Tag: software
-
Gefälschte Kalendereinladungen zielen auf Tausende von Organisationen ab
Sicherheitsforscher von Check Point haben mehrere groß angelegte Phishing-Kampagnen identifiziert, bei denen gefälschte Kalendereinladungen missbraucht werden, um Anmeldedaten zu stehlen. Einige werden als .ics-Anhang versendet. Da es sich bei der Datei um gültige Kalenderdaten handelt, nutzt der Angriff Kalenderfunktionen und das Vertrauen der Benutzer aus, ohne eine Software-Sicherheitslücke auszunutzen. Andere verwenden einen Link, der scheinbar…
-
CMA to decide Microsoft strategic market status by February 2027
The CMA proposes to designate Microsoft’s business software ecosystem with strategic market status and sets out a roadmap on Copilot, Teams, cloud licensing and security First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366652472/CMA-to-decide-Microsoft-strategic-market-status-by-February-2027
-
Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation
Progress Software has released fixes for 12 vulnerabilities in MOVEit Transfer, its managed file transfer (MFT) platform. Several of the flaws allow authentication bypass, session hijacking and administrative control. The company’s September 2026 critical security bulletin, published October 15, 2026, urges customers to upgrade immediately. MOVEit Transfer vulnerabilities According to the September 2026 critical security…
-
MITRE ATTCK v20 Adds New AI Attack Techniques for Prompt Injection and Data Theft
MITRE released ATT&CK v20 on October 13, 2026. It adds the first Enterprise techniques for direct and indirect prompt injection, AI-enabled exfiltration and AI result poisoning. MITRE ATT&CK v20 Adds New AI Attack Techniques According to updates published by MITRE, the release updates Techniques, Groups, Campaigns and Software across the Enterprise, Mobile and ICS domains.…
-
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
An alleged Chinese state-backed group is using a new zero-day affecting BeyondTrust IT support software to conduct espionage attacks. First seen on therecord.media Jump to article: therecord.media/beyond-trust-cyberattack-china
-
Intelligent-ResOps schafft Transparenz, Kontrollmöglichkeiten und Ausfallsicherheit für Microsoft-365
Veeam Software gab die allgemeine Verfügbarkeit von ‘Veeam Intelligent ResOps for Microsoft 365″ bekannt. Dabei handelt es sich um das erste allgemein verfügbare Angebot im Veeam-Intelligent-ResOps (iResOps)-Portfolio. Zu der Ankündigung gehört auch ein Add-on für ‘Veeam Data Cloud for Microsoft 365″. Kunden können ‘Veeam iResOps for Microsoft 365″ mit wenigen Klicks an ‘Veeam Data Cloud”…
-
New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure
A newly disclosed proxyjacking campaign has compromised at least 143 devices across 34 countries, exploiting vulnerabilities in network appliances and enterprise software to monetize victims’ internet connections. GreyNoise identified an attacker installing Pawns.app, a legitimate bandwidth-sharing application, without device owners’ consent, turning compromised systems into commercial residential proxy nodes. Unlike conventional VPN or hosting infrastructure,…
-
Cyberangriffe auf deutsche Unternehmen mehr als verdoppelt
Der Monthly-Cyber-Threat-Report für September 2026 von Check Point Research (CPR), die Sicherheitsforschungsabteilung von Check Point Software Technologies, zeigt einen weltweiten Anstieg der Cyberangriffe um 48 % gegenüber dem Vorjahr. Im DACH-Raum zogen die Angriffszahlen kräftig an: In Deutschland wurden Organisationen im September durchschnittlich 2316-mal pro Woche angegriffen und damit mehr als doppelt so häufig wie…
-
Veeam wurde von Gartner im ersten Gartner-Magic-Quadrant für Privacy-UX als Leader ausgezeichnet
Veeam Software gab bekannt, dass es von Gartner im ersten Gartner-Magic-Quadrant für Privacy-UX als ‘Leader” eingestuft wurde. Die Bewertung basierte auf spezifischen Kriterien, anhand derer die ‘Vollständigkeit der Vision” und die ‘Umsetzungsfähigkeit” des Unternehmens analysiert wurden. Nach Ansicht von Gartner bieten die ‘Privacy UX”-Funktionen von Veeam Unternehmen eine Möglichkeit, personenbezogene Daten in Produktions- und Backup-Umgebungen…
-
Wenn Cyberangriffe physische Schäden anrichten
In den vergangenen Tagen machten Berichte über manipulierte Kältetechnik in europäischen Supermärkten Schlagzeilen: In Frankreich waren rund 700 Supermärkte von Ausfällen betroffen. Auch in den Niederlanden fielen Kühlung-Systeme aus. Angreifer nutzten dabei Schwachstellen in vernetzten Steuerungssystemen. Oded Vanunu, Head of Vulnerability Research bei Check Point Software Technologies, ordnet die Hintergründe und Risiken dieser kinetischen Cyberangriffe…
-
Citrix Patches XenServer Vulnerabilities That Could Enable Host Compromise
Citrix has released security updates for XenServer 8.4 and XenServer 9. The updates fix several vulnerabilities, three of which could let a malicious privileged guest VM user compromise or crash the underlying host. Cloud Software Group rated the bulletin High severity. Citrix XenServer vulnerabilities According to the advisory published by Citrix on October 13, 2026…
-
Komplexität als Sicherheitsrisiko – Weniger Software, mehr Kontrolle
Tags: softwareFirst seen on security-insider.de Jump to article: www.security-insider.de/it-komplexitaet-sicherheitsrisiko-software-konsolidierung-ki-governance-a-373530ecc5e9282adfff5f89b20386e9/
-
KGB RAT Uses FUD Crypter to Evade Windows Defender and Spy on Victims
