tsecurity.de - News Radar & Live Feeds

Check Point führt „Firewall-as-a-Subscription“ ein

Tue, 27 Oct 2026 17:02:23 +0100

Check Point führt mit „Firewall-as-a-Subscription“ ein Abonnementmodell ein, das Unternehmen moderne Firewall-Technik und KI-gestützte Sicherheitsfunktionen ohne hohe anfängliche Hardwareinvestitionen bereitstellen soll. Das Angebot bündelt Hardware, Bedrohungsschutz, Sicherheitsupdates und cloudbasiertes Management in einer monatlichen oder... Weiterlesen

Podcast-Special „IT ImPuls“: Sicher, aber auch compliant? - it-business

Tue, 27 Oct 2026 17:02:14 +0100

Firewall, Backup, Endpoint-Schutz, aktuelle Software: Gerade mittelständische Unternehmen haben in den vergangenen Jahren viel in ihre IT-Sicherheit ... Weiterlesen

AuditTAP: Konformität der eigenen IT prüfen

Tue, 27 Oct 2026 10:01:15 +0100

AuditTAP: Konformität der eigenen IT prüfen Daniel Richey Di., 27.10.2026 - 07:00 Teure Firewalls und moderner Endpoint-Schutz helfen wenig, wenn dahinter lasche Konfigurationen schlummern. Das kostenlose Open-Source-Werkzeug AuditTAP misst Windows, Linux und gängige Anwendungen an anerkannten Härtungsrichtlinien und zeigt schwarz auf weiß, wo Sie... Weiterlesen

Works on localhost, silent from the phone: Windows Firewall rules for a LAN app

Tue, 27 Oct 2026 07:28:03 +0100

Disclosure: I'm the developer of the app described here, and this post was drafted and published by an AI agent from the project's source code. Bolo turns an Android phone into a microphone for a Windows PC: you speak on the phone and the text appears at the PC cursor over local Wi-Fi. The PC side is a small Node.js helper that listens for the... Weiterlesen

Palo Alto Confirms Brotli Vulnerability Impact on PAN-OS and Releases Workarounds

Tue, 27 Oct 2026 05:49:14 +0100

Palo Alto Networks has confirmed that a critical Brotli vulnerability affects some PAN-OS firewall deployments and its Prisma Cloud Application Security Transporter Client. Tracked as CVE-2026-111497, the flaw could let an attacker corrupt memory, expose sensitive data, crash a service, or potentially run code without authentication. The company... Weiterlesen

CVE-2026-20026 | Cisco Secure Firewall Threat Defense Software Snort 3 Detection Engine double free (cisco-sa-snort3-dcerpc-vulns-J9HNF4tH / WID-SEC-2026-0041)

Tue, 27 Oct 2026 03:42:29 +0100

A vulnerability, which was classified as problematic, has been found in Cisco Secure Firewall Threat Defense Software and UTD SNORT IPS Engine Software. The impacted element is an unknown function of the component Snort 3 Detection Engine. This manipulation causes double free. This vulnerability is tracked as CVE-2026-20026. The attack is possible... Weiterlesen

How to prevent unauthorized users from connecting to ProxySQL

Tue, 27 Oct 2026 03:06:25 +0100

ProxySQL is a great load balancer which however suffers from some shortcomings concerning the management of MySQL users. ProxySQL provides a firewall which, in my case, is not complete enough to properly manage users and secure their access. Indeed, this firewall does not accept subnets and keeps unauthorized connections in ProxySQL. We cannot... Weiterlesen

dshield

Tue, 27 Oct 2026 02:14:36 +0100

Installs and configures a DShield honeypot sensor on Raspberry Pi or Ubuntu, running Cowrie SSH and HTTP honeypots and forwarding firewall logs to the DShield portal. Weiterlesen

GitHub Release: anthropics/claude-code v2.1.311 (26.10.2026)

