Security

Enterprises relying on Gladinet’s file-sharing services are faced with another round of zero-day patching, this time to block attackers from abusing cryptographic keys directly baked into its CentreStack and Triofox platforms. Cybersecurity firm Huntress warned that attackers are already abusing the hardcoded keys to perform remote code execution (RCE) on the affected servers. “The AES implementation of Gladinet’s CentreStack and Triofox products contains hardcoded cryptographic keys,” H

HZ Creations – shutterstock.com Die Umsetzung großer Transformationsinitiativen, wie die Einführung von Zero Trust, erfordert mehr als nur technisches Verständnis – und genau hier beginnen die Herausforderungen für viele IT-Sicherheitsentscheider. Sie sind es gewohnt, technisch zu argumentieren, und nicht, einen kulturellen Wandel einzuleiten. Schließlich geht es bei der Ablösung herkömmlicher und gewohnter Infrastrukturen um nichts anderes, als die Komfortzone des Bekannten zu verlassen und

HZ Creations – shutterstock.com Die Umsetzung großer Transformationsinitiativen, wie die Einführung von Zero Trust, erfordert mehr als nur technisches Verständnis – und genau hier beginnen die Herausforderungen für viele IT-Sicherheitsentscheider. Sie sind es gewohnt, technisch zu argumentieren, und nicht, einen kulturellen Wandel einzuleiten. Schließlich geht es bei der Ablösung herkömmlicher und gewohnter Infrastrukturen um nichts anderes, als die Komfortzone des Bekannten zu verlassen und

Cybersecurity researchers have documented four new phishing kits named BlackForce, GhostFrame, InboxPrime AI, and Spiderman that are capable of facilitating credential theft at scale. BlackForce, first detected in August 2025, is designed to steal credentials and perform Man-in-the-Browser (MitB) attacks to capture one-time passwords (OTPs) and bypass multi-factor authentication (MFA). The kitView the full article

Cybersecurity researchers have documented four new phishing kits named BlackForce, GhostFrame, InboxPrime AI, and Spiderman that are capable of facilitating credential theft at scale. BlackForce, first detected in August 2025, is designed to steal credentials and perform Man-in-the-Browser (MitB) attacks to capture one-time passwords (OTPs) and bypass multi-factor authentication (MFA). The kitView the full article

The browser has become the main interface to GenAI for most enterprises: from web-based LLMs and copilots, to GenAI‑powered extensions and agentic browsers like ChatGPT Atlas. Employees are leveraging the power of GenAI to draft emails, summarize documents, work on code, and analyze data, often by copying/pasting sensitive information directly into prompts or uploading files.  TraditionalView the full article

The browser has become the main interface to GenAI for most enterprises: from web-based LLMs and copilots, to GenAI‑powered extensions and agentic browsers like ChatGPT Atlas. Employees are leveraging the power of GenAI to draft emails, summarize documents, work on code, and analyze data, often by copying/pasting sensitive information directly into prompts or uploading files.  TraditionalView the full article

BeeBright – shutterstock.com Mitte Oktober funktionierte im Rathaus Untereisesheim fast nichts mehr. Die Gemeindeverwaltung war Ziel eines Cyberangriffs, bei dem IT-Systeme verschlüsselt und Daten von den Servern gestohlen wurden, heißt es in einer aktuellen Mitteilung auf der Website. Demnach hätten die Ermittlungen nun ergeben, dass Teile der entwendeten Daten im Darknet gelandet sind. Bürgerdaten wohl nicht betroffen Dazu sollen unter anderem alte Personalakten sowie Daten- und Bi

BeeBright – shutterstock.com Mitte Oktober funktionierte im Rathaus Untereisesheim fast nichts mehr. Die Gemeindeverwaltung war Ziel eines Cyberangriffs, bei dem IT-Systeme verschlüsselt und Daten von den Servern gestohlen wurden, heißt es in einer aktuellen Mitteilung auf der Website. Demnach hätten die Ermittlungen nun ergeben, dass Teile der entwendeten Daten im Darknet gelandet sind. Bürgerdaten wohl nicht betroffen Dazu sollen unter anderem alte Personalakten sowie Daten- und Bi

The React team has released fixes for two new types of flaws in React Server Components (RSC) that, if successfully exploited, could result in denial-of-service (DoS) or source code exposure. The team said the issues were found by the security community while attempting to exploit the patches released for CVE-2025-55182 (CVSS score: 10.0), a critical bug in RSC that has since been weaponized inView the full article

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged federal agencies to patch the recent React2Shell vulnerability by December 12, 2025, amid reports of widespread exploitation. The critical vulnerability, tracked as CVE-2025-55182 (CVSS score: 10.0), affects the React Server Components (RSC) Flight protocol. The underlying cause of the issue is an unsafe deserializationView the full article

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a high-severity security flaw impacting OSGeo GeoServer to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation in the wild. The vulnerability in question is CVE-2025-58360 (CVSS score: 8.2), an unauthenticated XML External Entity (XXE) flaw that affects all versions prior toView the full article

