Joel Traber AG

Top news

• TAKTISCH ZDI: Published Advisories
  ZDI-26-661: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

  The vulnerability requires user interaction and carries a high but not critical risk at CVSS 7.8; there is no evidence of active exploitation.

  → Adobe Acrobat Reader DC is deployed as the standard PDF client in the company, so a use-after-free vulnerability leading to RCE would be directly exploitable.

• TAKTISCH The Hacker News
  Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

  Beyond the patch information itself, the report shows that CVE-2026-58115 is already being actively exploited to plant persistent remote-access backdoors on industrial Siemens devices.

  → The actively exploited flaw affects Siemens SIMATIC IoT2050 industrial devices, hitting the same vendor ecosystem as the Siemens SIMATIC/S7/TIA Portal equipment used in manufacturing OT environments.

• TAKTISCH Securelist
  How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

  The report adds to patch information the insight that APT41 has revived a known Secure Boot bypass with a UEFI bootkit for targeted attacks on diplomatic targets, demonstrating hard-to-detect persistence below Windows.

  → The item describes an APT41 campaign using a Windows Secure Boot bypass and UEFI bootkit, which is operationally relevant to Windows environments but targets diplomatic organizations in Central Asia rather than manufacturing.

• INFORMATIV ZDI: Published Advisories
  ZDI-26-751: Microsoft Windows dxgkrnl Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

  The flaw requires pre-existing local code execution but is rated high at CVSS 8.8 and is well suited as an escalation step after initial compromise.

  → The vulnerability affects the Windows kernel driver dxgkrnl and therefore directly impacts the Windows server and client systems in use at the company.

• TAKTISCH Unit 42
  Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

  The report shows that exploitation of CVE-2024-47575 does not end with patching: the attacker leaves a standalone, hard-to-detect implant on the FortiGate that persists even after the flaw is closed.

  → The article describes an implant for Fortinet FortiGate/FortiManager environments (CVE-2024-47575) and therefore directly affects an edge security platform deployed in the company.

• INFORMATIV Microsoft Security Blog
  From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

  The attack shows how an AD CS misconfiguration (ESC1/ESC8) turns a simple help desk call into durable certificate-based authentication that survives password resets.

  → The campaign abuses Microsoft Teams, Quick Assist and Active Directory Certificate Services (ESC1/ESC8) , components directly present in the described Microsoft 365/AD environment.

• UNIT 42 14/10/2026
  Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

  Unit 42 has discovered a stealthy FortiGate implant named PEERSTITCH. This malware appears to be distributed via a vulnerability in FortiManager (CVE-2024-47575) and allows attackers persistent access to firewalls. For manufacturing companies in the DACH region, this poses a significant risk as production networks can be compromised. Affected organizations should immediately apply patches and check their FortiGate and FortiManager systems for signs of infection.

• MICROSOFT SECURITY BLOG 30/10/2026
  From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

  The attack shows how an AD CS misconfiguration (ESC1/ESC8) turns a simple help desk call into durable certificate-based authentication that survives password resets.

• CISCO TALOS BLOG 21/10/2026
  Compromised eMudhra intermediate certificates

  Cisco Talos identified eight compromised intermediate certificates belonging to the certificate authority eMudhra. Due to a flaw in the key generation process, the private keys were generated with only 3 to 8 bits of entropy instead of the required 384 bits. An attacker with any of these private keys can impersonate any website or service; six TLS certificates have already been blocked by Chrome, Mozilla, and Apple, and two code signing certificates have been blocked by Microsoft. eMudhra has revoked the compromised certificates and stopped issuing new certificates under the G3 root, and the Go team has assigned CVE-2026-111943.