Tue, 27 Oct 2026 02:01:47 +0100

anthropics/claude-codev2.1.31126.10.2026@ashwin-ant

What's changed

Added --hold-idle-file and --max-hold-min to self-hosted-runner, to keep an idle session while your host reports processes it left running
Added a tip for the Explanatory output style, shown when you ask Claude for explanations
Fixed long freezes at startup and after reading or editing files when a CLAUDE.md file holds a very long list item
Fixed interrupting Claude not taking effect until a timeout while an MCP server had not answered a resource read or a skill was still downloading
Fixed standard-context sessions stopping with "Usage credits required for 1M context" when a request ran over 200K tokens; Claude Code now compacts the conversation and continues
Fixed Write and Edit stalling for up to 5 seconds after they ran, and reporting 0 lines changed, when changing thousands of lines in a file
Fixed subagents being unable to use MCP tools from servers that finish connecting after the subagent starts
Fixed Claude seeing stale MEMORY.md and CLAUDE.md content right after automatic compaction when those files were edited earlier in the session
Fixed claude -p and SDK sessions saving transcript messages out of order or keeping messages that were taken back
Fixed SubagentStop hooks running about twice a minute for each running subagent instead of once when it finishes
Fixed the @ file picker ignoring .ignore/.rgignore negation rules that re-include git-ignored files
Fixed a subagent's isolated worktree being removed while a background subagent it started was still working in it
Fixed background agents in auto mode that wait on their own shells starting a new main conversation turn on every wake
Fixed the Bash tool description claiming the working directory always persists between calls
Fixed the environment block naming a shell commands don't run in, such as fish when the Bash tool uses zsh
Fixed claude mcp add, claude mcp remove and /mcp naming the current folder instead of the project entry in ~/.claude.json that holds a local-scope server when run below a repository root
Fixed claude mcp list and claude mcp get showing the error code twice on failed-connection lines (for example ENOENT: ENOENT: …)
Fixed Remote Control sessions staying on "Connecting" for about two minutes when a network proxy blocks a startup request
Fixed messages that Claude sends to a cloud or Remote Control session appearing as your own message in the Claude mobile apps
Fixed Claude not being told the cause when a file attached to a message sent over Remote Control or to a cloud session could not be saved because the disk was full, or that a message's attachments past the first 20 were left out
Fixed WebFetch and WebSearch hanging on a stalled response in Cowork cloud sessions; an unfinished request now fails after 300 seconds
Fixed a background session that crashed between turns not being restarted while it was attached, pinned, or had a scheduled task or wake-up set
Fixed the "background service did not respond" error suggesting the disabled claude daemon restart; it now suggests claude daemon stop --any and says it ends background sessions
Fixed claude respawn starting the background service before reporting that no background session matches the id
Fixed /effort not warning about a prompt cache miss in plan mode when the plan model differs from the session model
Fixed /ide saying the VS Code extension was installed before the install finished or when it failed
Fixed the Write tool's file preview skipping rows and miscounting hidden lines when a line is wider than the terminal
Fixed ↑ in an agent's chat tab recalling a message that was still waiting to be delivered, so resending it sent a second copy
Fixed Cowork cloud sessions losing their connectors and most tools after a restart when a plugin or your settings named an agent; Cowork cloud sessions now ignore that setting
Fixed agent teams sessions showing an empty task list when coming back with --resume, --continue, /resume or --session-id, including after /clear or a crash, and /branch writing to the original session's list
Fixed pasting text that mentions an image file, such as ! open /tmp/shot.png or /review look at /tmp/shot.png, attaching the image and dropping its path from the prompt
Fixed the feedback draft card showing its 1/2/0 and Esc shortcuts while the prompt has text, when those keys act on the prompt instead of the card
Fixed a lone backslash in quotes or brackets, like "\" or (\), disappearing from Claude's responses
Fixed agent teammates compacting their history when DISABLE_COMPACT is set
Fixed the rewind menu offering "Summarize from here" and "Summarize up to here" when DISABLE_COMPACT is set
Fixed a finished /code-review, or another skill that runs in a sub-agent, running a second time when a cloud or background session restarts
Fixed long hidden thinking being cut off as idle on Google Vertex AI, Microsoft Foundry and Claude Platform on AWS, where the endpoint sends thinking progress updates
Fixed /ide saying it had installed the JetBrains plugin when nothing was installed
Fixed Claude Pro and Max subscribers being told to ask their admin when their subscription can't be used; the message now points to billing settings
Fixed the diff pane opening by itself after an edit in wide fullscreen terminals when it had nothing to show
Fixed /mcp showing a remote server as failed after "Clear authentication" when the server works without sign-in
Fixed /mcp showing "authenticated" for a remote server that Claude Code sends no credentials to
Fixed a --plugin-dir folder of plugins loading as one plugin when an empty .mcp.json was at its top
Fixed /usage never showing large prompt-cache misses under "What's contributing to your limits usage?"
Fixed status line links staying plain text in background sessions after you open them from a terminal that supports links
Fixed the /rewind confirmation saying the conversation "will be forked" when the later messages are removed from the conversation
Fixed the /rewind warning that wrongly said manual and Bash edits are never affected by a code restore
Fixed plan approval in screen reader mode sending feedback you had dismissed with Escape
Fixed Claude Code retrying requests the API marked not to retry, which could hold a turn for minutes or, in unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG), indefinitely
Linux: Fixed sandboxed Bash commands failing with bwrap: Can't create file when a --plugin-dir folder was also an added directory and permissions.blockReadsOutsideWorkingDirectories was on
Self-hosted runner: Fixed a session failing to start when a rate limit (HTTP 429, or a git wrapper that exits 75) blocks an added read-only repository; it now starts without that repository
Improved startup time for Pro and Max accounts by skipping two network requests on launches within an hour of the last check
Improved /teleport and claude --teleport to warn when a compacted cloud session loads from its last compaction, so the messages it summarized aren't in the local copy
Improved the messages shown when a background session's process exits: they no longer promise a restart that isn't coming, and they say how to resume the session
Improved artifacts with several views: Claude now routes each view on the link's #name and no longer says the address bar stays the same as you switch views
Improved shell commands that reach their timeout: the result now shows the output so far and says the command is still running in the background
Improved compaction: when the model's reply has no summary in it, Claude Code now usually asks for the summary once more before it replaces the conversation
Improved the Artifact tool's choice between a page and a document: explainers and visual or interactive work become artifact pages; documents are for writing people keep editing or pass around
Improved startup time for launches whose only arguments are options and their values, such as claude --model opus
Improved the "Connection dropped" API error: it now says where to look first (the proxy or gateway in use, else VPN or firewall; Anthropic API only, Bedrock, Vertex and Foundry are unchanged)
Improved screen reader mode: deleting a rule in /permissions says "Deleted allow rule …" right away
Improved the message shown when a pasted sign-in code is refused: it now says the code may have expired or been used, and to sign in again
Improved Slack connector sends: Claude now checks a channel's topic for posting rules before messaging a channel you didn't name
Improved screen reader mode: Claude's questions are listed as "Questions: Color (answered), Pages", without arrows or symbols
Changed ultrathink in the interactive terminal to run its turn at xhigh effort on Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1 through Anthropic's API; typed while Claude is working, it raises the rest of that turn
Changed the ultrathink rainbow to appear only where the keyword can raise effort, and not when the word is quoted or part of a file path
Changed Ctrl+D in agent view to match the prompt: on an empty input, pressing it twice exits
Changed --output-format json and stream-json output to write DEL, C1 control and Unicode format characters inside strings as \uXXXX escapes; parsed values are unchanged
Changed model names and IDs to drop the [1m] suffix and its label on models where the suffix has no effect; the suffix is still accepted
Changed startup warnings about permission rules in settings files to show once per user until the rule changes
Changed /code-review to tell Claude to put the effort level first and use max only when asked
Changed DISABLE_COMPACT in settings files and in a mod's $.env.set so they can only turn compaction off, not back on
Changed Claude Code on Bedrock, Mantle, Vertex, and Foundry to load model settings from a signed file on downloads.claude.ai; set CLAUDE_CODE_MODEL_CATALOG=off to turn this off
Changed sessions that set CLAUDE_CODE_SYNC_SKILLS with feature-flag fetching off to reuse a claude.ai skills list up to 10 minutes old that another session on the machine fetched
Changed clicks on scrollbar arrows and bars in fullscreen lists to act when the mouse button is released, so moving off the scrollbar before letting go cancels the click
Changed claude purge to say it deletes data only on this computer, not anything stored by Anthropic
[VSCode] Added syntax coloring to code blocks in Claude's replies, in light, dark and high contrast dark themes
[VSCode] Added a "Running UserPromptSubmit hooks" spinner status and screen reader announcement for slow UserPromptSubmit hooks
[VSCode] Fixed custom skills and custom slash commands sent from the VS Code or JetBrains panel leaving out the open file or selected lines that ordinary messages include (#102799)
[VSCode] Fixed the extension host freezing while the login shell ran its start-up files to read PATH on macOS and Linux
[VSCode] Fixed clicking an image in a tool result, or closing its preview, also opening the result's text in an editor tab
[VSCode] Fixed voice dictation continuing to record after a message was sent with the Send button; sending now stops dictation first, as pressing Enter already did
[VSCode] Changed the extension to start Claude Code sessions with DISABLE_TELEMETRY set while VS Code's telemetry setting is off, so they send no usage metrics or error reports and fetch no feature flags
[VSCode] Changed the session list side bar to load Web sessions when the Web tab is first opened, not at startup
[Cloud sessions] Fixed routines in Anthropic-hosted environments staying locked after their owner left the organization and rejoined; the owner can now turn them back on
[Cloud sessions] Fixed a failed routine API token delete or regenerate showing nothing if the edit dialog had already closed; it now shows an error toast
[Cloud sessions] Fixed cloud environment dialogs, including the admin dialog, accepting duplicate names; they now refuse a name another listed environment already has
[Claude Tag] Added a Skills view to Claude Tag analytics showing how often Claude runs each attached skill in Slack channels and which go unused, with Usage links in admin settings
[Claude Tag] Improved Claude Tag routines that run in a new session: a run with nothing to report can now end without posting a throwaway message to the channel
[Claude Tag] Changed Claude Tag admin settings to show a lock instead of # for private Slack channels that your own Slack account can see
[Code Review] Improved Code Review's check run to say no further automatic review will start when the model still can't analyze a change on the automatic retry
[Code Review] Improved Code Review reliability: a review whose session fails to start because of a transient server fault is now retried once automatically, and its check run says so

Microsoft Developer: Inside Azure's DDoS Defense | Behind the Code

Mon, 26 Oct 2026 23:13:21 +0100

YouTube Video

How do Azure engineers distinguish a legitimate traffic surge from a distributed denial-of-service (DDoS) attack without penalizing real customers? Karthik Uthaman, principal software engineer in Microsoft's Azure Front Door group, explains how traffic patterns and system resource usage help engineers tell the difference.

In this episode of Behind the Code, Karthik takes the problem to the whiteboard. He walks through resource-based defenses, finding top traffic contributors in a multi-tenant service, and combining threat intelligence with client fingerprinting to distinguish legitimate requests from malicious automated traffic.

⭐ What You'll Learn
- How DDoS attacks can exhaust CPU, memory, and network resources
- Why resource protection goes beyond individual attack vectors
- How requests per second (RPS) correlate with CPU utilization
- Why per-IP rate limiting alone cannot distinguish all good and bad traffic
- How Microsoft Threat Intelligence and JA4 fingerprints provide additional signals
- Why probabilistic data structures support real-time, inline analysis

👥 Speaker
Karthik Uthaman - Principal Software Engineer, Microsoft Azure Front Door group

⌨️ About Behind the Code
Behind the Code explores the engineering challenges and technical decisions behind Microsoft's systems, with the people who build them.

✅ Chapter Markers
00:00 – Meet Azure Front Door engineer Karthik Uthaman
00:22 – Azure Front Door and content delivery networks
00:52 – Why applications use a CDN for protection
01:44 – DDoS explained: overwhelming a service
02:46 – AI, amplification attacks, and HTTP/2
04:10 – AI and protocol vulnerability discovery
05:00 – DDoS defense through system resource protection
06:49 – Legitimate traffic surges versus DDoS attacks
07:36 – Whiteboard: correlating RPS with CPU usage
09:00 – Probabilistic data structures and top-K traffic
10:19 – Why per-IP rate limiting falls short
11:31 – Microsoft Threat Intelligence and IP groups
13:08 – Protecting real users on compromised devices
13:36 – JA4 fingerprints and client traffic profiling
14:53 – Real-time, inline DDoS analysis
16:03 – A shared defense across Microsoft teams

🔗 Resources & Links

Karthik's blog: Unmasking DDoS Attacks: https://techcommunity.microsoft.com/blog/azurenetworkingblog/unmasking-ddos-attacks-part-13/4384794
Microsoft Threat Intelligence: MCCrash DDoS botnet analysis: https://www.microsoft.com/en-us/security/blog/2022/12/15/mccrash-cross-platform-ddos-botnet-targets-private-minecraft-servers/
Azure Front Door overview: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-overview
DDoS protection on Azure Front Door: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-ddos
JA4 client fingerprint matching for Azure Front Door: https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/client-fingerprint-match-condition

🔔Subscribe to Microsoft Developer Channel
https://www.youtube.com/@MicrosoftDeveloper?sub_confirmation=1

#Azure #AzureFrontDoor #DDoS #CloudSecurity #MicrosoftDeveloper #BehindTheCode

OpenBSD 8.0 Released With Major Security Hardening and Post-Quantum SSH Support

Mon, 26 Oct 2026 18:11:36 +0100

OpenBSD 8.0 has been released with security fixes across its kernel, network services, firewall, and update tools, alongside experimental post-quantum SSH signature support. Released on October 20, 2026, the project’s 61st release includes OpenSSH 10.6 and LibreSSL 4.4.0, bringing stronger checks for untrusted data and changes to secure connection... Weiterlesen

Check Point Launches Firewall-as-a-Subscription as Cybersecurity Budgets Face Growing Pressure

