heise alerts
Patchday SAP: Angreifer können Systeme übernehmen
Warnung vor Angriffen auf alte Sicherheitslücken
heise security
watchguard blog
Not Making It Easy for Attackers Also Starts with Catching What Slips Through
Discover why new AI habits mean that security awareness initiatives must be adapted, and how visibility helps reduce business risks.
Rai Expands: WatchGuard’s Agentic AI Digital Workforce Is Now Available
Following its IMPACT debut, Rai is now generally available, bringing agentic AI to managed security with richer insights and Digital Workforce roles.
Spotlighting Success: Meet This Year’s WatchGuard Partner Award Winners
Meet the 2026 WatchGuard Partner Award Winners and celebrate the MSPs and partners driving growth, innovation, marketing, and success.
Strengthening Network Security for Modern Organizations
Discover how Firebox T175, Prime Security Suite, and AP340 Wi‑Fi 7 deliver stronger security, better performance, and simplified management.
Stay Ahead of Cyber Threats This October: Join WatchGuard’s New Webinar Series
Join WatchGuard’s October webinar series to explore cyber threat trends, unified managed security strategies, and NDR for MSPs.
IMPACT 2026: Powering the Next Evolution of the Unified Security Platform
Discover how WatchGuard is evolving its Unified Security Platform with agentic AI, deeper threat visibility, and secure access for modern cyber risks.
watchguard pressreleases
WatchGuard Unveils Major Unified Security Platform® Innovations at IMPACT North America
New innovations help MSPs scale security operations and combat increasingly automated threats
WatchGuard Technologies Appoints Allison Clarke as Vice President of Partner Programs and GTM Strategy
Former Sophos and SonicWall channel leader joins WatchGuard to accelerate a frictionless partner experience and unified go-to-market strategy.
New WatchGuard Threat Report Reveals AI Tooling Underpins Tactical Shift from High-Volume Malware Campaigns to Precision Attacks in 1H 2026
Lower network volume masks broader probing, greater evasion and persistent TLS exposure.
WatchGuard Names Five Winners in $10 Million AI Innovation Challenge
Strong global participation reinforces MSP demand for practical AI innovations that improve security outcomes and operational efficiency
WatchGuard Goes Multi-Model on Frontier AI for Stronger MSP Defense
Participation in OpenAI's Daybreak program and Anthropic's Cyber Verification Program advances vulnerability research, security testing, and proactive threat defense.
Employees Drive Rising Cybersecurity Risk As Shadow AI and Unsafe Work Habits Surge, WatchGuard Global Survey Finds
New Research Highlights Growing Visibility Gap Between Employee Behavior and Organizational Security Controls.
csoonline
Schwachstellen managen: Die besten Vulnerability-Management-Tools
Security-Infotainment: Die besten Hacker-Dokus
Der Kaufratgeber für Breach & Attack Simulation Tools
Google entdeckt erstmals KI-basierten Zero-Day-Exploit
Cybersicherheitsvorschriften: So erfüllen Sie Ihre Compliance-Anforderungen
Customer Identity & Access Management: Die besten CIAM-Tools
secplicity
The Tales of a Trezor Data Breach Victim
Introduction This post is a first-hand experience of all the phishing attempts against me after my data was exposed in four of the recent Trezor-related breaches. All four of these breaches were of Trezor third-party vendors, not Trezor themselves. The post is written as a personal narrative…
AI Cyber Threats: What Defenders Need to Know
72,000 CVEs are projected to be published in 2026, while the median time from vulnerability disclosure to in-the-wild weaponization has fallen to well under 24 hours. Those two figures capture a growing challenge for defenders: more vulnerabilities to manage and less time to respond. Marc and Corey…
The Next Identity Threat Isn’t Human
Cyberattacks do not always begin with malware. Sometimes they start with a job application. Sometimes with a trusted account. And increasingly, they may involve an AI agent operating with access that was originally intended for something much more routine. In Episode 389 of The 443: Security…
ClickFix + EtherHiding Targets Anglophone Countries with NightshadeC2/CastleRAT
TL;DR Euler Neto, a member of the WatchGuard Threat Lab, identified an active ClickFix and EtherHiding campaign targeting Windows users in Anglophone countries. WatchGuard telemetry observed activity affecting the United States, Canada, United Kingdom, Ireland, Australia, and New Zealand, with the…
Ethereum Malware Loader Targets Portuguese-Speaking Users