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a high-severity security flaw impacting OSGeo GeoServer to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation in the wild. The vulnerability in question is CVE-2025-58360 (CVSS score: 8.2), an unauthenticated XML External Entity (XXE) flaw that affects all versions prior toView the full article

OpenAI is preparing for the possibility that threat groups will try to abuse its increasingly powerful AI frontier models to carry out sophisticated cyberattacks. In a blog, the company describes how the evolving capabilities of its models could be used to “develop working zero-day remote exploits against well-defended systems, or meaningfully assist with complex, stealthy enterprise or industrial intrusion operations aimed at real-world effects.” According to OpenAI, the underlying prob

OpenAI is preparing for the possibility that threat groups will try to abuse its increasingly powerful AI frontier models to carry out sophisticated cyberattacks. In a blog, the company describes how the evolving capabilities of its models could be used to “develop working zero-day remote exploits against well-defended systems, or meaningfully assist with complex, stealthy enterprise or industrial intrusion operations aimed at real-world effects.” According to OpenAI, the underlying prob

A new variation of the ClickFix scam tries to get around phishing defenses by capturing an employee’s OAuth authentication token for Microsoft logins. Researchers at Push Security this week outlined the tactic, which they call ConsentFix, in a blog, calling it “a dangerous evolution of ClickFix and consent phishing that is incredibly hard for traditional security tools to detect and block.” Generally ClickFix attacks display a fake error or counterfeit CAPTCHA verification to a user to g

K2LStudio – shutterstock.com Ein umfangreicher internationaler Graumarkt mit SIM-Mobilfunkkarten fördert im großen Stil Manipulationen und Betrügereien im Internet. Nach einer Studie der Universität Cambridge werden die physischen und virtuellen SIM-Karten von Anbietern wie SMSActivate, 5Sim, SMShub und SMSPVA für die Verifikation von gefälschten Online-Konten bei Social-Media-Plattformen oder E-Commerce-Anbietern verwendet. “Wir haben es mit einem florierenden Untergrundmarkt zu tun, auf de

K2LStudio – shutterstock.com Ein umfangreicher internationaler Graumarkt mit SIM-Mobilfunkkarten fördert im großen Stil Manipulationen und Betrügereien im Internet. Nach einer Studie der Universität Cambridge werden die physischen und virtuellen SIM-Karten von Anbietern wie SMSActivate, 5Sim, SMShub und SMSPVA für die Verifikation von gefälschten Online-Konten bei Social-Media-Plattformen oder E-Commerce-Anbietern verwendet. “Wir haben es mit einem florierenden Untergrundmarkt zu tun, auf de

Researchers have uncovered fresh techniques for breaking SAML-based authentication, further undermining the security assurances offered by the aging by still widely used authentication protocol. SAML (Security Assertion Markup Language) has been the backbone of enterprise single sign-on (SSO) technologies for more than 20 years. During a presentation at the Black Hat Europe conference on Wednesday, PortSwigger security researcher Zak Fedotkin demonstrated novel techniques for breaking th

Confidential computing, powered by hardware technologies such as Intel SGX (Software Guard Extensions) and AMD SEV (Secure Encrypted Virtualization), promises strong isolation and transparent memory encryption. Designed to protect against privileged attackers and physical threats such as bus snooping and cold boot attacks, these secure CPU enclaves are used predominantly in cloud computing environments to create protected memory regions that are encrypted and inaccessible to the rest of the

Much of the narrative I come across online around cybersecurity budgets revolves around convincing the Board and justifying investments. Some approaches are built around financial models and aim at justifying return on investment. Some others focus on quantifying risk and showing risk reduction. All are data-driven and designed around some form of rational argument. But is this really the way decisions are made at the top of large organizations? In fact, those approaches are all

This week’s cyber stories show how fast the online world can turn risky. Hackers are sneaking malware into movie downloads, browser add-ons, and even software updates people trust. Tech giants and governments are racing to plug new holes while arguing over privacy and control. And researchers keep uncovering just how much of our digital life is still wide open. The new Threatsday BulletinView the full article

This week’s cyber stories show how fast the online world can turn risky. Hackers are sneaking malware into movie downloads, browser add-ons, and even software updates people trust. Tech giants and governments are racing to plug new holes while arguing over privacy and control. And researchers keep uncovering just how much of our digital life is still wide open. The new Threatsday BulletinView the full article

Cybersecurity researchers have disclosed details of a new fully-featured Windows backdoor called NANOREMOTE that uses the Google Drive API for command-and-control (C2) purposes. According to a report from Elastic Security Labs, the malware shares code similarities with another implant codenamed FINALDRAFT (aka Squidoor) that employs Microsoft Graph API for C2. FINALDRAFT is attributed to aView the full article

Cybersecurity researchers have disclosed details of a new fully-featured Windows backdoor called NANOREMOTE that uses the Google Drive API for command-and-control (C2) purposes. According to a report from Elastic Security Labs, the malware shares code similarities with another implant codenamed FINALDRAFT (aka Squidoor) that employs Microsoft Graph API for C2. FINALDRAFT is attributed to aView the full article

