[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service und Privilegieneskalation

Critical Linux kernel privilege escalation vulnerabilities require immediate patching across enterprise infrastructure, particularly affecting containerized environments.

Check Point links VPN zero-day attacks to Qilin ransomware gang

Qilin ransomware operators escalate VPN targeting through zero-day exploitation, highlighting enterprise perimeter vulnerability during active campaigns.

Cisco warns of unpatched SD-WAN zero-day exploited in attacks

Active exploitation of unpatched Cisco SD-WAN zero-day enabling root access demands immediate network segmentation reviews for European enterprise WAN deployments.

Patch Now: Another Palo Alto Auth Bypass Bug Under Active Exploit

Palo Alto GlobalProtect authentication bypass vulnerability faces active exploitation in two documented attack waves since mid-May, requiring immediate patching.

Patch Tuesday, April 2026 Edition

Microsoft's largest-ever patch release addresses 167 vulnerabilities including actively exploited SharePoint and Windows Defender flaws affecting enterprise environments.

Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups

Organizations still running deprecated IKEv1 VPN protocols face immediate password bypass risk from actively exploited Check Point infrastructure.

Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years

Critical Linux kernel privilege escalation enables undetectable root compromise across millions of European enterprise servers—immediate patching required as this represents fundamental OS-level security bypass.

Hades Cluster PyPI Worm Abuses Python Startup Hooks

Critical vulnerabilities in NetScaler ADC exploited in-the-wild: everything you need to know

Active exploitation of NetScaler ADC vulnerabilities threatens enterprise VPN infrastructure requiring immediate patching before weekend attack escalation.

Wiz observes exploitation in the wild of PAN-OS vulnerabilities

Active exploitation campaigns now target two critical PAN-OS flaws, escalating network perimeter risks for European enterprises relying on these firewalls for compliance boundaries.

Critical vulnerabilities in Palo Alto Expedition: everything you need to know

Five critical flaws in network security management tooling create urgent patching requirements for firewall infrastructure teams.

Securing the git push pipeline: Responding to a critical remote code execution vulnerability

GitHub demonstrates incident response excellence by containing a critical git pipeline RCE within two hours, establishing benchmark practices for enterprise DevOps security teams.

[UPDATE] [hoch] Ruby und Ruby on Rails (erb gem): Schwachstelle ermöglicht Codeausführung

Web application frameworks powering European e-commerce and SaaS platforms face template injection vulnerabilities enabling server compromise.

[UPDATE] [hoch] Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Critical automation infrastructure faces remote code execution risks, potentially disrupting DevOps pipelines across enterprise environments that rely on configuration management.

[UPDATE] [hoch] NGINX und NGINX Plus: Mehrere Schwachstellen

Critical NGINX vulnerabilities threaten web server security across enterprise environments, potentially enabling complete system compromise.

March 2026 CVE Landscape: 31 High-Impact Vulnerabilities Identified, Interlock Ransomware Group Exploits Cisco FMC Zero-Day

March vulnerability surge of 139% signals escalating enterprise risk, with ransomware groups actively weaponizing zero-days in critical infrastructure products like Cisco FMC.

Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation

CISA's addition of Oracle WebLogic CVE-2024-21182 to KEV catalog indicates enterprise Java infrastructure faces immediate patch priority for this actively exploited flaw.

Gemeinsamer Sicherheitshinweis (BfV und BSI) - Auskundschaftung schlecht geschützter PV-Anlagen durch staatliche Cyberakteure

German intelligence warns of state-sponsored reconnaissance targeting inadequately secured photovoltaic installations across critical infrastructure sectors.

Harvard and 140 other legitimate websites compromised

Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months

Financial sector espionage campaign reveals sophisticated data exfiltration techniques designed to evade cloud security monitoring in regulated industries.

Compromised Microsoft Key: More Impactful Than We Thought

Cryptographic key compromise at identity provider scale affects authentication trust across entire Microsoft ecosystem, forcing enterprise-wide credential rotation strategies.

Synthetic APTs: the Collapse of TTP-Based Attribution

Synthetic APT research challenges TTP-based attribution fundamentals, suggesting threat intelligence sharing frameworks may need restructuring as adversaries adopt AI-generated tactics.

