Tageszusammenfassung - 19.10.2026
End-of-Day report
Timeframe: Freitag 16-10-2026 18:00 - Montag 19-10-2026 18:00 Handler: Guenes Holler Co-Handler: Michael SchlagenhauferNews
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.Exploit-Code geleakt: Plex-Server werden attackiert
Anfang September hatte Plex vor gefährlichen Sicherheitslücken in seiner Media-Server-Software gewarnt und schützende Updates bereitgestellt. Inzwischen liegen weitere Informationen zu den Lücken vor. Zudem hat ein Sicherheitsforscher bereits laufende Angriffe festgestellt. Überraschend ist das nicht, denn der dafür nötige Exploit-Code liegt seit dem vergangenen Wochenende öffentlich auf Github.Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. [..] The flaw is in Broadcom's version of Wi-Fi Protected Setup (WPS), the feature that lets a device join a Wi-Fi network without the password being typed in. Broadcom's code mishandles the reassembly of fragmented WPS setup messages, so an attacker in range can send crafted messages that corrupt the router's memory.https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. [..] According to the threat intelligence platform, the threat actor registered the domain "my-github[.]com" and pointed it at "193.32.204[.]199," the same IP address that's used as an exfiltration endpoint for data harvested from running the malicious workflow.https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
On September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The vulnerability carries a CVSS v3.1 score of 9.8 according to NVD and a CVSS v4.0 score of 9.5 according to the Citrix security bulletin CTX697096. The vulnerability allows unauthenticated attackers to execute arbitrary commands on affected appliances. [..] The analysis in this blog focuses on the exploitation of CVE-2026-88771.AOMEI Backupper update servers hijacked to push malware: Check your PC
Attackers tampered with AOMEI Backupper-s update system to deliver malware that could give them remote access to users- PCs.Klimabonus-Köder und trügerische Sicherheit: Phishing-Welle rollt durch Österreich
Hohe Betrugsraten bei Österreichs Online-Banking-Nutzer. Aktuell warnt das Finanzministerium zusätzlich vor einer massiven Welle an Fake-Nachrichten.Keystrokes in Disguise: Forensic Analysis of a Digispark HID Device
A Digispark may look like a harmless USB development board, but it can easily be turned into a keystroke injection device that behaves like a USB Rubber Ducky. [..] he key difference between a USB Rubber Ducky and a Digispark is where the payload is stored. On a USB Rubber Ducky, it is located on removable storage, such as an SD card. On a Digispark, however, the logic is stored directly on the ATtiny85 microcontroller. From a forensic perspective, this makes analysis more difficult, as there is no easily accessible script file to review. [..] In this article, we show how such a device can be set up, used, and forensically analyzed, from payload execution on a target system to firmware extraction from the ATtiny85 microcontroller.https://blog.nviso.eu/2026/10/16/keystrokes-in-disguise-forensic-analysis-of-a-digispark-hid-device/
Claude Code Desktop Flaw Let Malicious HTML Steal Developer Credentials
Noma Labs found a high-severity Claude Code Desktop flaw that let malicious HTML files steal local credentials and private keys through the preview pane.https://hackread.com/claude-code-desktop-flaw-html-steal-credentials/
Vulnerabilities
Roundcube: Security updates 1.6.20 and 1.7.5 released
We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities.https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5