ImageFlow – shutterstock.com Ivanti hat kürzlich einen schwerwiegenden Fehler in seinen EMP-Systemen gemeldet, der Admin-Sitzungen ohne Authentifizierung erlaubt. Angreifer könnten dadurch möglicherweise Tausende von Unternehmensgeräten kontrollieren. Der Software-Anbieter veröffentlichte die EPM-Version 2024 SU4 SR1, um mehrere Schwachstellen zu beheben. Dazu gehört die kritische Schwachstelle mit der Kennung CVE-2025-10573, die einen CVSS-Score von 9,6 aufweist. Weitere Lücken

ImageFlow – shutterstock.com Ivanti hat kürzlich einen schwerwiegenden Fehler in seinen EMP-Systemen gemeldet, der Admin-Sitzungen ohne Authentifizierung erlaubt. Angreifer könnten dadurch möglicherweise Tausende von Unternehmensgeräten kontrollieren. Der Software-Anbieter veröffentlichte die EPM-Version 2024 SU4 SR1, um mehrere Schwachstellen zu beheben. Dazu gehört die kritische Schwachstelle mit der Kennung CVE-2025-10573, die einen CVSS-Score von 9,6 aufweist. Weitere Lücken

ImageFlow – shutterstock.com Ivanti hat kürzlich einen schwerwiegenden Fehler in seinen EMP-Systemen gemeldet, der Admin-Sitzungen ohne Authentifizierung erlaubt. Angreifer könnten dadurch möglicherweise Tausende von Unternehmensgeräten kontrollieren. Der Software-Anbieter veröffentlichte die EPM-Version 2024 SU4 SR1, um mehrere Schwachstellen zu beheben. Dazu gehört die kritische Schwachstelle mit der Kennung CVE-2025-10573, die einen CVSS-Score von 9,6 aufweist. Weitere Lücken

As enterprises refine their strategies for handling Non-Human Identities (NHIs), Robotic Process Automation (RPA) has become a powerful tool for streamlining operations and enhancing security. However, since RPA bots have varying levels of access to sensitive information, enterprises must be prepared to mitigate a variety of challenges. In large organizations, bots are starting to outnumberView the full article

As enterprises refine their strategies for handling Non-Human Identities (NHIs), Robotic Process Automation (RPA) has become a powerful tool for streamlining operations and enhancing security. However, since RPA bots have varying levels of access to sensitive information, enterprises must be prepared to mitigate a variety of challenges. In large organizations, bots are starting to outnumberView the full article

An advanced persistent threat (APT) known as WIRTE has been attributed to attacks targeting government and diplomatic entities across the Middle East with a previously undocumented malware suite dubbed AshTag since 2020. Palo Alto Networks is tracking the activity cluster under the name Ashen Lepus. Artifacts uploaded to the VirusTotal platform show that the threat actor has trained its sightsView the full article

An advanced persistent threat (APT) known as WIRTE has been attributed to attacks targeting government and diplomatic entities across the Middle East with a previously undocumented malware suite dubbed AshTag since 2020. Palo Alto Networks Unit 42 is tracking the activity cluster under the name Ashen Lepus. Artifacts uploaded to the VirusTotal platform show that the threat actor has trained itsView the full article

A high-severity unpatched security vulnerability in Gogs has come under active exploitation, with more than 700 compromised instances accessible over the internet, according to new findings from Wiz. The flaw, tracked as CVE-2025-8110 (CVSS score: 8.7), is a case of file overwrite in the file update API of the Go-based self-hosted Git service. A fix for the issue is said to be currently in theView the full article

A high-severity unpatched security vulnerability in Gogs has come under active exploitation, with more than 700 compromised instances accessible over the internet, according to new findings from Wiz. The flaw, tracked as CVE-2025-8110 (CVSS score: 8.7), is a case of file overwrite in the file update API of the Go-based self-hosted Git service. A fix for the issue is said to be currently in theView the full article

Google on Wednesday shipped security updates for its Chrome browser to address three security flaws, including one it said has come under active exploitation in the wild. The vulnerability, rated high in severity, is being tracked under the Chromium issue tracker ID "466192044." Unlike other disclosures, Google has opted to keep information about the CVE identifier, the affected component, andView the full article

Google on Wednesday shipped security updates for its Chrome browser to address three security flaws, including one it said has come under active exploitation in the wild. The vulnerability, rated high in severity, is being tracked under the Chromium issue tracker ID "466192044." Unlike other disclosures, Google has opted to keep information about the CVE identifier, the affected component, andView the full article

In modern corporate environments, investments in security technologies are no longer judged solely on technical maturity. Funding increasingly depends on the extent to which they can generate revenue, mitigate risks, and create shareholder value. As a result, CISOs are expected to present their strategies not as mere technical upgrades, but as enablers of revenue growth. The challenge lies not only in making the right investment decisions, but also in justifying them at the board level.