China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa

European expansion of Chinese threat group signals intensified cyber espionage targeting against EU economic interests and critical infrastructure.

DriveSurge Hijacks Thousands of Sites for ClickFix, FakeUpdate Attacks

DriveSurge operation compromises thousands of legitimate websites through malicious traffic distribution to deliver ClickFix and FakeUpdate malware campaigns.

[tl;dr sec] #331 - How Adversaries Use AI, Skill Issues, Using IDEs for C2

Google analysis reveals threat actors leveraging AI for enhanced operations while VS Code dev tunnels emerge as novel C2 infrastructure, bypassing traditional detection.

Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite

Multi-stage social engineering campaign demonstrates evolution toward persistent, relationship-based attacks that bypass traditional technical controls.

Meta Says 20,000 Instagram Accounts Hacked via AI Tool Abuse

Iran Expands Handala Brand to Physical Threats

Iranian intelligence escalates hybrid warfare by merging cyber operations with physical proxy attacks, potentially affecting European entities with US/Israeli connections.

Anti-DDoS Firm Heaped Attacks on Brazilian ISPs

Brazilian DDoS protection vendor weaponized own infrastructure against competitors, highlighting supply chain trust risks in cybersecurity service providers.

Russia upgrades rules for its digital spy system to better track citizens online

Russia's enhanced SORM surveillance system creates precedent for state-level digital monitoring that European enterprises should anticipate in authoritarian markets.

TRACE: Trajectory Reasoning through Adaptive Cross-Step Evidence Aggregation for LLM Agents

Research proposes monitoring framework for LLM agents that could execute covert sabotage through benign-seeming action sequences, addressing blind spots in current enterprise AI governance.

Extracting Recurring Vulnerabilities from Black-Box LLM-Generated Software

LLM code generation creates predictable vulnerability patterns that enterprise development teams must systematically identify and remediate.

Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts

High-profile Instagram account takeovers via AI chatbot manipulation expose enterprise customer service automation as new social engineering attack vector.

Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting

Bissa Scanner demonstrates how threat actors now integrate Claude and OpenClaw AI assistants into operational workflows for large-scale credential harvesting campaigns.

[tl;dr sec] #327 - Finding Zero-days with Any Model, Practical Package Security, Measuring the AI Offense-Defense Gap

Google's Niels Provos demonstrates that commodity AI models can discover zero-day vulnerabilities, fundamentally shifting the threat landscape where attackers now have democratized access to advanced exploit discovery capabilities.

Vulnerability Disclosure in the Age of AI

AI models now discover vulnerabilities faster than human teams can patch them, fundamentally breaking traditional disclosure timelines for enterprise security.

DPAgent-in-the-Middle: Agentic Defense and Repair Against AI-Groomed Deceptive Patterns

LLMs now weaponize privacy dark patterns more effectively than static approaches, requiring agentic countermeasures for GDPR-compliant interface design.

How are regulated orgs actually letting engineers use Claude Code / Copilot?

[tl;dr sec] #324 - OpenAI's GPT-5.4-Cyber, Solve by Default, GitHub Action Security

OpenAI launches cyber-specific LLM variant alongside early access program, potentially shifting enterprise AI adoption timelines for security operations and threat modeling workflows.

s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know

Enterprise development pipelines face critical exposure through compromised JavaScript toolchain targeting organizational secrets and CI/CD infrastructure.

Detecting npm Native Addon Malware: node-gyp Abuse

Rust-Written IronWorm Hits NPM Supply Chain

Rust-based NPM supply chain attack demonstrates credential harvesting persistence across developer environments, requiring immediate dependency scanning protocol reviews.

Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm

Miasma campaign's compromise of Red Hat npm packages with self-propagating worms represents escalating sophistication in supply chain attacks targeting enterprise development environments.

GitHub Actions dumped our unmasked API keys into the build logs yesterday. HELP ME

GitHub expands application security coverage with AI‑powered detections

GitHub integrates AI-powered vulnerability detection with CodeQL extending coverage beyond traditional SAST limitations to identify complex application security flaws across more frameworks.

The Custody Envelope Threshold: Authority-Scaled Admission of External Artifacts in Institutional Infrastructure

Enterprise dependency sprawl across registries, CI/CD actions, and AI tools creates supply-chain blind spots that current authority models cannot adequately govern.

