28.09. 14:37
heise alerts
heise security
watchguard blog
28.09. 00:00
Your Clients Already Deployed AI. Nobody Sold Them the Security for It.
AI is not just making attacks faster. It is creating a new attack surface inside every client you manage, and a new product line MSPs need to attach before someone else does.
24.09. 00:00
HTTPS Content Inspection: Give Your Firebox a Better View
Encrypted traffic is good for security and privacy. But for security teams, it can also create a visibility gap.
21.09. 00:00
Compliance Without Compromise: Why More Organizations Are Taking Ownership of Their Security Boundaries
Compliance is evolving beyond checklists. Learn how security enclaves, validated cryptography, and boundary ownership can simplify audits and reduce risk.
17.09. 00:00
Attackers Have Changed Their Playbook. Has Your Security Strategy Changed With Them?
Attackers now rely on stolen identities, encrypted traffic, and stealth tactics. Learn how WatchGuard helps MSPs detect, prevent, and respond.
16.09. 00:00
More Vulnerabilities Are Being Found Than Ever Before. That's Good News.
Why record-breaking disclosure numbers are a sign of a healthier industry and how WatchGuard's Firebreak Ideology fits into that shift.
15.09. 00:00
Cloud Risk Management for MSPs: From Visibility to Control
Seeing risk is not the same as ranking it. Discover how the value of a client's data sets the priority of every cloud finding an MSP works on.
watchguard pressreleases
22.09. 00:00
New WatchGuard Threat Report Reveals AI Tooling Underpins Tactical Shift from High-Volume Malware Campaigns to Precision Attacks in 1H 2026
Lower network volume masks broader probing, greater evasion and persistent TLS exposure.
12.08. 00:00
WatchGuard Names Five Winners in $10 Million AI Innovation Challenge
Strong global participation reinforces MSP demand for practical AI innovations that improve security outcomes and operational efficiency
21.07. 00:00
WatchGuard Goes Multi-Model on Frontier AI for Stronger MSP Defense
Participation in OpenAI's Daybreak program and Anthropic's Cyber Verification Program advances vulnerability research, security testing, and proactive threat defense.
14.07. 00:00
Employees Drive Rising Cybersecurity Risk As Shadow AI and Unsafe Work Habits Surge, WatchGuard Global Survey Finds
New Research Highlights Growing Visibility Gap Between Employee Behavior and Organizational Security Controls.
09.07. 00:00
WatchGuard Launches AI Innovation Challenge, Inviting MSPs to Help Shape the Future of AI-Powered Cybersecurity
Part of WatchGuard's $10M AI investment, the challenge will fund selected MSP ideas with up to $100,000 each, and one Grand Prize winner earns an exclusive VIP trip to WatchGuard Impact North America.
07.07. 00:00
WatchGuard Appoints Vincent Hwang as Chief Product Officer to Accelerate Platform Strategy and AI-Driven Innovation
Former Fortinet, Cisco, and Bitdefender leader brings proven track record in scaling cybersecurity platforms, strengthening partner-driven growth, and shaping category-defining product narratives.
csoonline
19.05. 00:00
Analyse
Schwachstellen managen: Die besten Vulnerability-Management-Tools
19.05. 00:00
Tipp
Security-Infotainment: Die besten Hacker-Dokus
13.05. 00:00
Analyse
Der Kaufratgeber für Breach & Attack Simulation Tools
13.05. 00:00
News
Google entdeckt erstmals KI-basierten Zero-Day-Exploit
12.05. 00:00
Analyse
Cybersicherheitsvorschriften: So erfüllen Sie Ihre Compliance-Anforderungen
12.05. 00:00
Analyse
Customer Identity & Access Management: Die besten CIAM-Tools
secplicity
15.09. 00:00
ClickFix + EtherHiding Targets Anglophone Countries with NightshadeC2/CastleRAT
TL;DR Euler Neto, a member of the WatchGuard Threat Lab, identified an active ClickFix and EtherHiding campaign targeting Windows users in Anglophone countries. WatchGuard telemetry observed activity affecting the United States, Canada, United Kingdom, Ireland, Australia, and New Zealand, with the…
13.08. 00:00
Ethereum Malware Loader Targets Portuguese-Speaking Users
TL;DR Cristóbal Tárraga García, a member of the WatchGuard Threat Lab, uncovered a malware loader targeting Portuguese-speaking users that uses an Ethereum smart contract to dynamically locate attacker infrastructure and distribute additional payloads. The multi-stage infection chain combines…
10.08. 00:00
ErrTraffic Malware Campaign: ClickFix and EtherHiding
TL;DR Euler Neto, a member of the WatchGuard Threat Lab identified an active malware campaign using the ErrTraffic Malware-as-a-Service framework to distribute multiple threats through compromised WordPress websites, ClickFix social engineering, and EtherHiding. The campaign uses Polygon blockchain…
27.07. 00:00
When AI Becomes the Attacker: What Autonomous Models Mean for Cybersecurity
Artificial intelligence is no longer just helping cybersecurity teams analyze alerts, write code, or investigate threats. Increasingly capable AI models can now reason through cybersecurity problems, identify vulnerabilities, chain weaknesses together, and autonomously pursue an objective. That…
22.07. 00:00
OpenAI’s Lab Rat Escapes
TL;DR: OpenAI models under evaluation reportedly escaped a restricted lab environment, exploited a zero-day vulnerability to gain internet access, and targeted Hugging Face while attempting to solve a cybersecurity benchmark. The incident highlights the growing risk of autonomous AI-driven attacks…
