Last Updated: 2026-10-08T21:02:44Z (UTC) What’s Happening Another critical vulnerability in Citrix Netscaler ADCs/Gateways has been published. This CVSS4 9.5 issue is a memory overflow leading to either denial-of-service or remote code execution. No evidence of exploitation is yet public, per Citrix’s advisory. They have published an accompanying blog post with little additional information. Affected Versions and Preconditions Broadly, the vulnerability affects devices configured as SAML...

Prepare for post-quantum authentication by testing certificate ecosystems now. Learn how Microsoft’s PQC TLS Pilot Program helps advance future readiness.

To rebuild one submitted form, React scanned every field in the request once for each reference it contained. Nothing capped either number, so one 900 KB POST makes the server do 100 million checks an...

Neues Daten-Leck bei Nius: Einsehbar sind Adressen von Lesern, Zahlen zu Abo-Einnahmen und umfassende Auszüge aus dem Redaktionssystem.

Python For Defenders The Bad Guys Code. So Should You. Updated for 2026! Adding Python programming to your defensive skillset makes you a formidable adversary. Whether it’s vastly increasing the efficiency of common procedures, or adding new capabilities to the entire team, Python in Jupyter Notebooks completely transforms what’s possible for a security operations team. Become the defender who can use use these skills to your advantage. This course is separated into two parts. Part 1 explo...

This is the second federal court decision in a little over a week to suggest that driver surveillance systems can go too far.

„Hallo, hier die IT, wir migrieren gerade den Login." Ein Anruf auf Niederländisch, eine nachgebaute Anmeldeseite, ein Callcenter-Account. Mehr brauchte es nicht, um beim Telekom-Anbieter Odido die Daten von über sechs Millionen Menschen abzuziehen. Kein Deepfake, keine KI - Svea erzählt, wie ShinyHunters vorgehen, warum die niederländische Polizei den Anruf im Fernsehen abspielte und was das FBI damit zu tun hat. Danach Angela Sasse, Professorin für Human-Centred Security in Bochum. 1999 schrieb sie „Users are not the enemy", bis heute einer der meistzitierten Texte des Fachs. Ihre These: Awareness-Training ist meist das Billigste, nicht das Wirksamste. Warum Passwörter ein Relikt sind, was Passkeys besser machen und wieso Eva selbst auf eine Test-Phishing-Mail geklickt hat. Mit Svea Eckert und Eva Wolfangel Musik und Produktion: Marko Pauli Odido-Hack: Mehr als sechs Millionen Betroffene (TechCrunch): https://techcrunch.com/2026/02/13/dutch-phone-giant-odido-says-millions-of-customers-affected-by-data-breach/ Die Polizei spielt die Stimme des Anrufers im Fernsehen ab (NOS): https://nos.nl/l/2622288 Zack Whittaker: Fear the phone call, die großen Vishing-Fälle der letzten Monate: https://this.weekinsecurity.com/fear-the-phone-call-hackers-are-calling-for-your-personal-data/ Der Angriff auf das FBI-Bewerbungsportal (Help Net Security): https://www.helpnetsecurity.com/2026/09/28/fbi-job-portals-offline-shinyhunters-breach/ Angela Sasse an der Ruhr-Universität Bochum: https://casa.rub.de/en/news/casa/news/angela-sasse-is-considered-a-pioneer-of-usable-security Adams und Sasse (1999): Users Are Not the Enemy: https://doi.org/10.1145/322796.322806 Selling Satisfaction, die Studie zu den Versprechen der Awareness-Anbieter: https://doi.org/10.1145/3658644.3690196 Passkeys und FIDO2, erklärt: https://fidoalliance.org/passkeys/ Law4school, das Webinar-Programm von Gesa von Schwerin: https://www.law4school.de

I dunno if people remember the ransomware economy thread I had on Twitter years ago, but one of the things I covered is all the “ransomware recovery” vendors who secretly pay ransomware groups and pre...

Digitale Attacken auf Wirtschaft und kritische Infrastruktur nehmen zu. Dazu kommt: KI-Programme hacken jetzt auch - und zwar selbsttätig. Kann man sich davor schützen? Eines jedenfalls ist sicher: Da...

Denmark's residents have been hit by a data breach affecting the country's Central Register of Persons, exposing names, addresses, CPR numbers and other details of

Explore this post and more from the cybersecurity community

App om op ATProto gebaseerde sociale medianetwerken te verkennen, b.v. Blauwe lucht

The FBI and Secret Service warn that the FortiBleed campaign has targeted over 400,000 Fortinet devices, locking users out and enabling ransomware attacks.

Threat actors are now hiding payloads by using DNS TXT records and browser cache pre-fetching, making it tougher to spot early attack stages.

Worlds Largest Ransomware Group Qilin Member Arrested in Japan Key Figure Extradited to Germany Amid Groups 161 August Attacks

Last Updated: 2026-10-06T17:20:51Z (UTC) CVSSv3: 9.3 Atlassian has published an advisory regarding a putative path traversal vulnerability in multiple products. We’re saying “putative” because although the remediation is plainly about dots and slashes, the word “traversal” does not appear in the advisory. WatchTowr, as usual, has published a writeup of this vulnerability, including a proof-of-concept. They have demonstrated that the file read in Atlassian Crowd leads credential leakage ...

Qilin is believed to have carried out ransomware attacks against companies worldwide, causing major damage through data encryption.

The FBI confirmed multiple arrests in its ShinyHunters investigation after suspected member Saif al-Din Khader was reportedly detained in Jordan.