Civil liberties group and Bitkom call for strict vulnerability managementAs intelligence laws are overhauled, business and civil society groups demand clear legal safeguards against deliberately leaving IT vulnerabilities unpatched.
Cyberattack disrupts construction work on Fehmarn Belt tunnelWorkers forced offline, problems with ship navigation and failed access controls hampered work on the megaproject.
October updates take down Exchange serversExchange servers go down after Windows Server’s October updates. Microsoft is investigating the issue.
Microsoft Defender now protects Linux desktopsMicrosoft Defender supports Linux desktops in businesses. Administrators can manage the devices through their existing infrastructure.
Works on iPhone 18 Pro: AI helps create untethered jailbreak for iOS 27.0.1The Calif.io team has developed the first reboot-proof jailbreak since iOS 9. It works on the latest version and the newest iPhones. AI helped.
Bugged wallets: Ledger calls it an “attack on the whole industry”Someone is tampering with cryptocurrency hardware wallets and stealing millions. The affected manufacturer, Ledger, has now spoken out.
Chinese spy satellite tracks Inmarsat satellites in spaceA suspected eavesdropping operation in geostationary orbit concerns Germany’s military and Western intelligence agencies. Communications data is also affected.
AdFection: How online ads became a vector for government spywareA Citizen Lab study reveals that global ad networks are being exploited for targeted zero-click spyware attacks. Media outlets are among the targets.
Germany issues guidance on switching to post-quantum cryptographyHigh-risk cryptographic applications must be quantum-safe by the end of 2030; medium-risk ones by the end of 2035.
PAN-OS: Root flaw lets malware slip through Palo Alto firewallsAttackers are targeting Palo Alto Networks firewalls. An updated version of PAN-OS fixes the issue.
IPFire: VPN clients can resolve DNS names againIPFire 2.29 Core Update 204 is here. It fixes a name resolution bug affecting VPN clients and updates numerous system packages.
Attackers exploit root vulnerability in Cisco Secure Email GatewayA critical flaw in Cisco Secure Email Gateway is already being exploited. Malicious email attachments give attackers root privileges.
Tainted Ledger crypto wallets: Problem bigger than thoughtSomeone is secretly installing LTE modems in new crypto wallets. Buyers have lost over 100 million dollars. Manufacturer Ledger communicates little.
BSI also warns operators of small networked systemsFollowing the attack on the cooling system control of French supermarkets, Germany’s IT security authority warns of similar attacks.
New curl version removes SMB support and fixes 24 security vulnerabilitiesThe most severe vulnerability fixed allows code execution via HTTP/2, found by Anthropic.
Patchday: Attacks on various Windows versions observedMicrosoft has closed over 1400 security vulnerabilities in Windows, Office & Co. Attacks are already underway.
Security Appliance: Attackers exploit vulnerability in Ivanti Connect SecureIvanti warns of a security vulnerability and has offered updates since early October. Network admins should install them quickly; attacks are ongoing.
Crypto thieves sell hardware wallets with secret eSIMAround 100 million US dollars in cryptocurrency have been stolen from users of certain hardware wallets because whoever can read the screen wins.
SAP Patchday: Attackers can take over systemsImportant security updates have been released for SAP Cloud SDK for Python, among others. Admins should act promptly.
Security vulnerability: DoS attacks on IBM SPSS Modeler possibleTwo vulnerabilities in Apache OpenNLP threaten IBM SPSS Modeler data mining software.
24 security vulnerabilities in GitLab closedAttackers can exploit several vulnerabilities in GitLab Community Edition and Enterprise Edition.
Kaspersky outage: Striking proximity to attacks on Russian data centersSince the weekend, Kaspersky software has not been working at all or only with restrictions. The timing is notable given the outages at Yandex.
Let’s Encrypt: Switch to 64-day certificates in February 2027Let’s Encrypt will significantly reduce certificate lifespan. From February, the switch to 64 days validity will occur.
Firefox Enterprise: Mozilla Launches Business BrowserMozilla introduces Firefox Enterprise. The business browser can, for example, prevent employees from copying sensitive data to unauthorized AI services.
Patch now! SonicWall SMA1000 in attackers' crosshairsCurrently, attackers are exploiting a critical vulnerability in the SonicWall SMA1000 remote access solution. Security updates are available.
Security vulnerability in flight booking systemA data leak at Amadeus exposed passenger data. Access credentials were visible in plain text via an unprotected heap dump.
Cybercriminals claim data leak at Confluent, Deloitte, KFC and MoneyGramA cyber gang claims to have copied data from Confluent, Deloitte, KFC and MoneyGram. It has published data from Air Canada and FTAPI.
Microsoft faces next certificate change – Windows Update affectedThe old Windows Update certificates expire starting next May, Microsoft will provide new ones via update. Admins should check if action is needed.
Old vulnerabilities in Apache Struts, BIND, and ProFTPD targeted by attackersCISA warns of observed attacks on Apache Struts, BIND, and ProFTPD, among others. The vulnerabilities are partly very old.
7-Zip: Update patches security vulnerabilitiesThe popular archiving tool 7-Zip has been released in the new version 26.04. It closes security vulnerabilities and corrects errors.
CEO Fraud: Manager liable for MillionsA manager must be liable for 50 million euros after a CEO fraud. The Cologne Regional Labour Court upheld the dismissal without notice.
Thousands of European wind and solar farms openly accessible onlineAn IT security firm has mapped European solar and wind farms. Over 8500 administration systems are openly accessible online.
Attackers can take over systems with IBM Verify Identity AccessIBM’s access management solutions IBM Verify Identity Access and IBM Security Verify Access are vulnerable.
Mastercard to introduce offline payments in Europe from 2027From the beginning of next year, customers will also be able to pay with Mastercard during power or network outages.
AWS Strands Box: Keeping AI agents on a short leashAn agent can read logs but not change infrastructure? Strands Box combines a sandbox with rules that also consider previous actions.
Security Patches: Critical Root Vulnerability Threatens Cisco SwitchesAttackers can, among other things, exploit vulnerabilities in Cisco License On-Prem and Nexus 3000.
Why open-source patches often don’t reach banksThe OSERA Risk Navigator helps financial institutions find, prioritize, and close security vulnerabilities in open-source software.
Citrix releases another security update for critical Netscaler vulnerabilityLast weekend, Citrix closed a zero-day vulnerability in Netscaler. Now the manufacturer is releasing another update.
Danger for autonomous cars: How a film deceives cameras and lidarResearchers from Munich are testing camera and lidar systems to better protect autonomous vehicles from targeted manipulation.
Veeam closes vulnerability in Backup & ReplicationVeeam has updated Backup & Replication, closing four security vulnerabilities. It is possible to smuggle malware onto the server.