20.07. 00:00
2026 Cyber Hygiene Report: The Security Tools Are There. The Habits Still Need Work.
Cybersecurity technology continues to improve, but one of the biggest security challenges facing organizations remains surprisingly familiar: human behavior. WatchGuard’s 2026 Cyber Hygiene Report, based on responses from employees at small and midsized businesses across the United States, Europe…
thehackernews
31.12. 00:00
U.S. Treasury Lifts Sanctions on Three Individuals Linked to Intellexa and Predator Spyware
The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) on Tuesday removed three individuals linked to the Intellexa Consortium, the holding company behind a commercial spyware known as Predator , from the specially designated nationals list. The names of the individuals are as follows - Merom Harpaz Andrea Nicola Constantino Hermes Gambazzi Sara Aleksandra Fayssal Hamou Hamou was sanctioned by OFAC in March 2024, and Harpaz and Gambazzi were targeted in September 2024 in connection with developing, operating, and distributing Predator. It's currently not known why they were removed from the list. Harpaz is said to be working as a manager of Intellexa S.A., while Gambazzi was identified as the owner of Thalestris Limited and Intellexa Limited. Thalestris, Treasury Department said, held the distribution rights to the spyware, and processed transactions on behalf of other entities within the Intellexa Consortium. It's also the parent company...
31.12. 00:00
IBM Warns of Critical API Connect Bug Allowing Remote Authentication Bypass
IBM has disclosed details of a critical security flaw in API Connect that could allow attackers to gain remote access to the application. The vulnerability, tracked as CVE-2025-13915 , is rated 9.8 out of a maximum of 10.0 on the CVSS scoring system. It has been described as an authentication bypass flaw. "IBM API Connect could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application," the tech giant said in a bulletin. The shortcoming affects the following versions of IBM API Connect - 10.0.8.0 through 10.0.8.5 10.0.11.0 Customers are advised to follow the steps outlined below - Download the fix from Fix Central Extract the files: Readme.md and ibm-apiconnect-<version>-ifix.13195.tar.gz Apply the fix based on the appropriate API Connect version "Customers unable to install the interim fix should disable self-service sign-up on their Developer Portal if enabled, which will help minimise their exp...
31.12. 00:00
Researchers Spot Modified Shai-Hulud Worm Testing Payload on npm Registry
Cybersecurity researchers have disclosed details of what appears to be a new strain of Shai Hulud on the npm registry with slight modifications from the previous wave observed last month. The npm package that embeds the novel Shai Hulud strain is " @vietmoney/react-big-calendar ," which was uploaded to npm back in March 2021 by a user named "hoquocdat." It was updated for the first time on December 28, 2025, to version 0.26.2. The package has been downloaded 698 times since its initial publication. The latest version has been downloaded 197 times. Aikido, which spotted the package, said it has not spotted any major spread or infections following the release of the package. "This suggests we may have caught the attackers testing their payload," security researcher Charlie Eriksen said . "The differences in the code suggests that this was obfuscated again from the original source, not modified in place. This makes it highly unlikely to be a copy-ca...
31.12. 00:00
Trust Wallet Chrome Extension Hack Drains $8.5M via Shai-Hulud Supply Chain Attack
Trust Wallet on Tuesday revealed that the second iteration of the Shai-Hulud (aka Sha1-Hulud) supply chain outbreak in November 2025 was likely responsible for the hack of its Google Chrome extension, ultimately resulting in the theft of approximately $8.5 million in assets. "Our Developer GitHub secrets were exposed in the attack, which gave the attacker access to our browser extension source code and the Chrome Web Store (CWS) API key," the company said in a post-mortem published Tuesday. "The attacker obtained full CWS API access via the leaked key, allowing builds to be uploaded directly without Trust Wallet's standard release process, which requires internal approval/manual review." Subsequently, the attacker is said to have registered the domain "metrics-trustwallet[.]com" and pushed a trojanized version of the extension with a backdoor that's capable of harvesting users' wallet mnemonic phrases to the sub-domain "api.metrics-...
31.12. 00:00
DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users Worldwide
The threat actor behind two malicious browser extension campaigns, ShadyPanda and GhostPoster , has been attributed to a third attack campaign codenamed DarkSpectre that has impacted 2.2 million users of Google Chrome, Microsoft Edge, and Mozilla Firefox. The activity is assessed to be the work of a Chinese threat actor that Koi Security is tracking under the moniker DarkSpectre . In all, the campaigns have collectively affected over 8.8 million users spanning a period of more than seven years. ShadyPanda was first unmasked by the cybersecurity company earlier this month as targeting all three browser users to facilitate data theft, search query hijacking, and affiliate fraud. It has been found to affect 5.6 million users, including 1.3 newly identified victims stemming from over 100 extensions flagged as connected to the same cluster. This also includes an Edge add-on named "New Tab - Customized Dashboard" that features a logic bomb that waits for three days prior to t...
