IT-Sicherheit · Aktuell
IT Security News
Aktuelle Meldungen zu IT-Sicherheit, Cyberbedrohungen und Datenschutz — automatisch kuratiert aus führenden Quellen.
Personal Intelligence: Google macht Gmail und Fotos für Werbung nutzbar
Google ändert seine Datenschutzerklärung. Wer Gmail und Fotos mit Personal Intelligence verbindet, sieht womöglich gezielte Werbung. (<a href="https://www.golem.de/specials/google/">Google</a>, <a href="https://www.golem
PHP2Shell: Die Schonfrist ist vorbei
Die PHP-Lücke hat am 21. Oktober etliche Websites vom Netz gezwungen. Wir brauchen eine andere Kultur im Umgang mit solchen Lücken, findet Tobias Glemser.
Angriffe auf Arista VeloCloud und Collabora/Nextcloud beobachtet
Angreifer nutzen eine Lücke in Collabora und installieren Webshells auf Nextcloud-Servern. Auch Arista VeloCloud wird attackiert.
Partnerangebot: heise conferences gmbh – “IT-Security im KI-Zeitalter – der Online-Thementag für Security-Profis”
Ausbrechende Agenten, haufenweise neue Sicherheitslücken und neue Waffen für Angreifer. Der secIT-Thementag thematisiert, wie sich IT-Security durch KI ändert. Im Fokus steht, neue Gefahren abzuwehren, Bug
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last w
ISC Stormcast For Monday, October 26th, 2026 https://isc.sans.edu/podcastdetail/10150, (Mon, Oct 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
YARA-X 1.22.0 Release, (Sun, Oct 25th)
YARA-X&#;x26;#;39;s 1.22.0 release brings 11 improvements and 9 bugfixes. 
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailsc
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws. "What rese
AI coding agents hijacked using AGENTS.md file in Downloads folder
Researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package. [...]
„Tal der Tränen“: Warum Angreifer bei Sicherheitslücken derzeit im Vorteil sind
Ein Experte der Cyberagentur des Bundes erklärt, warum Sicherheitslücken wie die PHP-Schwachstelle derzeit zunehmen und wie KI künftig helfen könnte.
OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models. "Based on the current
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions
Wähleradressen: AfD droht wegen Datenleck Ärger mit dem Datenschutz
Nach einem E-Mail-Leak prüft der Datenschutzbeauftragte, ob die AfD in MV Wählerdaten nicht ausreichend geschützt hat. (<a href="https://www.golem.de/specials/datenschutz/">Datenschutz</a>, <a href="https://www.golem.de/
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy pro
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python pac
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to
USA-Einreise: US-Grenzbeamte schauen immer öfter ins Handy
Die US-Grenzbehörde CBP prüft deutlich mehr Smartphones und Laptops. Der Rekord von 2025 dürfte fallen. (<a href="https://www.golem.de/specials/politik-recht/">Politik</a>, <a href="https://www.golem.de/specials/smartpho
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerab
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with
(Reliable)? php2shell exploitability, (Fri, Oct 23rd)
Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability. 
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. [...]
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uz
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations. The post Inside the LiteLLM 1.107.0 supply chain
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team K
Microsoft: Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. [...]
Anzeige: Microsoft 365 nach dem Zero-Trust-Prinzip absichern
Zero Trust verbindet Zugriffsschutz, Datenschutz und Monitoring in Microsoft 365. Ein Online-Workshop vermittelt die passenden Sicherheitsmaßnahmen. (<a href="https://www.golem.de/specials/golemakademie/">Golem Karrierew
Quest Diagnostics confirms data breach exposed patient records
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. [...]
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...]
You gave your AI agent access, but who is giving it orders?
AI agents can be manipulated through malicious emails, websites, and plugins into executing commands, stealing data, or deleting files using their legitimate permissions. Gen Digital explains how its Agent Trust Hub help
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this in
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you proba
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. [...]
Daten-Omnibus: EU-Ministerrat will Datenschutz für KI-Training lockern
Der EU-Ministerrat hat sich beim Daten-Omnibus geeinigt. KI-Training mit persönlichen Daten soll einfacher werden. (<a href="https://www.golem.de/specials/eu-dsgvo/">DSGVO</a>, <a href="https://www.golem.de/specials/date
php2shell: Millionen PHP-Dienste in Deutschland verwundbar
Die IT-Sicherheitsfirma Censys scannt PHP-Server auf für php2shell anfällige Versionen. Millionen in Deutschland sind noch verwundbar.
(g+) Cyber Resilience Act: Die Meldepflicht mit den eingebauten Lücken
Seit September gilt eine neue EU-Meldepflicht für Sicherheitslücken. Doch wer ein älteres vernetztes Gerät besitzt, kann auf einem bekannten Problem sitzen bleiben - ganz legal. Eine Analyse von Jan Gruber (<a href="http
AfD-Leak: Mutmaßliche Täter bekennen sich
In einem Interview mit der Zeit bekennen sich zwei anonyme Täter zu dem Cyberangriff auf die AfD: Es gehe um Transparenz und Gerechtigkeit.
PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications
Wird alle 30 Minuten aktualisiert · CH/DE: BACS Schweiz, BSI, Allianz Cyber-Sicherheit, Heise Security, Golem · EN: BleepingComputer, The Hacker News, Fortinet, SANS ISC, Microsoft Security, Krebs on Security, Kaspersky