IT-Sicherheit · Aktuell
IT Security News
Aktuelle Meldungen zu IT-Sicherheit, Cyberbedrohungen und Datenschutz — automatisch kuratiert aus führenden Quellen.
Ransomware recovery is now a client retention metric
Recovering from ransomware doesn't guarantee an MSP will retain its clients, especially when delays, poor communication, and unexpected costs undermine trust. Kaseya examines how disconnected recovery tools create these
Sabotage in Supermärkten: Warum Hacker Kühlanlagen in ganz Europa angreifen können
Öffentlich zugängliche Webinterfaces und bekannte Sicherheitslücken machen vernetzte Kontrollsysteme angreifbar, mit potenziell gravierenden Folgen weit über den Lebensmittelhandel hinaus. Ein Bericht von Stefan Beiersma
Umstrittene Cloud für den Staat: Delos will Anfang 2027 starten
Die SAP-Tochter Delos verspricht eine „souveräne“ Cloud speziell für den deutschen Staat. Aktuell laufen Zertifizierungen, Anfang 2027 soll das Angebot starten.
SAP-Patchday bringt Korrekturen für Codeschmuggel-Lücken
Der November-Patchday bei SAP stopft Code-Injection- und Speicherkorrumpierungslücken. Neun Sicherheitslecks gelten als kritisch.
Microsoft Paint: Codeschmuggel-Lücke im Malprogramm
In dem rudimentären Zeichenprogramm Paint von Windows können Angreifer Schadcode einschleusen. Jetzt gibt es ein Update dagegen.
Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)

Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance wa
SAP patches ICM2SHELL and PROXYGATE maximum severity flaws
SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. [...]
Beyond the Alert: The Case for Rich Network Data
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prev
Kritische Infrastruktur: Verbände fordern Notfallnetz für Krisenkommunikation
Kein Handyempfang, kein Internet - und trotzdem müssen Behörden im Krisenfall zusammenarbeiten. Wie kann das gelingen? (<a href="https://www.golem.de/specials/infrastruktur/">Infrastruktur</a>, <a href="https://www.golem
Angriffswarnung für GPUStack, FreeSwitch, OpenSSH und IBM Aspera Faspex
Die US-amerikanische IT-Sicherheitsbehörde CISA warnt vor Angriffen auf GPUStack, FreeSwitch, OpenSSH und IBM Aspera Faspex.
Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added
Hackers now exploit critical Barracuda ESG flaws to gain root access
Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. [...]
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an
Turla hackers use new Cereal malware to spy on govt Exchange servers
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. [...]
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application s
Zahlreiche Sicherheitslücken bedrohen IBM App Connect Enterprise
Patches schließen Schwachstellen in IBM App Connect Enterprise, der Log Source Management App for IBM QRadar SIEM und der TS4500 Tape Library.
40C3: Zweiter Vorverkaufstermin naht, Vortragsbeschreibungen sind online
Neben zwei VVK-Terminen im November gibt es per „Halfnarp“ erste Einblicke ins Konferenzprogramm. Über 180 Vorträge von Roboter-Hacks bis Sticken stehen drin.
Able2Shell: Geleakte N-central-Exploits gefährden unzählige Unternehmen
Nach einem Leak von über 30 N-central-Exploits hat N-able seine Server offline genommen - mit Folgen für die IT-Verwaltung zahlreicher Unternehmen. (<a href="https://www.golem.de/specials/sicherheitsluecke/">Sicherheitsl
Außer der Reihe: Sicherheitsupdates für fast alle Apple-Geräte
Apple hat iOS 27.2.1, macOS 27.2.1 und diverse weitere Updates veröffentlicht. Gestopft werden unter anderem Lücken in Bluetooth und der Nachrichten-App.
France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites
An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday. The attackers
Google patches eighth Chrome zero-day exploited in attacks this year
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. [...]
Online-Banking geknackt – Betrüger muss jahrelang in Haft
Der Fall führte Ermittler durch ein komplexes System aus Pseudonymen und Krypto-Konten. Welche Strafen und finanzielle Folgen das für den 36-Jährigen hat.
Anthropic's Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark
Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision. During pre-release training, the large language models (LLMs) helped its en
IT threat evolution in Q3 2026. Non-mobile statistics
Key trends and statistics on malware targeting Windows and macOS computers and Internet of Things (IoT) devices in Q3 2026.
IT threat evolution in Q3 2026. Mobile statistics
Q3 2026 mobile threat statistics for Android malware, adware, and unwanted software, plus the most notable malware found during the quarter.
Chrome-Update stopft attackiertes Sicherheitsleck
Google hat ein Update für den Webbrowser Chrome veröffentlicht. Die Entwickler warnen, dass eine Lücke bereits angegriffen wird.
Fireworks AI discloses new breach after cloud provider hack
AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. [...]
Dringend patchen: Attackierte Chrome-Lücke gefährdet unzählige Nutzer
Ein neues Chrome-Update adressiert mehrere gefährliche Sicherheitslücken. Eine wird bereits aktiv ausgenutzt. Nutzer sollten zügig patchen. (<a href="https://www.golem.de/specials/sicherheitsluecke/">Sicherheitslücke</a>
Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (C
N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively t
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilitie
Partnerangebot: LINK2AI – „Sicherheits- und Qualitätscheck für KI-Chatbots und -Agenten: Red Teaming und Policy-Testing für LLM-basierte Anwendungen“
Im Partnerbeitrag der LINK2AI GmbH geht es um die Sicherheits- und Qualitätsprüfung von Anwendungen auf Basis großer Sprachmodelle.
Anthropic Claude Fable 5.2 ist günstiger, aber Tempo kostet extra
Anthropic veröffentlicht Claude Fable 5.2 und Claude Mythos 5.2. Wer schnellere Ausgaben wünscht, darf das Doppelte zahlen.
ISC Stormcast For Tuesday, November 10th, 2026 https://isc.sans.edu/podcastdetail/10172, (Tue, Nov 10th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Vanderbilt University hit in BYOD ransomware attack, data theft claimed
Vanderbilt University warns it is responding to a cyberattack claimed by the BYOD ransomware gang, which claims to have encrypted the university's databases and stolen sensitive student, employee, and research data. [...
SEGA newsletter data breach exposes 2.2 million email addresses
Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers. [...]
N-able takes cloud platform offline after 30+ "zero-days" published
N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, includin
York University breach exposed personal information dating to 2007
York University has announced it suffered a cybersecurity incident in which a threat actor stole personal information people submitted through online forms. [...]
FORGE Lab uses agentic tools to identify memory safety issues in Rust
Microsoft FORGE Lab researchers found memory-safety bugs in Rust's core and std libraries, including cases where safe Rust code can trigger undefined behavior. Using Hyenas, FORGE's frontier research version of codename
Wird alle 30 Minuten aktualisiert · CH/DE: BACS Schweiz, BSI, Allianz Cyber-Sicherheit, Heise Security, Golem · EN: BleepingComputer, The Hacker News, Fortinet, SANS ISC, Microsoft Security, Krebs on Security, Kaspersky