30.12. 00:00
CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution
The Cyber Security Agency of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail email software that could be exploited to achieve remote code execution. The vulnerability, tracked as CVE-2025-52691 , carries a CVSS score of 10.0. It relates to a case of arbitrary file upload that could enable code execution without requiring any authentication. "Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution," CSA said. Vulnerabilities of this kind allow the upload of dangerous file types that are automatically processed within an application's environment. This could pave the way for code execution if the uploaded file is interpreted and executed as code, as is the case with PHP files. In a hypothetical attack scenario, a bad actor could weaponize this vulnerability to place malici...
borncity
28.09. 00:00
Kritische Schwachstellen in Citrix NetScaler ADC / Citrix NetScaler Gateway (27.9.2026)
Die Gerüchte vom Freitag über größere Schwachstellen in Citrix NetScaler ADC / Citrix NetScaler Gateway, die seit dem 24.9.2026 angegriffen werden, haben sich bestätigt. Citrix hat zum Sonntag, den 27.9.2026 ein Security Bulletin CTX697096 veröffentlicht, das gleich acht kritische Schwachstellen offen legt. Firmware-Updates sind verfügbar, es gilt also unverzüglich selbst verwaltete Citrix-Systeme zu patchen.
28.09. 00:00
OT-Schwachstellenscanning: So gelingt das sichere und effiziente Monitoring von IT und OT!
Werbung – Zur Operational Technology (OT) gehören nicht nur riesige Roboterarme oder SCADA-Systeme. Häufig sind es Wartungs-Gateways von Lieferanten, Verwaltungs-Clients, smarte HLK-Steuerungen (HKL = Heizung, Klima, Lüftung) oder IP-Kameras, die unabsichtlich ins IT-Netz eingebunden wurden und beliebte Angriffsziele für Cyberkriminelle sind. Wer diese blinden Flecken aufdecken will, muss scannen – aber mit OT-spezifischem Feingefühl, um die fragile Steuerungen nicht in den Reboot zu schicken. Wie das gelingt, zeigen wir im folgenden Beitrag.
28.09. 00:00
Rheinland-Pfalz: Landesweite Software-Störung – Citrix-Problem die Ursache? SIT schalte auch ab.
Am heutigen Montag, den 28. September 2026, gibt es in Rheinland-Pfalz eine landesweite Störung des Rechenzentrumsbetriebs. Es heißt, dass die Software in zwei Rechenzentren "heruntergefahren wurde", weil man befürchtet, dass "Sicherheitslücken gegeben haben könnte". Auch die SIT in Nordrhein-Westfalen hat Systeme heruntergefahren. Nachdem das Thema von zwei Seiten durch Leser an mich herangetragen wurde, ziehe ich mal einige Informationen zu einem Blog-Beitrag heraus. Sieht so aus, dass der Citrix-Fall vom Wochenende seine Schatten wirft.
28.09. 00:00
Microsoft stellt Copilot als "neues OS" vor
Noch ein kleiner Nachtrag von letzter Woche, denn da hat Microsoft seinen neuen Copilot vorgestellt. Microsoft Copilot sei neu gestaltet worden, um als Tool seinen Nutzern die Funktionen der nächsten Generation zu bieten, um KI im Arbeitsalltag aufzubauen, anzupassen und zu skalieren, heißt es in der blumigen Ankündigung. Satya Nadella spricht davon, dass man Copilot als neues Betriebssystem für die Arbeit entwickelt habe.
28.09. 00:00
Cybervorfall bei ftapi.com? Opfer der Gentlemen Ransomware?
Es gab möglicherweise einen erfolgreichen Angriff auf FTAP Software, eine Plattform für den DSGVO-konformen Austausch von Daten. Eine Software, die möglicherweise von dem einen oder anderen Leser genutzt wird. Aus der Leserschaft wurde ich über den Cybervorfall informiert. Nun listet die Gentlemen-Ransomware-Gruppe die URL ftapi.com als Opfer auf. Eine offizielle Bestätigung fehlt aber bisher.
28.09. 00:00
SEPA-Störung am 28.9.2028 bei Cleverbridge; Starmoney betroffen
Zum heutigen 28.9.2028 sehen sich Benutzer von Starmoney mit einer Störung von SEPA-Überweisungen konfrontiert. Ein Blog-Leser hat mich auf den Sachverhalt hingewiesen, der von Starmony-Anwendern in deren Forum diskutiert wird. Wie es ausschaut, ist die Ursache beim Anbieter Cleverbridge zu suchen. Derzeit ist mir unklar, wo genau das Problem liegt und wie lange diese Störung noch andauert.