Security News Feed

Qnap-NAS: Unbefugte Dateisystemzugriffe möglich

Warnung vor Attacken auf BeyondTrust-Fernwartungslösungen

Attacken auf Systeme mit FortiSandbox und FortiOS möglich

Dell schließt unzählige Sicherheitslücken in Avamar, iDRAC und NetWorker

Patchday SAP CRM, S/4HANA: Angreifer können Datenbanken beschädigen

Adobe-Patchday: Schadcode-Lücken bedrohen InDesign & Co.

Palantir will Gegendarstellung von Schweizer Magazin gerichtlich durchsetzen

iX-Workshop: Schwachstellen aufdecken – Pentesting mit Open-Source-Tools

IPFire stellt freie Domain-Blockliste DBL vor

Qnap-NAS: Unbefugte Dateisystemzugriffe möglich

iX-Workshop: Angriffe auf Entra ID abwehren

Warnung vor Attacken auf BeyondTrust-Fernwartungslösungen

How to Protect Identity in a World Without VPNs

Anticipating credential compromise is key to protecting client identities. How can MSPs monitor the Dark Web to detect risks early?

Cybersecurity and Scalability: The Pillars Driving Investment in MSPs

Learn how to grow your MSP business through strong cybersecurity and human support that builds trust.

Inside the Threat Landscape: Biannual Cybersecurity Briefing Webinar

Staying ahead of cyber threats has never been more critical, and WatchGuard is here to help you do just that. Join cybersecurity experts Corey Nachreiner (CSO) and Marc Laliberte (Director of Security Operations) on February 19, 2026 for the Inside the Threat Landscape: Biannual Cybersecurity…

How to Migrate from a Traditional Firewall to a Next-Generation Firewall

Find out how to migrate from a traditional firewall to a NGFW to improve security, gain visibility, and protect modern environments.

RIP mVPN: Why ZTNA Is the Future of Secure Access for SMBs

mVPN once powered remote work, trusting network access. Today’s hybrid, cloud-first world outgrew it. ZTNA replaces VPN tunnels with zero-trust security.

CRN Honors Nine WatchGuardians on 2026 Channel Chiefs List

CRN recognizes nine WatchGuard leaders on the 2026 Channel Chiefs list, honoring their impact on partner success, innovation, and channel growth worldwide.

WatchGuard Open MDR Gives MSPs a Faster Path to Enterprise-Grade, High-Margin Managed Security Services Across Existing Customer Environments

Open MDR delivers unified visibility and rapid response across WatchGuard and third-party environments, removing the constraints of single-vendor security models and accelerating MSP time to market

WatchGuard Delivers a Simple Path to Modern Zero Trust Security

A decade of zero trust complexity finally simplified through a unified approach built for MSPs and organizations of every size

Strong, Quiet, Predictable. WatchGuard Delivers Total Protection Without Operational Burden in MITRE ER7 Evaluation.

WatchGuard delivers full coverage with almost no noise in MITRE ATT&CK ER7 testing, giving MSPs stronger protection, faster response, and lower operational burden.

Zero Trust Emerges as Top Growth Opportunity at WatchGuard Partner Roadshow

High partner turnout and strong session engagement signal accelerating demand for advanced security strategies across global MSP market

WatchGuard Accelerates Platform Releases to Advance Four Innovation Spaces Critical for Modern Cybersecurity Success

Company’s rapid release cadence and new product launches mark a major step forward in delivering “Real Security for the Real World”

WatchGuard Appoints Joe Smolarski Chief Executive Officer to Lead a New Chapter in Platform-Driven Cybersecurity Innovation

Veteran industry executive with decades of experience scaling technology firms to build on record performance and drive the next phase of expansion

BSI läutet Ende der klassischen Verschlüsselung ein

Entwickler werden zum Angriffsvektor

Neue Warn-App für Cybervorfälle gestartet

Vorgetäuschte PDFs bergen neue Gefahren

Cyberangriff auf EU-Kommission

Gartner-Prognose: Die sechs wichtigsten Cybersicherheits-Trends für 2026

Ongoing Widespread Credential Harvesting Campaign Targets VPN Providers

Introduction At the turn of the year, we were alerted to a doppelganger domain impersonating WatchGuard’s Mobile VPN with SSL, delivering a malicious spoofed client to steal credentials. Navigating directly to the doppelganger domain resulted in a benign informational WatchGuard VPN page. However…

