heise alerts
heise security
watchguard blog
Autonomous AI Accelerates Cyberattacks and Shrinks Response Time
AI is accelerating cyberattacks and shrinking incident response windows. Learn how MSPs can adapt to this new threat landscape.
Shadow AI: Employees don’t ask IT to use AI tools
Shadow AI is already inside customer environments. MSPs need visibility to detect risks, control SaaS use, and secure AI-driven cloud activity.
Why Every MSP Should Be Offering a 30-Minute Cloud Risk Assessment
Learn how to deliver 30-minute cloud risk assessments that uncover hidden threats, strengthen customer trust, and grow your MSP security business.
The MSP’s Invisible Enemy: How to Pinpoint Friction in Cybersecurity
How to identify operational friction in managed security and maintain control and visibility at scale across your MSP environments.
Why AI Is Becoming an Operational Requirement for Security Teams
Organizations have visibility, but not enough capacity to act. The challenge is turning growing security data into fast, scalable decisions.
The End of the VPN: Why Modern Businesses Are Rethinking Remote Access
Discover why organizations are moving beyond VPNs and adopting Zero Trust access. Join our webinar to learn the future of secure connectivity.
watchguard pressreleases
WatchGuard Named a Champion in the Omdia Global Cybersecurity MSP Ecosystems Leadership Matrix for Fourth Consecutive Year
Recognition highlights WatchGuard’s continued innovation in helping MSPs scale through its Unified Security Platform®, agentic AI, and expanded cloud security capabilities
WatchGuard Launches New High-Performance Firebox Appliances to Secure Modern Enterprise Networks
New Firebox appliances deliver ultra-high-speed security performance, enterprise resiliency, and simplified operations for MSPs, Campus, and distributed enterprise environments
SMBs Hit a Cybersecurity Breaking Point as 91% Fear AI-Driven Attacks, Driving Shift to MSP-Led Security Models, WatchGuard Finds
New global research shows internal teams can’t keep pace, fueling demand for always-on, outcome-driven security services
WatchGuard Introduces Rai: The Agentic AI Digital Workforce Designed Specifically for MSPs
Shift from Assistive AI to Autonomous Execution to Unlock Scalable, Profitable Growth
WatchGuard Acquires Perimeters.io to Scale Cloud Security for MSPs
Introduces WatchGuard Cloud Detection and Response, extending protection beyond endpoints and networks
WatchGuard and Halo Announce Partnership to Deliver MSP Automation from Alert to Invoice
Integration embeds WatchGuard security operations inside HaloPSA, streamlining ticketing, provisioning, and billing workflows for MSPs
csoonline
Schwachstellen managen: Die besten Vulnerability-Management-Tools
Security-Infotainment: Die besten Hacker-Dokus
Der Kaufratgeber für Breach & Attack Simulation Tools
Google entdeckt erstmals KI-basierten Zero-Day-Exploit
Cybersicherheitsvorschriften: So erfüllen Sie Ihre Compliance-Anforderungen
Customer Identity & Access Management: Die besten CIAM-Tools
secplicity
Why CVE Grading Still Matters for Vulnerability Management
Vulnerability management has never been just about finding flaws. It is about understanding which flaws matter most, which ones attackers are likely to exploit, and which ones security teams need to prioritize before they become a real business risk. That is why CVEs, CVSS scores, and vulnerability…
TimbreStealer Malware Targets Mexico Companies with Advanced Evasion Techniques
WatchGuard telemetry identified a campaign associated to TimbreStealer, which is known to target companies based in Mexico. Some behaviors are similar to a previous campaign documented by Cisco Talos in 2024, which has sophisticated techniques to evade detection and difficult analysis. One more new…
NoisyS0cks: Undocumented SOCKS5 Pivot Framework Giving Ransomware Affiliates a Foothold Inside Networks
The WatchGuard Attestation Team has uncovered an undocumented pivot framework written in Golang that opens a Smux-multiplexed SOCKS5-style pivot channel on each compromised host using one of two interchangeable transports: KCP-over-UDP with DTLS obfuscation or Noise-over-TCP with TLS obfuscation…
Iran-Affiliated Cyber-Espionage Against Global High-Value Organizations
The WatchGuard Geopolitical Cyber Report Iran-Affiliated Cyber-Espionage Against Global High-Value Organizations MuddyWater (Seedworm) DLL Side-Loading Campaign Following the U.S.–Iran–Israel Conflict Geopolitical insight, threat intelligence, and practical cyber-risk guidance for the moments when…
test - Lorem ipsum dolor sit amet
Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse…
AI Export Controls, FortiBleed Credentials, and Windows Zero-Days: What Security Teams Should Take Away
Artificial intelligence, exposed edge devices, and vulnerability disclosure are colliding in ways that security teams can no longer treat as separate risks. In Episode 375 of The 443: Security Simplified, WatchGuard’s Marc Laliberte and Corey Nachreiner unpack three timely cybersecurity stories: the…
thehackernews