Huntress is warning of a new actively exploited vulnerability in Gladinet's CentreStack and Triofox products stemming from the use of hard-coded cryptographic keys that have affected nine organizations so far. "Threat actors can potentially abuse this as a way to access the web.config file, opening the door for deserialization and remote code execution," security researcher Bryan Masters said.View the full article

Huntress is warning of a new actively exploited vulnerability in Gladinet's CentreStack and Triofox products stemming from the use of hard-coded cryptographic keys that have affected nine organizations so far. "Threat actors can potentially abuse this as a way to access the web.config file, opening the door for deserialization and remote code execution," security researcher Bryan Masters said.View the full article

G Data IT-Sicherheit ist für Unternehmen von entscheidender Bedeutung, um die Infrastruktur vor Angriffen zu schützen und die Verfügbarkeit von Ressourcen und Daten zu gewährleisten. Der Bereich erfordet nicht nur spezielles Fachwissen, sondern vor allem Fachpersonal. IT-Sicherheitsexpertinnen und -experten sind jedoch Mangelware und eigene Mitarbeitende für diese Aufgabe zu gewinnen, ist für Firmen oft schwer. Hierdurch sind die Bedingungen für eine effektive Cyberabwehr denkbar schlecht.

G Data IT-Sicherheit ist für Unternehmen von entscheidender Bedeutung, um die Infrastruktur vor Angriffen zu schützen und die Verfügbarkeit von Ressourcen und Daten zu gewährleisten. Der Bereich erfordet nicht nur spezielles Fachwissen, sondern vor allem Fachpersonal. IT-Sicherheitsexpertinnen und -experten sind jedoch Mangelware und eigene Mitarbeitende für diese Aufgabe zu gewinnen, ist für Firmen oft schwer. Hierdurch sind die Bedingungen für eine effektive Cyberabwehr denkbar schlecht.

Admins using FortiCloud SSO (single sign on) to authenticate access to Fortinet products are urged to upgrade the software running some of the company’s gateway products as soon as possible, or risk their networks being compromised. “Users of Fortinet appliances should, for now, disable SSO until they are able to patch the devices,” advised Johannes Ullrich, dean of research at the SANS Institute. “However, in the long run, this is not a reason to abandon SSO, and it should be re-enabled aft

Computer security researchers are in the spotlight as governments look to tackle the growing threat of cybercrime. Last week, British security minister Dan Jarvis set out a new approach to combatting computer crime, highlighting the damage that security breaches have done to the UK economy and emphasizing the importance of computer security researchers. The next day, the Portuguese parliament passed an act giving more protection to the same group. In his speech, Jarvis explained how the

Researchers uncovered an unexpected behavior of HTTP client proxies when created in .NET code, potentially allowing attackers to write malicious code to arbitrary files. This in turn can open remote code execution (RCE) attack paths through web shells and malicious PowerShell scripts in many .NET applications, including commercial products. Microsoft does not plan to fix this issue in the .NET Framework itself, saying that application developers are responsible for not passing untrusted and

React2Shell continues to witness heavy exploitation, with threat actors leveraging the maximum-severity security flaw in React Server Components (RSC) to deliver cryptocurrency miners and an array of previously undocumented malware families, according to new findings from Huntress. This includes a Linux backdoor called PeerBlight, a reverse proxy tunnel named CowTunnel, and a Go-basedView the full article

React2Shell continues to witness heavy exploitation, with threat actors leveraging the maximum-severity security flaw in React Server Components (RSC) to deliver cryptocurrency miners and an array of previously undocumented malware families, according to new findings from Huntress. This includes a Linux backdoor called PeerBlight, a reverse proxy tunnel named CowTunnel, and a Go-basedView the full article

New research has uncovered exploitation primitives in the .NET Framework that could be leveraged against enterprise-grade applications to achieve remote code execution. WatchTowr Labs, which has codenamed the "invalid cast vulnerability" SOAPwn, said the issue impacts Barracuda Service Center RMM, Ivanti Endpoint Manager (EPM), and Umbraco 8. But the number of affected vendors is likely to beView the full article

New research has uncovered exploitation primitives in the .NET Framework that could be leveraged against enterprise-grade applications to achieve remote code execution. WatchTowr Labs, which has codenamed the "invalid cast vulnerability" SOAPwn, said the issue impacts Barracuda Service Center RMM, Ivanti Endpoint Manager (EPM), and Umbraco 8. But the number of affected vendors is likely to beView the full article

Staff+ engineers play a critical role in designing, scaling and influencing the security posture of an organization. Their key areas of expertise include developing security strategy and governance, incident response leadership, automation, compliance/risk management and cross-org collaboration to shape security culture. Together, these capabilities are essential to enhance application security and the effectiveness of their organizations. However, in our experience, we have seen that many s

Ivanti has patched a critical vulnerability in Endpoint Manager that enables attackers to hijack administrator sessions without authentication and potentially control thousands of enterprise devices. The company released EPM version 2024 SU4 SR1 to address four vulnerabilities, including the critical flaw tracked as CVE-2025-10573, which carries a CVSS score of 9.6. Three additional high-severity flaws could also enable code execution but require user interaction, Ivanti said in its December

