[NEU] [hoch] VMware Tanzu Spring Cloud Gateway Server und Sleuth: Mehrere Schwachstellen

Spring Cloud Gateway vulnerabilities pose denial-of-service and data manipulation risks for microservices architectures commonly deployed in European enterprises.

Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code

Veeam's critical RCE vulnerability exposes backup infrastructure to domain-level attacks, potentially compromising business continuity and recovery capabilities.

Max-Severity Ivanti Flaw Exploited 24 Hours After Disclosure

The immediate exploitation of Ivanti Sentry's maximum-severity flaw demonstrates how threat actors now pre-position for rapid weaponization once vulnerabilities become public.

[UPDATE] [kritisch] Ivanti Sentry: Mehrere Schwachstellen

Critical-severity Ivanti Sentry flaws enable unauthenticated remote attackers to execute arbitrary code with administrative privileges, creating immediate risk for organizations using this mobile device management platform.

[UPDATE] [kritisch] Oracle PeopleSoft: Schwachstelle ermöglicht Codeausführung

Critical Oracle PeopleSoft vulnerability enables complete system takeover, posing existential threat to organizations running HR and financial systems on this platform.

[UPDATE] [hoch] Check Point Remote Access VPN und Mobile Access: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Check Point VPN security bypasses allow unauthenticated access to corporate networks, creating direct exposure for remote workforce infrastructure.

[UPDATE] [hoch] OpenSSL: Mehrere Schwachstellen

High-severity OpenSSL vulnerabilities affect the cryptographic foundation of virtually all enterprise systems, requiring urgent patching across web services, applications, and infrastructure.

CVE-2025-0282 and CVE-2025-0283: Critical Ivanti 0days Exploited in the Wild

Zero-day exploitation of Ivanti Connect Secure introduces immediate enterprise VPN compromise risk, particularly threatening European organizations dependent on these appliances for remote workforce security.

Wiz Research Identifies Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603)

Unauthenticated remote code execution in Aviatrix Controllers enables direct escalation to AWS control plane privileges, creating a critical exposure path for cloud infrastructure managed through these platforms.

A Record-Breaking Patch Tuesday for June 2026

Microsoft's unprecedented 200-vulnerability patch release signals a potential shift toward batch disclosure of accumulated security debt rather than standard monthly maintenance.

CISA orders feds to patch actively exploited Ivanti flaw by Sunday

CISA's new BOD 26-04 mandates a 72-hour patch window for an actively exploited Ivanti Sentry vulnerability — a tempo that signals growing zero-day pressure on edge-gateway appliances common in European enterprises.

SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know

Active SharePoint exploitation campaigns target document repositories containing sensitive enterprise data, requiring immediate patch deployment and access audits.

[NEU] [hoch] Jenkins: Mehrere Schwachstellen

High-severity Jenkins vulnerabilities enable code execution and privilege escalation, threatening CI/CD pipeline integrity across development environments relying on this automation server.

LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE

LiteLLM's addition to CISA's KEV catalog indicates active exploitation of AI infrastructure components, highlighting enterprise AI deployment risks.

Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS

Protocol buffer implementation flaws in Node.js applications create RCE vectors in data serialization layers often overlooked during security assessments.

[UPDATE] [hoch] GitLab: Mehrere Schwachstellen

GitLab vulnerabilities threaten the software development lifecycle integrity across European enterprises increasingly reliant on DevOps automation for digital transformation initiatives.

[UPDATE] [kritisch] vm2: Mehrere Schwachstellen

Critical vm2 sandbox escape vulnerabilities expose Node.js applications to remote code execution, threatening containerized environments widely used in European CI/CD pipelines.

[UPDATE] [hoch] Red Hat Undertow: Mehrere Schwachstellen ermöglichen Umgehung von Sicherheitsmaßnahmen

Red Hat Undertow web server vulnerabilities enable security bypass and data manipulation, affecting enterprise applications built on this Java servlet container technology.

One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public

A single-character Linux kernel flaw demonstrates how minimal code changes can create container escape vulnerabilities with publicly available exploits.

Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now

Chrome's V8 zero-day exploitation underscores browser security as a critical enterprise attack vector requiring immediate patch deployment across distributed workforces.

phpBB forum fixes auth bypass bug lurking for a decade

The decade-long persistence of this phpBB authentication bypass demonstrates how privilege escalation vulnerabilities in widely-deployed open source software can remain hidden in plain sight.

[UPDATE] [mittel] Red Hat Enterprise Linux (giflib): Schwachstelle ermöglicht Codeausführung oder DoS

CERT-Bund updates advisory for giflib vulnerability in Red Hat Enterprise Linux enabling memory corruption attacks that could lead to code execution or denial of service.

[UPDATE] [hoch] Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Multiple browser vulnerabilities affecting Firefox and Thunderbird present enterprise-wide exposure given widespread deployment across European organizations for daily operations.

[UPDATE] [hoch] AMD ARM und EPYC Prozessoren: Mehrere Schwachstellen

AMD processor vulnerabilities affecting ARM and EPYC architectures could enable security bypass attacks at the hardware level, impacting data center and cloud deployments.

[UPDATE] [hoch] strongSwan: Mehrere Schwachstellen ermöglichen Denial of Service und Codeausführung

strongSwan VPN infrastructure faces remote code execution risks from anonymous attackers, threatening secure tunnel integrity across European networks.

[UPDATE] [hoch] Mozilla Firefox und Mozilla Thunderbird: Mehrere Schwachstellen

High-severity Mozilla updates address code execution and security bypass flaws affecting enterprise browser deployments across German organizations.

[UPDATE] [hoch] Keycloak: Mehrere Schwachstellen

High-severity Keycloak identity management vulnerabilities could compromise authentication systems protecting enterprise applications and user access controls.

[NEU] [hoch] Apache OFBiz: Mehrere Schwachstellen

Apache OFBiz enterprise resource planning vulnerabilities allow authenticated attackers to escalate privileges, potentially compromising business-critical financial and operational systems.

[UPDATE] [hoch] Google Chrome/Microsoft Edge: Schwachstelle ermöglicht Codeausführung

High-severity Chrome and Edge vulnerability enables arbitrary code execution, threatening enterprise browser security across widespread desktop deployments.

Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address

The Ghost-Sender Exchange misconfiguration enables email spoofing attacks that could bypass enterprise email authentication controls and regulatory compliance frameworks.

[UPDATE] [mittel] Red Hat Single Sign On: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Authentication bypass vulnerability in enterprise identity platform threatens centralized access controls used by thousands of European organizations for regulatory compliance.

[UPDATE] [mittel] Keycloak: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Identity management bypass affects authentication flows across enterprise SSO deployments relying on Keycloak for access control.

[UPDATE] [mittel] AMD Prozessoren: Schwachstelle ermöglicht Manipulation von Daten

AMD processor vulnerability enables local data manipulation, presenting risks for high-security environments where hardware integrity is critical.

Over 400 Arch Linux packages compromised to push rootkit, infostealer

The compromise of 400+ Arch Linux packages represents a sophisticated supply chain attack targeting developer workstations through trusted community repositories.

Chinese hackers hijack auth flow, spy on isolated network for a decade

This decade-long compromise of authentication infrastructure represents a masterclass in APT persistence, showing how attackers can maintain invisible access by controlling the very systems meant to secure access.

China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade

Enterprise Linux infrastructure faces heightened APT risk as authentication bypass techniques target core system components rather than traditional endpoints.

'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud

The Hades campaign's evolution of Shai-Hulud tactics demonstrates how supply chain attackers adapt existing frameworks rather than developing entirely new attack vectors.

The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm

The group's transition from affiliate to independent operator with worm capabilities represents a concerning evolution in ransomware ecosystem maturity.

ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed

Higher education institutions face disproportionate targeting through enterprise software vulnerabilities, with Oracle ERP systems providing broad access to sensitive academic and research data.

Pharma giant Novo Nordisk discloses breach of clinical trials data

Novo Nordisk's disclosure of a clinical-trials data breach highlights the unique GDPR and health-data-regulation exposure facing EU-headquartered pharma companies, where patient records trigger the strictest processing rules.

