Security News

High-end Trojans like Pegasus often make headlines. In their shadow, a market for cheap surveillance software is growing in Italy – with official approval.

5 billion US dollars, a central security clearinghouse, and AI-powered analysis: IBM and Red Hat aim to secure open source for the AI era.

An Enisa report shows significant progress through the NIS2 directive but warns of growing digital dangers in the space and transport sectors.

Google Cloud's new platform "AI Threat Defense" is designed to automatically identify and fix security vulnerabilities.

IT researchers have demonstrated a side-channel attack called "FROST" where browsers can spy on user behavior via SSD access times.

Attackers can attack Gogs servers with malicious code in the default settings. So far, admins can only protect systems via a workaround.

Various Oracle products have security vulnerabilities. Updates are available to fix 35 vulnerabilities.

Anyone using Chrome should urgently check if their browser is up to date. Wednesday's update closes 151 security vulnerabilities.

Microsoft is struggling with published evidence of unpatched security vulnerabilities. The company is now threatening legal action.

Vulnerabilities endanger Veeam Agent for Microsoft Windows and Veeam Software Appliance on Linux servers.

The sequel to the cult hacking game "868-BACK" is here. "868-BACK" offers complex turn-based strategy in the smallest space with cryptic rules.

BSI clarifies new Grundschutz++. Certification possible from early 2027, WiBA checklists remain. (max 140 chars)

The World Cup starts in two weeks. Criminals are taking advantage of the opportunity and faking the FIFA website for phishing, among other things.

An unofficial application page for the UK entry permit ETA has left applicant data openly accessible online.

CISA currently warns of recently observed supply chain attacks on TanStack, Daemon Tools, and Nx Console, which have distributed malware.

Microsoft is revising C#'s unsafe model based on Rust's example. The goal: fewer memory errors and thus fewer security vulnerabilities.

Attackers can exploit several security vulnerabilities in IBM HTTP Server, License Metric Tool, and WebSphere Application Server. Patches provide a remedy.

Partially high-risk security vulnerabilities in the powerful text editor Notepad++ allow attackers to inject malware and commands.

Microsoft closes security vulnerability with updates for SharePoint servers. The closed vulnerability allows the injection of malicious code.

Investigators are taking action against darknet drug trafficking and alleged money laundering via an international network.

Work intensification leads to overload for developers. Companies make billions thanks to open source and give little back, argues Christopher Kunz.

The cabinet has paved the way for new powers: the Federal Criminal Police Office will be allowed to disrupt or destroy attackers' IT systems in the future.

The popular compression program 7-Zip contains a vulnerability that allows the injection of malicious code. An update is available.

A security update closes a malicious code vulnerability in Docker for macOS.

In current versions, the developers of Roundcube Webmail have closed several security vulnerabilities.

With OpenVPN 2.7 and Data Channel Offloading, VPN throughput in IPFire increases to up to 10 GBit/s. The update also closes critical kernel vulnerabilities.

In UniFi OS Server and products equipped with it, attackers can exploit five vulnerabilities to make unauthorized changes.

LiteSpeed develops plugins for various CMS. The one for cPanel has a security vulnerability that attackers are already exploiting.

Among other things, now closed security vulnerabilities in the Linux kernel endanger IBM QRadar SIEM.

A pre-installed app on Motorola smartphones redirects Amazon calls and injects affiliate codes. Affected users can disable the app.

In current versions of NGINX Open Source and NGINX Plus, developers have closed a security vulnerability.

Attackers are currently targeting websites created with the CMS Drupal. However, pages are only vulnerable if they use PostgreSQL.

Unknowns exfiltrated and deleted data via a poorly secured API. Thousands of photographers and customers are affected by the cyberattack.

Depending on how intensively you use the messenger, it can take days for a deleted message to disappear. Signal ignored the bug for half a year.

In Apache Airflow CNCF Kubernetes Provider and Apache Airflow Amazon Provider, developers have closed a security vulnerability in each case.

An update for Notepad++ closes a security vulnerability in the installer. An official CVE entry with risk assessment is still missing.

Cisco is providing an update that closes a security vulnerability with the highest possible risk assessment in Secure Workload.

Security vulnerabilities in Trend Micro Apex One and Langflow are being actively exploited by cybercriminals. CISA warns of this.

For months, implausible accusations have been circulating in the US that WhatsApp can view completely encrypted content. Now Texas is filing a lawsuit.

Anyone who pastes text into AI chatbots often unintentionally shares sensitive data. A new Chrome extension from DFKI aims to prevent this.