U.S. Treasury Lifts Sanctions on Three Individuals Linked to Intellexa and Predator Spyware
The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) on Tuesday removed three individuals linked to the Intellexa Consortium, the holding company behind a commercial spyware known as Predator , from the specially designated nationals list. The names of the individuals are as follows - Merom Harpaz Andrea Nicola Constantino Hermes Gambazzi Sara Aleksandra Fayssal Hamou Hamou was sanctioned by OFAC in March 2024, and Harpaz and Gambazzi were targeted in September 2024 in connection with developing, operating, and distributing Predator. It's currently not known why they were removed from the list. Harpaz is said to be working as a manager of Intellexa S.A., while Gambazzi was identified as the owner of Thalestris Limited and Intellexa Limited. Thalestris, Treasury Department said, held the distribution rights to the spyware, and processed transactions on behalf of other entities within the Intellexa Consortium. It's also the parent company...
IBM Warns of Critical API Connect Bug Allowing Remote Authentication Bypass
IBM has disclosed details of a critical security flaw in API Connect that could allow attackers to gain remote access to the application. The vulnerability, tracked as CVE-2025-13915 , is rated 9.8 out of a maximum of 10.0 on the CVSS scoring system. It has been described as an authentication bypass flaw. "IBM API Connect could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application," the tech giant said in a bulletin. The shortcoming affects the following versions of IBM API Connect - 10.0.8.0 through 10.0.8.5 10.0.11.0 Customers are advised to follow the steps outlined below - Download the fix from Fix Central Extract the files: Readme.md and ibm-apiconnect-<version>-ifix.13195.tar.gz Apply the fix based on the appropriate API Connect version "Customers unable to install the interim fix should disable self-service sign-up on their Developer Portal if enabled, which will help minimise their exp...
Researchers Spot Modified Shai-Hulud Worm Testing Payload on npm Registry
Cybersecurity researchers have disclosed details of what appears to be a new strain of Shai Hulud on the npm registry with slight modifications from the previous wave observed last month. The npm package that embeds the novel Shai Hulud strain is " @vietmoney/react-big-calendar ," which was uploaded to npm back in March 2021 by a user named "hoquocdat." It was updated for the first time on December 28, 2025, to version 0.26.2. The package has been downloaded 698 times since its initial publication. The latest version has been downloaded 197 times. Aikido, which spotted the package, said it has not spotted any major spread or infections following the release of the package. "This suggests we may have caught the attackers testing their payload," security researcher Charlie Eriksen said . "The differences in the code suggests that this was obfuscated again from the original source, not modified in place. This makes it highly unlikely to be a copy-ca...
Trust Wallet Chrome Extension Hack Drains $8.5M via Shai-Hulud Supply Chain Attack
Trust Wallet on Tuesday revealed that the second iteration of the Shai-Hulud (aka Sha1-Hulud) supply chain outbreak in November 2025 was likely responsible for the hack of its Google Chrome extension, ultimately resulting in the theft of approximately $8.5 million in assets. "Our Developer GitHub secrets were exposed in the attack, which gave the attacker access to our browser extension source code and the Chrome Web Store (CWS) API key," the company said in a post-mortem published Tuesday. "The attacker obtained full CWS API access via the leaked key, allowing builds to be uploaded directly without Trust Wallet's standard release process, which requires internal approval/manual review." Subsequently, the attacker is said to have registered the domain "metrics-trustwallet[.]com" and pushed a trojanized version of the extension with a backdoor that's capable of harvesting users' wallet mnemonic phrases to the sub-domain "api.metrics-...
DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users Worldwide
The threat actor behind two malicious browser extension campaigns, ShadyPanda and GhostPoster , has been attributed to a third attack campaign codenamed DarkSpectre that has impacted 2.2 million users of Google Chrome, Microsoft Edge, and Mozilla Firefox. The activity is assessed to be the work of a Chinese threat actor that Koi Security is tracking under the moniker DarkSpectre . In all, the campaigns have collectively affected over 8.8 million users spanning a period of more than seven years. ShadyPanda was first unmasked by the cybersecurity company earlier this month as targeting all three browser users to facilitate data theft, search query hijacking, and affiliate fraud. It has been found to affect 5.6 million users, including 1.3 newly identified victims stemming from over 100 extensions flagged as connected to the same cluster. This also includes an Edge add-on named "New Tab - Customized Dashboard" that features a logic bomb that waits for three days prior to t...
CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution
The Cyber Security Agency of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail email software that could be exploited to achieve remote code execution. The vulnerability, tracked as CVE-2025-52691 , carries a CVSS score of 10.0. It relates to a case of arbitrary file upload that could enable code execution without requiring any authentication. "Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution," CSA said. Vulnerabilities of this kind allow the upload of dangerous file types that are automatically processed within an application's environment. This could pave the way for code execution if the uploaded file is interpreted and executed as code, as is the case with PHP files. In a hypothetical attack scenario, a bad actor could weaponize this vulnerability to place malici...
borncity
Microsoft Access: Macht die Aufhebung der Beschränkung der Bildschirmgröße Ärger?
Microsoft rollt wohl einen Fix für Access aus, der die Begrenzung der Bildschirmgröße auf 22 Zoll aufheben soll. Allerdings liegen mir erste Informationen vor, dass es nun Probleme mit der Darstellung von Access-Formularen geben soll. Ich tippe darauf, dass das zusammen hängen könnte.
NIS2-Compliance: Passwörter und MFA richtig umsetzen
Werbung – Die NIS2-Richtlinie der EU verpflichtet über 29.000 Unternehmen dazu, Cybersicherheit ernst zu nehmen. Das bedeutet auch, die Verwaltung von Zugriffsrechten und Identitäten kritisch zu überprüfen. Wenn Sie für die IT-Sicherheit eines betroffenen Unternehmens verantwortlich sind, stellen Sie sich wahrscheinlich die Frage: Was genau muss ich in Bezug auf Passwörter und Authentifizierung tun? Werfen wir einen Blick darauf, welche Anforderungen NIS2 an Identitäts- und Zugriffskontrollen stellt und wie Sie eine praxisnahe Roadmap entwickeln, die in der Praxis funktioniert.
Windows 11 25H2: Startmenü per Gruppenrichtlinien anpassbar
Seit Mai 2026 ermöglicht Microsoft Windows 11-Nutzern in der Version 25H2 die Anpassung des Startmenüs. Für Administratoren besteht die Möglichkeit, dass Startmenü mittels Gruppenrichtlinien anzupassen, die in von Windows 11 25H2 Pro und Enterprise angewandt werden können. Die betreffenden Informationen hat Microsoft die Tage veröffentlicht.
Bayern: Kontrollverlust bei Palantir?
Die US-Software Palantir ist ja in Bayern bei der Polizei im Einsatz. Trotz großer Bedenken seitens der Datenschützer. Es wird behauptet: "In Bayern ist der Einsatz von Palantir sicher, wir haben alles mit unseren Informatikern im Griff". Nun gibt es Informationen, dass dies mitnichten der Fall ist, und dass Bayern die Kontrolle über die eingesetzte Software von Palantir entgleitet oder längst entglitten ist. Es läuft eher auf eine Blindflug "wir wissen nicht, wass abläuft" hinaus.
Deutsche Bank Opfer der UnSafe Ransomware-Gruppe?
Es ist derzeit eine unbestätigte Information, aber die Deutsche Bank wird derzeit auf der Leak-Seite der UnSafe Ransomware-Gruppe als Opfer geführt. Die Gruppe behauptet interne Daten aus der IT-Infrastruktur des Unternehmens erbeutet zu haben. Diese sollen in 8 Tagen veröffentlicht werden, wenn nicht gezahlt wird.
Digital Independence Day: Exchange/Outlook ersetzen; grommunio 2026.06.1 ist da
Wir haben wieder den 1. Sonntag im Monat, also "Digital Independence Day" und Zeit für einen Beitrag zum Thema digitale Souveränität. Das Thema digitale Souveränität in Europa liegt ja seit ca. einem Jahr virulent in der Luft und hat auch die Mainstream-Medien erreicht. Vor einigen Tagen habe ich eine Rückmeldung von René Ketterer Kleinsteuber auf Facebook erhalten, der mir schrieb, dass sie in seinem Umfeld Exchange/Outlook ersetzen. Ich skizziere mal, was ich so erfahren habe. Zudem ist vor einigen Tagen grommunio 2026.06.1 erschienen.