In today’s threat landscape, it’s no longer enough to focus solely on malware signatures and IP addresses. Defenders must understand how adversaries think, organize and operate, because attacker intent and methodology are now just as critical as technical artifacts. Recent developments have provided rare visibility into the internal processes of modern threat groups, how they coordinate, communicate, exploit vulnerabilities and adapt their tooling in real time. This kind of behind-the-scenes ins

Three security vulnerabilities have been disclosed in the Peripheral Component Interconnect Express (PCIe) Integrity and Data Encryption (IDE) protocol specification that could expose a local attacker to serious risks. The flaws impact PCIe Base Specification Revision 5.0 and onwards in the protocol mechanism introduced by the IDE Engineering Change Notice (ECN), according to the PCI SpecialView the full article

In recent years, artificial intelligence (AI) has been spreading its tentacles across the global technological landscape, as evidenced by the increase in autonomous and automated technologies and their deployment across industries and sectors. While the world is still recovering from the global impact of AI, quantum computing is gradually emerging. In quantum computing, the principles of quantum mechanics are used to perform calculations, enabling the solution of complex problems faster than cla

Digineer Station – shutterstock.com Die Gartner-Analysten Dennis Xu, Evgeny Mirolyubov und John Watts empfehlen Unternehmen dringend, alle KI-Browser aufgrund der Cybersicherheitsrisiken auf absehbare Zeit zu blockieren. Sie stützten ihre Empfehlung auf bereits identifizierte Risiken „und andere potenzielle Risiken, die noch entdeckt werden müssen, da es sich um eine sehr junge Technologie handelt“. Die Warnung kommt zum richtigen Zeitpunkt, da KI-Browser bereits häufig eingesetzt werden

Digineer Station – shutterstock.com Die Gartner-Analysten Dennis Xu, Evgeny Mirolyubov und John Watts empfehlen Unternehmen dringend, alle KI-Browser aufgrund der Cybersicherheitsrisiken auf absehbare Zeit zu blockieren. Sie stützten ihre Empfehlung auf bereits identifizierte Risiken „und andere potenzielle Risiken, die noch entdeckt werden müssen, da es sich um eine sehr junge Technologie handelt“. Die Warnung kommt zum richtigen Zeitpunkt, da KI-Browser bereits häufig eingesetzt werden

Cloud security is changing. Attackers are no longer just breaking down the door; they are finding unlocked windows in your configurations, your identities, and your code. Standard security tools often miss these threats because they look like normal activity. To stop them, you need to see exactly how these attacks happen in the real world. Next week, the Cortex Cloud team at Palo Alto NetworksView the full article

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a security flaw impacting the WinRAR file archiver and compression utility to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2025-6218 (CVSS score: 7.8), is a path traversal bug that could enable code execution. However, for exploitationView the full article

Date: March 18-19, 2026 Location: Monterey Conference Center, Monterey, CA Formerly hosted by Advanced Onion, Inc, Defense Strategies Institute will host the 10th Insider Risk Summit West, March 18-19, 2026, in Monterey, CA. The Insider Risk Summit West unites the nation’s leading experts, innovators, and security professionals dedicated to tackling one of today’s most complex challenges — the insider risk. Hosted on the West Coast, this premier forum will bring together voices from big tech,

Microsoft closed out 2025 with patches for 56 security flaws in various products across the Windows platform, including one vulnerability that has been actively exploited in the wild. Of the 56 flaws, three are rated Critical, and 53 are rated Important in severity. Two other defects are listed as publicly known at the time of the release. These include 29 privilege escalation, 18 remote codeView the full article

We are either at the dawn of AI-driven malware that rewrites itself on the fly, or we are seeing vendors and threat actors exaggerate its capabilities. Recent Google and MIT Sloan reports reignited claims of autonomous attacks and polymorphic AI malware capable of evading defenders at machine speed. Headlines spread rapidly across security feeds, trade publications, and underground forums as vendors promoted AI-enhanced defenses. Beneath the noise, the reality is far less dramatic. Yes, atta

We are either at the dawn of AI-driven malware that rewrites itself on the fly, or we are seeing vendors and threat actors exaggerate its capabilities. Recent Google and MIT Sloan reports reignited claims of autonomous attacks and polymorphic AI malware capable of evading defenders at machine speed. Headlines spread rapidly across security feeds, trade publications, and underground forums as vendors promoted AI-enhanced defenses. Beneath the noise, the reality is far less dramatic. Yes, atta

On Dec. 7, the House and Senate Homeland Security Committees released their compromise version of the 2026 National Defense and Authorization Act (NDAA), a nearly 3,100-page piece of legislation that contains a host of provisions to fund several Department of Defense cybersecurity efforts in fiscal year 2026. Although cybersecurity is referenced hundreds of times across the NDAA, the legislation contains provisions that, once the law becomes effective, will mark significant shifts in how the

