IT‑Sicherheits‑Digest (2026-05-07)

Aktuelle Security‑News

Google Chrome: Update auf Version 148 stopft 127 Sicherheitslücken (2026-05-07 05:52 UTC)
- Kurz: In der Nacht zum Mittwoch hat Google den Chrome-Webbrowser auf den Versionszweig 148 gehievt. Der schließt 127 Sicherheitslücken.
- Quelle: Link
Welt-Passwort-Tag: Passkeys, Mehr-Faktor-Authentifizierung, alles ist besser (2026-05-07 05:30 UTC)
- Kurz: Jeden ersten Donnerstag im Mai ist der Welt-Passwort-Tag. Zeit, sich um bessere Sicherheit zu kümmern.
- Quelle: Link
Apache HTTP Server: Hochriskante Lücken ermöglichen Einschleusen von Schadcode (2026-05-06 11:28 UTC)
- Kurz: Im Apache HTTP Server 2.4.67 stopfen die Entwickler mehrere Sicherheitslücken, die teils das Einschleusen von Schadcode ermöglichen.
- Quelle: Link

Hackers abuse Google ads for GoDaddy ManageWP login phishing (2026-05-06 21:36 UTC)
- Kurz: A phishing campaign delivered through Google sponsored search results is targeting credentials for ManageWP, GoDaddy’s platform for managing fleets of WordPress websites. […]
- Quelle: Link
Critical vm2 sandbox bug lets attackers execute code on hosts (2026-05-06 18:38 UTC)
- Kurz: A critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitrary code on the host system. […]
- Quelle: Link
New Cisco DoS flaw requires manual reboot to revive devices (2026-05-06 18:06 UTC)
- Kurz: Cisco patched a Crosswork Network Controller and Network Services Orchestrator denial-of-service vulnerability that requires manually rebooting targeted systems for recovery. […]
- Quelle: Link

vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution (2026-05-07 04:15 UTC)
- Kurz: A dozen critical security vulnerabilities have been disclosed in the vm2 Node.js library that could be exploited by bad actors to break out of the sandbox and execute arbitrary code on susceptible systems. vm2 is an open-source library used…
- Quelle: Link
Mirai-Based xlabs_v1 Botnet Exploits ADB to Hijack IoT Devices for DDoS Attacks (2026-05-06 20:21 UTC)
- Kurz: Cybersecurity researchers have exposed a new Mirai-derived botnet that self-identifies as xlabs_v1 and targets internet-exposed devices running Android Debug Bridge (ADB) to enlist them in a network capable of carrying out distributed denia…
- Quelle: Link
MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack (2026-05-06 13:00 UTC)
- Kurz: The Iranian state-sponsored hacking group known as MuddyWater (aka Mango Sandstorm, Seedworm, and Static Kitten) has been attributed to a ransomware attack in what has been described as a “false flag” operation. The attack, observed by Rapi…
- Quelle: Link

CVE‑Treffer sind ein Frühwarn‑Check (NVD) und müssen für eure exakten Versionen/Deployments gegengeprüft werden (Vendor Advisory/Patches).