KGB RAT, a Windows remote access trojan marketed as legitimate administration software, combines surveillance, credential theft, and configurable malicious functions with a built-in crypter advertised to evade Windows Defender. Researchers identified unobfuscated payloads, obfuscated variants, and encrypted loaders that reconstruct malware during execution. This distinction matters: the crypter conceals the underlying payload, while the deployed…
-
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface.”A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables…
-
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface.”A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables…
-
The internet’s attack surface moves at very different speeds
Censys found that AI-related software exposed to the public internet grew 63% in nine months, from 164,088 IP addresses in October 2025 to 267,915 in July 2026. Elsewhere in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/15/exposed-ai-infrastructure-report/
-
AI-generated changes create review bottlenecks in software delivery
83.4% of respondents who use DevOps practices run CI/CD pipelines, making them the most widely adopted practice in that group, according to JetBrains’ The State of CI/CD in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/15/jetbrains-ai-software-delivery-report/
-
Meta GitHub Repositories Compromised, Exposing Software Code and Employee Personal Data
Meta has revealed a breach of a GitHub repository that exposed software code and personal information belonging to about 1,500 individuals, most of whom are U.S. employees. The company began notifying affected individuals on October 13, after discovering the intrusion several weeks earlier, which involved the theft of an employee’s credentials. According to Meta’s statement…
-
Most companies count AI agents as insiders, and CISOs worry about their own liability
Software that works on an employee’s behalf is now turning up in incident reports. At 95% of the companies in a Trellix survey of 600 CISOs, an AI agent or other autonomous … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/ciso-ai-agent-insider-risk/
-
Ivanti Connect Secure CVE-2026-104935 Flaw Enables Unauthenticated Remote Code Execution
Tags: authentication, cve, cyber, exploit, flaw, ivanti, remote-code-execution, software, update, vulnerabilityIvanti released security updates for Ivanti Connect Secure (ICS) to address CVE-2026-104935, a high-severity authentication-bypass vulnerability. This vulnerability allows remote, unauthenticated attackers to execute arbitrary commands. The company disclosed the issue on October 13, 2026. It confirmed that exploitation had affected a limited number of customers at the time of disclosure. Fixed software versions are…
-
KI für Ermittlungsbehörden: Software soll Wohnungen und Häuser über Innenraumfotos orten
Für die Zuordnung der Wohnadresse soll der KI ein einzelnes Bild ausreichen. First seen on golem.de Jump to article: www.golem.de/news/ki-fuer-ermittlungsbehoerden-software-soll-wohnungen-und-haeuser-ueber-innenraumfotos-orten-2610-214067.html
-
KI für Ermittlungsbehörden: Software soll Wohnungen und Häuser über Innenraumfotos orten
Für die Zuordnung der Wohnadresse soll der KI ein einzelnes Bild ausreichen. First seen on golem.de Jump to article: www.golem.de/news/ki-fuer-ermittlungsbehoerden-software-soll-wohnungen-und-haeuser-ueber-innenraumfotos-orten-2610-214067.html
-
IMF warns of cyber threat to digitally connected financial markets
Interconnected services plus software from key suppliers and greater digitisation presents a large attack surface for AI-powered attacks First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366652153/IMF-warns-of-cyber-threat-to-digitally-connected-financial-markets
-
IMF warns of cyber threat to digitally connected financial markets
Interconnected services plus software from key suppliers and greater digitisation presents a large attack surface for AI-powered attacks First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366652153/IMF-warns-of-cyber-threat-to-digitally-connected-financial-markets
-
G2A.COM Reports 35% Growth in Security Software Orders, Outpacing VPN Growth
Amsterdam, Netherlands, October 13th, 2026, CyberNewswire Antivirus and security software orders grow more than twice as fast as VPN orders, accounting for 43% of cybersecurity purchases on the marketplace G2A.COM, a digital marketplace that serves more than 35 million users across 180 countries, reports a 35% year-on-year surge in antivirus and security software orders, outpacing…
-
Researchers Discover 253 Security Vulnerabilities Across 343 AI Agent Tools in MCP Servers
Researchers have identified 253 verified security vulnerabilities affecting 343 AI agent tools across 118 Model Context Protocol (MCP) servers. These vulnerabilities expose weaknesses in how software processes arguments generated by large language models (LLMs). The findings are based on an evaluation of 273 open-source MCP servers containing 3,405 tools, using a new fuzzing framework called…
-
G2A.COM Reports 35% Growth in Security Software Orders, Outpacing VPN Growth
Amsterdam, Netherlands, 13th October 2026, CyberNewswire First seen on hackread.com Jump to article: hackread.com/g2a-com-reports-35-growth-in-security-software-orders-outpacing-vpn-growth/
-
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
Two of 31 newly disclosed flaws in Progress Software’s MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0.Affected…
-
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.”GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in…
-
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.”GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in…