Joel Traber AG

Top news

• TAKTISCH ZDI: Published Advisories
  ZDI-26-777: Adobe Photoshop AdobePDFL PDF JPEG Parsing Integer Overflow Remote Code Execution Vulnerability

  The ZDI advisory provides technical details and a CVSS score of 7.8 for an integer overflow vulnerability in Adobe Photoshop, for which no active exploitation has been documented so far.

  → The vulnerability affects Adobe Photoshop, a product present in the company's tech stack, and allows remote code execution with user interaction.

• TAKTISCH ZDI: Published Advisories
  ZDI-26-665: Adobe Acrobat Reader DC Annots Report Use-After-Free Remote Code Execution Vulnerability

  This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  → The vulnerability affects Adobe Acrobat Reader DC, which is part of the company's tech stack, and allows remote code execution with user interaction.

• TAKTISCH The Hacker News
  PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

  Beyond a mere patch: a previously unknown, memory-resident ARM64 malware strain called PEERSTITCH is being actively delivered via a FortiOS flaw to tagged VPN sessions.

  → The vulnerability affects FortiOS, which is in use at the company via FortiGate/FortiClient, and is already being actively exploited.

• TAKTISCH ZDI: Published Advisories
  ZDI-26-669: Adobe Acrobat Reader DC JBIG2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

  The low CVSS score of 3.3 and the required user interaction limit the risk; no active exploit is known.

  → The vulnerability affects Adobe Acrobat Reader DC, which is in use at the company, but it has a low CVSS score and requires user interaction.

• TAKTISCH SecurityWeek
  Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

  The October Patch Tuesday includes CVE-2026-96951, an already actively exploited Windows security bypass, but the report provides no details on attacks, TTPs, or affected sectors.

  → The alert concerns Microsoft Windows vulnerabilities patched in October 2026, including an actively exploited zero-day, directly affecting the company's Microsoft-based environment.

• TAKTISCH The Hacker News
  China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

  The actor uses zero-days selectively against chosen targets and shifts to broad exploitation of all reachable instances once the flaw becomes public , a pattern that underscores the urgency of compromise assessments and prompt patching.

  → BeyondTrust Remote Support is not in the company's stack, but it belongs to the same class of remote-support/remote-access tooling as the TeamViewer and Microsoft Remote Desktop Gateway products the company does use.

• TAKTISCH The Hacker News
  Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

  The report documents that a China-linked actor (Flax Typhoon) is actively exploiting vulnerabilities that CISA classifies as exploited in the wild , this is more than a patch note and points to ongoing state-sponsored attacks against exposed infrastructure.

  → ProFTPD vulnerabilities (e.g. CVE-2015-3306) can affect Linux-based servers such as Ubuntu, but the alert primarily describes a China-linked APT targeting US federal agencies rather than DACH manufacturing environments.

• OPERATIV ZDI: Published Advisories
  ZDI-26-620: Microsoft Windows UMPDDrvPlgBlt Improper Object Management Local Privilege Escalation Vulnerability

  Local privilege escalation in a Windows driver that can only be exploited after prior code execution.

  → The vulnerability affects Microsoft Windows, which is part of the company's core IT infrastructure, and allows local privilege escalation.

• OPERATIV ZDI: Published Advisories
  ZDI-26-622: Microsoft Windows IKEv2 AES-GCM Decryption Integer Underflow Remote Code Execution Vulnerability

  The report describes a new, unauthenticated RCE vulnerability in Windows IKEv2 that is only exploitable under specific IPsec configurations.

  → Microsoft Windows is part of the company's tech stack, and IKEv2/IPsec is used for VPN connections, making this remote code execution vulnerability operationally relevant.

• OPERATIV ZDI: Published Advisories
  ZDI-26-571: Linux Kernel Net Scheduler Packet Classifier API Use-After-Free Local Privilege Escalation Vulnerability

  New vulnerability in the Linux kernel allows local privilege escalation; affects all distributions with the affected kernel.

  → The Linux kernel vulnerability affects Ubuntu 24.04 LTS, which is part of the company's server infrastructure.

• TAKTISCH Unit 42
  Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

  The report describes PEERSTITCH, a new stealthy implant on FortiGate devices delivered via the FortiManager flaw CVE-2024-47575, turning an already KEV-listed vulnerability into persistent edge compromise.

  → The implant abuses CVE-2024-47575 in FortiManager/FortiGate infrastructure, which is part of the company's edge security stack and a known target of state-linked espionage actors.

• UNIT 42 14/10/2026
  Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

  The report describes PEERSTITCH, a stealthy implant targeting FortiGate firewalls. It is deployed by exploiting the critical vulnerability CVE-2024-47575 in FortiManager and abuses legitimate functions to remain undetected. Attackers can maintain persistent command-and-control communication. Organizations such as Joel Traber AG in the DACH manufacturing sector should apply patches and monitor their network perimeter.

• UNIT 42 14/10/2026
  Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

  Unit 42 has discovered a stealthy implant called PEERSTITCH that targets FortiGate devices. It is associated with the CVE-2024-47575 vulnerability in FortiManager and allows attackers to maintain persistent access while evading detection. For Joel Traber AG, a manufacturing company in the DACH region, there is an elevated risk if affected systems are not patched promptly. Organizations should apply patches and scan for indicators of compromise.

• PROJECT ZERO 21/09/2026
  Windows Exploitation Techniques: Dangling COM Object Registrations

  The report describes CVE-2026-66804 as an incomplete fix for a Windows LPE vulnerability, with a public exploit leveraging a dangling COM registration.