Fortinet, Ivanti, and SAP have moved to address critical security flaws in their products that, if successfully exploited, could result in an authentication bypass and code execution. The Fortinet vulnerabilities affect FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager and relate to a case of improper verification of a cryptographic signature. They are tracked as CVE-2025-59718 andView the full article

Gorodenkoff | shutterstock.com Model Context Protocol (MCP) verbindet KI-Agenten mit Datenquellen und erfreut sich im Unternehmensumfeld wachsender Beliebtheit. Allerdings ist auch MCP nicht frei von Sicherheitslücken, wie entsprechende Entdeckungen, etwa beim SaaS-Anbieter Asana oder dem IT-Riesen Atlassian gezeigt haben. Inzwischen hat sich jedoch einiges in Sachen MCP-Sicherheit getan. Einerseits wurden mit Blick auf das Kernprotokoll etliche Fortschritte erzielt. Beispielsweise in Form v

People Images | shutterstock.com Was gut ist, kommt bekanntlich wieder. So auch das Experten-Netzwerk von CSO Deutschland, Computerwoche und CIO.de. Selbst wenn Sie davon noch nie zuvor etwas gehört haben: Vertrauen Sie uns, dieses Comeback ist eine gute Sache! Personal Brand als Experte ausbauen Denn das deutschsprachige Experten-Netzwerk von Foundry ermöglicht Ihnen als IT- oder Business-Entscheider, Fachexperte oder auch Wissenschaftler ab sofort, sich mit eigenen Fach- oder auch

Gorodenkoff | shutterstock.com Model Context Protocol (MCP) verbindet KI-Agenten mit Datenquellen und erfreut sich im Unternehmensumfeld wachsender Beliebtheit. Allerdings ist auch MCP nicht frei von Sicherheitslücken, wie entsprechende Entdeckungen, etwa beim SaaS-Anbieter Asana oder dem IT-Riesen Atlassian gezeigt haben. Inzwischen hat sich jedoch einiges in Sachen MCP-Sicherheit getan. Einerseits wurden mit Blick auf das Kernprotokoll etliche Fortschritte erzielt. Beispielsweise in Form v

Many enterprises use GitHub Action Secrets to store and protect sensitive information such as credentials, API keys, and tokens used in CI/CD workflows. These private repositories are widely assumed to be safe and locked down. But attackers are now exploiting that blind trust, according to new research from the Wiz Customer Incident Response Team. They found that threat actors are using exposed GitHub Personal Access Tokens (PATs) to access GitHub Action Secrets and sneak into cloud environm

Microsoft is finishing 2025 by issuing only 57 patches for Windows and other products for December Patch Tuesday, but one vulnerability is already being exploited as a zero day and needs to be addressed fast. It’s an escalation of privilege vulnerability in Windows Cloud Files Mini Filter Driver (CVE-2025-62221), described as a use-after-free problem in which a program tries to use a block of memory that has already been returned to system control. The attack complexity is low. The worst cas

Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities. Despite releasing a lower-than-normal number of security updates these past few months, Microsoft patched a whopping 1,129 vulnerabilities in 2025, an 11.9% increase from 2024. According to Satnam Narang at Tenable, this year marks t

Threat actors with ties to North Korea have likely become the latest to exploit the recently disclosed critical security React2Shell flaw in React Server Components (RSC) to deliver a previously undocumented remote access trojan dubbed EtherRAT. "EtherRAT leverages Ethereum smart contracts for command-and-control (C2) resolution, deploys five independent Linux persistence mechanisms, andView the full article

Google is deploying a second AI model to monitor its Gemini-powered Chrome browsing agent after acknowledging the agent could be tricked into taking unauthorized actions through prompt injection attacks. “We’re introducing a user alignment critic where the agent’s actions are vetted by a separate model that is isolated from untrusted content,” the company said in a blog post about the addition. If the critic determines an action doesn’t match what the user asked for, it blocks the action, Go

The physical roots of resilience Five years ago, at 2 a.m., I stood in a data center aisle watching a core switch lose a power supply. The room was cold, the fans loud and the alert light blinked amber. Within four seconds, the backup unit took over. Not a single packet dropped. That seamless, silent shift captured the essence of networking redundancy at its best: automatic, invisible and flawless. It was the kind of moment engineers live for — a quiet victory in the dark. Today, that sa

Four distinct threat activity clusters have been observed leveraging a malware loader known as CastleLoader, strengthening the previous assessment that the tool is offered to other threat actors under a malware-as-a-service (MaaS) model. The threat actor behind CastleLoader has been assigned the name GrayBravo by Recorded Future's Insikt Group, which was previously tracking it as TAG-150.View the full article

Vadi Fuoco – shutterstock.com NIS2 ist symbolisch für das Kernproblem europäischer Richtlinien und Verordnungen: Sie erzeugen unnötigen Papierkrieg und entfalten ihre Wirkung zu selten. Sei es das Lieferkettengesetz, die DSGVO‑Folgenabschätzungen oder das IT‑Sicherheitsgesetz – sie haben gemeinsam, dass Unternehmen gigantische Dokumentationsberge produzieren müssen. Diese erhöhen weder die tatsächliche Sicherheit, noch sind sie realistisch prüfbar. Compliant ist in der Regel derjenige, d