Mon, 26 Oct 2026 18:10:30 +0100

Check Point Software Technologies has announced the launch of Firewall-as-a-Subscription, a new offering designed to make advanced AI-powered network security more accessible to organisations without requiring a significant upfront hardware investment. The new subscription model gives businesses access to Check Point Force Firewalls, AI-powered... Weiterlesen

Cloudflare Release Emergency WAF Ruleset Update Following Brotli Vulnerability

Mon, 26 Oct 2026 18:09:26 +0100

Cloudflare has announced an emergency Web Application Firewall (WAF) ruleset update linked to CVE-2026-111497, a Brotli vulnerability. The October 25, 2026 release adds two rules for Brotli-encoded request bodies and the Next.js image optimization endpoint, enabled by default in Log mode to monitor matching traffic without blocking it. The key... Weiterlesen

Rising Borrowing Costs Shouldn’t Delay Your Security: Meet Firewall-as-a-Subscription

Mon, 26 Oct 2026 18:06:46 +0100

Why more companies are moving from hardware purchases to one predictable subscription. Attacks don’t wait for budget approval. But firewall purchases often do, and that wait is getting longer. Rising interest rates have made borrowing more expensive. For a midsize company, a single rate rise can cost the equivalent of a branch office firewall. A... Weiterlesen

Budgets Are Stalling Firewall Deals. Here’s How Partners Can Get Them Moving Again

Mon, 26 Oct 2026 18:06:42 +0100

Every partner knows this conversation. A customer agrees their firewalls need replacing. Their teams are using AI tools, they are connecting more systems, and the threats are moving faster than their hardware was built for. They want to upgrade. Then the quote goes into the capital approval process, and the deal goes quiet. This year, that... Weiterlesen

Security Policy Management Tools Reviewed: 7 Platforms In Depth (2026)

Mon, 26 Oct 2026 13:24:37 +0100

“Security policy management” is two different purchases wearing one name and buying across the confusion wastes quarters. Lane one is network security policy management (NSPM): engines that analyze, clean, and orchestrate firewall and cloud-security rules across hybrid estates. Lane two is governance policy management: platforms that author,... Weiterlesen

OpenBSD 8.0 Released With Enhanced Firewall Security and Critical Vulnerability Fixes

Mon, 26 Oct 2026 13:22:41 +0100

OpenBSD 8.0 was released on October 20, 2026, marking the project’s 61st release. This update includes significant improvements, including enhanced firewall security, memory-safety fixes, stronger validation for network daemons, and security updates to core components. Key updates include enhancements to PF, OpenBSD’s packet filtering firewall, as... Weiterlesen

Thales Imperva Cloud WAF

Mon, 26 Oct 2026 13:16:04 +0100

Part of the mighty Thales cybersecurity division, the Imperva WAF (web application firewall) solutions stand out from the competition as they support multiple deployment scenarios and are designed to be up and running in minutes. It looks to have every angle covered, as Imperva WAF is available as a SaaS-based service, can be hosted locally on... Weiterlesen

OpenBSD 8.0 Released With Enhanced Firewall Security and Critical Vulnerability Fixes

Mon, 26 Oct 2026 12:53:17 +0100

Cloudflare Releases Emergency WAF Rules for Critical Node.js Brotli Vulnerability

Mon, 26 Oct 2026 09:26:53 +0100

Cloudflare announced an emergency update to its Cloudflare Managed Ruleset, adding two web application firewall rules for the Brotli vulnerability tracked as CVE-2026-111497. Published on October 25, 2026, the release targets requests declaring Brotli request-body encoding and traffic reaching the Next.js image optimization endpoint. Both... Weiterlesen

Cloudflare Adds New WAF Rules to Detect Attacks Targeting CVE-2026-111497

Mon, 26 Oct 2026 09:26:32 +0100

Cloudflare announced an emergency release of its Web Application Firewall (WAF) on October 25, 2026. This update introduces two detection rules for the Brotli vulnerability tracked as CVE-2026-111497. These rules specifically target requests that declare Brotli body encoding and traffic accessing the Next.js image optimization endpoint. By... Weiterlesen

Achtung: Fortigate OS 7.6.8 brickt SSO

Mon, 26 Oct 2026 00:52:09 +0100

Ich stelle mal eine kurze Information für Administratoren von Fortinet-Applicances hier ein. Das Update FortiOS 7.6.8 macht das Single Sign-On (SSO) auf einer FortiGate-Firewall kaputt. Bernd hatte sich bereits zum 23. Oktober 2026 per Mail "Weiß nicht, ob das eventuell … Weiterlesen → Quelle Weiterlesen

Global Cyberattack Exploits Fortinet and Palo Alto Devices to Steal More Than 70,000 Credentials

Sat, 24 Oct 2026 19:13:04 +0200

A global exploit campaign has been uncovered by cyber investigators, targeting exposed network security appliances in order to steal credentials and gain persistence into victim organisations. Group-IB and NyxLab found a number of Fortinet FortiGate firewalls and Palo Alto Networks’ GlobalProtect infrastructures targeted with some leading to... Weiterlesen

EIFT Firewall: a new free tool for controlled agent sideloading

Sat, 24 Oct 2026 15:45:31 +0200

We are expanding our collection of free forensic tools with EIFT Firewall, a new companion application for Elcomsoft iOS Forensic Toolkit to safely sideload the low-level extraction agent. It's a macOS application that creates a temporary, controlled USB network path between the Mac and a connected evidentiary device. It runs on macOS only, and it... Weiterlesen

Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products

Sat, 24 Oct 2026 09:41:16 +0200

Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces. The company updated its security advisory... Weiterlesen

My Firewall Caught My Prompt Injection

Fri, 23 Oct 2026 23:55:15 +0200

I've learned a lot about computer science this year, and large language models have been useful tools for my productivity. To do that, I invested heavily in a setup that I feel comfortable using with my subscription CLI memberships from Anthropic, OpenAI, and Google. Over time, that setup became a private collection of governance and coordination... Weiterlesen

IT department and auditors at major pharmacy chain got into a rip-roaring fight about using ‘password’ on Cisco firewall

Fri, 23 Oct 2026 18:44:11 +0200

Misaligned incentives led to an intractable argument This article has been indexed from www.theregister.com – Articles Read the original article: IT department and auditors at major pharmacy chain got into a rip-roaring fight about using ‘password’ on Cisco firewall The post IT department and auditors at major pharmacy chain got into a rip-roaring... Weiterlesen

Kampagne „k0t“ bricht Enterprise-Firewalls und VPNs auf und stiehlt über 70.000 Credentials

Fri, 23 Oct 2026 16:36:28 +0200

LONDON (IT BOLTWISE) – Eine groß angelegte Angriffskampagne soll weltweit Enterprise-Firewalls und VPN-Zugänge ins Visier genommen haben. Laut einer gemeinsamen Analyse von Group-IB und NyxLab werden über 70.000 zugehörige Zugangsdaten und LDAP-Dumps mit dem Cluster in Verbindung gebracht. Als Angriffsweg nennt die Untersuchung sowohl Exploits mit... Weiterlesen

PHP-Lücken: IT-Experten fordern Maßnahmen über Updates hinaus - DerStandard

Fri, 23 Oct 2026 16:29:20 +0200

IT-Security. PHP-Lücken: IT-Experten fordern Maßnahmen über Updates hinaus. Zugangsdaten für Programmierschnittstellen und Web Application Firewalls ... Weiterlesen

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Fri, 23 Oct 2026 16:27:25 +0200

Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have... Weiterlesen

NPM: GitHub stellt neue Package Firewall für Unternehmen vor

Fri, 23 Oct 2026 13:36:14 +0200

Wenn GitHub neben seinen eigenen Stabilitätsproblemen in diesem Jahr etwas geplagt hat, dann sicherlich das monatelange Sicherheitsdesaster um den eigenen Paketmanager NPM für Node.js, wo über die beiden Malwares Mini-Shai-Hulud und Miasma zahlreiche Unternehmen und andere Stellen von Supply-Chain-Angriffen heimgesucht wurden. Auch Microsoft... Weiterlesen

GitHub Package Firewall blockiert schädliche npm-Pakete

Fri, 23 Oct 2026 10:43:27 +0200

GitHub hat die Package Firewall als öffentliche Vorschau für Enterprise-Cloud-Kunden freigegeben. Sie prüft Paketabfragen und Downloads. Weiterlesen

GitHub Package Firewall blockiert schädliche npm-Pakete

Fri, 23 Oct 2026 10:25:13 +0200

GitHub hat die Package Firewall als öffentliche Vorschau für Enterprise-Cloud-Kunden freigegeben. Sie prüft Paketabfragen und Downloads. Weiterlesen

GitHub Package Firewall blockiert schädliche npm-Pakete

Fri, 23 Oct 2026 10:22:01 +0200

GitHub hat die Package Firewall als öffentliche Vorschau für Enterprise-Cloud-Kunden freigegeben. Sie prüft Paketabfragen und Downloads. Weiterlesen

