Joel Traber AG

Top news

• TAKTISCH ZDI: Published Advisories
  ZDI-26-661: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

  Exploitation strictly requires user interaction (opening a crafted document or visiting a malicious page); the advisory contains no indication of active exploitation in the wild.

  → Adobe Acrobat Reader DC is part of the company's standard software stack, and a 7.8-rated use-after-free allowing remote code execution is directly patchable on affected endpoints.

• TAKTISCH The Hacker News
  Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

  The report links the addition of five vulnerabilities to the CISA KEV catalog with active exploitation by the China-linked APT Flax Typhoon, indicating a state-sponsored attack campaign.

  → The alert describes active exploitation of ProFTPD and other flaws by a China-linked APT, with CISA KEV inclusion, relevant to organizations running Linux/Unix services and facing nation-state threats.

• OPERATIV ZDI: Published Advisories
  ZDI-26-619: Microsoft Windows UMPDDrvStretchBltROP Improper Object Management Local Privilege Escalation Vulnerability

  This is a Microsoft Windows local privilege escalation with a CVSS of 7.8 for which no active exploitation in the wild has been reported so far; the advisory therefore essentially provides patch-relevant information.

  → The vulnerability affects Microsoft Windows and enables local privilege escalation, directly impacting the Windows server and client systems in use at the company.

• OPERATIV ZDI: Published Advisories
  ZDI-26-622: Microsoft Windows IKEv2 AES-GCM Decryption Integer Underflow Remote Code Execution Vulnerability

  An unauthenticated attacker can execute code on Windows systems with specific IPsec configurations via crafted IKEv2 packets , a rare but severe attack vector against VPN endpoints.

  → The vulnerability affects Microsoft Windows, which is the core server and client platform across the company's environment, and IPsec/IKEv2 is relevant to its FortiGate/FortiClient VPN deployments.

• OPERATIV ZDI: Published Advisories
  ZDI-26-571: Linux Kernel Net Scheduler Packet Classifier API Use-After-Free Local Privilege Escalation Vulnerability

  A local LPE in the Linux kernel can enable lateral movement in multi-stage attacks.

  → The vulnerability affects the Linux kernel, which is part of the company's Ubuntu 24.04 LTS stack.

• INFORMATIV ZDI: Published Advisories
  ZDI-26-605: Microsoft Windows Localized Filenames Improper Input Validation NTLM Response Information Disclosure Vulnerability

  ZDI reports a vulnerability in Windows that can disclose NTLM responses through localized filenames, but only with user interaction and a low CVSS.

  → Directly affects Microsoft Windows, a core component of the company's IT infrastructure, though exploitation requires user interaction and severity is low.

• OPERATIV Project Zero
  Windows Exploitation Techniques: Dangling COM Object Registrations

  A public working exploit shows that CVE-2026-66804 is only an incomplete fix of the 'Dark Elevator' COM registration bug (CVE-2026-50343), so dangling CLSID entries under HKEY_CLASSES_ROOT must be re-verified for completeness.

  → Public, fully working local privilege-escalation exploit for Windows COM registrations that affects any unpatched Windows Server 2019/2022 and Windows endpoint in the environment.

• OPERATIV Microsoft Security Blog
  Storm-3168: Agentic-driven cloud attacks using compromised service principals

  The report shows that automated agents use compromised service principals for Azure resource destruction and credential collection , an attack path beyond classic endpoint ransomware.

  → The campaign abuses compromised Azure service principals and cloud credentials, directly touching the Microsoft Entra ID / Microsoft 365 / Azure identity surface used by the company.

• PROJECT ZERO 21/09/2026
  Windows Exploitation Techniques: Dangling COM Object Registrations

  A public working exploit shows that CVE-2026-66804 is only an incomplete fix of the 'Dark Elevator' COM registration bug (CVE-2026-50343), so dangling CLSID entries under HKEY_CLASSES_ROOT must be re-verified for completeness.

• MICROSOFT SECURITY BLOG 25/09/2026
  Storm-3168: Agentic-driven cloud attacks using compromised service principals

  Microsoft Security Research identified malicious cloud activity attributed to Storm-3168, also known as JADEPUFFER, which is reported as the first documented agentic ransomware operation. The threat actor used compromised service principals to perform bulk destructive actions against Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, Virtual Machines, and App Services. Two compromised service principals from the same tenant were observed: one conducted extensive reconnaissance, while the other performed discovery, destruction, and cloud credential collection. The report highlights a broader shift toward AI-orchestrated attacks and recommends protecting workload identities and secrets, enforcing least privilege, safeguarding recovery resources, and enabling Microsoft Defender for Cloud.

• SECURELIST 21/09/2026
  Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

  In April 2026, Kaspersky's Global Emergency Response Team investigated a security incident at a manufacturing organization in the Middle East. The attackers gained domain admin-equivalent control over Active Directory and created a malicious Group Policy Object named PAYLOAD, linked at the domain root. Through this GPO, they delivered ransom notes, hijacked desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account on all domain-joined Windows workstations. No ransomware was deployed or data encrypted on Windows; only a PAYLOAD sample targeting ESXi on Linux servers was found, and data exfiltration occurred with later publication on the dark web.