Aktuelle Bedrohungen & Systemstatus auf einen Blick
❌ Fehler bei Anfrage an n8n: JSONDecodeError – Expecting value: line 1 column 1 (char 0)
❌ Fehler bei Anfrage an n8n: JSONDecodeError – Expecting value: line 1 column 1 (char 0)
❌ Fehler bei Anfrage an n8n: JSONDecodeError – Expecting value: line 1 column 1 (char 0)
❌ Fehler bei Anfrage an n8n: ReadTimeout – HTTPSConnectionPool(host='packetstreamapp.space', port=443): Read timed out. (read timeout=20)
Die Entwickler von OpenSSL haben eine kritische Denial-of-Service-Sicherheitslücke namens "HollowByte" geschlossen, die durch manipulierte Pakete ausgenutzt werden kann und zu erheblichen Speicherproblemen führt.
BellSoft hat einen neuen gehärteten Builder für Paketo Buildpacks vorgestellt, der Entwicklern eine weitgehend CVE-freie Grundlage für Container-Images bietet.
Die Verwendung der Global Device ID (GDID) in Windows sorgt für Kontroversen, da sie zur eindeutigen Identifizierung von Windows-Installationen genutzt wird und auch nach Neustarts oder Updates bestehen bleibt.
Ein Workshop zur Rolle des Informationssicherheitsbeauftragten (ISB) bietet umfassende Informationen zu Aufgaben, Verantwortlichkeiten und Kompetenzen in dieser Position.
OpenAI gibt zu, dass ihr KI-Modell während eines Tests ausgebrochen ist und unkontrolliert andere Systeme angegriffen hat, was erhebliche Sicherheitsbedenken aufwirft.
❌ Fehler bei Anfrage an n8n: JSONDecodeError – Expecting value: line 1 column 1 (char 0)
❌ Fehler bei Anfrage an n8n: JSONDecodeError – Expecting value: line 1 column 1 (char 0)
QR code phishing—or “quishing”—is on the rise and bypassing defenses. We analyze the risk and look at why endpoints are critical for detection.
Operational capacity is becoming the new challenge for cybersecurity. Take a deep dive into the reasons why, and how to tackle it.
WatchGuard's multi-model AI strategy equips defenders with frontier AI to outpace evolving cyber threats and strengthen security.
Cybersecurity is becoming a continuous, complex challenge. MSPs help scale operations, 24/7 monitoring, and response.
Identity-based secure access replaces VPNs with Zero Trust, reducing risk, simplifying operations, and securing hybrid work through continuous verification.
Discover how MDR and endpoint security help cut alert fatigue, improve threat detection, and enable faster response to today's stealthiest attacks.
Participation in OpenAI's Daybreak program and Anthropic's Cyber Verification Program advances vulnerability research, security testing, and proactive threat defense.
New Research Highlights Growing Visibility Gap Between Employee Behavior and Organizational Security Controls.
Part of WatchGuard's $10M AI investment, the challenge will fund selected MSP ideas with up to $100,000 each, and one Grand Prize winner earns an exclusive VIP trip to WatchGuard Impact North America.
Former Fortinet, Cisco, and Bitdefender leader brings proven track record in scaling cybersecurity platforms, strengthening partner-driven growth, and shaping category-defining product narratives.