Nginx 502/504 Troubleshooting: A Field Engineer's Checklist

Fri, 23 Oct 2026 01:22:20 +0200

Nginx 502/504 Troubleshooting: A Field Engineer's Checklist When your upstream returns 502 or 504, here's the systematic approach I use. The Two Error Codes Code Meaning Typical Cause 502 Bad Gateway Nginx can't reach upstream Upstream down, wrong port, firewall 504 Gateway Timeout Upstream too slow Heavy query, connection pool full Step 1: Check... Weiterlesen

NIS2: Warum Firewalls allein nicht ausreichen - it-daily.net

Thu, 22 Oct 2026 23:29:34 +0200

Startseite/IT-Sicherheit/Cyber & Cloud Security/Was NIS2 wirklich verlangt. Mehr als IT. Was NIS2 wirklich verlangt. 22.10.2026. 5 Min. Lesezeit. Weiterlesen

iSCSI gives you two minutes

Thu, 22 Oct 2026 21:54:21 +0200

You can have enterprise storage, a healthy host and a filesystem doing exactly what it was designed to do, and still lose a node to one network interruption. This is what a firewall racking job did to my Sia hostd node, and what it taught me about how much interruption iSCSI will actually absorb before the filesystem underneath runs out of... Weiterlesen

[NEU] [hoch] Cisco Produkte (IOS XE, SFTD) und Snort: Mehrere Schwachstellen

Thu, 22 Oct 2026 17:36:28 +0200

Ein Angreifer kann mehrere Schwachstellen in Cisco IOS XE, Cisco Secure Firewall Threat Defense und Snort ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen und um beliebigen Programmcode auszuführen. Weiterlesen

Onlinescam-Industrie: Auf der Jagd nach Millionen-Betrügern - Podcast Firewall

Thu, 22 Oct 2026 17:24:08 +0200

Sein Werkzeug: eine Software. Sein Geschäft: gefälschte Aktienkurse. Doch der Scam-Boss hat seine Rechnung ohne eines der Opfer gemacht. Weiterlesen

The biggest AI security risk is doing nothing

Thu, 22 Oct 2026 14:28:21 +0200

On September 14th, 2026, AI frontier lab OpenAI called on UK lawmakers to impose regulations to tackle the security threats posed by the rapid development of artificial intelligence. This follows an unsolicited attack from an OpenAI agent that broke the firewalls of startup Hugging Face earlier this year. Cybersecurity isn’t a new issue for... Weiterlesen

Hackers Target FortiGate, FortiWeb and Palo Alto GlobalProtect, Exposing 70,000+ Credentials

Thu, 22 Oct 2026 12:32:38 +0200

Hackers are targeting internet-facing Fortinet FortiGate firewalls, FortiWeb appliances, and Palo Alto Networks GlobalProtect systems to steal passwords and maintain access to corporate networks. A joint investigation NyxLab linked the campaign to an operator known as k0t. The investigation, published on October 21, 2026, identified more than... Weiterlesen

IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall

Thu, 22 Oct 2026 12:24:45 +0200

Welcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This week’s sad story involves a major American pharmacy chain that couldn’t fill a prescription for password security. Have a story about someone leaving a gaping hole in their network? Share it with us at... Weiterlesen

IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall

Thu, 22 Oct 2026 12:23:03 +0200

Welcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This week’s sad story involves a major American pharmacy chain that couldn’t fill a prescription for password security.Have a story about someone leaving a gaping hole in their network? Share it with us at... Weiterlesen

Was NIS2 wirklich verlangt

Thu, 22 Oct 2026 11:28:39 +0200

NIS2 ist kein reines IT-Projekt: Warum Unternehmen jetzt Prozesse, Notfallpläne und Lieferketten organisationsweit anpassen müssen. Schon ein Blick auf die digitale Bedrohungslage europäischer Unternehmen und Organisationen zeigt, weshalb die Network and Information Security-2-Richtlinie (NIS2) der Europäischen Union notwendig ist. Allein 2024... Weiterlesen

How to Protect a Laravel App with a WAF Before PHP Starts

Thu, 22 Oct 2026 10:13:05 +0200

A Laravel application can validate input, escape output, and reject some bad requests inside controllers. That still leaves a gap. Hostile HTTP traffic reaches PHP before those checks run. If you are working through how to protect a Laravel app with a WAF, treat the job as a front-door decision: put a reverse-proxy firewall on the public side,... Weiterlesen

Why I Put a Reverse-Proxy WAF in Front of Laravel

Thu, 22 Oct 2026 10:13:04 +0200

I stopped treating controller middleware as the outer edge of a Laravel app after I mapped what actually happens to an HTTP request. Form Requests, CSRF tokens, authentication, policies, and the query builder all run after PHP has already accepted the connection. A web application firewall is a different layer. SafeLine is a self-hosted WAF that... Weiterlesen

How to Harden Production AI Agents Against Prompt Injection & Tool Hijacking

Thu, 22 Oct 2026 08:40:47 +0200

If you are moving AI agents from a toy script into production with enterprise clients, you quickly encounter a harsh reality: Traditional cybersecurity firewalls know nothing about probabilistic LLMs. When your agent has access to tools (like SQL databases, web scrapers, shell commands, or Model Context Protocol servers), indirect prompt injection... Weiterlesen

Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems to Steal Passwords

Thu, 22 Oct 2026 08:34:55 +0200

Internet-facing firewalls and VPN systems are under attack in a campaign that aims to steal credentials and gain lasting access to corporate networks. The activity targets FortiGate and FortiWeb devices from Fortinet, as well as Palo Alto Networks GlobalProtect portals. Once inside, operators can collect passwords stored in device configurations... Weiterlesen

Running a Self-Hosted WAF in Production: Practical Lessons From SafeLine

Thu, 22 Oct 2026 08:33:37 +0200

Why Put a WAF in Front of the Application? Web application firewalls are often introduced as a list of security features: SQL injection protection, cross-site scripting detection, bot mitigation, rate limiting, and access control. Those capabilities matter, but they are only part of the operational problem. The more difficult questions usually... Weiterlesen

Securing Quick access from corporate networks with AWS PrivateLink

Thu, 22 Oct 2026 02:32:26 +0200

When enterprise data sits behind a corporate firewall or in a private on-premises data center, there’s no direct network path from AWS, even though the AI agents and dashboards in Amazon Quick can query virtually any data source. Administrators must make sure their sensitive enterprise data isn’t exposed to the public internet while being... Weiterlesen

Three KEV-listed Linux kernel CVEs (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682): status and fixes for CloudLinux

Wed, 21 Oct 2026 19:28:13 +0200

📋 TL;DR — last updated October 12, 2026 On September 18, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue: CVE-2025-39964 (a crypto-socket flaw), CVE-2026-53266 (a bridge-firewall flaw), and CVE-2025-39682 (a kernel-TLS flaw). They... Weiterlesen

Cloudflare Warns of Active Exploitation Attempts Against Two Leaked PHP Flaws

Wed, 21 Oct 2026 19:01:56 +0200

Cloudflare has issued a warning about emerging attacks targeting two critical PHP vulnerabilities. In response, the company has implemented emergency web application firewall (WAF) rules while developers await an official security release. The PHP Foundation has provided advance notice, assigning both vulnerabilities a CVSS v4 score of 9.2,... Weiterlesen

Cloudflare Detects Early Attacks Exploiting Critical PHP Flaws, Deploys WAF Rules

Wed, 21 Oct 2026 19:01:18 +0200

Cloudflare has deployed emergency web application firewall rules after detecting early attacks targeting two critical PHP vulnerabilities, ahead of a scheduled security release on October 21, 2026. Both flaws carry CVSS v4 severity scores of 9.2, according to advance notice from the PHP Foundation. Dane Knecht said PHP websites behind Cloudflare... Weiterlesen

Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June

Wed, 21 Oct 2026 18:56:05 +0200

Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy. CVE-2026-0257 stems from the firewalls relying on cookies without performing detailed validation and... Weiterlesen

Critical PHP Security Release

Wed, 21 Oct 2026 18:51:14 +0200

The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place to... Weiterlesen

Breach & Attack Simulation (BAS) Tools Reviewed: 8 Platforms In Depth (2026)

Wed, 21 Oct 2026 11:25:21 +0200

Security stacks fail quietly: the EDR solutions policy someone loogive me proper 2 internal links and link should not be repeated and avoid the integration topicsened, the SIEM rule that stopped matching after a log-format change, the firewall exception that outlived its ticket. Breach and attack simulation tools exist to make those silent... Weiterlesen

TinyWall Download - Kompakte Firewall für Windows

Wed, 21 Oct 2026 11:21:12 +0200

Der Download von TinyWall installiert eine einfach zu bedienende Alternative zur Windows-Firewall mit zusätzlichen Funktionen für mehr Sicherheit. Filterlisten bestimmen, welche Programme auf das Internet ... (Weiter lesen) Weiterlesen

Angreifer können Firewalls von Palo Alto Networks kapern

Wed, 21 Oct 2026 08:03:29 +0200

Palo Alto Networks meldet Angriffe auf eine Schwachstelle in PAN-OS. Angreifer mit Zugriff auf die Verwaltungsoberfläche können Code mit Root-Rechten auf der Firewall ausführen. Betroffen sind mehrere Versionen der Reihen 10.2 bis 12.2. (Bild: © Studenkova - stock.adobe.com / KI-generiert) Weiterlesen

