Situational news & topics
Current cyber situation from curated feeds
Aggregated from BSI Bürger-CERT, BSI WID, SANS NewsBites, Krebs on Security, The Hacker News and the Allianz für Cyber-Sicherheit.
- Newsdarkreading
Social Engineering AI Agents: The New BEC for 2026
As AI agents gain authority over business systems, attackers can manipulate them like business email compromise (BEC) victims.
2026-10-09 13:00 UTC - Newscsoonline
Exposed Nvidia GPU monitors can reveal AI infrastructure secrets
A component of Nvidia’s GPU monitoring software that enterprises use to keep tabs on their AI training and inference infrastructure has been vulnerable to denial-of-service (DoS) and information disclosure attacks. The Nvidia DCGM Exporter contains an unauthenticated resource…
2026-10-09 12:35 UTC2 CVEs - Newsbleepingcomputer
Max severity SonicWall SMA1000 flaw now exploited in attacks
Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. [...]
2026-10-09 12:32 UTC3 CVEs - Newsthehackernews
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon. The vulnerabilities in question are listed…
2026-10-09 12:21 UTC2 CVEs - Newssecurityweek
In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
Noteworthy stories that might have slipped under the radar: Tensorlake npm SDK compromised, Empire Market co-founder gets 40 years, exposed NVIDIA GPU monitors leak telemetry. The post In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years…
2026-10-09 12:03 UTC - Newssecurityweek
Google Domains Impacted by Recent ccTLD Hijacks
Hackers hijacked the .gh, .sl, and .as ccTLDs and obtained HTTPS certificates for several Google domains. The post Google Domains Impacted by Recent ccTLD Hijacks appeared first on SecurityWeek .
2026-10-09 11:43 UTC
Editorial
From the blog
Microsoft Patchday September 2026: 974 Schwachstellen, zwei aktiv ausgenutzt
Microsoft schließt im September einen Rekordzyklus. Je nach Quelle sind es 966, 970, 972, 974 oder über 1.100 Schwachstellen. Keine dieser Zahlen ist falsch, und keine beantwortet die Frage, die im Betrieb zählt.
MicrosoftPatchdayStyleSmuggler (CVE-2026-75650): Patchen allein reinigt keinen Magento-Shop
Adobe hat am 7. September einen Notfall-Hotfix für eine Magento-Lücke mit CVSS 10.0 veröffentlicht. Angegriffen wurde bereits seit dem 4. September. Wer jetzt nur patcht und den Vorgang abhakt, übersieht den entscheidenden Teil.
MagentoAdobe CommerceSAP Patchday September 2026: CVSS 10.0 im Kernel, kein Workaround
SAP schließt am 8. September 17 Schwachstellen, vier davon kritisch. Die schwerste erreicht CVSS 10.0, ist vorauthentifiziert ausnutzbar und lässt sich nicht abschalten. Der Fix verlangt einen Kernel-Austausch — und damit ein Wartungsfenster, das Wochen entfernt liegt.
SAPPatchday
Latest priority advisories
Ranked by priority score — KEV, EPSS, CVSS, recency and CPE relevance.
CVE-2025-8088
[KEV] [high] Security update for clamav
Security update for clamav This update for clamav fixes the following issues: - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597). - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598). - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599). - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600). - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601). - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602). - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603). - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside the notebook directory (bsc#1271922). - CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows. Changes for clamav: Update to 1.5.4: * Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses. * FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races. * Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment. * Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.
CVE-2026-12569
[KEV] [critical] PTC FlexPLM: Schwachstelle ermöglicht Codeausführung
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
CVE-2026-41940
[KEV] [critical] WebPros cPanel & WHM and WP2 (WordPress Squared) — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CVE-2026-50751
[KEV] checkpoint gaia_embedded: unzureichende Authentifizierung
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.