DIESEC
@diesec.bsky.social
Ivanti: patched VPN rooted, checker blind
France: fridges pushed to 50°C online
Microsoft: record Patch Tuesday, one exploited
Ledger: spy chip behind a genuine check
Read the full analysis:
🇬🇧 diesec.com/2026/10/top-...
🇩🇪 diesec.com/de/2026/10/t...
#Cybersecurity #DIESEC Ivanti Connect Secure: three chained zero-days gave root on a patched VPN (CVE-2026-104935, CVSS 8.6, in CISA KEV). As of Oct 14, no fix for the root flaw. Integrity Checker misses it. #Ivanti #ZeroDay #CyberSecurity
diesec.com/2026/10/ivan...
diesec.com/de/2026/10/i... AhsayCBS backup servers are being exploited (CVE-2026-105134, CVSS 9.3). Ahsay confirmed 10.3.4.0 did not fix it; install hotfix 10.3.4.45 and restrict the console to trusted IPs or VPN. #AhsayCBS #CyberSecurity
diesec.com/2026/10/ahsa...
diesec.com/de/2026/10/a... IDC Frontier Ransomware
One ransomware attack on a SoftBank cloud region in Japan hit 495 companies and local governments. JR East says 6.09M accounts may be affected. Attacker claims unverified. #Ransomware #CloudSecurity
diesec.com/2026/10/idc-...
diesec.com/de/2026/10/i... ENISA 2026: cyber dependencies expand the attack surface. One compromised supplier can reach many organisations. What it means under NIS2 and where to start.
🇬🇧 diesec.com/2026/10/enis...
🇩🇪 diesec.com/de/2026/10/c...
#Cybersecurity #ENISA #DIESEC Third max-severity SonicWall SMA1000 flaw in three months: CVE-2026-102255, pre-auth SSRF (CVSS 10.0). One firm saw exploitation attempts; SonicWall says no evidence. Patch to 12.4.3-03670 / 12.5.0-03082. #SonicWall #CyberSecurity
diesec.com/2026/10/soni...
diesec.com/de/2026/10/s... Attackers forced fridge controllers at hundreds of French supermarkets into defrost, up to 50°C. CERT-FR: take Danfoss, Copeland and Dixell controllers off the internet. As of Oct 13, attacker unknown. #OTSecurity #CyberSecurity
diesec.com/2026/10/fren...
diesec.com/de/2026/10/c... GhostAction is back: fake "Security Audit" workflows hit 345 GitHub repos on Oct 8 and now harvest secrets from the full git history. Deleted keys count too. Search for the workflow, rotate everything. #GhostAction #CyberSecurity
🇬🇧 diesec.com/2026/10/ghos...
🇩🇪 diesec.com/de/2026/10/g... FBI seized 7 domains behind Flax Typhoon's MicroScan and FishHub tools. The advisory points to Exchange password spraying and old CVEs, not zero-days. Check logs back to March, enforce MFA on mail.
🇬🇧 diesec.com/2026/10/flax...
🇩🇪 diesec.com/de/2026/10/f...
#CyberSecurity FortiBleed: owners locked out of their own firewalls
South Korea: AI tool probed bank portals
ASOS: breach announced via its own app
Osaka: 500 servers down, backups hit
Top 5 Cybersecurity News:
🇬🇧 diesec.com/2026/10/top-...
🇩🇪 diesec.com/de/2026/10/t...
#Cybersecurity Denmark's population register lost 8.8M records through one company's lawful lookup access. 14M+ lookup attempts in ten days, noticed via an oversized invoice. Set volume caps on every bulk-access account. #DataBreach #Denmark
diesec.com/2026/10/denm...
diesec.com/de/2026/10/d... Atlassian CVE-2026-21589 (CVSS 9.3): unauthenticated file read in 8 Data Center products incl. Jira, Confluence, Bitbucket, Crowd. No exploitation reported yet. Upgrade, restrict access, check logs.
🇬🇧 diesec.com/2026/10/atla...
🇩🇪 diesec.com/de/2026/10/a...
#cybersecurity Berlin refused to pay. Rhysida published the data anyway. September 2026 Cybersecurity Roundup: Berlin, Landsberg, Keio, 220M exposed travel records and 4 exploited CVEs in Cisco, Zyxel, Citrix and MikroTik.
🇬🇧diesec.com/2026/10/sept...
🇩🇪diesec.com/de/2026/10/c...