38,988 FortiGate and 22,586 Palo Alto Assets: Using Perimeter Counts to Challenge Firewall Inventory

Wed, 21 Oct 2026 05:55:01 +0200

38,988 FortiGate and 22,586 Palo Alto Assets: Using Perimeter Counts to Challenge Firewall Inventory Firewalls are the infrastructure most likely to be documented and least likely to be re-verified. They appear in architecture diagrams, in change records and in network inventories, and their existence is rarely questioned. That makes perimeter... Weiterlesen

GitHub package firewall in public preview

Tue, 20 Oct 2026 22:21:47 +0200

An increasing number of malware attacks exploit systems at package installation time, harvesting credentials on CI/CD hosts or developer workstations without even running the package’s code. To stem this tide of attacks, GitHub is introducing a new package firewall capability. The package firewall sits between endpoints like Actions runners or... Weiterlesen

Running a Self-Hosted WAF in Production: Practical Lessons From SafeLine

Tue, 20 Oct 2026 22:21:08 +0200

Palo Alto’s firewall OS has been under attack from multiple ransomware groups since June

Tue, 20 Oct 2026 22:11:38 +0200

Unit 42 investigates network compromises across numerous industries This article has been indexed from www.theregister.com – Articles Read the original article: Palo Alto’s firewall OS has been under attack from multiple ransomware groups since June The post Palo Alto’s firewall OS has been under attack from multiple ransomware groups since June... Weiterlesen

IT Security News Hourly Summary 2026-10-20 21h : 5 posts

Tue, 20 Oct 2026 22:11:38 +0200

5 posts published in the last hour 18:31Nikkei data breach affected over 1.8 million records 18:02Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign 18:02Palo Alto’s firewall OS has been under attack from multiple ransomware groups since June 18:02CrowdStrike Achieves NCSC CIR Enhanced... Weiterlesen

Palo Alto's firewall OS has been under attack from multiple ransomware groups since June

Tue, 20 Oct 2026 22:01:46 +0200

Multiple ransomware groups, including Qilin and Inc, have been exploiting a high-severity authentication bypass bug in Palo Alto Networks' PAN-OS, with Unit 42 investigating attacks since early June across numerous industries, such as finance, healthcare, and manufacturing.CVE-2026-0257 affects PAN-OS GlobalProtect portals and gateways,... Weiterlesen

Firewall-Sicherheit beginnt mit dem laufenden Betrieb - businessportal24

Mon, 19 Oct 2026 22:58:52 +0200

Luzern, Oktober 2026 - Eine Firewall gehört für Unternehmen zur Grundausstattung der IT-Sicherheit. Doch mit der Installation allein ist ihre Aufgabe ... Weiterlesen

Sonatype Unveils Nexus Repository Pro+ to Stop Malicious Components

Mon, 19 Oct 2026 20:34:34 +0200

Fulton, Md. – Sonatype, the company helping enterprises build with confidence in the AI era, today announced Nexus Repository Pro+, which stops malicious code where it enters, not after it’s already inside. By bringing Sonatype Repository Firewall, the company’s malicious code protection and policy enforcement product, inside the repository,... Weiterlesen

frp — Updated!

Mon, 19 Oct 2026 16:03:39 +0200

A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet. Weiterlesen

Hackers Exploit SiteGuard WAF Vulnerability That Could Give Them Full Control of Servers

Mon, 19 Oct 2026 14:28:18 +0200

Hackers are exploiting a command injection flaw in SiteGuard Server Edition, a web application firewall installed directly on protected servers. Tracked as CVE-2026-106931, the vulnerability could let attackers run operating system commands with root or SYSTEM privileges, potentially giving them full control of an affected server. The flaw affects... Weiterlesen

IT Security News Hourly Summary 2026-10-19 12h : 8 posts

Mon, 19 Oct 2026 12:03:02 +0200

8 posts published in the last hour 09:32From pilots to production: The four disciplines that make generative AI work 09:32Hybrid mesh firewalls: Distributed security enforcement for a self-driving network 09:32New in Falcon Cloud Security: Third-Party App Insights and AI-Enhanced Remediation 09:31Hands-on with Antigravity 2: No IDE, just agent... Weiterlesen

Hybrid mesh firewalls: Distributed security enforcement for a self-driving network

Mon, 19 Oct 2026 11:17:07 +0200

Can traditional firewalls keep up with today's distributed enterprise? Discover how hybrid mesh firewalls close security gaps without slowing networks. Weiterlesen

Firewall Rule Hygiene for Multi-Site SMEs: A Practical Checklist from the Field (UAE Edition)

Mon, 19 Oct 2026 09:48:35 +0200

Most firewall breaches we investigate at small and mid-sized companies are not clever zero-days. They are rules someone added three years ago "just for this weekend" and never removed. If you run more than one site (a head office plus a warehouse, or branches across Dubai, Abu Dhabi and Muscat), the problem multiplies. This is the checklist our... Weiterlesen

AI Can Hijack Industrial Systems in 16 Minutes

Sun, 18 Oct 2026 19:37:29 +0200

Frontier AI models can move from an enterprise network into operational technology (OT) systems and take physical control of industrial equipment in as little as 16 minutes, according to new lab testing by Booz Allen. In one demonstration, an AI model navigated through a firewall and IT network, entered the OT environment, compromised a SCADA... Weiterlesen

Security Operations as Cyber Defense Strategy

Sun, 18 Oct 2026 11:01:12 +0200

Attacks are automated now. New endpoints get scanned within minutes, and credential stuffing and stolen sessions are routine. Firewalls and MFA are necessary, but they don't tell you when something gets through. Detection, automated response and an audit trail are a baseline defense today, not an enterprise luxury. Here's how a small company... Weiterlesen

Wallet Firewall: A Pre-Signing Security Layer for EVM Wallets

Sat, 17 Oct 2026 18:51:30 +0200

What I Built Wallet Firewall is a pre-signing transaction security layer for EVM wallets. Every day, people lose funds because they blindly sign transactions they don't understand. A MetaMask popup shows a scary hex string, and the user just clicks "Confirm." Wallet Firewall solves this, before you sign, it decodes the transaction, checks the... Weiterlesen

New PEERSTITCH Malware Bypasses Security Checks on Fortinet VPNs

Sat, 17 Oct 2026 00:59:54 +0200

Security researchers have found a new malware that hides inside Fortinet firewalls. The malware is called PEERSTITCH. It is an ARM64 implant that runs in the memory of the device. Palo Alto Networks’ Unit 42 shared the findings on October 14, 2026. Its team studied an attack on a telecommunications managed service provider. Hackers steal […] The... Weiterlesen

Post-Quantum TLS for Cloud APIs and Microservices

Fri, 16 Oct 2026 22:13:49 +0200

Why Every TLS Termination Is a Separate Migration Boundary A cloud application rarely has one TLS connection. A single API request can be decrypted and re-encrypted at a CDN, a web application firewall, an API gateway, a load balancer, a service-mesh proxy, an application runtime, and a managed cloud endpoint. Each termination negotiates a fresh... Weiterlesen

Post-Quantum TLS for Cloud APIs and Microservices

Fri, 16 Oct 2026 20:53:39 +0200

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Fri, 16 Oct 2026 12:06:39 +0200

We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. This article has been indexed from Unit 42 Read the original article: Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant... Weiterlesen

PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager

Fri, 16 Oct 2026 11:48:34 +0200

PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. PEERSTITCH, a stealthy implant deployed during a prolonged intrusion, helped attackers maintain access to a telecom managed service provider after compromising its FortiManager appliance. Palo Alto Networks Unit... Weiterlesen

Die Windows Defender Firewall ist immer noch wichtig | Computer Weekly

Fri, 16 Oct 2026 08:47:17 +0200

Windows-Firewall auf Büro-PCs und Notebooks gezielt härten. SMB-Zugriffe begrenzen, Server mit IPsec isolieren und Regeln über Intune zentral ... Weiterlesen

Spyware infects journalists through unclicked ads, Palo Alto firewall zero-day exploited, OpenAI engineer charged with bugging exec room

Fri, 16 Oct 2026 03:38:48 +0200

Zero-Click Spyware Ads, Palo Alto Firewall Zero-Day, Critical Drupal Flaw, and OpenAI Bugging Charge Cybersecurity Today Host David Shipley reports on Citizen Lab findings that Israeli spyware maker Candiru, now reportedly rebranded as Integrity Labs, used targeted online ads bought through DiscoverTech's Controlium platform to profile and, in... Weiterlesen

IT Security News Hourly Summary 2026-10-16 03h : 3 posts

Fri, 16 Oct 2026 03:38:44 +0200

3 posts published in the last hour 00:31TypeSafe’s Jev ‘even more susceptible to attack’ than LLMs, says security vendor 00:01Spyware infects journalists through unclicked ads, Palo Alto firewall zero-day exploited, OpenAI engineer charged with bugging exec room 00:00IT Security News Hourly Summary 2026-10-16 02h : 3 posts The post IT Security... Weiterlesen

A little too OpenAI.

