„Passwort“ Folge 68: Alte Exploits in neuen Appliances (2026-10-14 07:02 UTC)
Kurz: Die Hosts fragen sich ob vieler altbekannter Bugs, ob sie versehentlich in die Neunziger zurückgereist sind. Immerhin gibt’s echte PKI-Neuigkeiten.
OpenAI engineer arrested for allegedly planting spy device in office (2026-10-13 22:33 UTC)
Kurz: A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company’s San Francisco offices to secretly record sensitive conversations. […]
Ghostscript flaw lets hackers hijack servers via PDF uploads (2026-10-13 21:33 UTC)
Kurz: A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. […]
Anthropic warns self-replicating AI could spread to your smart devices (2026-10-13 21:16 UTC)
Kurz: Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers. …
Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave (2026-10-14 05:52 UTC)
Kurz: Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating sys…
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug (2026-10-14 04:34 UTC)
Kurz: Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in …
OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room (2026-10-14 01:59 UTC)
Kurz: A Saudi National and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the company’s San Francisco offices to covertly record sensitive conversations. Abdulrahman Alfoza…
Kurz: A improper limitation of a pathname to a restricted directory (‘path traversal’) vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.
Kurz: An Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer…
Kurz: An improper neutralization of special elements used in an SQL Command (“SQL Injection”) vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 throu…
Kurz: A improper neutralization of special elements used in an os command (‘os command injection’) vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allo…
Kurz: A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Clou…
Kurz: An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attacker to deny access to …
Kurz: Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi me…