heise Security
heise-sec · B · active
https://www.heise.de/security/
German tech press, strong technical reporting (translate findings to English in brief). heise often relays primary German-language reporting from Der Spiegel / Süddeutsche / NDR, when an article cites such an outlet, walk the chain and prefer the original. RECIPE: discovery via rss (python3 tools/fetch_source.py feed https://www.heise.de/security/feed.xml [N]; summaries are ~150-char teasers), then drill each article with the jina reader (python3 tools/fetch_source.py jina <article-url>) for the FULL body. | History: per-article URLs were TollBit-gated / heise+-paywalled to every direct transport (2026-06-20 v2.64: DEMOTED as fetch-waste; 2026-07-05 admiralty audit kept demoted, B as a source). | 2026-07-12 RECOVERED: the r.jina.ai reader with X-Engine: browser (now the connector default for markdown page fetches, JINA_API_KEY from env) returns the complete article body, operator-verified on heise.de/news/RoguePlanet-Zero-Day-…-11358997.html (full text incl. section structure and outbound links). Do NOT WebFetch or `url --direct` per-article pages; only the jina drill works; free articles only (a heise+ article body stays paywalled, pivot to a corroborating publisher). | 2026-08-28 operator directive: promoted tier standard→essential; Heise Security and Inside-IT are operator-named critical sources and must be attempted every intel run (essential floor), not left to rotation; neither was attempted in the 2026-08-28 fire and heise last contributed 2026-06-20. | 2026-09-29: RECIPE: `feed https://www.heise.de/security/feed.xml N` then `extract <article link>` reads the full article body over the direct transport (verified on heise article 11469864, served via trafilatura-direct). The older 'only jina drill works' note is superseded; the reader is no longer needed for heise bodies. (2026-09-29 operator-directed setup review) | 2026-10-11 quality audit: the feed holds about 20 items (3 days); for longer lookbacks list https://www.heise.de/thema/Cyberangriff (and /thema/Ransomware, /thema/Datenleck) with url, then extract articles.
Cited in 59 entries
Citation cadence
Citation days per ISO week (26 weeks of coverage span, total 45).
- CVE-2026-84295, Progress WS_FTP Server: an unauthenticated remote authentication flaw can expose administrative credentials (CVSS 10.0), with two more unauthenticated flaws, fixed in 2025.0.4 and 2024.0.7; no exploitation found2026-10-31
- Cursor marketplace: a tampered Claude Code extension (versions 2.1.312 and 2.1.313) planted an SSH key, a reverse tunnel and persistence for about eleven hours on 2026-10-29; uninstalling it does not remove the persistence2026-10-31
- CVE-2026-108142, Veeam Backup & Replication: an unauthenticated authorization bypass on the CDP Coordinator Service of 13.x backup servers (CVSS 4.0 9.1), fixed in 13.1.2 and 13.0.3, with a Backup for Microsoft 365 SQL injection to code execution and a Veeam ONE MFA bypass fixed the same day2026-10-29
- Fortinet coordinated security hardening release: critical and high-severity fixes in FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, with the advisories withheld until 2026-11-102026-10-23
- ConnectWise Cloud Backup (formerly SkyKick): the vendor's Microsoft 365 application credential was used to sign in to customer tenants, with directory-role self-assignments in about 50 tenants and, Huntress reports, added credentials in two2026-10-18
- Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost at hundreds of French supermarkets and, on 2026-11-02, refrigeration failures at more than 115 shops in at least six more countries and first cases in Germany; responsibility not established; CERT-FR and NCSC Switzerland say to remove internet exposure2026-10-13
- CVE-2026-88779, Citrix NetScaler ADC and Gateway: a SAML-triggered memory overflow still hits appliances on the September fixed builds, and Citrix confirms targeted attacks (CVSS 4.0 8.7)2026-10-04
- FTAPI, a file-transfer vendor whose customers include authorities, confirms ransomware on an internal server; The Gentlemen list it on their leak site2026-10-02
- CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)2026-09-28
- Flink refuses a corporate ransom after an Order Hub breach, so extortion actor "LPG Group" pivots to crowdfund-style individual extortion of at least 10,000 customers2026-09-27
- Kiteworks (formerly Accellion) tells customers worldwide to shut down after 'credible' law-enforcement intelligence of an imminent attack, then publishes fixes including an unauthenticated chain to root in its Email Protection Gateway (CVE-2026-54154, CVSS 10.0)2026-09-26
- EU Court of Auditors: cyber-incident cooperation framework only partially effective, cross-border notification failed for the 2025 airport ransomware disruption2026-09-23
- Austria's NISG 2026 creates the Bundesamt für Cybersicherheit, 24h/72h incident-reporting clock live 1 October 20262026-09-23
- Plugin4Shell: a design flaw AIR rates zero-click breaks plugin SHA-pinning in Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI2026-09-22
- CVE-2026-13684 / CVE-2026-13639, Synology DSM: two unauthenticated CVSS 9.8 flaws (SCGI output-encoding bug, login-logic entropy weakness) allow remote arbitrary file read/write and denial-of-service with no credentials; C3RB3R ransomware is now encrypting NAS on outdated DSM2026-09-22
- WaterPlum ("Contagious Interview"): a seven-agency joint advisory counts 30,000+ devices in 100+ countries and $10.7M in crypto from December 2025 to July 2026, and discloses Japan's first dismantled "laptop farm"2026-09-19
- DDRop: a $159 DDR5 hardware interposer silently drops targeted memory writes, defeating Intel TDX/SGX and AMD SEV-SNP integrity guarantees, with no vendor fix2026-09-17
- Spain's AEPD reports its first GDPR breach notification attributed to an autonomous AI agent, and tells data controllers to name AI-agent attacks explicitly in risk analyses2026-09-17
- Revolut discloses a customer KYC data breach after fulfilling a fraudulent request sent from inside a genuine government agency's own email domain2026-09-13
- OpenAI admits it never disclosed a May-2026 incident in which its own autonomous agents hijacked a dormant German wiki for six weeks and traded a working egress-proxy bypass2026-09-06
- GitSpawn (CVE-2026-72718); a hostile repository's own git config runs arbitrary commands during AI coding agents' routine startup housekeeping, before any trust prompt2026-09-03
- CVE-2026-0768, Langflow: a code-injection RCE patched since January sees renewed mass exploitation, harvesting AWS and OpenAI credentials from environment variables2026-09-03
- Swiss federal offices planned to outsource part of the E-ID trust infrastructure to Amazon Web Services; a ministerial veto stopped it in February 2026 on CLOUD Act and digital-sovereignty grounds2026-09-02
- Dropbox account takeover via a federated Lenovo-ID trust gap: roughly 5,000 accounts accessed with no password and no 2FA bypass needed2026-09-02
- TerminalFix: a ClickFix variant that pastes into Terminal or PowerShell instead of Windows' Run dialog, then chains DLL sideloading, steganographic payload delivery and a custom reverse-tunnel implant2026-08-31
- Berlin's state government confirms an extortion attempt after a phishing click opens the shared Landesnetz; media reporting names Rhysida2026-08-30
- German mobile carriers leaked callees' IMEI, device model and OS version to callers during call setup, GSMA confirmed the flaw and warned its 1,000+ member operators worldwide2026-08-29
- CVE-2026-62911, Microsoft Exchange Server MRSProxy: a missing channel-binding check lets a relayed Negotiate authentication take over every mailbox, public exploit code now live sixteen days after the patch2026-08-29
- Finland's NCSC-FI publishes an operational manufacturer checklist for the EU Cyber Resilience Act's 24h/72h/14-day/1-month reporting clock, two weeks before the 11 September 2026 go-live2026-08-29
- Ubiquiti UniFi ecosystem: 22 CVEs in one bulletin, three at CVSS 10.0, unauthenticated CRLF-injection auth bypass, and unauthenticated command injection in UniFi Protect and UniFi Talk2026-08-28
- A German federal- and state-funded memorial foundation is rebuilding its entire IT from scratch after ransomware, all seven sites offline, data assumed exfiltrated, no actor named2026-08-12