[tl;dr sec] #325 - Dissecting Mythos, The $0 Security Stack, GitHub Action Red Team Framework

New CI/CD post-exploitation framework enables full TeamPCP attack replication, highlighting supply chain risks in automated deployment pipelines across European enterprises.

EU unveils tech sovereignty package to cut reliance on US, Chinese suppliers

EU's Chips Act 2.0 and Cloud and AI Development Act represent the bloc's most ambitious attempt to reduce strategic dependency on US and Chinese technology suppliers.

Online Safety Regulation Increases Privacy Risk: Evidence from the UK Online Safety Act

UK Online Safety Act creates privacy paradox where age verification requirements may drive users toward less secure platforms, offering lessons for NIS2 implementation across EU.

LinkedIn locks your GDPR rights behind a paywall

Apple removes Russia’s state-backed messaging app Max from its store

Apple's removal of Russia's state-backed Max messaging app signals potential regulatory coordination between tech platforms and Western sanctions regimes.

FTC considers setting aside or modifying $150 million privacy penalty against X

Corporate restructuring used to challenge existing privacy penalties creates precedent concern for European compliance teams managing GDPR fines through organizational changes.

Anthropic to Open Mythos AI to EU's ENISA

ENISA gains access to Anthropic's Mythos AI through Project Glasswing, strengthening EU-US cooperation on AI security assessment capabilities.

Microsoft's Zero-Day Legal Threats Spark Backlash

Microsoft's threat of criminal prosecution against researchers publishing zero-days highlights growing tension between coordinated disclosure and public vulnerability research.

Post-Quantum Cryptography and Quantum-Safe Security: A Comprehensive Survey

NIST post-quantum standards transition from ML-KEM to ML-DSA requires immediate enterprise cryptographic architecture planning.

Quantum Risk Explained

European enterprises must begin quantum-safe cryptography migration now as adversaries collect encrypted data for future quantum decryption capabilities.

A commercially-available quantum chip will supposedly arrive in 2029 from Microsoft. Does this influence your view of how soon post-quantum cryptographic threats will be a reality?

Database of Malicious Browser Extensions

Netmirror exposed - The Free Movie App That Was Robbing You Blind

Hypotheses, telemetry, and human judgment: Inside Cisco Talos Threat Hunting

Hypothesis-driven threat hunting methodology combines multi-domain telemetry analysis to detect advanced persistent threats operating below automated detection thresholds.

GCD: Garbled, Corrected, Demonstrandum -- Fixing and Proving Go's Extended GCD Implementation

Critical RSA key generation flaw discovered in Go's standard library despite direct BoringSSL porting, affecting enterprise cryptographic foundations.

Cyber Insurance Rates Are Dropping, but Exclusions Widen

European enterprises face tighter exclusions in cyber policies despite premium reductions, potentially leaving social engineering incidents uncovered during NIS2 compliance planning.

Empirical Evaluation of Large Language Models for Migration of Code Fragments to Post-Quantum Cryptography

LLM evaluation for post-quantum cryptography migration reveals automation potential for the massive code refactoring enterprises face before cryptographic agility deadlines.

Investing in the people shaping open source and securing the future together

GitHub's Alpha-Omega partnership and maintainer funding initiatives address supply chain security concerns particularly relevant for EU organizations facing NIS2 and CRA compliance requirements.

Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack

Microsoft repositories falling to supply chain worms highlights enterprise risk from trusting major vendor code without internal verification processes.

EDRChoker: Choking The Telemetry Stream to Bypass Defenses

Your Supply Chain Breach Is Someone Else's Payday

TeamPCP supply chain attack demonstrates how compromised developer tools enable multi-stage fraud operations, from credential harvesting to payroll manipulation and ransomware deployment.

Anthropic's open-source framework for AI-powered vulnerability discovery

CrowdStrike LogScale queries I use to detect LOLBin- built from 10 years of production SOC work

AWS Console Session Traceability: How Attackers Obfuscate Identity Through the AWS Console

AWS console session logging gaps enable attackers to mask their identity during post-compromise activities, requiring additional SourceIdentity configuration for proper attribution.