SAP warns of critical flaws in NetWeaver and Commerce Cloud

Three critical SAP flaws in NetWeaver, Commerce Cloud, and AppRouter demand urgent patching — European enterprises running SAP-centric landscapes face elevated ERP exposure.

15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros

CVE-2026-43499 (GhostLock) exposes a 15-year-old Linux kernel locking flaw enabling any local user to achieve root and escape containers—affecting virtually every mainstream distribution since 2011 and demanding immediate patching.

[NEU] [hoch] JetBrains TeamCity: Mehrere Schwachstellen

BSI flags high-severity flaws in JetBrains TeamCity enabling RCE, data manipulation, and XSS — a direct threat to CI/CD pipeline integrity and software supply-chain trust across European enterprises.

[UPDATE] [hoch] Splunk Splunk Enterprise: Mehrere Schwachstellen

CERT-Bund escalates multiple high-severity Splunk Enterprise flaws spanning RCE, data manipulation, and DoS — a direct threat to organisations relying on Splunk as their security backbone.

Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days

Microsoft's largest-ever Patch Tuesday addresses 570 flaws including two actively exploited zero-days — European enterprises should treat the sheer scope as a stress test for patch-management SLAs.

[UPDATE] [hoch] Microsoft Windows: Mehrere Schwachstellen

BSI updates its high-severity advisory for Windows client and server, covering privilege escalation to admin, RCE, and spoofing—European enterprises should accelerate Patch Tuesday rollouts.

CISA warns of actively exploited RCE flaws in Joomla extensions

CISA flags active exploitation of file-upload RCE in two Joomla extensions—many Mittelstand web presences still run unpatched Joomla stacks, making rapid triage essential.

[UPDATE] [kritisch] Wazuh Manager: Schwachstelle ermöglicht Privilegieneskalation

A critical BSI-rated vulnerability in Wazuh Manager allows remote, unauthenticated privilege escalation — compromising the very SIEM/XDR platform defenders depend on, making this a top-priority patch.

Russia's FSB blamed for Poland grid attack as UK and EU impose first joint cyber sanctions

The UK and EU imposed their first joint cyber sanctions on Russia's FSB Center 16 for attempted sabotage of Poland's energy grid — a watershed moment for European critical-infrastructure threat posture.

NATO logistics, Ukrainian troops are top subjects of Russian camera hacks, advisory says

Dutch intelligence links Russian services to systematic compromise of IP cameras monitoring NATO supply routes and Ukrainian personnel across Europe — a hybrid-warfare escalation with direct NIS2 implications for critical-infrastructure operators.

OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials

Two threat groups are exploiting OAuth client-ID spoofing to silently validate stolen Microsoft Entra ID credentials while evading standard sign-in telemetry — a blind spot most SOCs aren't watching.

ClickFix's Mushrooming Ecosystem Demands New Defense Tactics

ClickFix has matured into a rentable attack ecosystem that consistently bypasses AV and EDR — YARA-based analysis is currently the most reliable detection method.

Finding SOCKS with Proxywatch

SpecterOps introduces Proxywatch, a behavioural detection approach for SOCKS proxy tunnels used in lateral movement — addressing a gap where static IOC rules consistently fall short.

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

Unit 42 dissects a Vidar Stealer campaign that chains code-signing abuse, Go-compiled DLL sideloading, and file inflation to bypass endpoint defences — a commodity threat adopting APT-grade evasion.

Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity

Microsoft documented three attack paths used by ShinyHunters to breach Salesforce environments purely through abused OAuth trust — no platform vulnerability required — over the past year.

EU takes member states to court over unimplemented cybersecurity law

The European Commission is taking Ireland, Spain, France, and the Netherlands to court over NIS2 transposition delays exceeding 20 months — a clear signal that enforcement patience has expired.

Reverse Engineering Compliance: A Dual-Graph Verification Framework for Auditing Legacy IT Security Concepts

Dual-graph verification framework automates auditing of legacy IT security concepts against NIS2 via OSCAL, helping enterprises shift from document-based compliance to machine-readable evidence.

Manage Vendor Risk in a Few Practical Steps

A practical framework for vendor risk governance — covering risk tolerance, exposure visibility, and board oversight — offers timely guidance as NIS2 supply-chain obligations come into force.

Compromised AsyncAPI npm packages: inside a CI supply-chain attack

Four @asyncapi npm packages (3M+ weekly downloads) were compromised to steal CI credentials — Datadog's detailed writeup offers actionable IOCs and a CI supply-chain attack playbook.

Heimdallr: Characterizing and Detecting LLM-Induced Security Risks in GitHub CI Workflows

Heimdallr systematically maps how LLM integrations in GitHub Actions create injectable attack surfaces via externally controllable inputs—a concrete and growing risk for any enterprise using AI-augmented CI/CD pipelines.

Mako: A Self-Evolving Agentic Operating System (SE-AOS) for Autonomous Web Exploitation

Self-evolving AI agent 'Mako' autonomously synthesises and chains web exploits at runtime — a paradigm shift that accelerates the offensive-defensive arms race.

Build your own vulnerability harness

Cursor IDE Auto-Executes Malicious Code in Poisoned Repos

Cursor IDE still auto-executes malicious code from poisoned repositories months after disclosure — a critical risk for enterprises using AI coding assistants with external codebases.

When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems

Researchers show that per-message runtime monitors for multi-agent LLM systems miss distributed backdoors where harmful payloads are split across cooperating agents — demanding compositional safety analysis.

Certifying Ghosts: How Cybersecurity AI Agents Break the EU Cyber Resilience Act

Researchers argue the CRA's process-based compliance model breaks down when autonomous AI agents — not humans — handle vulnerability discovery, patching, and disclosure for certified products.

AWS designated as a critical third party to the UK financial sector

HM Treasury's designation of AWS as a UK Critical Third Party foreshadows how DORA's ICT oversight regime may treat hyperscalers — EU financial-sector CISOs should prepare now.

Lessons Learned from CISA’s Recent GitHub Leak

CISA's postmortem on a six-month public GitHub leak of AWS GovCloud keys provides a sobering blueprint for any enterprise: even the agency tasked with defending US infrastructure struggled with basic secrets management.