#CyberSecurity Warlock ransomware still enters via on-prem SharePoint: Symantec links it to a water utility and a telecom attack. EDR killer on 40+ hosts in about 2 hours. Patch, rotate machine keys, watch SYSVOL.
diesec.com/2026/10/warl...
diesec.com/de/2026/10/w...
#SharePoint #cybersecurity Zammad zero-days CVE-2026-102489 + CVE-2026-102490: session hijack to code execution to root. DIVD says an AI agent chained them in seconds. First one is on CISA KEV. No fix for the root flaw at disclosure.
🇬🇧 diesec.com/2026/10/zamm...
🇩🇪 diesec.com/de/2026/10/z...
#cybersecurity FortiMail zero-day CVE-2026-104286 (CVSS 9.8): unauthenticated file write, exploited now, CISA KEV. No fix for 7.4, 7.6, 8.0 as of Oct 2. Disable IBE or block internet access to the management interface. #FortiMail #CyberSecurity
diesec.com/2026/10/fort...
diesec.com/de/2026/10/f... 5 attacked layers — all ones other infrastructure trusts.
Cisco SD-WAN 9.8 · WSO2 JWT bypass 10.0 · Citrix backdoors survive patching · Apple iOS zero-day #7 · German KRITIS cert breach, 640 GB
🇬🇧 diesec.com/2026/10/top-...
🇩🇪 diesec.com/de/2026/10/t...
#Cybersecurity #DIESEC GUTcert, a German KRITIS certifier, breached Sep 5-9. 640GB stolen incl. grid substation locations and network plans. ENTEGA confirms downstream impact. Extortion attempts followed.
🇬🇧 diesec.com/2026/10/gutc...
🇩🇪 diesec.com/de/2026/10/g...
#KRITIS #ThirdPartyRisk #CyberSecurity New Spectre v2 attack (Branch Target Reuse) recovers a Linux root password hash in minutes, on a fully patched Intel system. Hits Intel, AMD, Arm. Linux fix: CVE-2026-64507/64508. Firefox fix still pending.
🇬🇧diesec.com/2026/10/spec...
🇩🇪diesec.com/de/2026/10/s...
#cybersecurity DACH under fire: ENISA names ransomware the EU's most damaging threat, while hacktivist DDoS campaigns drove close to 80% of reported incidents. Germany's own BSI calls the situation "angespannt." What SMEs should check first:
diesec.com/2026/09/dach...
diesec.com/de/2026/09/d...
#cybersecurity "SalesBleed": poisoned Salesforce lead form hijacked Agentforce AI agents, zero-click CRM theft, no login needed. Patched by Aug 19, disclosed by Zenity Labs. 4th AI agent hijack of 2026, same root cause.
🇬🇧 diesec.com/2026/09/sale...
🇩🇪 diesec.com/de/2026/09/s...
#cybersecurity #diesec Citrix NetScaler: 2 unauthenticated RCE zero-days (CVSS 9.5), exploited before a patch existed. Default config affected. CISA KEV deadline Wed Sep 30. Patch to 14.1-73.37 / 13.1-64.23 now.🇬🇧 diesec.com/2026/09/citr...
🇩🇪 diesec.com/de/2026/09/c...
#CyberSecurity #CISA #Citrix Arista VeloCloud Orchestrator: 2nd CVSS-10.0 CVE in 3 months. CVE-2026-93952 gives unauthenticated privileged access, actively exploited. Patch to 5.2.3.16+/6.4.2.8+ now. On 6.1.x/7.0.x? Call Arista TAC.
🇬🇧 diesec.com/2026/09/aris...
🇩🇪 diesec.com/de/2026/09/a...
#cybersecurity TOP 5 Cybersecurity News: Sandworm in your firewall manager. Check Point zero-day for 2 months. F5 BIG-IP OAuth RCE. OpenAI agents flooding RubyGems. Ransomware via Active Directory GPO.
🇬🇧 diesec.com/2026/09/top-...
🇩🇪 diesec.com/de/2026/09/t...
#cybersecurity #CISA #AIGovernance New EU audit: no member state has EVER classified a cyber incident "large-scale" since 2016. Not WannaCry, NotPetya, or Collins Aerospace's ransomware hit. If your NIS2 plan assumes Brussels steps in, it won't.
🇬🇧 diesec.com/2026/09/eu-c...
🇩🇪 diesec.com/de/2026/09/e...
#NIS2 #Cybersecurity F5 confirms exploitation of CVE-2026-94127 (CVSS 9.8): unauth RCE in BIG-IP APM's OAuth Authorization Server role. CISA KEV same day, deadline Friday. 14,700+ exposed IPs. Patch or apply F5's interim
🇬🇧 diesec.com/2026/09/f5-b...
