heise alerts
Google Chrome: Update schließt 429 Sicherheitslücken
Cisco stopft kritische Lücke in Unified CM und mehr
Angreifer können SolarWinds Web Help Desk lahmlegen
heise security
watchguard blog
WatchGuard Named Champion in Omdia Report: Why It Matters for MSPs in 2026
Omdia named WatchGuard a Champion in its 2026 Cybersecurity MSP Leadership Matrix, recognizing our partner-first innovation and MSP growth focus.
What SMBs Really Want from MSPs: Join Our Upcoming Webinar
Discover what SMBs expect from MSPs today and how to adapt your services to stay competitive. Join our webinar and turn insights into growth.
Scaling Security Further: Introducing the New High- Performance Firebox Series
New Firebox appliances deliver ultra-high-speed security performance, enterprise resiliency, and simplified operations for MSPs.
Cybersecurity Operations Are Entering the AI-Native Era
Explore how AI-driven, agentic attacks are overwhelming traditional security operations and why cybersecurity must evolve toward AI-native defense.
85% of Attacks Leverage RDP for Lateral Movement
Discover why lateral movement is hard to detect and how to catch it before it’s too late.
The MSP Evolution: From IT Support to Cybersecurity Leadership
WatchGuard’s latest report reveals how MSPs are evolving into strategic cybersecurity partners focused on AI, resilience, and measurable outcomes.
watchguard pressreleases
WatchGuard Named a Champion in the Omdia Global Cybersecurity MSP Ecosystems Leadership Matrix for Fourth Consecutive Year
Recognition highlights WatchGuard’s continued innovation in helping MSPs scale through its Unified Security Platform®, agentic AI, and expanded cloud security capabilities
WatchGuard Launches New High-Performance Firebox Appliances to Secure Modern Enterprise Networks
New Firebox appliances deliver ultra-high-speed security performance, enterprise resiliency, and simplified operations for MSPs, Campus, and distributed enterprise environments
SMBs Hit a Cybersecurity Breaking Point as 91% Fear AI-Driven Attacks, Driving Shift to MSP-Led Security Models, WatchGuard Finds
New global research shows internal teams can’t keep pace, fueling demand for always-on, outcome-driven security services
WatchGuard Introduces Rai: The Agentic AI Digital Workforce Designed Specifically for MSPs
Shift from Assistive AI to Autonomous Execution to Unlock Scalable, Profitable Growth
WatchGuard Acquires Perimeters.io to Scale Cloud Security for MSPs
Introduces WatchGuard Cloud Detection and Response, extending protection beyond endpoints and networks
WatchGuard and Halo Announce Partnership to Deliver MSP Automation from Alert to Invoice
Integration embeds WatchGuard security operations inside HaloPSA, streamlining ticketing, provisioning, and billing workflows for MSPs
csoonline
Schwachstellen managen: Die besten Vulnerability-Management-Tools
Security-Infotainment: Die besten Hacker-Dokus
Der Kaufratgeber für Breach & Attack Simulation Tools
Google entdeckt erstmals KI-basierten Zero-Day-Exploit
Cybersicherheitsvorschriften: So erfüllen Sie Ihre Compliance-Anforderungen
Customer Identity & Access Management: Die besten CIAM-Tools
secplicity
The Shrinking Exploit Window and What It Means for Cybersecurity Teams
TL;DR The time between vulnerability disclosure and active exploitation is shrinking. In episode 372 of The 443 Security Simplified, WatchGuard’s Marc Laliberte and Adam Winston discuss why the traditional patch window is becoming harder for defenders to rely on. The episode also examines a recent…
DeadLock Ransomware Group Embeds Data Leak Site Within Ransom Note
The DeadLock ransomware operation has existed since mid-2025, with most of the first reported sightings in mid-July, according to ThreatScene. Their report mentioned the group “now conducts double extortion” following a subsequent analysis in September 2025, which revealed newer DeadLock payloads…
Grandoreiro Banking Trojan Targets Europe and Latin America
WatchGuard telemetry identified a campaign associated to Grandoreiro that uses the DLL Side-Loading technique abusing four different softwares, targeting banks in Portugal. Also, it was identified cases of a known campaign that uses a malicious VBS to deliver the malware, targeting companies in…
Grandoreiro Malware Campaign Targets Europe and Latin America
WatchGuard telemetry identified a campaign associated to Grandoreiro that uses the DLL Side-Loading technique abusing four different softwares, targeting banks in Portugal. Also, it was identified cases of a known campaign that uses a malicious VBS to deliver the malware, targeting companies in…
Long Weekend Cybersecurity Checklist
