Changes replace syscall with unix/windows packages where possible (#3032) @mmetc pkg/acquisition: refact configuration validation and tests (#4187) @mmetc pkg/acquisition: remove/restore mock datasources after usage (#4190)…

IT Security Tools github.com 22.01.2026, 15:40 Uhr 4 Min. Lesezeit CWE-89 KRITIS / Energie Cloud & IT-Enterprise

↗ Quelle (github.com)

Reagiere als Erste:r — dein Feedback zählt!

STANDARD — Regulärer Patch-Zyklus ~4 Min. (656 W.)

Deep Tech

v1.7.5

Angriffsfläche

Kubernetes / Container

Exploit-Status

⚠️ Öffentlicher Exploit-PoC verfügbar

Sofortmaßnahme

Hersteller-Sicherheitsupdate unverzüglich einspielen

Changes

replace syscall with unix/windows packages where possible (#3032) @mmetc

pkg/acquisition: refact configuration validation and tests (#4187) @mmetc

pkg/acquisition: remove/restore mock datasources after usage (#4190) @mmetc

pkg/leakybucket: replace global variables with injected StateDumper (#4197) @mmetc

pkg/acquisition: method docs, deduplicate module names (#4192) @mmetc

errors.Wrapf -> fmt.Errorf, remove dependency on github.com/pkg/errors (#4198) @mmetc

update golangci-lint 2.8 (#4194) @mmetc

notification plugins: readability / dry refact, unnecessary pointers (#4166) @mmetc

refact acquisition/appsec: happy path (#4183) @mmetc

pkg/acquisition/registry, move datasource registration to avoid dependency (#4189) @mmetc

gin middleware: drop closures (#4186) @mmetc

acquisition/journalctl: test cleanup (#4182) @mmetc

cscli hubtest: extract method finalizeRun() (#4181) @mmetc

refact cmd/crowdsec: remove globals ParseDump, BucketPourTrack (#4184) @mmetc

refact pkg/apiserver: happy path; nil guard (#4180) @mmetc

refact pkg/leakybucket: drop closures (#4178) @mmetc

cmd/crowdsec: rename pipeline channels (#4175) @mmetc

move dir debian, rpm to /build/ (#4174) @mmetc

refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc

lint: modernize - enable slicessort, stringsseq (#4162) @mmetc

appsec: inject dependencies, avoid globals (#4148) @mmetc

CI: move windows build scripts to ./build/windows (#4145) @mmetc

remove obsolete readme (replaced by go generate) (#4164) @mmetc

cmd/crowdsec: refact dump.go, loops (#4158) @mmetc

cmd/crowdsec: refact output.go, pour.go, parse.go (#4157) @mmetc

refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc

drop unused method Client.IsMachineRegistered() (#4121) @mmetc

CI: build with the tag "nomsgpack" to reduce binary size (#4151) @mmetc

move ./docker to ./build/docker (#4130) @mmetc

acquisition refact: context-aware OneShot(), for file + journalctl + wineventlog (#4125) @mmetc

lint: forbidigo (no print or printf in production, prefer fprint) (#4141) @mmetc

CI: avoid using nolint with revive (#4144) @mmetc

Lint: add explicit per-linter settings (#4134) @mmetc

refact pkg/acquisition: split docker.go (#4065) @mmetc

get rid of tombs in leakybucket package (#4127) @sabban

refact pkg/acquisition: cloudwatch configuration (#4058) @mmetc

refact pkg/acquisition: kinesis configuration (#4059) @mmetc

refact pkg/acquisition: k8saudit configuration (#4060) @mmetc

refact pkg/acquisition: http configuration (#4061) @mmetc

refact heartbeat: context-aware method (#4126) @mmetc

pkg/leakybucket refact: unexport, unused, explicit field names (#4123) @mmetc

docker build: run builds on large runner (#4120) @blotus

Improvements

docker datasource schema (#4206) @mmetc

lint: enable bodyclose (ensure response bodies are closed to avoid leaks) (#4200) @mmetc

feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007) @LaurenceJJones

pkg/parser: avoid calling spew unless trace (#4156) @mmetc

leakybucket: reduce error verbosity, test for misconfiguration (#4087) @mmetc

feat(appsec): support transaction id header for request tracing (#4124) @LaurenceJJones

Bug Fixes

update functional tests with time-based-bf (#4217) @mmetc

papi: check if decision is allowlisted before adding it (#4196) @blotus

pkg/acquisition: register mock datasource for YAML tests (#4205) @mmetc

pkg/acquisition: prevent duplicate send in case of transform error (#4191) @mmetc

CI fix - exit lapi during hub tests; pass container struct reference instead of slice (#4202) @mmetc

CAPI: always reuse the stored token (#4201) @blotus

fix #4066: don't prepare the hub in lapi-only containers (#4169) @mmetc

fix #3991 - Acquisition config formatting in bug template (#4170) @mmetc

fix typos in function name, comments and user-facing docs (#4154) @mmetc

refact appsec tests: prevent data race (#3902) @mmetc

fix build issue on freebsd, add cross platform CI build and lint target (#4109) @mmetc

Chore / Deps

build(deps): bump actions/setup-go from 6.1.0 to 6.2.0 (#4195) @dependabot[bot]

build(deps): bump github/codeql-action from 4.31.9 to 4.31.10 (#4193) @dependabot[bot]

build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0 (#4185) @dependabot[bot]

CI/tests: update bats-*, remove bats-mock (#4172) @mmetc

deps: update modernc.org/sqlite (#4177) @mmetc

CI, docker: update yq to v4.50.1 (#4179) @mmetc

build(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#4167) @dependabot[bot]

build(deps): bump github/codeql-action from 4.31.8 to 4.31.9 (#4153) @dependabot[bot]

update expr to 1.17.7 (#4150) @blotus

build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4146) @dependabot[bot]

build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6 (#4147) @dependabot[bot]

build(deps): bump github/codeql-action from 4.31.7 to 4.31.8 (#4135) @dependabot[bot]

build(deps): bump github/codeql-action from 4.31.6 to 4.31.7 (#4116) @dependabot[bot]

CI: update and/or pin actions with tag comments (#4108) @mmetc

CI: update golangci-lint to 2.7 (#4110) @mmetc

make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.