TL;DR Cristóbal Tárraga García, a member of the WatchGuard Threat Lab, uncovered a malware loader targeting Portuguese-speaking users that uses an Ethereum smart contract to dynamically locate attacker infrastructure and distribute additional payloads. The multi-stage infection chain combines…
ErrTraffic Malware Campaign: ClickFix and EtherHiding
TL;DR Euler Neto, a member of the WatchGuard Threat Lab identified an active malware campaign using the ErrTraffic Malware-as-a-Service framework to distribute multiple threats through compromised WordPress websites, ClickFix social engineering, and EtherHiding. The campaign uses Polygon blockchain…
thehackernews
U.S. Treasury Lifts Sanctions on Three Individuals Linked to Intellexa and Predator Spyware
The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) on Tuesday removed three individuals linked to the Intellexa Consortium, the holding company behind a commercial spyware known as Predator , from the specially designated nationals list. The names of the individuals are as follows - Merom Harpaz Andrea Nicola Constantino Hermes Gambazzi Sara Aleksandra Fayssal Hamou Hamou was sanctioned by OFAC in March 2024, and Harpaz and Gambazzi were targeted in September 2024 in connection with developing, operating, and distributing Predator. It's currently not known why they were removed from the list. Harpaz is said to be working as a manager of Intellexa S.A., while Gambazzi was identified as the owner of Thalestris Limited and Intellexa Limited. Thalestris, Treasury Department said, held the distribution rights to the spyware, and processed transactions on behalf of other entities within the Intellexa Consortium. It's also the parent company...
IBM Warns of Critical API Connect Bug Allowing Remote Authentication Bypass
IBM has disclosed details of a critical security flaw in API Connect that could allow attackers to gain remote access to the application. The vulnerability, tracked as CVE-2025-13915 , is rated 9.8 out of a maximum of 10.0 on the CVSS scoring system. It has been described as an authentication bypass flaw. "IBM API Connect could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application," the tech giant said in a bulletin. The shortcoming affects the following versions of IBM API Connect - 10.0.8.0 through 10.0.8.5 10.0.11.0 Customers are advised to follow the steps outlined below - Download the fix from Fix Central Extract the files: Readme.md and ibm-apiconnect-<version>-ifix.13195.tar.gz Apply the fix based on the appropriate API Connect version "Customers unable to install the interim fix should disable self-service sign-up on their Developer Portal if enabled, which will help minimise their exp...
Researchers Spot Modified Shai-Hulud Worm Testing Payload on npm Registry
Cybersecurity researchers have disclosed details of what appears to be a new strain of Shai Hulud on the npm registry with slight modifications from the previous wave observed last month. The npm package that embeds the novel Shai Hulud strain is " @vietmoney/react-big-calendar ," which was uploaded to npm back in March 2021 by a user named "hoquocdat." It was updated for the first time on December 28, 2025, to version 0.26.2. The package has been downloaded 698 times since its initial publication. The latest version has been downloaded 197 times. Aikido, which spotted the package, said it has not spotted any major spread or infections following the release of the package. "This suggests we may have caught the attackers testing their payload," security researcher Charlie Eriksen said . "The differences in the code suggests that this was obfuscated again from the original source, not modified in place. This makes it highly unlikely to be a copy-ca...
Trust Wallet Chrome Extension Hack Drains $8.5M via Shai-Hulud Supply Chain Attack
Trust Wallet on Tuesday revealed that the second iteration of the Shai-Hulud (aka Sha1-Hulud) supply chain outbreak in November 2025 was likely responsible for the hack of its Google Chrome extension, ultimately resulting in the theft of approximately $8.5 million in assets. "Our Developer GitHub secrets were exposed in the attack, which gave the attacker access to our browser extension source code and the Chrome Web Store (CWS) API key," the company said in a post-mortem published Tuesday. "The attacker obtained full CWS API access via the leaked key, allowing builds to be uploaded directly without Trust Wallet's standard release process, which requires internal approval/manual review." Subsequently, the attacker is said to have registered the domain "metrics-trustwallet[.]com" and pushed a trojanized version of the extension with a backdoor that's capable of harvesting users' wallet mnemonic phrases to the sub-domain "api.metrics-...
DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users Worldwide
The threat actor behind two malicious browser extension campaigns, ShadyPanda and GhostPoster , has been attributed to a third attack campaign codenamed DarkSpectre that has impacted 2.2 million users of Google Chrome, Microsoft Edge, and Mozilla Firefox. The activity is assessed to be the work of a Chinese threat actor that Koi Security is tracking under the moniker DarkSpectre . In all, the campaigns have collectively affected over 8.8 million users spanning a period of more than seven years. ShadyPanda was first unmasked by the cybersecurity company earlier this month as targeting all three browser users to facilitate data theft, search query hijacking, and affiliate fraud. It has been found to affect 5.6 million users, including 1.3 newly identified victims stemming from over 100 extensions flagged as connected to the same cluster. This also includes an Edge add-on named "New Tab - Customized Dashboard" that features a logic bomb that waits for three days prior to t...
CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution
The Cyber Security Agency of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail email software that could be exploited to achieve remote code execution. The vulnerability, tracked as CVE-2025-52691 , carries a CVSS score of 10.0. It relates to a case of arbitrary file upload that could enable code execution without requiring any authentication. "Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution," CSA said. Vulnerabilities of this kind allow the upload of dangerous file types that are automatically processed within an application's environment. This could pave the way for code execution if the uploaded file is interpreted and executed as code, as is the case with PHP files. In a hypothetical attack scenario, a bad actor could weaponize this vulnerability to place malici...
borncity
Patchday: Windows Server-Updates (13. Oktober 2026)
Zum 13. Oktober 2026 (zweiter Dienstag im Monat, Patchday bei Microsoft) wurden verschiedene kumulative Updates für die unterstützten Versionen von Windows Server freigegeben. Nachfolgend habe ich die bereitgestellten Updates samt einigen Details für diese Windows Server-Versionen herausgezogen.
Patchday: Windows 10/11 Updates (13. Oktober 2026)
Am 13. Oktober 2026 (zweiter Dienstag im Monat, Patchday bei Microsoft) hat Microsoft kumulative Updates für die noch unterstützten Client-Betriebssystem-Versionen von Windows 10 (mit ESU-Lizenz) und Windows 11 veröffentlicht. Erstmals wird Windows 11 26H2 mit Updates versehen. Hier einige Details zu diesen Updates, die Schwachstellen sowie Probleme beheben sollen.
Cyberangriff auf Danfoss Kühlanlagen, Details und Hintergründe
Am 12. Oktober 2026 wurde bekannt, dass in französischen Supermarktketten Kühlanlagen remote per Cyberangriff abgeschaltet wurden und Lebensmittel verdarben. Die Schäden könnten in die Millionen gehen. Im Blog-Beitrag zeichne ich einige Erkenntnisse nach, beleuchte, warum die Anlagen am Internet hingen und was schief gelaufen ist.
IT-Sicherheitsvorfall bei Ahold Delhaize (Supermärkte in Niederlande etc.)
Es ging am gestrigen 12. Oktober 2026 etwas unter, weil es in Frankreich zu einem Cyberangriff auf Kühlsysteme, die per Internet erreichbar waren, kam. Hunderte Supermärkte können ihre Tiefkühlwaren wegwerfen. Aber in Belgien sowie in den Niederlanden (und darüber hinaus) hat ein Cyberangriff einige Supermarkt-Ketten von Ahold Delhaize getroffen. Hier eine kurze Nachlese.
Kaspersky-Dienste seit 3 Tagen down; die Schatten von Yandex?
Jemand aus der Leserschaft, der noch auf Produkte und Dienste von Kaspersky setzt? Ich bin gerade informiert worden, dass die "seit drei Tagen down seien". Da ging mir irgendwie sofort "da war doch was mit Angriffen auf drei Yandex-Rechenzentren in Russland" durch den Kopf. Kurzer Blick auf den Sachverhalt.
Windows 11 24H2 / Server 2025: Erinnerung an bevorstehende Änderungen an NTLMv1
Microsoft hat NTLM ja als "deprecated" erklärt und will NTLMv1 auch Sicherheitsgründen beerdigen. Seit September 2025 galt ja bereits der Audit-Modus, mit dem die Protokollierung der NTLMv1-Nutzung auf Clients mit Windows 11 24H2 und neuer aktiviert aktiviert wurde. Zum heutigen 13. Oktober 2026 wird Microsoft beginnen, den Enforcement-Modus zu aktivieren, um die NTLMv1-Nutzung in Windows-Netzwerken zu sperren. Das Rollout per Update erfolgt aber wohl gestuft (und nicht für alle Clients gleichzeitig).