🇩🇪 diesec.com/de/2026/09/f...
#cybersecurity Revolut disclosed customer data after fraudulent requests came through a compromised account, passing every authentication check. Authentication proves the route, not that a request should be trusted.
🇬🇧 diesec.com/2026/09/revo...
🇩🇪 diesec.com/de/2026/09/r...
#CyberSecurity #DataBreach #Revolut CVE-2025-14733 (CVSS 9.3): WatchGuard Firebox RCE patched since Dec 2025, now confirmed under ransomware exploitation. ~125K IPs exposed, ~9K unpatched. Patch + rotate credentials now.
🇬🇧 diesec.com/2026/09/watc...
🇩🇪 diesec.com/de/2026/09/w...
#WatchGuard #CyberSecurity #Ransomware CVE-2026-76460 (CVSS 10.0): unauth attackers skip login on Cisco ISE, reach root. Active exploitation confirmed. 2nd Cisco zero-day this week. Patch to 3.5p4/3.4p7/3.3p12/3.2p11/3.1p12 now.
🇬🇧 diesec.com/2026/09/cisc...
🇩🇪 diesec.com/de/2026/09/c...
#Cisco #CyberSecurity #ZeroDay GitLab CVE-2026-85706 (CVSS 10.0): unauthenticated attackers read ANY file off self-managed servers, no login needed. Exploited within hours of the Sep 10 patch. CISA KEV. Patch to 19.3.2/19.2.6/19.1.8 now.
🇬🇧 diesec.com/2026/09/gitl...
🇩🇪 diesec.com/de/2026/09/g...
#cybersecurity Top 5 Cybersecurity News.
Cisco ISE zero-day bypasses identity checks entirely.
ScreenConnect sessions hijacked to push malware.
GitLab's 2nd max-severity flaw in 6 weeks.
EU's new 24h vulnerability reporting law is live.
🇬🇧 diesec.com/2026/09/top-...
🇩🇪 diesec.com/de/2026/09/t...
#cybersecurity CVE-2026-59822 (CVSS 8.8): LiteLLM MCP proxy lets attackers skip OAuth2 login entirely, no credentials needed. First MCP flaw in CISA KEV. Exploited since Sep 1. Upgrade to v1.84.0+. Federal deadline: today.
diesec.com/2026/09/lite...
diesec.com/de/2026/09/l...
#cybersecurity #diesec #LiteLLM Cisco confirms active exploitation: CVE-2026-76461 (CVSS 9.8) grants ROOT access via one crafted email, no login needed. AsyncOS Secure Email Gateway. CISA KEV deadline Sep 17. Patch to 16.5.0-780 now.
diesec.com/2026/09/cisc...
diesec.com/de/2026/09/c...
#Cisco #EmailSecurity #CyberSecurity AI just overtook social engineering... almost. SANS's 2026 report has it at #2 human risk, up from #4 two years ago. The #1 barrier to fixing this? Lack of time, five years running:
🇬🇧diesec.com/2026/09/cybe...
🇩🇪diesec.com/de/2026/09/c...
#CyberSecurity #SecurityAwareness Dutch NCSC: exploitation of new Check Point VPN flaws (CVE-2026-85102/85103, CVSS 9.8) is imminent, before Check Point saw any attacks. Pre-auth RCE. 3rd critical Check Point CVE in 2026. Patch via LivePatch now.
diesec.com/2026/09/chec...
diesec.com/de/2026/09/c...
#CyberSecurity New Windows Defender exploit "ShieldCrash" grants SYSTEM access on FULLY PATCHED systems, bypasses the fix Microsoft shipped days ago. No CVE, no patch yet. 5th Defender EoP bug from this researcher in 2026.
🇬🇧 diesec.com/2026/09/wind...
🇩🇪 diesec.com/de/2026/09/w...
#ZeroDay #cybersecurity #diesec SAP patched (Sep 8) a CVSS 10.0 flaw reachable before login, via HTTP, SAP GUI, AND RFC. CVE-2026-44756 OVERPASS. 10,000+ SAP interfaces found online, not all confirmed vulnerable. Check SAP Note 3747649.
diesec.com/2026/09/sap-...
diesec.com/de/2026/09/s...
#CyberSecurity #SAP 974 CVEs. Two zero-days in the wild. One release.
TerminalFix hit Berlin's Senate before awareness training caught up.