Over 73,000 French govt employees affected in Tchap messenger breach

France's government messaging platform breach affecting 73,000 employees highlights risks when secure communication tools become single points of failure for sensitive operations.

Belarus-linked hackers target Gmail accounts of Polish public figures and their families

State-sponsored targeting of personal accounts belonging to officials' family members represents an expansion of traditional espionage tactics beyond professional targets.

Early Warning Signs of Supply-Chain Attacks Live in the Dark Web

Dark-web monitoring of GitHub credential sales and leaked API keys can surface supply-chain compromise indicators well before a downstream attack materialises — a proactive intelligence capability most Mittelstand firms still lack.

Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories

The Miasma worm's self-propagating compromise of Microsoft repositories demonstrates how supply chain attacks can achieve lateral movement within vendor ecosystems.

Silent Ransom Group Hits US Law Firms in Escalating Extortion Attacks

Silent Ransom's multi-vector approach combining social engineering with physical office intrusion represents an escalation beyond traditional ransomware operational models.

When “Hi, This Is IT” Comes Through Microsoft Teams

Enterprise collaboration platforms face elevated phishing risks as attackers exploit trusted internal communication channels to bypass traditional email security controls.

China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance

The botnet's focus on SOHO devices suggests Chinese actors are building distributed reconnaissance infrastructure that could threaten European SME networks.

FBI disrupts massive AI-powered phishing service using a million URLs

The FBI's disruption of this million-URL phishing infrastructure demonstrates how AI-powered cybercrime services are scaling beyond traditional detection capabilities, requiring new defensive approaches.

Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History

DeepSeek database exposure reveals millions of chat logs and internal data, highlighting AI service privacy risks for European enterprise users.

The Invisible Battlefield: How Cyberwar Is Reshaping Everyday Life

Critical infrastructure sectors face escalating nation-state targeting that threatens business continuity beyond traditional IT systems, extending to operational technology and essential services.

NSO Group Hacking WhatsApp Despite Court Order

Commercial spyware vendors continue operations despite legal constraints, demonstrating enforcement challenges for enterprise communication security.

Ukrainian national pleads guilty to role in Conti ransomware operation

Legal accountability for major ransomware groups continues advancing as another Conti operative faces US prosecution, signaling strengthened international cooperation in cybercrime enforcement.

SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents

New benchmark reveals social engineering vulnerabilities in LLM code reviewers, demonstrating how adversaries could manipulate automated pull request workflows to introduce malicious code.

Trust No Skill: Integrity Verification for AI Agent Supply Chains

Third-party AI agent extensions present supply chain risks through hidden vulnerabilities and multi-stage attack sequences that traditional security controls may miss.

COGNITION: From Evaluation to Defense against Multimodal LLM CAPTCHA Solvers

Large language models can now bypass visual CAPTCHAs at scale, fundamentally undermining a core web security assumption relied upon by enterprise authentication flows.

From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails

LLM safety guardrails designed to prevent prompt injection attacks can themselves become targets for denial-of-service attacks, creating availability risks for AI-powered enterprise systems.

Anthropic requires 30 day data retention for Fable and Mythos

Hacking Embodied AI

Physical AI robots entering enterprise environments introduce novel attack vectors combining traditional IoT vulnerabilities with AI manipulation techniques.

MAStrike: Shapley-Guided Collusive Red-Teaming on Multi-Agent Systems

Shapley-value-guided red-teaming of hierarchical multi-agent systems reveals that collusion among specialised AI agents can bypass distributed safety controls — a concern as agentic AI enters finance and software engineering workflows.

Game-Theoretic Multi-Agent Control for Robust Contextual Reasoning in LLMs

A game-theoretic multi-agent control framework addresses prompt-injection and context-poisoning in multi-turn LLM interactions — a defence pattern enterprises should watch as agentic AI moves into production pipelines.