Thu, 15 Oct 2026 22:31:56 +0200

An OpenAI engineer faces charges over an alleged covert recording device. Attackers exploit a PAN-OS firewall flaw and an Ivanti zero-day. Aoki infostealer hunts AI credentials. Researchers uncover critical weaknesses in an AI gateway. CikaBika Bot turns Discord into a command center. Online ads deliver mercenary spyware without a click. Microsoft... Weiterlesen

Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks

Thu, 15 Oct 2026 17:30:43 +0200

Palo Alto Networks has warned that attackers are exploiting a high-severity remote code execution flaw in the PAN-OS management interface. Tracked as CVE-2026-0322, the bug lets an authenticated attacker with network access run arbitrary code with root privileges on the firewall. PAN-OS zero-day vulnerability The flaw is a code injection weakness... Weiterlesen

New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory

Thu, 15 Oct 2026 15:57:51 +0200

PEERSTITCH, a memory-resident ARM64 implant deployed against FortiGate firewalls during a prolonged intrusion into a telecommunications managed service provider. The malware hijacks legitimate FortiOS processes, leaving no persistent executable, opening no listening ports, and initiating no outbound connections of its own. Published October 14,... Weiterlesen

Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls

Thu, 15 Oct 2026 14:35:22 +0200

Attackers compromised a telecommunications managed service provider by exploiting vulnerabilities in Fortinet’s centralized management and firewall systems, then deployed PEERSTITCH, a stealthy malware implant that runs inside FortiGate processes. Unit 42 says the activity began with a breach of a FortiManager appliance and exposed configurations... Weiterlesen

Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix

Thu, 15 Oct 2026 14:34:42 +0200

Attackers are exploiting a newly disclosed flaw in Palo Alto Networks’ PAN-OS firewall software to run code with root privileges, and US federal agencies have been ordered to fix it and check for compromise by October 17. Palo Alto Networks disclosed the vulnerability, tracked as CVE-2026-0322, in a security advisory published October 14. The flaw... Weiterlesen

Firewall und Sicherheit: Microsoft Defender kommt für Linux-Desktops - Golem.de

Thu, 15 Oct 2026 14:24:18 +0200

Bei der Einrichtung erkennt Microsoft Defender, ob es sich beim genutzten Computer um einen Server oder einen Client handelt. Anschließend wird das ... Weiterlesen

Hackers Chain Fortinet Vulnerabilities to Deploy Memory-Resident Malware on Firewalls

Thu, 15 Oct 2026 13:36:57 +0200

Hackers chained Fortinet vulnerabilities to steal sensitive firewall data and deploy PEERSTITCH, a stealthy implant that operates inside running processes. Unit 42 uncovered the activity while investigating an intrusion against a telecommunications managed service provider that began in September 2024. Researchers track the attackers as... Weiterlesen

Unsichere Firewall: Palo Alto Networks warnt vor Angriffen auf Zero-Day-Lücke

Thu, 15 Oct 2026 12:21:04 +0200

Betroffen sind Firewalls der Serien PA und VM. Ein Angreifer kann Code mit Root-Rechten ausführen. (Firewall, Virtualisierung) Weiterlesen

PAN-OS: Schadcode schlüpft durch Root-Lücke in Palo-Alto-Firewalls

Thu, 15 Oct 2026 12:20:39 +0200

Angreifer attackieren zurzeit Firewalls von Palo Alto Networks. Eine reparierte PAN-OS-Version schafft Abhilfe. Weiterlesen

PAN-OS: Schadcode schlüpft durch Root-Lücke in Palo-Alto-Firewalls

Thu, 15 Oct 2026 11:29:37 +0200

Angreifer attackieren zurzeit Firewalls von Palo Alto Networks. Eine reparierte PAN-OS-Version schafft Abhilfe. Weiterlesen

GitHub Release: NousResearch/hermes-agent v0.22.2 (15.10.2026)

Thu, 15 Oct 2026 10:23:24 +0200

NousResearch/hermes-agentv0.22.215.10.2026@jquesnelle

Hermes Agent v0.22.2

Release Date: October 15, 2026

v0.22.1 was built from the wrong commit. It shipped unreleased gateway work, and the Microsoft Store app could stick on "Connecting." 0.22.2 is the release 0.22.1 was meant to be.

Known issue: Sessions that ran under the 0.22.1 gateway can't be deleted in 0.22.2.

Highlights

The gateway starts after a reboot again. After a restart, Linux can hand an early PID to an unrelated process, and the gateway could mistake it for a running gateway, so a supervised gateway (systemd, launchd, Docker) refused to start. Hermes now records the boot it started in, and when it can't tell, it asks the host lock, which only a live gateway holds. (#138594, fixes #133744)
Long local-model turns survive on laptops. Local requests always stream with prompt-reading progress (shown in the status line), stall timers skip time the machine was asleep, a recovered local server gets another try instead of a breaker that failed every later message, and compression no longer times out while the server is still reading a long conversation. On Windows unified-memory machines, model launch and the prompt cache are sized to free memory. (#138560)

Below is everything in the 0.22 release line since v0.22.0: the fixes 0.22.1 was meant to ship, plus the two above. Work that is only on main ships with v0.23.0.

✨ Features

Release: split the Microsoft Store bundle into its own windows-store lane (f9d8a740) — @ethernet8023
Agent: add nemotron super 3.5 default parameters (c59d2994) — @elisam0
Cli: add nemotron to NVIDIA NIM default model list (cc55270e) — @elisam0
Cli: add curated model list at the top in the model picker list (e6835fd3) — @elisam0
Release: choose what a stable release builds and tests with lanes (36a8ee18) — @ethernet8023
Plugin-catalog: add hermes-lang-ko — Korean Desktop language pack (e5f49b6a) — @dandacompany
Plugin-catalog: add hermes-lang-pt-br (Brazilian Portuguese language pack) (0169e80c) — @StudioCodeAI
Contributors: add 2867297362mjb-sketch email mapping (9ab40641) — @2867297362mjb-sketch
Plugin-catalog: add teamorouter (TeamoRouter model providers) (ef223406) — @2867297362mjb-sketch
Plugin-catalog: add author-feed (5f6d6836) — @TakeshiTGAL
Plugin-catalog: bump aux-ledger to 1.4.0 (6048066e) — @olric3015
Plugin-catalog: add the wait-ledger catalog card (77cb58e5) — @olric3015
Plugin-catalog: add wait-ledger (97e65322) — @olric3015
Community plugin: lightningai + lightningai-rate-limit (07515466) — @dinosauria123
Catalog: add Hermes AAC 0.1.0 at reviewed exact source pin (7c9adda8) — @TREE-Ind
Plugin-catalog: add openinvest (b6e86101) — @longsizhuo
Catalog: add hermes-agent-mixer (v0.2.0 @ 04c4e13) (2e7e3859) — @Sahil-SS9
Plugins: move Kumiho Memory to memory catalog shelf (46f95e08) — @kaveone
Release: dispatch Stable Release from the default branch (667e6639) — @ethernet8023

🔧 Improvements

Agent: keep the Mistral tool-id rule beside its only consumer (c5fc0958) — @kshitijk4poor
Profiles: build the seed routing view once; expand enabled too (311155fa) — @kshitijk4poor
Profiles: simplify the model seed and trim its tests (d9dfb124) — @kshitijk4poor
Update nemotron super 3.5 name (3224993a) — @elisam0
Hermes_cli: update nemotron 3.5 name (108ae4e7) — @elisam0
Catalog: re-pin showly to the build without the upstream self-update check (6462f64a) — @slchris
Catalog: update Model Router to v0.4.3 native preferences (6a097ee9) — @metamindedu