Vadi Fuoco – shutterstock.com NIS2 ist symbolisch für das Kernproblem europäischer Richtlinien und Verordnungen: Sie erzeugen unnötigen Papierkrieg und entfalten ihre Wirkung zu selten. Sei es das Lieferkettengesetz, die DSGVO‑Folgenabschätzungen oder das IT‑Sicherheitsgesetz – sie haben gemeinsam, dass Unternehmen gigantische Dokumentationsberge produzieren müssen. Diese erhöhen weder die tatsächliche Sicherheit, noch sind sie realistisch prüfbar. Compliant ist in der Regel derjenige, d

The threat actor known as Storm-0249 is likely shifting from its role as an initial access broker to adopt a combination of more advanced tactics like domain spoofing, DLL side-loading, and fileless PowerShell execution to facilitate ransomware attacks. "These methods allow them to bypass defenses, infiltrate networks, maintain persistence, and operate undetected, raising serious concerns forView the full article

Zero Trust helps organizations shrink their attack surface and respond to threats faster, but many still struggle to implement it because their security tools don’t share signals reliably. 88% of organizations admit they’ve suffered significant challenges in trying to implement such approaches, according to Accenture. When products can’t communicate, real-time access decisions break down. TheView the full article

Google on Monday announced a set of new security features in Chrome, following the company's addition of agentic artificial intelligence (AI) capabilities to the web browser. To that end, the tech giant said it has implemented layered defenses to make it harder for bad actors to exploit indirect prompt injections that arise as a result of exposure to untrusted web content and inflict harm. ChiefView the full article

Download the December 2025 issue of the Enterprise Spotlight from the editors of CIO, Computerworld, CSO, InfoWorld, and Network World. View the full article

Canadian organizations have emerged as the focus of a targeted cyber campaign orchestrated by a threat activity cluster known as STAC6565. Cybersecurity company Sophos said it investigated almost 40 intrusions linked to the threat actor between February 2024 and August 2025. The campaign is assessed with high confidence to share overlaps with a hacking group known as Gold Blade, which is alsoView the full article

fongbeerredhot – shutterstock.com Im Kampf gegen Anlagebetrüger, «Enkeltrick»-Kriminelle und falsche Polizisten ist den Ermittlern nach eigenen Angaben ein großer Schlag gelungen. Die Infrastruktur der mutmaßlichen Cyberkriminellen sei erheblich geschwächt worden, teilten das bei der Generalstaatsanwaltschaft Karlsruhe eingerichtete Cybercrime-Zentrum Baden-Württemberg, das baden-württembergische Landeskriminalamt (LKA) und die Bundesanstalt für Finanzdienstleistungsaufsicht (Bafin) gemeinsa

fongbeerredhot – shutterstock.com Im Kampf gegen Anlagebetrüger, «Enkeltrick»-Kriminelle und falsche Polizisten ist den Ermittlern nach eigenen Angaben ein großer Schlag gelungen. Die Infrastruktur der mutmaßlichen Cyberkriminellen sei erheblich geschwächt worden, teilten das bei der Generalstaatsanwaltschaft Karlsruhe eingerichtete Cybercrime-Zentrum Baden-Württemberg, das baden-württembergische Landeskriminalamt (LKA) und die Bundesanstalt für Finanzdienstleistungsaufsicht (Bafin) gemeinsa

Cybersecurity researchers have discovered two new extensions on Microsoft Visual Studio Code (VS Code) Marketplace that are designed to infect developer machines with stealer malware. The VS Code extensions masquerade as a premium dark theme and an artificial intelligence (AI)-powered coding assistant, but, in actuality, harbor covert functionality to download additional payloads, takeView the full article

The manufacturing industry is performing better in protecting itself against ransomware, according to a recent study from security provider Sophos. Compared to previous years’ results, many manufacturing companies are now able to stop ransomware attacks before data is encrypted. This year just 40% of cyberattacks against manufacturing entities resulted in data encryption. This is the lowest figure in five years and a decrease from 74% in 2024, Sophos reports. However, data theft remains

Das Open Web Application Security Project (OWASP) gibt Unternehmen eine Checkliste für (mehr) GenAI-Sicherheit an die Hand. Foto: Gannvector | shutterstock.com Während Unternehmen wie OpenAI, Anthropic, Google oder Microsoft aber auch Open-Source-Alternativen bei ihren Generative-AI– und Large-Language-Model-Angeboten exponentielle User-Zuwächse verzeichnen, sind IT-Sicherheitsentscheider bemüht, mit der rasanten KI-Entwicklung in ihren Unternehmen Schritt zu halten. Die Non-Profit-Organisa

A security flaw in the widely-used Apache Tika XML document extraction utility, originally made public last summer, is wider in scope and more serious than first thought, the project’s maintainers have warned. Their new alert relates to two entwined flaws, the first CVE-2025-54988 from August, rated 8.4 in severity, and the second, CVE-2025-66516 made public last week, rated 10. CVE-2025-54988 is a weakness in the tika-parser-pdf-module used to process PDFs in Apache Tika from version 1.

