IT Security · Latest
IT Security News
Latest reports on IT security, cyber threats and data protection — automatically curated from leading sources.
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with
(Reliable)? php2shell exploitability, (Fri, Oct 23rd)
Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability. 
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. [...]
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uz
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations. The post Inside the LiteLLM 1.107.0 supply chain
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team K
Microsoft: Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. [...]
Anzeige: Microsoft 365 nach dem Zero-Trust-Prinzip absichern
Zero Trust verbindet Zugriffsschutz, Datenschutz und Monitoring in Microsoft 365. Ein Online-Workshop vermittelt die passenden Sicherheitsmaßnahmen. (<a href="https://www.golem.de/specials/golemakademie/">Golem Karrierew
Quest Diagnostics confirms data breach exposed patient records
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. [...]
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...]
You gave your AI agent access, but who is giving it orders?
AI agents can be manipulated through malicious emails, websites, and plugins into executing commands, stealing data, or deleting files using their legitimate permissions. Gen Digital explains how its Agent Trust Hub help
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this in
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you proba
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. [...]
Daten-Omnibus: EU-Ministerrat will Datenschutz für KI-Training lockern
Der EU-Ministerrat hat sich beim Daten-Omnibus geeinigt. KI-Training mit persönlichen Daten soll einfacher werden. (<a href="https://www.golem.de/specials/eu-dsgvo/">DSGVO</a>, <a href="https://www.golem.de/specials/date
php2shell: Millionen PHP-Dienste in Deutschland verwundbar
Die IT-Sicherheitsfirma Censys scannt PHP-Server auf für php2shell anfällige Versionen. Millionen in Deutschland sind noch verwundbar.
(g+) Cyber Resilience Act: Die Meldepflicht mit den eingebauten Lücken
Seit September gilt eine neue EU-Meldepflicht für Sicherheitslücken. Doch wer ein älteres vernetztes Gerät besitzt, kann auf einem bekannten Problem sitzen bleiben - ganz legal. Eine Analyse von Jan Gruber (<a href="http
AfD-Leak: Mutmaßliche Täter bekennen sich
In einem Interview mit der Zeit bekennen sich zwei anonyme Täter zu dem Cyberangriff auf die AfD: Es gehe um Transparenz und Gerechtigkeit.
PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications
Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UA
Microsoft hübscht den Authenticator auf
Microsoft will den Authenticator für Android und iOS übersichtlicher und einfacher bedienbar machen. Die Verteilung läuft bereits.
Entra ID: Wer hat hier eigentlich die Schlüssel?
Entra ID birgt Risiken durch versteckte Berechtigungen. Lukas Petzi erklärt, wie Selbstaudits sie aufdecken und welche Prüfstandards helfen.
ISC Stormcast For Friday, October 23rd, 2026 https://isc.sans.edu/podcastdetail/10148, (Fri, Oct 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
82 Prozent ungepatcht: Über 34 Millionen Systeme noch anfällig für PHP2Shell
Laut Scans von Censys ist PHP2Shell auf den meisten Systemen im Netz noch ausnutzbar. Allein in Deutschland gibt es Millionen davon. (<a href="https://www.golem.de/specials/sicherheitsluecke/">Sicherheitslücke</a>, <a hr
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow ha
W3C: Ein Auftrag ist kein Freibrief für KI-Agenten
Wie bleiben Nutzer in Kontrolle, wenn KI-Agenten Websites bedienen? Das W3C-Strategieteam skizziert Anforderungen an sichere Webstandards.
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the offici
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was
Cisco stopft diverse, teils kritische Sicherheitslücken
In mehreren Produkten von Cisco klaffen teils kritische Lücken. Der Hersteller stellt Sicherheitsupdates bereit.
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing th
GitHub Package Firewall blockiert schädliche npm-Pakete
GitHub hat die Package Firewall als öffentliche Vorschau für Enterprise-Cloud-Kunden freigegeben. Sie prüft Paketabfragen und Downloads.
Schadcode-Attacken möglich: 12 Jahre alte Lücke gefährdet Gitlab-Server
Administratoren sollten dringend ihre Gitlab-Instanzen aktualisieren. Eine seit 2014 bestehende Lücke lässt Angreifer eigenen Code einschleusen. (<a href="https://www.golem.de/specials/sicherheitsluecke/">Sicherheitslück
AWS Continuum: KI findet und behebt Code-Schwachstellen
Amazon Web Services macht die KI-gestützte Erkennung und Behebung von Code-Schwachstellen in AWS Continuum allgemein verfügbar.
JFrog führt BYOK-Unterstützung für KI-Sicherheitsscans ein
JFrog erweitert die Erkennung von Schatten-KI in seiner KI-Sicherheitssuite AI Security. Ebenfalls neu ist BYOK für AI Asset Scanning.
Railway warns devs to rotate secrets after potential breach
Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. [...]
Zensur-Urteil: DNS-Dienst Quad9 verlässt Frankreich
Der DNS-Vermittler Quad9 zieht sich aus Frankreich zurück. Grund ist ein Zensururteil, erstritten von beIN aus Katar.
Capcom confirms data breach affecting 11.7 million accounts
Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. [...]
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. [...]
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its
Updated every 30 minutes · CH/DE: BACS Switzerland, BSI, Allianz Cyber-Sicherheit, Heise Security, Golem · EN: BleepingComputer, The Hacker News, Fortinet, SANS ISC, Microsoft Security, Krebs on Security, Kaspersky