradar breach details, and Mandiant's quantification of 1,000+ compromised SaaS environments. This update consolidates five days of intelligence from April 3 through April 8, 2026.
https://isc.sans.edu/diary/rss/32880
Number Usage in Passwords: Take Two, (Thu, Apr 9th)
In a previous diary [1], we looked to see how numbers were used within passwords submitted to honeypots. One of the items of interest was how dates, and more specifically years, were represented within the data and how that changed over time. It is often seen that years and seasons are used in passwords, especially when password change requirements include frequenty password changes.
https://isc.sans.edu/diary/rss/32866
Cracks in the Bedrock: Agent God Mode
Our first article about the boundaries and resilience of Amazon Bedrock AgentCore focused on the Code Interpreter sandbox, and how it can be bypassed using DNS tunneling. In this second part, we delve into the identity and permissions model of AgentCore and the AgentCore starter toolkit.
https://unit42.paloaltonetworks.com/exploit-of-aws-agentcore-iam-god-mode/
What we learned about TEE security from auditing WhatsApps Private Inference
WhatsApp-s new -Private Inference- feature represents one of the most ambitious attempts to combine end-to-end encryption with AI-powered capabilities, such as message summarization. To make this possible, Meta built a system that processes encrypted user messages inside trusted execution environments (TEEs), secure hardware enclaves designed so that not even Meta can access the plaintext. Our now-public audit, conducted before launch, identified several vulnerabilities that compromised WhatsApp-s privacy model, all of which Meta has patched.
https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/
Vulnerabilities
Drupal: Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032
https://www.drupal.org/sa-contrib-2026-032
LWN: Security updates for Thursday
https://lwn.net/Articles/1066972/
Google Chrome 147: Update stopft 60 Sicherheitslücken, davon zwei kritische
https://heise.de/-11249800