IT‑Sicherheits‑Digest (2026-06-11)

Aktuelle Security‑News

OpenSSL: Präparierte Signatur kann Weg für Schadcode ebnen (2026-06-11 07:52 UTC)
- Kurz: In aktuellen Versionen haben die OpenSSL-Entwickler insgesamt 18 Sicherheitslücken geschlossen.
- Quelle: Link
Oracle warnt außer der Reihe vor kritischer PeopleSoft-Codeschmuggel-Lücke (2026-06-11 06:05 UTC)
- Kurz: Oracle schließt außerhalb der üblichen Zeitpläne mit einem Update eine kritische Codeschmuggel-Lücke in PeopleSoft.
- Quelle: Link
E-Mail-Fälschung bei Exchange Online: Ghost-Sender betrifft viele Unternehmen (2026-06-10 14:58 UTC)
- Kurz: Nicht alle Unternehmenskunden von Microsofts Maildienst sind betroffen. Ein Prüfdienst schafft Klarheit und zeigt die möglichen Auswirkungen.
- Quelle: Link

Nottingham University data breach affects over 450,000 students (2026-06-11 07:27 UTC)
- Kurz: The University of Nottingham confirmed on Wednesday that a hacking group gained access to its student records system in a breach affecting both current students and alums. […]
- Quelle: Link
Max severity Ivanti Sentry vulnerability now exploited in attacks (2026-06-11 06:20 UTC)
- Kurz: Attackers are now targeting a recently patched maximum-severity flaw in Ivanti Sentry, enabling them to execute code with root privileges on Internet-exposed secure mobile gateways. […]
- Quelle: Link
Path traversal flaw in AI dev platform Langflow exploited in attacks (2026-06-10 21:23 UTC)
- Kurz: Attackers are actively exploiting CVE-2026-5027, a high-severity path traversal vulnerability in the AI development platform Langflow, to write arbitrary files on exposed servers. […]
- Quelle: Link

GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks (2026-06-11 06:23 UTC)
- Kurz: GitHub has announced what it said are “breaking changes” coming to npm version 12, one of which turns off install scripts by default to combat software supply chain threats. The changes aim to combat attack techniques that abuse the “npm in…
- Quelle: Link
China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance (2026-06-10 16:08 UTC)
- Kurz: Cybersecurity researchers have warned of a “resurgence and expansion” of JDY, a covert network associated with China-nexus state-sponsored threat actors. “The JDY botnet comprises over 1,500 SOHO [small office and home office] and IoT devic…
- Quelle: Link
Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities (2026-06-10 15:10 UTC)
- Kurz: Fortinet, Ivanti, and SAP have released security updates to address multiple critical security vulnerabilities that could result in arbitrary code execution and information disclosure. The security flaw patched by Fortinet relates to a comm…
- Quelle: Link

CVE-2026-53475 — CVSS 9.3 (CRITICAL)
- Kurz: A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connections when communicating with vCenter. This vulnerability allows a Man-in-the-Middle (MITM) attacker t…
- Quelle: Link

CVE‑Treffer sind ein Frühwarn‑Check (NVD) und müssen für eure exakten Versionen/Deployments gegengeprüft werden (Vendor Advisory/Patches).
News-Auswahl: nur frische Meldungen aus den letzten 36 Stunden; Dubletten aus dem Vortags-Digest werden ausgeblendet.