Patcher: Post-Hoc Patching of Backdoored Large Language Models

This post-deployment backdoor remediation technique addresses a critical gap in AI security by enabling organizations to clean compromised models without complete retraining, reducing the operational cost of security incidents.

Security in a Workflow: Exploring Role-Based Agentic Architectures for Vulnerability Handling

Multi-agent AI systems are being designed to handle complete vulnerability management workflows, potentially automating the entire security remediation cycle from detection through verification.

I evaluated 5 LLM agents on patching real-world CVEs. Here is what I found.

From Prompts to Responses: Dual-Sided Data Leakage and Defense in Split Large Language Models

Split learning architectures for LLMs create dual-sided data leakage risks where both user prompts and model responses can expose sensitive information across distributed infrastructure.

[NEU] [mittel] vllm: Schwachstelle ermöglicht Codeausführung

BSI issues a new advisory for vLLM, the popular open-source LLM inference engine — remote code execution risk highlights the attack surface that AI serving infrastructure introduces.

[NEU] [mittel] vllm: Schwachstelle ermöglicht Manipulation von Daten

A file-manipulation flaw in the vLLM inference engine is notable as enterprises scaling GPU workloads with this framework risk unauthorised data tampering in their AI serving layer.

New GitHub Action supply chain attack: reviewdog/action-setup

GitHub Actions supply chain compromise affects reviewdog automation, demonstrating cascading risks in CI/CD dependency chains beyond tj-actions incident.

Software Dark Matter: Gazing at Uncharted Files to Navigate SBOM Integrations

Research identifies 'software dark matter' - untracked files in modern applications that escape SBOM visibility, creating blind spots in European supply chain transparency initiatives.

Config Files That Run Code: Supply Chain Security Blindspot

Bayesian-Calibrated Detection of Hallucinated Package Imports in AI-Assisted Code

AI coding assistants increasingly introduce phantom package dependencies that create supply chain vulnerabilities, requiring new detection methods beyond traditional dependency scanning.

GPS As a Key Distribution Platform

Military-grade encryption key distribution through civilian GPS infrastructure creates unexpected security dependencies for enterprise positioning services.

Defending the Core: A Centrality-Based Protection Strategy for Supply Chain Security in npm Dependency Network

Research proposes centrality-based protection strategies for npm dependencies, potentially helping enterprises prioritize security investments in the most critical supply chain components.

Critical Zcash Vulnerability Found and Fixed

AI-assisted vulnerability research demonstrates accelerated discovery timelines for cryptographic flaws in financial technology infrastructure.

Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility

Cloud logging services become attack targets themselves as adversaries manipulate audit trails to hide their activities and evade detection mechanisms.

Gain visibility into DDoS attacks with flow logs in AWS Shield Advanced

Shield Advanced now emits per-attack flow logs during DDoS events, giving SOC teams real-time traffic metadata instead of post-hoc reconstruction — a significant uplift for incident forensics on AWS.

South Korea hits Coupang with record $409 million fine over data breach

South Korea's record $409 million data breach penalty against Coupang signals increasingly severe regulatory enforcement that European enterprises should anticipate under GDPR and NIS2.

Microsoft Threatening Security Researcher

Microsoft's legal threats against BitLocker exploit researchers highlight growing tension between vulnerability disclosure and corporate liability concerns.

ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances

ServiceNow's security incident demonstrates SaaS platform vulnerabilities can provide unauthorized access to multiple customer environments simultaneously.

Bug Bounty Research Triggers ServiceNow Security Alert

Legitimate bug-bounty probing of ServiceNow instances triggered false-positive breach alerts at multiple organisations, revealing how thin the line is between authorised research and perceived incident response scenarios.

How much of your company's security info ends up on Reddit?

Navigating the New Federal Logging Mandate | OMB Memorandum M-26-14

OMB M-26-14 mandates risk-based federal logging priorities — European firms supplying US agencies should expect stricter log-retention and forwarding requirements in upcoming contract clauses.

Making secret scanning more trustworthy: Reducing false positives at scale

GitHub deploys context-aware LLM verification to reduce secret scanning false positives, potentially improving developer adoption of security tooling.