Long weekends are good for people. They're also useful for attackers. That's not fearmongering. It's an operational reality. Threat actors understand how businesses work. They know when staffing is lighter, when response times may be slower, and when IT and security teams are more likely to be…
The IDE Is the New Domain Admin: How Developer Environments Became Ground Zero
I remember my first real dev setup. A beige tower, a copy of Turbo C++, and a dial-up connection that screamed like a fax machine having an existential crisis. The workstation was an island. What lived on it stayed on it. The biggest security risk was a floppy disk from a friend, and even then, you…
thehackernews
U.S. Treasury Lifts Sanctions on Three Individuals Linked to Intellexa and Predator Spyware
The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) on Tuesday removed three individuals linked to the Intellexa Consortium, the holding company behind a commercial spyware known as Predator , from the specially designated nationals list. The names of the individuals are as follows - Merom Harpaz Andrea Nicola Constantino Hermes Gambazzi Sara Aleksandra Fayssal Hamou Hamou was sanctioned by OFAC in March 2024, and Harpaz and Gambazzi were targeted in September 2024 in connection with developing, operating, and distributing Predator. It's currently not known why they were removed from the list. Harpaz is said to be working as a manager of Intellexa S.A., while Gambazzi was identified as the owner of Thalestris Limited and Intellexa Limited. Thalestris, Treasury Department said, held the distribution rights to the spyware, and processed transactions on behalf of other entities within the Intellexa Consortium. It's also the parent company...
IBM Warns of Critical API Connect Bug Allowing Remote Authentication Bypass
IBM has disclosed details of a critical security flaw in API Connect that could allow attackers to gain remote access to the application. The vulnerability, tracked as CVE-2025-13915 , is rated 9.8 out of a maximum of 10.0 on the CVSS scoring system. It has been described as an authentication bypass flaw. "IBM API Connect could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application," the tech giant said in a bulletin. The shortcoming affects the following versions of IBM API Connect - 10.0.8.0 through 10.0.8.5 10.0.11.0 Customers are advised to follow the steps outlined below - Download the fix from Fix Central Extract the files: Readme.md and ibm-apiconnect-<version>-ifix.13195.tar.gz Apply the fix based on the appropriate API Connect version "Customers unable to install the interim fix should disable self-service sign-up on their Developer Portal if enabled, which will help minimise their exp...
Researchers Spot Modified Shai-Hulud Worm Testing Payload on npm Registry
Cybersecurity researchers have disclosed details of what appears to be a new strain of Shai Hulud on the npm registry with slight modifications from the previous wave observed last month. The npm package that embeds the novel Shai Hulud strain is " @vietmoney/react-big-calendar ," which was uploaded to npm back in March 2021 by a user named "hoquocdat." It was updated for the first time on December 28, 2025, to version 0.26.2. The package has been downloaded 698 times since its initial publication. The latest version has been downloaded 197 times. Aikido, which spotted the package, said it has not spotted any major spread or infections following the release of the package. "This suggests we may have caught the attackers testing their payload," security researcher Charlie Eriksen said . "The differences in the code suggests that this was obfuscated again from the original source, not modified in place. This makes it highly unlikely to be a copy-ca...
Trust Wallet Chrome Extension Hack Drains $8.5M via Shai-Hulud Supply Chain Attack
Trust Wallet on Tuesday revealed that the second iteration of the Shai-Hulud (aka Sha1-Hulud) supply chain outbreak in November 2025 was likely responsible for the hack of its Google Chrome extension, ultimately resulting in the theft of approximately $8.5 million in assets. "Our Developer GitHub secrets were exposed in the attack, which gave the attacker access to our browser extension source code and the Chrome Web Store (CWS) API key," the company said in a post-mortem published Tuesday. "The attacker obtained full CWS API access via the leaked key, allowing builds to be uploaded directly without Trust Wallet's standard release process, which requires internal approval/manual review." Subsequently, the attacker is said to have registered the domain "metrics-trustwallet[.]com" and pushed a trojanized version of the extension with a backdoor that's capable of harvesting users' wallet mnemonic phrases to the sub-domain "api.metrics-...
DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users Worldwide
The threat actor behind two malicious browser extension campaigns, ShadyPanda and GhostPoster , has been attributed to a third attack campaign codenamed DarkSpectre that has impacted 2.2 million users of Google Chrome, Microsoft Edge, and Mozilla Firefox. The activity is assessed to be the work of a Chinese threat actor that Koi Security is tracking under the moniker DarkSpectre . In all, the campaigns have collectively affected over 8.8 million users spanning a period of more than seven years. ShadyPanda was first unmasked by the cybersecurity company earlier this month as targeting all three browser users to facilitate data theft, search query hijacking, and affiliate fraud. It has been found to affect 5.6 million users, including 1.3 newly identified victims stemming from over 100 extensions flagged as connected to the same cluster. This also includes an Edge add-on named "New Tab - Customized Dashboard" that features a logic bomb that waits for three days prior to t...
CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution
The Cyber Security Agency of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail email software that could be exploited to achieve remote code execution. The vulnerability, tracked as CVE-2025-52691 , carries a CVSS score of 10.0. It relates to a case of arbitrary file upload that could enable code execution without requiring any authentication. "Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution," CSA said. Vulnerabilities of this kind allow the upload of dangerous file types that are automatically processed within an application's environment. This could pave the way for code execution if the uploaded file is interpreted and executed as code, as is the case with PHP files. In a hypothetical attack scenario, a bad actor could weaponize this vulnerability to place malici...
borncity
BlackHat 2026 in Vegas: Tritt das MSRC gerade in das nächste Fettnäpfchen?
Nach der öffentlich ausgetragenen Auseinandersetzung zwischen dem Microsoft Security Response Center (MSRC) und einem Sicherheitsforscher mit dem Alias Nightmare Eclipse hat Microsoft es sich mit Sicherheitscommunity ziemlich verscherzt. Man versucht zwar nun wenigstens partiell zurückzurudern. Aber für mich sieht es so aus, dass ein Team-Mitglied des MSRC im Vorfeld der BlackHat 2026-Sicherheitskonferenz in Las Vegas zielsicher in das nächste Fettnäpfchen getreten ist.
Windows 11 24H2/25H2: Probleme mit Preview-Update KB5089573 (kollidiert mit VBS)
Ich stelle mal eine Beobachtung zum Preview-Update KB5089573 für Windows 11 24H2 und 25H2 hier ein. Das zum 26. Mai 2026 veröffentlichte Preview Update KB5089573 kann zu Konflikten mit der "Virtualization-based Security" (VBS) führen. Es gibt vereinzelte Berichte, hier im Blog, sowie im Internet, zu Problemen (Hypervisor-Error, BlueScreens und Neustartschleifen), die ich kurz aufgreife.
Microsoft Entra ID: SSPR erfordert ab Sept. 2026 registrierte Authentifizierung
Microsoft will die Sicherheit von Entra ID erhöhen und plant Änderungen für September. Soll Self-Service Password Reset (SSPR) durch Benutzer verwendet werden, müssen ab dem 7. September 2026 registrierte Authentifizierungsmethoden dazu genutzt werden. Das hat Microsoft am 28. Mai 2026 in einer Mitteilung MC1325414 verlauten lassen.
Zerschellt der KI-Traum an den gigantischen (Token-)Kosten?
Platzt die KI-Blase, die sich in den letzten Jahren gebildet hat, demnächst wegen der Nutzungskosten? Rein von der ökonomischen Seite konnten die gigantischen Investitionen in KI-Entwicklung und Rechenzentren sich angesichts der erwartbaren Umsätze nicht "rechnen". Nun erlebt Firmen, die KI anwenden und jetzt erstmal KI-Leistungen wirklich begleichen müssen, einen Kostenschock. Die vermeintliche Killer-Technologie AI erweist sich als "Budget-Killer".
MC1326253: Änderungen bei den Conditional Access-Policies für Windows und macOS
Microsoft hat Änderungen bei den Conditional Access-Policies für Windows und macOS angekündigt, die bereits ab dem 6. Juli 2026 wirksam werden. Die Richtlinien für den bedingten Zugriff (Conditional Access) gelten nun auch für die SSO-Registrierung bei Windows Hello for Business und auf der macOS-Plattform.
Fehler in Microsoft 365 Android-Apps ermöglichte Anmeldetoken-Klau
Den Entwicklern der Microsoft 365-Apps für Android ist ein Fehler bei der Auslieferung passiert. Ein bei der Aktualisierung der Apps versehentlich gesetztes Debug-Flag ermöglichte anderen Apps Kontotokens abzugreifen. Microsoft hat das Problem inzwischen behoben.