1. Sofort-Triage & Abwehrmaßnahmen

IR-PLAYBOOK-RCEHIGH

Schritte anzeigen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - v1.7.5
id: 028bc8c2-ddb9-4c92-8dad-8cf984e1c104
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "v1.7.5" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("v175")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*v175*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "v175"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 1 Min

Gefahr fürs Herz: Schlafzimmer-Temperatur sollte nachts diese Grenze nicht überschreiten

IT Nachrichten

NÄCHSTER BEITRAG 1 Min

Landespolizei bekommt neue Diensthandys wohl erst im Sommer | ndr.de

Hacking & PentestingWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich v1.7.5.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')

Auch interessante Nachrichten v1.7.5

Thematisch verwandte Begriffe: v175 · 6 Treffer

Sicherheitslücken (CVE) KitPloit - PenTest Tools!

xalgorix v4.6.78

vor 5 Tagen 📆 19.09.2026 um 21:27 Uhr

Weiterlesen ↗

IT Security Downloads GitHub · openclaw/openclaw

GitHub Release: openclaw/openclaw v2026.7.34 (20.09.2026)

Release v2026.7.34 von openclaw/openclaw auf GitHub: test(release): use entitled Gemini live model (#153189)

vor 5 Tagen 📆 20.09.2026 um 00:00 Uhr

Weiterlesen ↗

Sichere Programmierung DEV Community

Introducing mvnex v0.1.0: A Native CLI for Faster Maven Workflows

vor 5 Tagen 📆 20.09.2026 um 01:54 Uhr

Weiterlesen ↗

IT Security Downloads GitHub · openclaw/openclaw

GitHub Release: openclaw/openclaw vrelease-publish/91926f9b61a5-1789871489 (20.09.2026)

Release release-publish/91926f9b61a5-1789871489 von openclaw/openclaw auf GitHub: fix(release): repair 7.34 validation gates (#153190)

vor 5 Tagen 📆 20.09.2026 um 00:26 Uhr

Weiterlesen ↗

IT Security Tools KitPloit - PenTest Tools!

BrowserBox v19.0.3

vor 5 Tagen 📆 20.09.2026 um 08:30 Uhr

Weiterlesen ↗

Sicherheitslücken (CVE) 🛡️ Security Fix Linux, GNU/Linux, free softw

Critical 9.8 vulnerability in Unbound up to and including version 1.26.0

vor 5 Tagen 📆 20.09.2026 um 02:08 Uhr

Weiterlesen ↗

Videos werden geladen ...

Beiträge werden geladen ...

Videos werden geladen ...

🚀 Auf tsecurity.de entdecken

Kommentare über v1.7.5

💬 Social News Network

Community Debatte 0 Beiträge

Tags:Noch keine Tags.

Noch keine Diskussion eröffnet

Sei der Erste, der seine Einschätzung oder PoC zu diesem Thema teilt.

🚀 Auf tsecurity.de entdecken

Echtzeit-Radar & Feeds

👥 Community & Social

🕒 tsecurity.de Such-Trends & Chronologie

v1.7.5

Changes

Improvements

Bug Fixes

Chore / Deps

Geolite2 notice

Installation

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

2. Cyber Threat Intelligence & Forensik

MITRE ATT&CK Matrix Navigator 14 Taktiken

tsecurity.de Cognitive Threat RAG

Auch interessante Nachrichten v1.7.5

xalgorix v4.6.78

GitHub Release: openclaw/openclaw v2026.7.34 (20.09.2026)

Introducing mvnex v0.1.0: A Native CLI for Faster Maven Workflows

GitHub Release: openclaw/openclaw vrelease-publish/91926f9b61a5-1789871489 (20.09.2026)

BrowserBox v19.0.3

Critical 9.8 vulnerability in Unbound up to and including version 1.26.0

tsecurity.de LIVE

Echtzeit-Radar & Feeds

👥 Community & Social

v1.7.5

Changes

Improvements

Bug Fixes

Chore / Deps

Geolite2 notice

Installation

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

2. Cyber Threat Intelligence & Forensik

MITRE ATT&CK Matrix Navigator 14 Taktiken

Mehr aus dieser Kategorie

tsecurity.de Cognitive Threat RAG

Auch interessante Nachrichten v1.7.5

xalgorix v4.6.78

GitHub Release: openclaw/openclaw v2026.7.34 (20.09.2026)

Introducing mvnex v0.1.0: A Native CLI for Faster Maven Workflows

GitHub Release: openclaw/openclaw vrelease-publish/91926f9b61a5-1789871489 (20.09.2026)

BrowserBox v19.0.3

Critical 9.8 vulnerability in Unbound up to and including version 1.26.0

tsecurity.de App