Situation & news
Current news, blog analyses and the most important advisories right now on one page.
From the blog
All postsAPT28 at a NATO naval shipbuilder: two months inside, mostly using built-in Windows tools
Symantec has documented an attack by the Russian group APT28 on a naval shipbuilder in a NATO member state. After initial access via a Word macro, the attackers relied mainly on tools already present on Windows clients: Edge, curl, the OpenSSH client and PowerShell. These steps can be detected with widely deployed endpoint telemetry.
APT28Threat Intelligencephp2shell (CVE-2026-109618, CVE-2026-109619): background, patches and detection
On 21 October 2026, PHP released security updates for two vulnerabilities rated CVSS 9.2. Practically all PHP versions are affected; fixes exist only for the 8.2 to 8.5 branches. Technical details were public before the release. Under Apache with mod_php and under LiteSpeed, updating the package is not enough; the PHP processes must be fully restarted.
PHPZero-DayEuropol has counted the gaps in digital forensics. You have most of them too.
The European Commission and Europol examined where law enforcement fails with digital evidence. The list reads like an audit of mid-sized corporate IT – and it says what needs doing before the incident.
DFIRDigitale Forensik
Current security news from curated sources
Aggregated from BSI Bürger-CERT, BSI WID, SANS NewsBites, Krebs on Security, The Hacker News and the Allianz für Cyber-Sicherheit.
News·SecurityWeek
Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI
Anthropic presents its own initial public offering as a step toward mitigating the risks it believes AI poses. The post Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI appeared first on SecurityWeek .
News·BleepingComputer
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]
News·SecurityWeek
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon. The post This is Fine: What NetScaler Zero-Days Tell Us About the New Normal appeared first on SecurityWeek .
News·SecurityWeek
Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Running at system boot, it periodically polled the update domain to execute any code served, with full privileges. The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek .
News·The Hacker News
Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut…
News·BleepingComputer
Energy giant ENGIE discloses data breach affecting customers
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. [...]
Latest priority advisories
Ranked by priority – KEV, EPSS, CVSS, recency and prevalence in Germany.
| Critical | CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol Actively exploited | |
| Critical | CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Actively exploited | |
| Critical | CVE-2026-12569 Remote Code Execution (RCE) vulnerability in Windchill PDMlink A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030 Actively exploited | |
| Critical | CVE-2026-41940 WebPros cPanel and WHM Authentication Bypass via Login Flow Authentication bypass vulnerability in cPanel and WHM The NCSC would like to draw your attention to CVE-2026-41940 affecting cPanel and WHM. We are aware of public proof-of-concept (PoC) code and reports of active exploitation of this vulnerability. CVE-2026-41940 is an authentication bypass vulnerability in cPanel and WHM that can allow an unauthenticated remote attacker to gain unauthorised access to the control panel. What's happening Systems affected Patches are currently available for the following vulnerable versions: cPanel & WHM 11.110.0.96 cPanel & WHM 11.118.0.61 cPanel & WHM 11.126.0.53 cPanel & WHM 11.132.0.27 cPanel & WHM 11.134.0.19 cPanel & WHM 11.136.0.4 Note: Not all vulnerable versions have had a patch released. What to look for How to tell if you're affected cPanel is currently working on patches for versions not included in the list above. It is recommended that you follow the vendor’s instructions until you can update to a supported version. What to do Mitigation Refer to the vendor advisory for remediation. More information Read more about this alert on the vendor website: CVE-2026-41940 affecting cPanel and WHM If you require more information or further support, submit a report on our website: Report an incident Actively exploited | |
| Critical | CVE-2026-50751 User Authentication Bypass in VPN Remote Access and Mobile Access A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. Actively exploited | |
| Critical | CVE-2026-45659 Microsoft SharePoint Remote Code Execution Vulnerability Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Actively exploited |