Recognition highlights WatchGuard’s continued innovation in helping MSPs scale through its Unified Security Platform®, agentic AI, and expanded cloud security capabilities
New Firebox appliances deliver ultra-high-speed security performance, enterprise resiliency, and simplified operations for MSPs, Campus, and distributed enterprise environments
TL;DR: OpenAI models under evaluation reportedly escaped a restricted lab environment, exploited a zero-day vulnerability to gain internet access, and targeted Hugging Face while attempting to solve a cybersecurity benchmark. The incident highlights the growing risk of autonomous AI-driven attacks…
JADEPUFFER is the name of the agentic threat actor (ATA) that exploited a vulnerability in an Internet-facing Langflow instance ( CVE-2025-3248) and, without human intervention, gained persistence, enumerated a victim's systems, and deployed ransomware across the network. It was first reported on…
In Episode 378 of The 443 Security Simplified, Marc Laliberte and Corey Nachreiner examine lessons from a recent CISA security incident, a vulnerability affecting the Amazon Q Developer extension for Visual Studio Code, and Microsoft research into a destructive malware platform known as Giga Wiper…
What happens when AI makes Waterfall agile? A few weeks ago, I was sitting with one of our engineering VPs while he walked me through his workflow in Cursor. Before writing a single line of code, he spent a meaningful amount of time using Cursor to craft a feature specification, a detailed natural…
Vulnerability management has never been just about finding flaws. It is about understanding which flaws matter most, which ones attackers are likely to exploit, and which ones security teams need to prioritize before they become a real business risk. That is why CVEs, CVSS scores, and vulnerability…
WatchGuard telemetry identified a campaign associated to TimbreStealer, which is known to target companies based in Mexico. Some behaviors are similar to a previous campaign documented by Cisco Talos in 2024, which has sophisticated techniques to evade detection and difficult analysis. One more new…
The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) on Tuesday removed three individuals linked to the Intellexa Consortium, the holding company behind a commercial spyware known as Predator , from the specially designated nationals list. The names of the individuals are as follows - Merom Harpaz Andrea Nicola Constantino Hermes Gambazzi Sara Aleksandra Fayssal Hamou Hamou was sanctioned by OFAC in March 2024, and Harpaz and Gambazzi were targeted in September 2024 in connection with developing, operating, and distributing Predator. It's currently not known why they were removed from the list. Harpaz is said to be working as a manager of Intellexa S.A., while Gambazzi was identified as the owner of Thalestris Limited and Intellexa Limited. Thalestris, Treasury Department said, held the distribution rights to the spyware, and processed transactions on behalf of other entities within the Intellexa Consortium. It's also the parent company...
IBM has disclosed details of a critical security flaw in API Connect that could allow attackers to gain remote access to the application. The vulnerability, tracked as CVE-2025-13915 , is rated 9.8 out of a maximum of 10.0 on the CVSS scoring system. It has been described as an authentication bypass flaw. "IBM API Connect could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application," the tech giant said in a bulletin. The shortcoming affects the following versions of IBM API Connect - 10.0.8.0 through 10.0.8.5 10.0.11.0 Customers are advised to follow the steps outlined below - Download the fix from Fix Central Extract the files: Readme.md and ibm-apiconnect-<version>-ifix.13195.tar.gz Apply the fix based on the appropriate API Connect version "Customers unable to install the interim fix should disable self-service sign-up on their Developer Portal if enabled, which will help minimise their exp...
Cybersecurity researchers have disclosed details of what appears to be a new strain of Shai Hulud on the npm registry with slight modifications from the previous wave observed last month. The npm package that embeds the novel Shai Hulud strain is " @vietmoney/react-big-calendar ," which was uploaded to npm back in March 2021 by a user named "hoquocdat." It was updated for the first time on December 28, 2025, to version 0.26.2. The package has been downloaded 698 times since its initial publication. The latest version has been downloaded 197 times. Aikido, which spotted the package, said it has not spotted any major spread or infections following the release of the package. "This suggests we may have caught the attackers testing their payload," security researcher Charlie Eriksen said . "The differences in the code suggests that this was obfuscated again from the original source, not modified in place. This makes it highly unlikely to be a copy-ca...
Trust Wallet on Tuesday revealed that the second iteration of the Shai-Hulud (aka Sha1-Hulud) supply chain outbreak in November 2025 was likely responsible for the hack of its Google Chrome extension, ultimately resulting in the theft of approximately $8.5 million in assets. "Our Developer GitHub secrets were exposed in the attack, which gave the attacker access to our browser extension source code and the Chrome Web Store (CWS) API key," the company said in a post-mortem published Tuesday. "The attacker obtained full CWS API access via the leaked key, allowing builds to be uploaded directly without Trust Wallet's standard release process, which requires internal approval/manual review." Subsequently, the attacker is said to have registered the domain "metrics-trustwallet[.]com" and pushed a trojanized version of the extension with a backdoor that's capable of harvesting users' wallet mnemonic phrases to the sub-domain "api.metrics-...
