Even gem list can run someone else's code

Aikido researchers show that Ruby's gem lifecycle hooks let malicious packages execute and exfiltrate data even on seemingly safe commands like `gem list`, with four such gems identified in the wild.

[NEU] [hoch] apt: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten

BSI warns of a critical apt vulnerability enabling remote root-level code execution — a systemic risk to any enterprise relying on Debian-based Linux infrastructure or CI/CD pipelines.

SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks

SonicWall is patching an SSL-VPN authentication bypass already exploited in the wild—one of seven SonicOS flaws—giving attackers unauthenticated VPN access past MFA on a firewall platform widely used by European Mittelstand.

Stopping Node2Shell: How SentinelOne Protects Customers From Brotli-Based Remote Code Execution

SentinelOne dissects Node2Shell, a Brotli-decoder RCE affecting Node.js, Bun, and .NET—demonstrating how a single compression-library flaw can propagate across runtimes and evade standard patching cycles.

[NEU] [hoch] Wazuh: Mehrere Schwachstellen

High-severity Wazuh flaws allow RCE with admin privileges, security-bypass, and data manipulation — a compromised SIEM/XDR platform becomes the attacker's most powerful tool for evading detection.

[NEU] [hoch] IBM MQ: Mehrere Schwachstellen

CERT-Bund flags multiple high-severity IBM MQ vulnerabilities — including RCE and data manipulation — that threaten enterprise messaging infrastructure widely used across European organisations.

Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

CISA added an actively exploited Apple flaw to its KEV catalogue after info-stealer campaigns leveraged it—organisations with mixed-OS fleets should verify Apple patch compliance immediately.

[NEU] [hoch] JetBrains IntelliJ IDEA: Mehrere Schwachstellen

BSI issues a high-severity advisory for IntelliJ IDEA covering RCE, XSS, and file manipulation — a direct threat vector for developer-workstation compromise via malicious repos.

October 2026 CVE Landscape

Recorded Future's October 2026 CVE review identified 82 high-impact flaws (52 rated Very Critical), down 13% from September — useful as a curated prioritisation input alongside NVD and EPSS feeds.

APT29's Watering Holes Target Thousands of Mobile Users

APT29 is compromising websites to fingerprint and selectively exploit mobile visitors at scale—a pivot toward mobile that European organisations, a frequent Cozy Bear target, should treat as an immediate detection priority.

CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations

Kaspersky documents real-world attacks where CyberStrikeAI fully automated the post-exploitation phase against educational institutions—one of the first confirmed cases of end-to-end AI-driven offensive operations, with clear implications for enterprise defence posture.

Hackers pull off $133 million French bank heist via service provider

Crédit Mutuel Arkéa suffered $133 million in fraudulent transactions routed through a compromised service provider—a stark illustration of why DORA's third-party ICT risk rules exist and why EU banks must enforce transaction-anomaly controls at every integration boundary.

The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603

Kaspersky dissects Storm-2603's fileless SharePoint intrusion using ToolShell exploitation and runtime subversion—SOC teams should operationalise the detection guidance for in-memory threats in Microsoft 365 environments.

CEO-spoofing scammers used AI to help steal more than $100 million, feds say

Federal prosecutors have charged three suspects—extradition from Europe pending—for AI-assisted CEO-impersonation fraud exceeding $100 million, marking a threshold moment where deepfake-enabled BEC has become a nine-figure financial crime.

Fake security tools on GitHub push backdoors and infostealers

Attackers are planting backdoored security tools on GitHub that specifically target cybersecurity professionals—a supply-chain tactic that could compromise the defenders themselves and their privileged access.

Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware

Russia-aligned group Gorbag weaponises a WinRAR flaw to deploy info-stealers against Ukrainian law enforcement—EU organisations with Ukraine ties should review archive-handler patching and endpoint telemetry.

Firecracker VM Escape: PwnEscape Part 2

Escalate or Close: How Fast-Tier Models Handle Held-Out Web Attack Families in Two-Tier Triage

Researchers show that fast-tier ML classifiers in two-tier WAF architectures can silently suppress entire unseen attack families, quantifying a blind-spot risk that SOC teams relying on such setups should stress-test.

SoK: Post-Quantum Cryptography (PQC) Integration in Software Development: Approaches, Gaps, and Future Directions

A systematisation of PQC software integration reveals that standardised algorithms alone do not guarantee secure deployment—enterprises must address library compatibility, performance, and API gaps before quantum deadlines arrive.

Making HTTP header injection critical with one prompt

PortSwigger now automates the full escalation chain from HTTP header injection to CRLF-powered request-smuggling desync in a single Burp scan check, turning low-severity findings into critical proxy-level exploits.

Mi Scusi, My SCSI: Abusing iSCSI Target Server

SpecterOps demonstrates how unauthenticated iSCSI target servers still allow initiator impersonation and full disk access — a risk first flagged at BlackHat 2005 that persists in many enterprise SANs.

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

Active exploitation of a CVSS-10 authentication bypass in Siemens SIMATIC IoT2050 gateways gives attackers unauthenticated remote command access—European manufacturers should treat this as a P0 OT incident.

Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System

Unit 42 documents active cyberattacks against European refrigeration and cold-chain control systems—a direct threat to food, pharma, and logistics operators that underscores the urgency of OT segmentation and NIS2 compliance for industrial environments.

Harden cooling systems now, feds warn critical infrastructure operators amid attacks

CISA and FBI urge critical-infrastructure operators to harden cooling and refrigeration OT systems after confirmed attacks disrupted European supermarkets—a direct NIS2-relevant threat to EU essential entities.

PolinRider Loader Reappears in Hijacked npm Packages

Sonatype found concealed loaders in 12 releases of 10 hijacked npm packages that decode C2 server addresses from Ethereum transactions — a blockchain-based evasion tactic that complicates traditional domain blocking.

A.S.E 2.0: Understanding How Repository Context Impacts the Security of LLM-Generated Code

Study finds that the repository context fed to LLM coding assistants decisively shapes whether generated code inherits project safeguards or introduces new vulnerabilities—a tunable risk lever for DevSecOps teams.

EU AI Act transparency rules show why businesses can’t afford to wait

With EU AI Act transparency deadlines approaching, organisations deploying AI need structured inventories and disclosure processes now—waiting risks both fines and reputational damage.

Watermarking Without Standards Is Not AI Governance

A position paper warns that AI watermarking without interoperability standards risks becoming theatre rather than governance—a pointed concern for EU enterprises building AI Act compliance programmes.

AIs Hacking the Law

Schneier examines German demonstrations of AI models discovering exploitable loopholes in legal systems—raising urgent questions for EU enterprises deploying AI in regulated decision-making under the AI Act.

Grammar-Constrained Decoding Can Jailbreak LLMs into Generating Malicious Code

Grammar-constrained decoding—meant to improve LLM output reliability—ironically enables more effective malicious-code generation by guaranteeing syntactic validity of exploits.

Medical services company settles with 4 states over 2023 hack of sensitive patient records

Four US state AGs jointly settled with a healthcare transcription firm over a 2023 patient-data breach — a cross-jurisdiction enforcement model European enterprises should watch as NIS2 coordination matures.