A procurement team throws a small party. They’ve shaved millions off the supplier budget. The CFO beams. The board applauds. Six months later, a cyber incident or supply disruption wipes out those savings in days. The champagne glow fades. This is not fiction. It happens every year in boardrooms that treat procurement as a hunting ground for savings instead of a safeguard for resilience. When cost reduction becomes the primary focus, resilience pays the price, especially in the case of cyber

AI browsers including Perplexity Comet and OpenAI’s ChatGPT Atlas present security risks that cannot be adequately mitigated, and enterprises should prevent employees using them, according to Gartner. “Gartner strongly recommends that organizations block all AI browsers for the foreseeable future because of the cybersecurity risks,” analysts Dennis Xu, Evgeny Mirolyubov, and John Watts wrote in a research note last week. They made their recommendation based on risks they had already identifi

Cybersecurity researchers are calling attention to a new campaign dubbed JS#SMUGGLER that has been observed leveraging compromised websites as a distribution vector for a remote access trojan named NetSupport RAT. The attack chain, analyzed by Securonix, involves three main moving parts: An obfuscated JavaScript loader injected into a website, an HTML Application (HTA) that runs encryptedView the full article

Durch bigjom jom – shutterstock.com Die Sicherheit der Betriebstechnik (Operational Technology – OT) in kritischen Infrastrukturen ist seit Jahren ein immer wiederkehrendes Thema. Nach Ansicht von Sicherheitsorganisationen könnte die vermehrte Nutzung von KI in der OT die Lage noch verschlimmern. Die US-Cybersicherheitsbehörde CISA hat deshalb vor kurzem gemeinsam mit internationalen Partnerbehörden Handlungsempfehlungen zur sicheren Integration künstlicher Intelligenz (KI) in Operationa

It’s been a week of chaos in code and calm in headlines. A bug that broke the internet’s favorite framework, hackers chasing AI tools, fake apps stealing cash, and record-breaking cyberattacks — all within days. If you blink, you’ll miss how fast the threat map is changing. New flaws are being found, published, and exploited in hours instead of weeks. AI-powered tools meant to help developersView the full article

The holiday season compresses risk into a short, high-stakes window. Systems run hot, teams run lean, and attackers time automated campaigns to get maximum return. Multiple industry threat reports show that bot-driven fraud, credential stuffing and account takeover attempts intensify around peak shopping events, especially the weeks around Black Friday and Christmas.  Why holiday peaksView the full article

Cybersecurity researchers have disclosed details of two new Android malware families dubbed FvncBot and SeedSnatcher, as another upgraded version of ClayRat has been spotted in the wild. The findings come from Intel 471, CYFIRMA, and Zimperium, respectively. FvncBot, which masquerades as a security app developed by mBank, targets mobile banking users in Poland. What's notable about the malwareView the full article

A critical security flaw in the Sneeit Framework plugin for WordPress is being actively exploited in the wild, per data from Wordfence. The remote code execution vulnerability in question is CVE-2025-6389 (CVSS score: 9.8), which affects all versions of the plugin prior to and including 8.3. It has been patched in version 8.4, released on August 5, 2025. The plugin has more than 1,700 activeView the full article

The Iranian hacking group known as MuddyWater has been observed leveraging a new backdoor dubbed UDPGangster that uses the User Datagram Protocol (UDP) for command-and-control (C2) purposes. The cyber espionage activity targeted users in Turkey, Israel, and Azerbaijan, according to a report from Fortinet FortiGuard Labs. "This malware enables remote control of compromised systems by allowingView the full article

Over 30 security vulnerabilities have been disclosed in various artificial intelligence (AI)-powered Integrated Development Environments (IDEs) that combine prompt injection primitives with legitimate features to achieve data exfiltration and remote code execution. The security shortcomings have been collectively named IDEsaster by security researcher Ari Marzouk (MaccariTA). They affect popularView the full article

A sprawling academic cheating network turbocharged by Google Ads that has generated nearly $25 million in revenue has curious connections to a Kremlin-connected oligarch whose Russian university builds drones for Russia’s war against Ukraine. The Nerdify homepage. The link between essay mills and Russian attack drones might seem improbable, but understanding it begins with a simple question: How does a human-intensive academic cheating service stay relevant in an era when students can simply a

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday formally added a critical security flaw impacting React Server Components (RSC) to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. The vulnerability, CVE-2025-55182 (CVSS score: 10.0), relates to a case of remote code execution that could be triggered by anView the full article

Plugging the React2Shell vulnerability in the open source React server and Next.js in IT environments has just become even more urgent with reports that exploits are already in the wild. Researchers at Greynoise said today they are seeing “opportunistic, largely automated exploitation attempts” trying to take advantage of the unsafe deserialization vulnerability in React Server Components (RSC). There’s an early focus on attacking just this vulnerability, the report adds, “but we’ve alre