🐛 Bug Fixes

Gateway: a recorded boot epoch that cannot be compared is unprovable (79b3b724) — @ethernet8023
Local: keep long local-model turns alive on laptops (518ce272) — @emozilla
Gateway: a read-only host-record check never creates the lock file (91e63f84) — @kshitijk4poor
Gateway: let the host lock decide a legacy record that looks older than this boot (4d984677) — @ethernet8023
Gateway: anchor the legacy host-record check on boot time, not a live create_time (5b416e42) — @ethernet8023
Gateway: drop argv identity from host rendezvous liveness (c7fa3cbf) — @sin5ddd
Gateway: reject a recycled PID that only matches start ticks (7934442e) — @sin5ddd
Tui: keep a ${VAR} bare-custom endpoint as a ref in the new profile (dd2db134) — @kshitijk4poor
Tui: a new profile inherits a bare custom launch model with its endpoint (463d4019) — @kshitijk4poor
Release: a Store-only Windows build gets no signing vars; Store-plus-macOS smokes record only macOS (a8cc19eb) — @ethernet8023
Agent: keep composite tool ids paired on Mistral routes (0c1bfb7d) — @kshitijk4poor
Agent: rewrite split tool ids before Mistral sees them (b33ed359) — @xxxigm
Release: macOS smoke runs when no receipt was staged (f546ea2f) — @ethernet8023
Install-e2e: preserve bundled Windows process arrays (6db1934d) — @Oceanswave
Profiles: match env-referenced endpoint names when seeding a profile (7b755ed5) — @kshitijk4poor
Profiles: drop every same-identity destination entry when merging (9a9a6e43) — @kshitijk4poor
Profiles: match endpoint identity the way runtime does when merging (ef57cbd9) — @kshitijk4poor
Profiles: keep URL-less destination entries when merging the endpoint seed (2aa469f7) — @kshitijk4poor
Profiles: inherited endpoint is not shadowed by the profile's own entries (ac0b63af) — @kshitijk4poor
Profiles: select the seeded endpoint from an env-referenced provider (c85302a2) — @kshitijk4poor
Profiles: keep bare custom provider tuning in the model seed (424aa90f) — @kshitijk4poor
Profiles: reuse named provider lookup without credential reads (c8a777ff) — @helix4u
Profiles: align model seed with provider resolution (5fee8d77) — @helix4u
Profiles: inherit canonical and legacy custom endpoints (2d3e75aa) — @helix4u
Drop the VPN/proxy advice from the CDN-block message (300228d2)
Scope the no-cf-cache-status block signal to our R2 host; keep it on 429s (ec5fa1e4)
Name a CDN firewall block instead of a bare HTTP 403 (#128295) (#128295)
Release: termux-only claims finish and partial releases keep the shared downloads page (6743ab71) — @ethernet8023
Ci: packaged-update acceptance retries a download whose connection resets (db4a6a9e) — @ethernet8023
Catalog: re-pin Agent Mixer after maintainer review (4297a692) — @Sahil-SS9
Pin Activity v0.2.1 public credential routes (3dac1f07) — @hassan-kamel
Plugin-catalog: update jp-egov-law to f1dd47e (c029046d) — @TakeshiTGAL
Plugin-catalog: update switchbot-control to d0e6f77 (c4bf61b1) — @TakeshiTGAL
Install-e2e: the Windows packaged-app feed serves byte ranges (1f6c02c0)
Pm: re-merge the uv cache seed on volumes marked by a seedless image (1226894b) — @ethernet8023
Release: publish replaces the stable head instead of create-only (df8c3ca5)
Release: keep a stable run on main from using the controller commit or cancelling pushes (0dbd96ab) — @ethernet8023
Pm: stage a version for version-less buildable plugin members too (3d8dfc1d) — @ethernet8023
Pm: don't stamp project.version on members declaring it dynamic (2a10164c) — @Ieqzya
Pm: give generated virtual workspace members a project.version (357986e5) — @Ieqzya
Pm: retry sync without bytecode compile when that step fails (10619939) — @smfworks
Deps: bump httpx2/httpcore2 2.7.0 -> 2.12.0 for the audit advisories (bc8545bd) — @guthixboss1
Doctor: stop mislabeling the root npm audit row as agent-browser (7b1dc974) — @chelsealong
Doctor: say recreating the same Docker image does not fix npm findings (dee35e1d) — @ethernet8023
Doctor: describe full workspace npm audit scope (b9dda06b) — @dwaxe
Doctor: clarify Docker npm audit remediation (e21caa27) — @KoNit-K
Deps: bump the WhatsApp bridge lock past its npm-audit findings (231cb757) — @ethernet8023
Deps: land source-map-js 1.2.2 and sync the workspace pins to the overrides (f57d12eb) — @ethernet8023
Deps: bump pinned npm packages to clear npm audit findings (732f0f17) — @sajidhaleem
Windows: packaged-npx install failures degrade to plain npx; payload venv must be real (84e2250b) — @ethernet8023
Docker: ship the build's uv cache at the PM seed path (f4e70b9d) — @ethernet8023
Release: publish the final vX.Y.Z Docker tag again (c1100232) — @ethernet8023
Pm: npm on PATH is the pinned npm, not the copy bundled inside node (8d3b5ab5) — @ethernet8023
Windows: an MSIX with no Node to copy runs npx MCP servers on its packaged node (8ef7654b) — @ethernet8023
Windows: MSIX terminal and MCP children get node, npm and python copied outside the package (c7abf4fb) — @ethernet8023
Terminal: the user's own tools come before Hermes's in the terminal (162b457c) — @ethernet8023
Search: local file search runs Hermes's pinned ripgrep, not the first rg on PATH (9b4710b8) — @ethernet8023
Terminal: strip a sealed payload's venv from child PYTHONPATH (671996b1) — @ethernet8023

📚 Documentation

Agent: use the released model name Nemotron 3.5 Super VL (79651b71) — @j-nolan
Agent: name the guidance blocks and drop the unsupported claims (ba498735) — @j-nolan
Agent: note that the guidance blocks were tested on Nemotron without effect (2b57b0db) — @j-nolan
Providers: rephrased content (4f8df7e1) — @nv-pberard
Env: add NVIDIA NIM to .env example (3dd96101) — @elisam0
Providers: use a non-cloud example key for local NIM (da463310) — @rroverin
Providers: update NVIDIA NIM example to Nemotron 3.5 Super VL (c5bab4af) — @rroverin
Local Models is on by default on macOS, Windows and Linux (1e8bf3ee)

🧪 Tests

Agent: pin Mistral's 9-character tool id on the wire (9a90a825) — @xxxigm
Profiles: pin same-identity eviction of URL-less and disabled entries (0f447876) — @kshitijk4poor
Profiles: pin that the model seed copies only the selected endpoint (29db211b) — @kshitijk4poor
Agent: add reasoning timeout default test (73a07104) — @elisam0
Relay: the OpenAI-stream e2e no longer self-deadlocks when the stream is buffered (6e84ce66)
Pm: one streamed-sync test covers the bytecode-compile retry (7f21aad1) — @ethernet8023
Deps: fail the build if an httpx2 pin or lock entry drops below 2.12.0 (3ca10d88) — @jarvistwil
Doctor: point the root-row label test at the staged-npm seam (40441695) — @ethernet8023
Pm: allow-list the packaged-npx node lookups in the resolution ratchet (c4f9a169) — @ethernet8023

🏗️ Infrastructure

Release: admit stable releases from release/* branches, not just main (9686d55c) — @ethernet8023
Map contributor email for sin5ddd (#133750 salvage) (#133750) — @kshitijk4poor
Map Oceanswave noreply email to GitHub login (f343bdff) — @ethernet8023
Map contributor email for ashmoonori-afk (6a1ee825)
Plugins: pin birkin-mnemosyne to core 0.7.1 (e216cd74) — @ashmoonori-afk
Catalog: review disclosure for huddo (85d27a51)
Map contributor email for StudioCodeAI (c708b34f)
Plugin-catalog: update Telegram Client to 1.3.1 (27aaade9) — @guberm
Plugin-catalog: bump Gmail to v1.0.20 (c6ac0565) — @guberm
Plugin-catalog: bump Gmail to v1.0.19 (74324f11) — @guberm
Plugin-catalog: update Gmail to v1.0.18 (8050d9ea) — @guberm
Kiwi: bump pin to kiwi@0.12.5, plugin v1.2.2 (a08f5894) — @harrylabsj
Map contributor email for dinosauria123 (06c81873)
Lightningai-rate-limit to v1.1.0 (wall-clock aligned window) (e28d64e8) — @dinosauria123
Map contributor email for TREE-Ind (71f78b3f)
Catalog: review disclosure for hermes-aac (0567d017)
Catalog: review disclosure for openinvest (c179b286)
Map contributor email for Sahil-SS9 (d8b5bd8a)
Catalog: review disclosure for hermes-agent-mixer (a98cc310)
Catalog: review disclosure for hermes-activity (e891815c)
Update Activity catalog to v0.2.0 (908c525d) — @hassan-kamel
Map contributor email for slchris (eaf08400)
Catalog: showly reviewed disclosure + requires_hermes >=0.21.6 (2ee820e7)
Map contributor email for Neboy72 (d9971f13)
Catalog: review disclosure for nexus (1a5f5c7b)
Catalog: review disclosure for kumiho-memory (63da5f7b)
Catalog: review disclosure for model-router (92790c6d)
Catalog: review disclosures for anatomy-museum, agent-janitor (560b2507)
Contributors: map ieqzya@gmail.com to Ieqzya (c98162bb) — @ethernet8023
Contributors: map Darthvader88@gmail.com to guthixboss1 (8c5c9ac4) — @ethernet8023
Release: pass the commit under test through every stable lane (66facf4a) — @ethernet8023

