[NEU] [hoch] Palo Alto Networks PAN-OS: Mehrere Schwachstellen

BSI flags multiple high-severity PAN-OS flaws — including root-level RCE and user impersonation — placing Palo Alto firewalls at the network perimeter in immediate jeopardy.

BeyondTrust patches zero-day exploited in attacks since August

BeyondTrust's Remote Support zero-day, silently exploited since August, underscores the risk of unmonitored privileged-access tooling becoming an attacker's persistence channel.

[UPDATE] [kritisch] Microsoft Windows und Windows Server: Mehrere Schwachstellen

BSI flags critical Windows/Windows Server update covering privilege escalation to admin, RCE, and info disclosure — the breadth of impact makes this the top patching priority for any Windows-centric estate this cycle.

[NEU] [hoch] Fortinet FortiSIEM: Mehrere Schwachstellen ermöglichen Codeausführung

Multiple remote code execution flaws in Fortinet FortiSIEM allow unauthenticated attackers to compromise the very platform enterprises rely on for security monitoring — a scenario reminiscent of previous Fortinet appliance exploitation waves.

Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday

Dark Reading dissects the zero-days buried in Microsoft's record October patch haul — unauthenticated RCEs and security-bypass flaws demand emergency triage, particularly for NIS2-regulated environments.

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

Palo Alto Networks confirms active exploitation of CVE-2026-0322, a high-severity RCE zero-day in PAN-OS, demanding emergency patching of one of the most widely deployed firewall platforms in European enterprise networks.

Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat

A zero-click flaw in Claude Code Desktop's preview pane enables silent theft of SSH keys, AWS credentials, and OAuth tokens from developer machines — a direct pipeline-compromise risk requiring immediate credential rotation.

[NEU] [hoch] Sonatype Nexus Repository Manager: Mehrere Schwachstellen

BSI flags high-severity flaws in Sonatype Nexus Repository Manager that could allow remote code execution and admin takeover — a supply-chain chokepoint many enterprises depend on for build-artifact governance.

[NEU] [hoch] JetBrains TeamCity: Mehrere Schwachstellen

High-severity RCE and XSS flaws in JetBrains TeamCity threaten build-pipeline integrity—a supply-chain risk for any organisation relying on this CI/CD platform.

Hackers exploit SiteGuard WAF flaw to run commands as admins

Attackers are actively exploiting a command-injection flaw in SiteGuard WAF to gain root/SYSTEM access — an ironic reminder that security appliances themselves need rigorous patching.

ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

Attackers hijacked ConnectWise Cloud Backup application identities to breach customer M365 tenants — a supply-chain vector that should prompt immediate OAuth grant audits across European organisations using managed backup services.

Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Attackers repeatedly hijacked AOMEI Backupper's update servers in windows as short as five minutes, delivering a backdoor to any client that auto-updated — a supply-chain technique that challenges conventional detection timelines.

Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day

A suspected Chinese APT is exploiting an unpatched BeyondTrust IT-support zero-day for espionage — enterprises using the tool face immediate exposure and should verify deployment scope now.

Investigating Ephemeral Supply Chain Tampering

Mandiant documents a months-long campaign in which attackers repeatedly injected short-lived malicious payloads into AOMEI Technology's update infrastructure—a stealthy supply-chain pattern that challenges conventional integrity checks.

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Unit 42 reveals PEERSTITCH, a memory-only ARM64 implant deployed across 500+ FortiGate firewalls via CVE-2024-47575—a campaign that signals network-appliance implants are becoming commodity attacker tradecraft.

Fake WatchGuard VPN site steals credentials, then serves the genuine signed client

An SEO-poisoning campaign clones WatchGuard's VPN download page to harvest SSL VPN credentials, then delivers the real signed installer — leaving zero malicious artefacts for endpoint tools to flag.

Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks

Forescout exposes ROMULUS, a previously undocumented malware delivery platform powering ClickFix campaigns and linked to Vice Society ransomware — revealing the growing professionalisation of criminal delivery infrastructure.

Package managers have an integrity problem

Trail of Bits tested 25 package managers against compromised mirrors and found many lack basic cryptographic integrity checks — a systemic supply-chain blind spot CRA auditors will probe.

Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain

PAGE404: Breaking GPU Isolation Through Hardware-assisted Page Migration

PAGE404 breaks GPU tenant isolation on NVIDIA Grace Hopper via hardware page migration, exposing a novel side channel in cache-coherent CPU-GPU architectures used for AI workloads.

Measuring Human Cryptanalysis Effort

A new research tool estimates cumulative cryptanalyst-hours spent on each public-key algorithm, offering a quantitative basis for assessing cryptographic maturity ahead of post-quantum migration.

Poisoning the Neighborhood: A Topology-Aware Topic-Level Attack on Large-Scale HNSW-based RAG Systems

A novel poisoning attack exploits the HNSW graph topology of large-scale RAG systems, achieving high retrieval corruption rates that generic embedding defences miss—critical for any enterprise relying on external knowledge ingestion.

Prompt injection in HTTP headers: what 217M web responses show

Backdooring Open-Weight AI Models

Schneier highlights that any open-weight AI model with edited weights — fine-tuned, merged, or abliterated — can harbour backdoors, creating a software supply-chain problem enterprises must address before deploying community models.

VOW: Verifiable and Oblivious Watermark Detection for Large Language Models

VOW protocol lets organisations verify LLM watermarks on sensitive documents in-house without exposing content to the watermark provider, addressing a key gap for EU AI Act provenance compliance.

MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

The MALFEX campaign plants shellcode inside a native Node.js addon on npm, escalating supply-chain attack sophistication beyond script-level tampering and evading source-only scanning tools.

GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement

GoLeash adds runtime policy enforcement to Go binaries, containing supply-chain attack capabilities that static dependency scanning alone cannot catch.

Evaluating and Improving Static Application Security Testing Tools for Rust

A systematic evaluation of Rust SAST tools reveals significant detection gaps for common vulnerability classes, offering concrete improvement paths as Rust adoption accelerates in safety-critical enterprise software.

U.K. Sanctions Cryptomus for RU Money Laundering

The UK sanctioned Cryptomus, a cryptocurrency platform allegedly enabling ransomware payments and Russian sanctions evasion — tightening the legal minefield for any European enterprise considering ransom payments.