Joel Traber AG

Top news

• TAKTISCH SecurityWeek
  Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

  A low-severity ESXi logging flaw was exploited as a zero-day by a China-nexus actor , the low severity rating says nothing about its operational value for concealing attacker activity.

  → The exploited zero-day is a VMware ESXi logging flaw (CVE-2026-41709), a virtualization platform directly present in the company's vSphere/ESXi environment.

• TAKTISCH SecurityWeek
  TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians' Machines

  The flaw reverses the remote-support threat model: instead of the technician reaching into a foreign system, a malicious host can gain control of the support engineer's own machine.

  → TeamViewer is part of the company's remote-support toolchain, so a remote code execution flaw in the viewer component directly affects the IT staff who use it.

• TAKTISCH The Hacker News
  Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

  An app with no permissions at all can pose as a trusted Microsoft application such as Teams and harvest sign-in tokens for work accounts , stealing valid tokens this way bypasses multi-factor authentication entirely.

  → The flaw affects Microsoft Authenticator for Android, which is used for sign-in alongside Microsoft 365 and Entra ID; token theft enables takeover of work accounts.

• TAKTISCH The Hacker News
  China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

  What matters here is less the low CVSS score of 2.7 than the fact that a state-sponsored actor deliberately used this logging gap as a zero-day to erase audit trails and conceal its persistence on edge devices.

  → The flaw affects VMware ESX/ESXi, which is part of the company's virtualization stack, and is under active exploitation by a China-nexus APT.

• TAKTISCH ZDI: Published Advisories
  ZDI-26-674: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability

  The flaw requires user interaction and has no known in-the-wild exploitation at present; it is primarily addressed by promptly patching Reader DC and Acrobat.

  → Adobe Acrobat Reader DC and Adobe Acrobat are in use at the company; an out-of-bounds write flaw rated CVSS 7.8 enables code execution and requires only that a crafted file be opened.

• TAKTISCH ZDI: Published Advisories
  ZDI-26-678: Adobe Photoshop DCM File Parsing Integer Overflow Remote Code Execution Vulnerability

  This is a pure ZDI advisory with no indication of active exploitation; exploitation requires a user to open a crafted DCM file.

  → Adobe Photoshop is part of the company's creative toolchain, and a parsed-file integer overflow allows code execution in the context of the logged-on user.

• TAKTISCH The Hacker News
  Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

  What is remarkable is not the flaw itself but that an AI model produced a working root exploit for it from a short prompt, drastically shortening the gap between disclosure and weaponisation.

  → Ubuntu 24.04 LTS is part of the server estate and the flaw allows an unauthenticated remote attacker to gain root on Linux hosts running a multipath TCP listener, with no fixed kernel available from Ubuntu or Red Hat as of October 29.

• TAKTISCH Securelist
  How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

  By reviving BlackLotus, APT41 shows that an older Secure Boot bypass remains viable for long-term state-sponsored compromise,an indication of persistent UEFI attack surfaces beyond conventional malware.

  → APT41's revival of the BlackLotus bootkit exploits a Windows Secure Boot flaw and demonstrates a nation-state technique relevant to Windows environments, though the observed targeting is diplomatic organizations in Central Asia.

• OPERATIV ZDI: Published Advisories
  ZDI-26-694: Linux Kernel Net Scheduler Clsact Qdisc Use-After-Free Local Privilege Escalation Vulnerability

  The report adds patch information about a local kernel vulnerability with a high CVSS score, but exploitation requires prior high-privileged access.

  → The vulnerability affects the Linux kernel used by Ubuntu 24.04 LTS servers, though exploitation requires prior high-privileged code execution.

• INFORMATIV ZDI: Published Advisories
  ZDI-26-751: Microsoft Windows dxgkrnl Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

  The vulnerability is not remotely exploitable, but after prior code execution it can significantly elevate privileges on Windows systems.

  → The vulnerability affects Microsoft Windows, which is part of the company's core operating system stack, but it requires local low-privileged code execution.

• TAKTISCH Unit 42
  Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

  The implant persists on the FortiGate devices as a standalone backdoor after FortiManager is patched and disguises its C2 traffic as regular FGFM management communication , patch information alone therefore does not cover this attack path.

  → The implant targets FortiGate devices and abuses the FGFM management channel, a product family that is part of the company's perimeter stack, and CVE-2024-47575 is being exploited in espionage-motivated intrusions.

• OPERATIV Microsoft Security Blog
  From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

  The report shows that a successful help desk vishing call via Teams does not merely yield a compromised account but, through AD CS certificate templates (ESC1/ESC8), establishes durable password-independent authentication for privileged accounts.

  → The investigation describes attack paths via Microsoft Teams, Quick Assist and Active Directory Certificate Services (ESC1/ESC8) , components directly present in the company's tech stack (AD, Entra ID, Teams, Windows Server, Defender).

• UNIT 42 14/10/2026
  Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

  Unit 42 has discovered a stealthy implant called PEERSTITCH that targets FortiGate devices. The implant is associated with the vulnerability CVE-2024-47575 in FortiManager. It is designed to evade detection mechanisms and remain unnoticed. This poses a significant risk for manufacturing companies in the DACH region that use Fortinet products.

• MICROSOFT SECURITY BLOG 30/10/2026
  From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

  The report shows that a successful help desk vishing call via Teams does not merely yield a compromised account but, through AD CS certificate templates (ESC1/ESC8), establishes durable password-independent authentication for privileged accounts.

• BLOG 26/10/2026
  October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities

  The October 2026 Patch Tuesday report documents 1,413 CVEs, including three zero-day vulnerabilities and 75 critical vulnerabilities. For Joel Traber AG, a manufacturing company in the DACH region, this creates heightened urgency because zero-days may be actively exploited. The large number of critical vulnerabilities requires prioritized identification of affected systems and timely patch deployment. Systematic vulnerability management is necessary to minimize operational risk in manufacturing.