IT‑Sicherheits‑Digest (2026-09-20)

Aktuelle Security‑News

Gefälschte GitHub-Repositorys: Neue Infostealer-Variante (2026-09-19 15:40 UTC)
- Kurz: Gefälschte GitHub-Repositorys sollen Opfer zum Download bewegen. Ein Infostealer arbeitet mit Signaturen aus Microsofts Hardware-Kompatibilitäts-Programm.
- Quelle: Link
Fehlkonfiguration im Test: Gemini greift auf drei echte Firmen zu (2026-09-19 10:02 UTC)
- Kurz: Eine Fehlkonfiguration gab Gemini in einem Cybertest Internetzugang. Die KI griff auf Systeme dreier Firmen zu und brach laut Google jeweils ab.
- Quelle: Link

BragJack attacks hijack AI browser agents through malicious extensions (2026-09-19 14:56 UTC)
- Kurz: BragJack, a proof-of-concept attack from Forever Security’s Gal Weizman, hijacks the AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome using one malicious extension. The Prompt Forcing technique earned over $…
- Quelle: Link
North Korean WaterPlum hackers infected 30,000 devices worldwide (2026-09-19 14:05 UTC)
- Kurz: A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to Nort…
- Quelle: Link
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang (2026-09-19 13:48 UTC)
- Kurz: The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation’s data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service. […]
- Quelle: Link

Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws (2026-09-19 18:36 UTC)
- Kurz: Three researchers at the security firm Hacktron used Anthropic’s Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository. The chain began with …
- Quelle: Link
Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar (2026-09-19 13:28 UTC)
- Kurz: A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited in your environment? Mythos-class AI is compressing the time between disclosure an…
- Quelle: Link
Identity Visibility in 2026: The Foundation of Identity Security (2026-09-19 13:28 UTC)
- Kurz: Identity visibility is a starting point for modern identity security, because stolen and misused credentials are among the most frequently reported initial access vectors in breach research, including Verizon’s annual Data Breach Investigat…
- Quelle: Link

CVE‑Treffer sind ein Frühwarn‑Check (NVD) und müssen für eure exakten Versionen/Deployments gegengeprüft werden (Vendor Advisory/Patches).
News-Auswahl: nur frische Meldungen aus den letzten 36 Stunden; Dubletten aus dem Vortags-Digest werden ausgeblendet.