4 espionage clusters shared the same Chrome+Windows exploit kit.
🇬🇧 diesec.com/2026/09/top-...
🇩🇪 diesec.com/de/2026/09/t...
#Cybersecurity #DIESEC N-able N-central: 4th emergency hotfix in 5 weeks. CVE-2026-86218 (CVSS 10.0) unauthenticated RCE. Huntress found an already-patched customer breached again Sept 4. CISA KEV deadline: today.
🇬🇧 diesec.com/2026/09/n-ab...
🇩🇪 diesec.com/de/2026/09/n...
#MSP #CyberSecurity StyleSmuggler: unauthenticated CVSS 10.0 RCE in Magento/Adobe Commerce, exploited since Sept 4 via a poisoned payment-reminder email. Rust backdoors on live webshops. Adobe: rotate encryption keys, not just patch.
diesec.com/2026/09/adob...
diesec.com/de/2026/09/a...
#CyberSecurity #StyleSmuggler Five breaches, five CVEs, one pattern: compromised identities and overlooked apps. August 2026 Cybersecurity Roundup — SafePal, CEVA, France's tax authority, Latvia's CSDD, Manchester Airports.
diesec.com/2026/09/augu...
diesec.com/de/2026/09/c...…lick-august-2026/
#CyberSecurity Chrome's 6th zero-day of 2026: CVE-2026-85046 (CVSS 8.8). Google says an exploit existed in the wild when it shipped the Sep 3 fix. CISA KEV deadline Sep 18. Update managed fleets, enforce min version on BYOD.
diesec.com/2026/09/chro...
diesec.com/de/2026/09/c...
#CyberSecurity #Chrome #ZeroDay No Password Needed to Break In. Dropbox/Lenovo flaw let attackers register a Lenovo ID with your email, then log in passwordless (no 2FA). ~5,000 hit, Aug 4-21; files accessed in <1/3. Third 2026 case.
diesec.com/2026/09/drop...
diesec.com/de/2026/09/d...
#CyberSecurity #Dropbox TerminalFix: fake CAPTCHA tricks users into pasting PowerShell, creating a pivot into the network. BSI confirms a German state institution hit (unnamed). Same cluster as Berlin's Rhysida breach, per heise.
diesec.com/2026/09/term...
diesec.com/de/2026/09/t...
#CyberSecurity #ClickFix onicWall SMA1000 hit again: CVE-2026-83548 (CVSS 10.0) + CVE-2026-83549 chain to unauthenticated root RCE. Same appliance we flagged in July. CISA KEV deadline was Sept 5. BSI warning issued. Patch now.
🇬🇧 diesec.com/2026/09/soni...
🇩🇪 diesec.com/de/2026/09/s...
#SonicWall #CyberSecurity Boston Scientific cyberattack: shipping still down 1+ week after Aug 25. 8 European Ceva warehouses hit, device shipments delayed. No group has claimed it, no CVE — pure business continuity failure.
🇬🇧 diesec.com/2026/09/bost...
🇩🇪 diesec.com/de/2026/09/b...
#CyberSecurity #Healthcare Patch applied → Exchange still running Pwn2Own chain.
MFA active → vishing bypassed it, 284M records gone.
AI tools ready → GitSpawn ran code first.
SonicWall CVSS 10. JFrog phantom key. Five gaps, one pattern.
🇬🇧 diesec.com/2026/09/top-...
🇩🇪 diesec.com/de/2026/09/t...
#cybersecurity #diesec JFrog Artifactory auth bypass (CVSS 9.8): attackers minting unauthenticated admin tokens on self-hosted instances just 4 days after disclosure. Patch now, rotate join key, revoke existing tokens.
diesec.com/2026/09/jfro...
diesec.com/de/2026/09/j...
#CyberSecurity #DevSecOps #CVE ShinyHunters claims it vished McKesson staff, hijacked Okta, exfiltrating ~1TB from Salesforce/Snowflake. Claimed $55.2M ransom, 72h deadline. McKesson confirmed the breach, not the attack path.
🇬🇧 diesec.com/2026/09/mcke...
🇩🇪diesec.com/de/2026/09/m...
#CyberSecurity #Vishing Device code phishing uses Microsoft's real login page — MFA completes normally, no red flags. Detections rose 37.5x. Now sold as a subscription kit.
Full breakdown:
🇬🇧 diesec.com/2026/09/devi...
🇩🇪 diesec.com/de/2026/09/d...
#CyberSecurity #PhishingSimulation #DeviceCodePhishing 