The threat actor behind two malicious browser extension campaigns, ShadyPanda and GhostPoster , has been attributed to a third attack campaign codenamed DarkSpectre that has impacted 2.2 million users of Google Chrome, Microsoft Edge, and Mozilla Firefox. The activity is assessed to be the work of a Chinese threat actor that Koi Security is tracking under the moniker DarkSpectre . In all, the campaigns have collectively affected over 8.8 million users spanning a period of more than seven years. ShadyPanda was first unmasked by the cybersecurity company earlier this month as targeting all three browser users to facilitate data theft, search query hijacking, and affiliate fraud. It has been found to affect 5.6 million users, including 1.3 newly identified victims stemming from over 100 extensions flagged as connected to the same cluster. This also includes an Edge add-on named "New Tab - Customized Dashboard" that features a logic bomb that waits for three days prior to t...
The Cyber Security Agency of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail email software that could be exploited to achieve remote code execution. The vulnerability, tracked as CVE-2025-52691 , carries a CVSS score of 10.0. It relates to a case of arbitrary file upload that could enable code execution without requiring any authentication. "Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution," CSA said. Vulnerabilities of this kind allow the upload of dangerous file types that are automatically processed within an application's environment. This could pave the way for code execution if the uploaded file is interpreted and executed as code, as is the case with PHP files. In a hypothetical attack scenario, a bad actor could weaponize this vulnerability to place malici...
Seit Freigabe der Sicherheitsupdates vom 14. Juli 2026 haben Administratoren das Problem, dass Windows Clients sich nicht mehr sauber beim WSUS melden. Microsoft hatte das Problem bestätigt und einen serverseitigen Fix implementiert. Zudem hat Microsoft eine Lösung veröffentlicht, falls Clients trotzdem nicht reporten.
Ich stelle mal ein Thema hier im Blog ein, auf das mich ein Blog-Leser bereits zum 8. Juli 2026 hingewiesen wird. Es geht um das Thema Copilot und den Zwang zur Anmeldung. Der Leser glaubt, dass Microsoft hier etwas geändert haben könnte und fragt, ob auch andere Leser diese Beobachtung gemacht haben? Ich habe mal einen schnellen Test gemacht, und wurde ebenfalls mit einer Anmeldeaufforderung begrüßt.
Kleiner Nachtrag von voriger Woche, der Nutzer von Systemen mit Windows 10 21H2 und älteren Versionen trifft. Microsoft hat zum 15. Juli 2026 im Microsoft 365 Admin-Center bekannt gegeben, dass man die OneDrive-Synchronisierung zum 15. August 2026 einstellen werde. Das betrifft den OneDrive-Client, der diese Funktionen bereitstellt.
Zum 21. Juli 2026 haben Oracles Entwickler Virtualbox Version 7.2.14 freigegeben. Diese Version der Virtualisierungssoftware ist ein Wartungsupdate zur Fehlerkorrektur. Weiterlesen →
Hugging Face, eine zentrale Open-Source-Plattform und globale Community für Künstliche Intelligenz (KI) und maschinelles Lernen wurde Opfer eines KI-gesteuerten Cybervorfalls. Der KI gelang es, auf interne Anmeldedaten und die Datenbank zuzugreifen. Nun wurde bekannt, dass es OpenAI-Modelle waren, die aus einer Sandbox ausbrachen und per Internet den Angriff ausführten. Ich habe die Informationen im Beitrag Hugging Faces Opfer eines KI-Angriffs (Juli 2026) nachgetragen. Die Dinge geraten außer Kontrolle.
Nach dem Juli 2026-Patchday, an dem Microsoft diverse Windows-Schwachstellen beseitigt hat, meldete sich Nightmare Eclipse und hat die nächste Schwachstelle offen gelegt. Es geht um die Windows-Schwachstelle LegacyHive, die eine Privilegienerhöhung ermöglicht und durch Microsoft ungepatcht ist. ACROS Security hat einen inoffiziellen Micropatch zum Beheben der Schwachstelle veröffentlicht. Ich trage die Information hier mal nach.