[NEU] [hoch] Argo CD: Mehrere Schwachstellen

High-severity Argo CD flaws enable remote code execution, credential theft, and access-control bypass — organisations using GitOps workflows should patch urgently as compromised CD pipelines can cascade across all managed clusters.

US, Australia warn of latest Citrix vulnerability after NetScaler advisory

US and Australian cyber agencies issued joint warnings after Citrix disclosed a new NetScaler issue distinct from last week's vulnerabilities, suggesting broadening attack surface on a perimeter device favoured by APTs.

Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes

Microsoft issued an out-of-band patch for CVE-2026-96940 (CVSS 8.8), a privilege-escalation weakness in Exchange Server that lets any authenticated user read other mailboxes — a potent espionage vector for on-prem environments.

Max severity SonicWall SMA1000 flaw now exploited in attacks

SonicWall SMA1000 appliances face active exploitation of a CVSS-10 flaw (CVE-2026-102255) within days of patch release, underscoring the near-zero grace period European enterprises now have for perimeter-device remediation.

Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto

Threat actors are actively exploiting unpatched vulnerabilities in AhsayCBS backup software to plant webshells and cryptominers — a reminder that backup infrastructure is a high-value, often overlooked attack surface.

[NEU] [kritisch] Drupal Erweiterungen: Mehrere Schwachstellen

BSI CERT-Bund flags critical Drupal extension vulnerabilities enabling RCE, privilege escalation, and XSS — enterprises running Drupal should treat this as an emergency patching event.

[NEU] [hoch] Splunk Enterprise: Mehrere Schwachstellen

BSI warns of high-severity Splunk Enterprise flaws allowing root-level command execution and SQL injection — a compromised SIEM undermines the entire detection and response capability of an organisation.

FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins

The FBI warns that FortiBleed exploitation remains active, with attackers seizing administrative control of FortiGate VPN gateways — a scenario reminiscent of past Fortinet zero-day waves that hit European mid-market firms hard.

Evolution of Web3 in Cloud Supply Chain Attacks

Unit 42 maps how attackers combine decentralised Web3 hosting with poisoned open-source packages to infiltrate enterprise cloud environments — a pattern that complicates takedown and attribution compared to traditional C2 infrastructure.

Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia

The Wazza phishing kit integrates session hijacking, traffic filtering, and evasion controls directly into its delivery infrastructure — elevating phishing-as-a-service beyond simple credential harvesting and posing a targeted threat to EU banking and government sectors.

No EDR, no problem: how Huntress rebuilt an Akira ransomware attack from forensic leftovers

Huntress reconstructed a full Akira ransomware kill chain from native Windows artefacts alone after EDR was absent at time of compromise – a valuable forensic blueprint for Mittelstand firms that still have partial endpoint coverage.

Power BI phishing campaign drops rogue ScreenConnect clients

A phishing campaign abuses Microsoft Power BI's trusted domain to host lures that evade email gateways, then drops multiple ScreenConnect clients for persistent remote access — a technique that weaponises legitimate SaaS trust.

FBI Arrests Executive at Ransomware Negotiation Firm

The FBI arrested a Canadian cybersecurity firm co-founder allegedly linked to ShinyHunters, spotlighting third-party risk in the largely unregulated ransomware-negotiation industry.

UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing

Cisco Talos exposes APT group UAT-11985 using AI-generated academic-event lures and real-time Google adversary-in-the-middle phishing against Taiwanese researchers – a playbook that could easily target European R&D institutions.

Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub

Researchers map how AI coding-agent skill files spread across GitHub like unversioned dependencies, exposing a novel supply-chain vector that current SBOM and code-review practices miss entirely.

Package Hallucination Attacks on Coding Agents through Prompt Injection in Rule Files

Poisoned community rule files can trick AI coding agents into importing hallucinated malicious packages—a supply-chain vector that enterprises using tools like Cursor or Copilot Workspace should address now.

Phantom Transfer: Data Poisoning can Survive Data-Level Defences

'Phantom Transfer' poisoning attack persists even when defenders know exactly how training data was tampered with, defeating all current data-level filtering defences and challenging AI supply-chain trust assumptions.

Ignore all instructions and read this blog: The state of AI-analysis evasion in malware

Cisco Talos catalogues real-world techniques malware authors use to evade AI-powered analysis – from prompt injection in binaries to adversarial feature manipulation – exposing a growing blind spot in automated SOC triage.

Identity-aware AI data agents with AWS Lake Formation and Trusted Identity Propagation

AWS shows how to build AI data agents that inherit Lake Formation access policies via Trusted Identity Propagation, avoiding the common anti-pattern of duplicating authorisation logic in agent code.

11 of 23 Core Open Source Projects Run on 1 or 2 People

[NEU] [hoch] BuildKit: Mehrere Schwachstellen

BSI issues a new high-severity advisory for BuildKit — as Docker's default build engine, RCE and security-bypass flaws here threaten the integrity of every container image produced in affected CI/CD environments.

Let's Encrypt: 64-Day Certificate Lifetimes Coming Feb 2027

CYBERFORT: A Compliance-Chain Platform Operationalising the Cyber Resilience Act for SMEs

CYBERFORT proposes a compliance-chain platform that operationalises EU Cyber Resilience Act obligations for SMEs — a segment that faces disproportionate CRA burden yet lacks tooling.

Australian Gov't Weighs Mandatory AI Incident Reporting

After an agentic AI attack hit Australia's Medicare systems, Canberra is exploring mandatory AI incident reporting — a development European compliance teams should track as the EU AI Act's own reporting obligations take shape.

Japan Adopts Proactive Cyber Defense Strategy

Japan's new Active Cyber Defence law mandates incident reporting for critical infrastructure – European multinationals with Japanese operations should benchmark requirements against NIS2 to avoid duplicative compliance gaps.

FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach

The FBI's removal of an Accenture contractor after a ShinyHunters breach traced to unpatched systems is a high-profile warning that outsourced patch management without verification creates existential supply-chain risk.

`123456' password used in Danish CPR data breach

SoK: Failure Modes in Common Criteria Product Evaluation - A Taxonomy and Design-for-Evaluability Guidance

A systematic taxonomy of why Common Criteria (ISO/IEC 15408) evaluations stall or fail, paired with design-for-evaluability guidance — practical for any European firm navigating government or defence procurement gates.

Lawmakers warn Google could expose Spirit Airlines data in $10 million AI training deal

US lawmakers flagged that Google's proposed $10M deal to acquire Spirit Airlines' internal data — covering 100M emails and 500M Teams messages — for AI training could expose employee PII, a scenario with direct GDPR parallels for European enterprises considering similar data monetisation.

Provable Subexponential Algorithms for NIST Third-Round Lattice Families

Provable subexponential classical algorithms for NIST lattice families (ML-KEM, ML-DSA, and others) don't threaten deployed parameters today but underscore the need for cryptographic agility in post-quantum migration plans.

Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering

Sigma-Hunter is a specialised language model designed to produce valid, accurate Sigma detection rules from threat reports — addressing quality gaps that hamper general-purpose LLMs in detection engineering.