New Kyber Ransomware Posts U.S. Defense Contractor As First Victim

A new ransomware operation known as Kyber has emerged. Their first and current only posted victim is L3Harris, a major defense contractor in the United States. The operators have provided a timer that ends around 6 PM EST on Sunday, October 19. The group claims to have stolen over 300 GB of data…

dAn0n Hacker Group Reemerges as White Lock Ransomware

The first samples of the new(ish) White Lock ransomware began emerging towards the end of September. The earliest compilation time stamp of the four samples currently on MalwareBazaar, Triage, and VirusTotal is September 29, 2025. It has all the hallmarks of traditional crypto-ransomware: kills anti…

Ransomware Tracker (Entry #152): dAn0n

Entry: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/dan0n The dAn0n Hacker Group, or dAn0n, was first observed in the Spring of 2024. They posted their first victim on their simultaneous dark web and clear net data leak site on March 26. The dAn0n group is often lumped in with…

Global Surge of VPN Exploits: Brute-Force, Blast-RADIUS and Password Spray

The past 18 months have been shaped by a surge in brute-force attacks and critical vulnerabilities (CVEs) targeting VPNs, authentication services, privilege elevation, and denial of service across the network security landscape. This timeline outlines key advisories and CVEs beginning with Cisco…

4 Major UK CyberAttacks and the Year Isn’t Over Yet

Cyberattacks have become the new normal, but 2025 has been particularly brutal for UK businesses. We’re not even through the year, and already four major incidents have shaken industries, disrupted communities, and forced us to think harder about how we deal with cyber threats. Here’s what’s…

U.S. Treasury Lifts Sanctions on Three Individuals Linked to Intellexa and Predator Spyware

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) on Tuesday removed three individuals linked to the Intellexa Consortium, the holding company behind a commercial spyware known as Predator , from the specially designated nationals list. The names of the individuals are as follows - Merom Harpaz Andrea Nicola Constantino Hermes Gambazzi Sara Aleksandra Fayssal Hamou Hamou was sanctioned by OFAC in March 2024, and Harpaz and Gambazzi were targeted in September 2024 in connection with developing, operating, and distributing Predator. It's currently not known why they were removed from the list. Harpaz is said to be working as a manager of Intellexa S.A., while Gambazzi was identified as the owner of Thalestris Limited and Intellexa Limited. Thalestris, Treasury Department said, held the distribution rights to the spyware, and processed transactions on behalf of other entities within the Intellexa Consortium. It's also the parent company...

IBM Warns of Critical API Connect Bug Allowing Remote Authentication Bypass

IBM has disclosed details of a critical security flaw in API Connect that could allow attackers to gain remote access to the application. The vulnerability, tracked as CVE-2025-13915 , is rated 9.8 out of a maximum of 10.0 on the CVSS scoring system. It has been described as an authentication bypass flaw. "IBM API Connect could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application," the tech giant said in a bulletin. The shortcoming affects the following versions of IBM API Connect - 10.0.8.0 through 10.0.8.5 10.0.11.0 Customers are advised to follow the steps outlined below - Download the fix from Fix Central Extract the files: Readme.md and ibm-apiconnect-<version>-ifix.13195.tar.gz Apply the fix based on the appropriate API Connect version "Customers unable to install the interim fix should disable self-service sign-up on their Developer Portal if enabled, which will help minimise their exp...

Researchers Spot Modified Shai-Hulud Worm Testing Payload on npm Registry

Cybersecurity researchers have disclosed details of what appears to be a new strain of Shai Hulud on the npm registry with slight modifications from the previous wave observed last month. The npm package that embeds the novel Shai Hulud strain is " @vietmoney/react-big-calendar ," which was uploaded to npm back in March 2021 by a user named "hoquocdat." It was updated for the first time on December 28, 2025, to version 0.26.2. The package has been downloaded 698 times since its initial publication. The latest version has been downloaded 197 times. Aikido, which spotted the package, said it has not spotted any major spread or infections following the release of the package. "This suggests we may have caught the attackers testing their payload," security researcher Charlie Eriksen said . "The differences in the code suggests that this was obfuscated again from the original source, not modified in place. This makes it highly unlikely to be a copy-ca...

Trust Wallet Chrome Extension Hack Drains $8.5M via Shai-Hulud Supply Chain Attack

Trust Wallet on Tuesday revealed that the second iteration of the Shai-Hulud (aka Sha1-Hulud) supply chain outbreak in November 2025 was likely responsible for the hack of its Google Chrome extension, ultimately resulting in the theft of approximately $8.5 million in assets. "Our Developer GitHub secrets were exposed in the attack, which gave the attacker access to our browser extension source code and the Chrome Web Store (CWS) API key," the company said in a post-mortem published Tuesday. "The attacker obtained full CWS API access via the leaked key, allowing builds to be uploaded directly without Trust Wallet's standard release process, which requires internal approval/manual review." Subsequently, the attacker is said to have registered the domain "metrics-trustwallet[.]com" and pushed a trojanized version of the extension with a backdoor that's capable of harvesting users' wallet mnemonic phrases to the sub-domain "api.metrics-...

DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users Worldwide

The threat actor behind two malicious browser extension campaigns, ShadyPanda and GhostPoster , has been attributed to a third attack campaign codenamed DarkSpectre that has impacted 2.2 million users of Google Chrome, Microsoft Edge, and Mozilla Firefox. The activity is assessed to be the work of a Chinese threat actor that Koi Security is tracking under the moniker DarkSpectre . In all, the campaigns have collectively affected over 8.8 million users spanning a period of more than seven years. ShadyPanda was first unmasked by the cybersecurity company earlier this month as targeting all three browser users to facilitate data theft, search query hijacking, and affiliate fraud. It has been found to affect 5.6 million users, including 1.3 newly identified victims stemming from over 100 extensions flagged as connected to the same cluster. This also includes an Edge add-on named "New Tab - Customized Dashboard" that features a logic bomb that waits for three days prior to t...

CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution

The Cyber Security Agency of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail email software that could be exploited to achieve remote code execution. The vulnerability, tracked as CVE-2025-52691 , carries a CVSS score of 10.0. It relates to a case of arbitrary file upload that could enable code execution without requiring any authentication. "Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution," CSA said. Vulnerabilities of this kind allow the upload of dangerous file types that are automatically processed within an application's environment. This could pave the way for code execution if the uploaded file is interpreted and executed as code, as is the case with PHP files. In a hypothetical attack scenario, a bad actor could weaponize this vulnerability to place malici...

287 Chrome Extensions spionieren 37 Millionen Nutzer aus

Der Google Chrome Store hostet mittlerweile rund 240.000 Erweiterungen für den Google Chrome-Browser, manche mit Millionen Nutzer. Sicherheitsforscher haben diese Extensions analysiert und kamen zu einem unschönen Ergebnis: 287 Chrome Extensions spionieren ihre Nutzer aus. Es gibt wohl rund 37 Millionen Betroffene.

Outlook-Add-in stiehlt ~ 4.000 Anmelde- und Zahlungsdaten

Add-ins sind ja als "Software-Helfer" allgegenwärtig. Aber es droht permanent die Gefahr, dass solche Add-Ins plötzlich schädliche Funktionen implantiert bekommen. Ein einst recht beliebtes Outlook-Add-Ins hat 4.000 Anmeldedaten und Zahlungsdaten abgegriffen, nachdem der Entwickler das Projekt aufgegeben und ein Krimineller die Domain übernommen hat.

AI-Fails und Sicherheitsvorfälle der letzten 12 Monate – ein Grund zur Sorge

Heute noch einige Informationen aus dem Bereich AI. Analyst Miles Deutscher hat sich die Sicherheitsvorfälle der letzten 12 Monate im AI-Bereich angesehen und schlägt Alarm. Zwei KI-Entwickler sind die letzten Tage aus ihrem Job ausgeschieden. LLMs versagten bei Tests gravierend in der Sicherheit, Störungen bei AI-Lösungen im Medizinbereich nehmen zu, und Forscher sehen in KI ein Risiko für den Zusammenbruch ganzer Systeme.

Windows 11 24H2/25H2: Update KB5077181 verursacht Boot-Schleife

Zum 10. Februar 2026 hat Microsoft auch das kumulative Update KB5077181 für Windows 11 24H2/25H2 veröffentlicht. Während sich die Kommentare hier im Blog in Grenzen halten, klagen einige Nutzer darüber, dass das kumulative Update KB5077181 Windows 11 24H2/25H2-Maschinen in einen Boot-Schleife schickt. Hier einige Informationen dazu.

Outlook New: Kategorien können in freigegebenen Postfächern nicht gesetzt werden

Gibt es das nächste Problem mit der Outlook New-App von Microsoft? Könnt ihr bei Outlook New noch Kategorien in freigegebenen, also geteilten, Postfächern setzen, oder ist diese Möglichkeit verschwunden?

Exchange Online: PowerShell Parameter "-Credential" ist veraltet

Microsoft hat zum 12. Februar 2026 noch eine Information für Exchange Online veröffentlicht. Redmond stuft den Parameter "-Credential" in der Exchange Online PowerShell als "deprecated" also veraltet ein. Der Parameter wird nach Juni 2026 nicht mehr in PowerShell-Scripten funktionieren. Administratoren sollten sich daher darum kümmern, dass der Parameter nicht mehr verwendet wird.