Heise Security (DE)

cybersecurity · government-security · data-protection

Foxit developers close vulnerabilities in PDF reader and editor

Not critical, but numerous: Current security updates seal Foxit's PDF reader and editor against a long list of gaps.

borderlinecybersecurity · government-security · data-protection

Open database: Nextcloud GmbH fixes potential data leak

Data from the company behind the popular collaboration solution was exposed online due to a misconfiguration. The software is not affected.

borderlinecybersecurity · government-security · data-protection

RootAsRole 4.0: More control than sudo

RootAsRole 4.0 extends the sudo alternative with a new execution model and finer guidelines for privileged Linux commands.

cybersecurity · government-security · data-protection

Europe strengthens AI security after US model blockade

The US government had blocked access to two of Anthropic's AI models for foreigners. The EU Commission is responding with a plan for more AI security.

cybersecurity · government-security · data-protection

CERT emphasizes importance: Security patch for geographic information system platform

Admins who have not yet installed Esri's June patch should do so in view of individual targeted attacks and a current warning.

cybersecurity · government-security · data-protection

ILIAS: Important updates for the learning platform eliminate vulnerabilities

Important updates for three series of versions of the e-learning platform ILIAS close a total of six security gaps, some of which have a high risk rating.

cybersecurity · government-security · data-protection

“Password” Episode 61: News from bomb-building worms to certificate chain complexity

Malware containing instructions on how to build nuclear weapons is a worrying development. The PKI isn't neglected either - and there's good news from Android.

cybersecurity · government-security · data-protection

Security nightmare inverter: Hoymiles silences neighborhoods

According to researchers, severe radio vulnerabilities in hundreds of thousands of PV systems allow the devices to be switched off while driving past and even physically destroyed.

cybersecurity · government-security · data-protection

OpenSSH strengthens SSH against current and future attacks

OpenSSH 10.4 fixes several security vulnerabilities in SSH, SCP and SFTP. There are also tightened protocols and experimental post-quantum signatures.

cybersecurity · government-security · data-protection

Zimbra Collaboration Suite: Critical vulnerability makes Classic Web Client vulnerable

If you use the Zimbra Collaboration Suite web client, you should update it quickly to prevent attempts to attack via email.

cybersecurity · government-security · data-protection

Jadepuffer: The first AI ransomware attack doesn't just corrupt the key

Researchers document the first LLM-driven ransomware attack. But the AI failed due to fundamental errors. A reminder for admins.

cybersecurity · government-security · data-protection

Samsung security update: July patches for Galaxy devices

Samsung has published its security bulletin for July 2026 and is distributing important security patches, especially for the top models in the Galaxy series.

borderlinecybersecurity · government-security · data-protection

BSI publishes draft test catalog on the trustworthiness of AI systems

Comments desired: A first “community draft” of the new A5 test catalog from the Federal Office for Information Security is now available.

cybersecurity · government-security · data-protection

Intelligence Report in Canada: Cyber Operations Abroad

Intelligence agency carries out cyber attacks against drug traffickers, extremists and cyber criminals. That's not unusual, but the public confession is.

cybersecurity · government-security · data-protection

For digital sovereignty: RISC-V security chip from Germany

Several Fraunhofer Institutes have jointly developed a secure element based on the disclosed OpenTitan, which Globalfoundries manufactures in Dresden.

cybersecurity · government-security · data-protection

Node.js struggles with flood of automated security reports

A discussion has arisen in the Node.js community about how to proceed with the large number of LLM-generated security reports.

cybersecurity · government-security · data-protection

OPNsense update eliminates critical root vulnerability and other security risks

Current versions of the open source firewall distribution close several gateways. A gap that is rated as critical makes the update particularly urgent.

cybersecurity · government-security · data-protection

Dell seals PowerProtect Data Domain against dangerous attack scenarios

Dell classifies a provided update package for several versions of the PowerProtect DD operating system as “critical”. Remote attacks are possible.

cybersecurity · government-security · data-protection

Coolify: Critical holes can enable remote attacks

Security gaps in the self-hosting platform offer attack opportunities based on low but narrowly defined access rights. Updates are available.

borderlinecybersecurity · government-security · data-protection

Comment: CISA overzealousness makes CVSS scores worthless

CVSS ad absurdum: Two "low" vulnerabilities in Apache Tomcat almost became heisec alert candidates thanks to extremely idiosyncratic CISA vulnerability.

borderlinecybersecurity · government-security · data-protection

Cloud is becoming the Achilles heel of the German economy

German companies rely extensively on cloud services - and are therefore vulnerable to failures.

cybersecurity · government-security · data-protection

Update now: Critical holes in Ubiquiti UniFi allow remote attacks

Several products from Ubiquiti's UniFi ecosystem are affected by some critical gaps. Admins should install the secured versions quickly.