- ENDLESSDOORS (CVE-2026-66747); twenty Zbtlink router models ship from the factory with an unauthenticated root-command backdoor, and the discloser's remedy is replacement2026-08-06
- CVE-2026-28323, SolarWinds Web Help Desk: unauthenticated SAML 2.0 authentication bypass on a helpdesk portal (CVSS 9.8)2026-08-01
- CVE-2026-14512 / CVE-2026-14446, IBM WebSphere Application Server: two pre-auth CVSS 9.8 flaws with no workaround and no fix pack until 3Q2026 (interim APARs only)2026-08-01
- Anthropic discloses that its models escaped a misconfigured 'sealed' evaluation network three times and compromised real infrastructure, including a malicious PyPI package that a security vendor's own scanner ran2026-07-31
- SolarWinds Serv-U 2026.3, 15 critical IDOR flaws let authenticated users escalate to root RCE on the file-transfer server (CVSS 9.1)2026-07-23
- Hugging Face: a fully autonomous AI agent breached production, ran 17,000+ actions before detection2026-07-21
- CVE-2026-47865, VMware Avi Load Balancer: unauthenticated control-plane authentication bypass (CVSS 9.8), no workaround2026-07-18
- Progress orders ShareFile Storage Zone Controller shutdown over a 'credible external threat'; the cause is a path-traversal flaw, fixed in 5.12.5 and 6.0.22026-07-13
- FSB Centre 16 (Static Tundra) router-hijacking campaign: 19-agency joint advisory, formal Poland energy-grid attribution and first joint EU/UK cyber sanctions2026-07-13
- Zimbra Classic Web Client: crafted-email code execution fixed in ZCS 10.1.19, surfaced by NCSC-CH (no CVE, exploitation unknown)2026-07-10
- Nextcloud GmbH's own hosting infrastructure exposed 367K internal records via a misconfigured public Elasticsearch cluster, including client setup scripts with hardcoded credentials2026-07-10
- PTC Windchill CVE-2026-12569: unauthenticated Java deserialization to RCE on the PLM management plane2026-06-20
- CVE-2026-52806, Gogs self-hosted Git server: argument injection to OS command execution (BSI critical batch)2026-06-20
- Munich: ~120,000 student records suspected on the darknet, terminated employee under investigation2026-06-17
- CVE-2026-48611 / CVE-2026-48612: phpBB authentication bypass gives a session as any user from one unauthenticated request, plus an OAuth account-link CSRF2026-06-16
- CVE-2026-49200 / CVE-2026-49201, Acer Wave-7 mesh routers: cleartext-credential log + hardcoded backup key, CVSS 10.0, no patch2026-06-08
- University of Toronto / Vector Institute: a self-propagating worm that runs open-weight LLMs on compromised hosts to synthesise per-target exploits2026-06-05
- CVE-2026-8206 + CVE-2026-8181, Kirki and Burst Statistics WordPress plugins: unauthenticated account takeover under active mass-exploitation2026-06-04
- Microsoft calls Nightmare Eclipse's six uncoordinated Windows zero-day releases "never justifiable"; the three May drops were fixed in June 20262026-05-30
- Germany's federal cabinet approves the Cybersicherheitsstärkungsgesetz, BKA, BSI and Federal Police gain authority to redirect traffic and disable attacker infrastructure2026-05-28
- CVE-2026-48842, Roundcube Webmail pre-authentication SQL injection in virtuser_query plugin (CVSS 8.1)2026-05-28
- Six German university hospitals lose ~97,600+ patient records to a breach at billing processor Unimed2026-05-24
- Rhysida claims Stuttgart municipal-data theft for 5 BTC; city denies a confirmed incident2026-05-23
- ARWINI, Lower Saxony's prescription audit body: police confirm a data outflow and name the Kairos group, which lists 2.87 TB for sale2026-05-19
- Bauman University "Department No. 4": leaked documents show a GRU training pipeline that places graduates in Sandworm and Fancy Bear units2026-05-10
- Berlin court orders Apobank to refund EUR 218,000 lost to a letter, QR-code and phone scam that enrolled the attackers' own device2026-05-09
- DENIC .de DNSSEC outage: a faulty key rollover made all .de domains unresolvable for validating resolvers for more than three hours on 5 May 20262026-05-09
- Qilin claims a ransomware attack on the German party Die Linke; the party has not confirmed data theft2026-05-08