Adobe PDF: Zero-Day seit Monaten angegriffen

Wieder einmal hat Adobe mit Acrobat etc. der Welt ein zweifelhaftes Geschenk gemacht. In den Produkten Acrobat DC, Acrobat Reader DC und Acrobat 2024 für Windows und macOS steckte eine öffentlich bisher nicht bekannte Sicherheitslücke, die mindestens seit dem vorigen November für Angriffe ausgenutzt wird (Zero-Day Exploit). Entdeckt wurde die Lücke CVE-2026-34621 im März. In der Meldung steht noch, dass es keinen Flicken gäbe. Das stimmt nicht mehr; Adobe hat gerade Updates veröffentlicht. Für einen Angriff reicht es aus, dem Opfer ein präpariertes PDF unterzuschieben. Außer das PDF

https://www.pc-fluesterer.info/wordpress/2026/04/14/adobe-pdf-zero-day-seit-monaten-angegriffen/

#Allgemein #Empfehlung #Hintergrund #Warnung #0day #cybercrime #exploits #pdf #sicherheit #spionage #trojaner #UnplugTrump #adobe

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CVE-2012-1854 Visual Basic for Applications Insecure Library Loading

CVE-2020-9715 Adobe Acrobat Use-After-Free

CVE-2023-21529 Microsoft Exchange Deserialization of Untrusted

CVE-2023-36424 Microsoft Windows Out-of-Bounds Read

CVE-2025-60710 Microsoft Windows Link Following

CVE-2026-21643 Fortinet SQL Injection

CVE-2026-34621 Adobe Acrobat Reader Prototype

https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog

#cybersecurity #cisa #adobe #microsoft

Critical wolfSSL flaw (CVE-2026-5194) allows digital ID forgery across billions of devices. Update to version 5.9.1 to fix the issue and reduce risk

Read: https://hackread.com/wolfssl-vulnerability-iot-routers-military-systems/

#CyberSecurity #Vulnerability #wolfSSL #IoT

CVE-2026-5194 : quand un bug dans wolfSSL valide des certificats falsifiés https://www.it-connect.fr/cve-2026-5194-quand-un-bug-dans-wolfssl-valide-des-certificats-falsifies/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Web

ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers

https://thehackernews.com/2026/04/showdoc-rce-flaw-cve-2025-0520-actively.html

Read on HackerWorkspace: https://hackerworkspace.com/article/showdoc-rce-flaw-cve-2025-0520-actively-exploited-on-unpatched-servers

#cybersecurity #vulnerability #exploit

Critical Marimo Python Notebook Zero-Day (CVE-2026-39987) Exploited Within 10 Hours of Disclosure
#CyberSecurity
https://securebulletin.com/critical-marimo-python-notebook-zero-day-cve-2026-39987-exploited-within-10-hours-of-disclosure/

Anthropic built an AI model called Mythos that autonomously found a 17-year-old remote code execution vulnerability in FreeBSD. No human involvement after the initial prompt. It found thousands more zero-days across every major OS and browser, some hiding for decades. Anthropic says it's too dangerous to release publicly, so they gave it to AWS, Microsoft, Apple, Google, CrowdStrike, and a handful of others under a new initiative called Project Glasswing. $100M in usage credits to go fix things before similar capabilities go wide.

Impressive, but worth some skepticism. Bruce Schneier pointed out this is also a very effective PR play. A security firm called Aisle replicated many of the same findings using older, cheaper, publicly available models. The gap between "too dangerous to release" and "already achievable with what's out there" may be thinner than the headlines suggest.

🔒 Mythos autonomously discovered and exploited a FreeBSD RCE that had been present for 17 years (CVE-2026-4747)
🔗 It chains 3-5 vulnerabilities together into multi-step attack sequences
📊 Over 99% of the vulnerabilities found are still unpatched, so we're trusting Anthropic's claims on scope
💰 $25/$125 per million input/output tokens for partners, if you're on the list

Meanwhile, the advice cybersecurity experts are giving the rest of us: update your software, use MFA, get a password manager. The most advanced AI vulnerability scanner ever built, use off-line (truly air-gapped) backups, and basic hygiene is still the best defense most people have.

https://www.crn.com/news/security/2026/5-things-to-know-on-anthropic-s-claude-mythos-and-project-glasswing
#CyberSecurity #AI #ProjectGlasswing #security #privacy #cloud #infosec

FreeBSD CVE-2026-4747 Log Suggests Mythos is a Marketing Trick https://www.flyingpenguin.com/freebsd-cve-2026-4747-log-suggests-mythos-is-a-marketing-trick/

Red Hat published RHSA-2026:7381 for CVE-2026-4631. The flaw is unauthenticated remote code execution in Cockpit. Cockpit is the default web console on RHEL 9, RHEL 10, Rocky, and AlmaLinux. CVSS 9.8. Cockpit passes hostnames and usernames from the browser straight to SSH, before any password check. One HTTP request to the login page runs commands as the server. Default on, web-facing, unauthenticated. Patch this week.

#Linux #CyberSecurity #RHEL #SysAdmin

@canartuc Ouch.
https://nvd.nist.gov/vuln/detail/CVE-2026-4631

🔴 CRITICAL: CVE-2026-6264 affects Talend JobServer 8.0 & 7.3. Unauthenticated RCE via JMX port — patch immediately or require TLS client auth for mitigation. Disable JMX in Runtime if possible. Details: https://radar.offseq.com/threat/cve-2026-6264-cwe-306-missing-authentication-for-c-26a424cb #OffSeq #Talend #Vuln #RCE #Infosec

🚨 Composer 2.9.6 and 2.2.27 are out with fixes for CVE-2026-40261 and CVE-2026-40176, both command injection issues in the Perforce driver. Run composer self-update now. No exploitation detected on Packagist.org and Private Packagist. Details on our blog: https://blog.packagist.com/composer-2-9-6-perforce-driver-command-injection-vulnerabilities/ #php #phpc #composerphp