📦 Other Changes

Repin hermes-insight to a61cdf6 (1.0.3) (0e427d78) — @BrokeSkill
Repin hermes-insight to afb08fb (1.0.2) (51e663da) — @BrokeSkill
Plugin-catalog: bump huddo to 0.9.0 (eeacc00a) — @hellohanchen
Plugin-catalog: re-pin hermes-lang-pt-br to 7548ff1 (pack verifier + CI) (82fbd41f) — @StudioCodeAI
Plugin-catalog: re-pin hermes-lang-pt-br to 69efb2f (credits/timeline README) (2c20d9a3) — @StudioCodeAI
Catalog: bump speechify to 0.1.1 (3a5b9e84) — @Lokeshm24
Catalog: re-pin qdrant-memory to 0.2.1 (e14adc06) (720552bb) — @cnkang
Catalog: repin Hermes AAC 0.1.1 SDK-only reduced features (473e2847) — @TREE-Ind
Plugin-catalog: openinvest re-pin to 106e5ba (bounded backend deps, 0.41.6) (6cc9a434) — @longsizhuo
Plugin-catalog: openinvest re-pin to 3a0c816 (review fixes, backend 0.41.4) (00c311c8) — @longsizhuo
Plugin-catalog: openinvest re-pin to 3e1a9d7 (review fixes) (cb223633) — @longsizhuo
Plugin-catalog: bump plan-mode to 0.4.4 (2a5617f8) — @100yenadmin
Plugin-catalog: bump plan-mode to 0.4.3 (6fafdd4f) — @100yenadmin
Catalog: pin the Showly community plugin (5da3156c) — @slchris
Catalog(nexus): repin the sha to 4392e6d — /embed and /mcp demand a per-installation key (64425a06) — @Neboy72
Catalog(nexus): repin to v0.22.24 — the embedder comes from the service, not from a shadowed path (0ee11795) — @Neboy72
Catalog(nexus): repin to v0.22.23 — the plugin reaches its own venv again (a442c9a5) — @Neboy72
Catalog(nexus): pin the engine to the full sha of the reviewed commit (1f295ae0) — @Neboy72
Catalog(nexus): repin to v0.22.22 — the engine rev is one resolvable tag, the docs match the code (7f495184) — @Neboy72
Catalog(nexus): repin to v0.22.21 — five access-level gaps closed (0f8a2a17) — @Neboy72
Catalog(nexus): repin to v0.22.20 — conversation history is private (14aaf8e1) — @Neboy72
Catalog(nexus): repin to v0.22.18 (Claude Code writes memory again) (2165eed9) — @Neboy72
Catalog(nexus): repin to v0.22.17 (memory provider can embed again) (f60e16fc) — @Neboy72
Catalog(nexus): repin to v0.22.16 (named-vector fixes in the root package) (dab47696) — @Neboy72
Catalog(nexus): repin to v0.22.15 (review findings: stricter trust matching) (3952f2b5) — @Neboy72
Catalog(nexus): repin to 3f77b2a (plugin.yaml version parity) (ca1c2261) — @Neboy72
Catalog(nexus): repin to v0.22.13 (named collection model) (c7b035c1) — @Neboy72
Plugin-catalog: bump account-pool to 4.0.2 (e5d2cebe) — @roqianjas
Plugin-catalog: bump alans-way and alans-way-computer to 0.21.5 (a8d61e30) — @capthvnsen
Plugin-catalog: bump tinyfish to 0.2.2 (6ebd92d9) — @Zechereh
Plugin-catalog: nvidia pins -> de75692 (Broadcast troubleshooting uses tool_search, not a shell probe) (66cd37c9) — @alt-glitch
Plugin-catalog: nvidia-app + nvidia-broadcast pin -> 729e25c (first-run setup when the app side is not ready) (f18948e4) — @alt-glitch
Catalog: agent-janitor (from #137875) (#137875) — @ZidoCode
Catalog: anatomy-museum (from #138166) (#138166) — @danrudy33
Catalog: secure-env-ingress (from #132272) (#132272) — @web3blind

👥 Contributors

Thank you to everyone who contributed to this release!

@ethernet8023 (33 commits)
@kshitijk4poor (17 commits)
@Neboy72 (13 commits)
@elisam0 (7 commits)
@guberm (4 commits)
@longsizhuo (4 commits)
@helix4u (3 commits)
@j-nolan (3 commits)
@StudioCodeAI (3 commits)
@TakeshiTGAL (3 commits)
@olric3015 (3 commits)
@sin5ddd (2 commits)
@xxxigm (2 commits)
@rroverin (2 commits)
@BrokeSkill (2 commits)
@2867297362mjb-sketch (2 commits)
@dinosauria123 (2 commits)
@TREE-Ind (2 commits)
@100yenadmin (2 commits)
@Sahil-SS9 (2 commits)
@hassan-kamel (2 commits)
@slchris (2 commits)
@alt-glitch (2 commits)
@Ieqzya (2 commits)
@emozilla (1 commit)
@predatorheard-byte (1 commit)
@Oceanswave (1 commit)
@nv-pberard (1 commit)
@dandacompany (1 commit)
@ashmoonori-afk (1 commit)
@hellohanchen (1 commit)
@Lokeshm24 (1 commit)
@harrylabsj (1 commit)
@cnkang (1 commit)
@kaveone (1 commit)
@roqianjas (1 commit)
@capthvnsen (1 commit)
@Zechereh (1 commit)
@metamindedu (1 commit)
@ZidoCode (1 commit)
@danrudy33 (1 commit)
@web3blind (1 commit)
@smfworks (1 commit)
@jarvistwil (1 commit)
@guthixboss1 (1 commit)
@chelsealong (1 commit)
@dwaxe (1 commit)
@KoNit-K (1 commit)
@sajidhaleem (1 commit)

Updating

CLI and installer-script desktop installs: hermes update, or re-run the installer one-liner. This moves installs that took v0.22.1 back onto the release line.
Microsoft Store: updates through the Store.
Docker / Hermes Cloud: nousresearch/hermes-agent:stable (or :latest).

Full Changelog: v0.22.0...v0.22.2 (release line)

Microsoft Mechanics: Automated SQL Injection Remediation With AI Agents

Thu, 15 Oct 2026 09:55:45 +0200

YouTube Video

Can an AI agent fix a SQL injection, not just report it? Project Perception's posture remediation agent shields the app with a web application firewall, adds an authorization check, then writes a code fix to parameterize invoice queries, runs tests to validate it, and opens the pull request that merges it into production.

▶ Full video: https://youtu.be/afXHGzGNAtM
▶ Get started: https://microsoft.com/perception

#Shorts #MicrosoftDefender #AIAgents #SecOps

HomeLab

Thu, 15 Oct 2026 09:31:30 +0200

GNS3 home lab documenting a segmented network with Cisco ASAv firewall, L3 core, DMZ, and an Active Directory domain for practicing networking, sysadmin, and offensive security. Weiterlesen

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Thu, 15 Oct 2026 09:31:22 +0200

We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant appeared first on Unit 42. Weiterlesen

Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls

Thu, 15 Oct 2026 09:28:25 +0200

Hackers are exploiting a high-severity flaw in Palo Alto Networks PAN-OS that allows authenticated attackers to run code with root privileges on affected firewalls. Tracked as CVE-2026-0322, the vulnerability affects the management interface, with the company confirming “very limited exploitation” and urging customers to apply fixes as soon as... Weiterlesen

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

Thu, 15 Oct 2026 09:21:24 +0200

Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...] Weiterlesen

Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution

Thu, 15 Oct 2026 09:20:48 +0200

The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available. The post Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution appeared first on SecurityWeek. Weiterlesen

Warnung des BSI: Hacker nehmen Firewall von Sonicwall ins Visier

Thu, 15 Oct 2026 09:19:14 +0200

Die Schwachstelle ist besonders schwerwiegend, weil sie Zugriffe aus der Ferne erlaubt - ohne Authentifizierung. (Firewall, Server) Weiterlesen

Firewall und Sicherheit: Microsoft Defender kommt für Linux-Desktops

Thu, 15 Oct 2026 09:18:52 +0200

Microsoft weitet das Security-Tool auf Linux-Systeme aus. Dabei werden die Features für Linux-Server direkt übernommen. (Microsoft 365, Server) Weiterlesen

OpenAI’s AI misalignment problem is growing

Thu, 15 Oct 2026 09:12:54 +0200

OpenAI’s misalignment problems seem to only be getting worse, based on yet another trio of reports detailing its models’ troubling and overzealous behaviors. In ad hoc misalignment testing, OpenAI models found creative ways to subversively access restricted information by cheating their way through proxy or firewall settings, getting savvy with... Weiterlesen

Firewall und Sicherheit: Microsoft Defender kommt für Linux-Desktops

Thu, 15 Oct 2026 09:02:39 +0200

Microsoft weitet das Security-Tool auf Linux-Systeme aus. Dabei werden die Features für Linux-Server direkt übernommen. (Microsoft 365, Server) Weiterlesen

Microsoft Mechanics: Fight AI with AI | Multi-Agent Security Defense

Mon, 12 Oct 2026 22:34:43 +0200

YouTube Video

Match AI-powered attacks at machine speed with Project Perception. Point red, blue, and green AI agent teams at a known threat actor, confirm which vulnerabilities attackers can reach, then deploy KQL detections, harden your posture, and merge a tested code fix in minutes with Microsoft Defender.

Stay in control and approve key actions before agents run them. Run Microsoft’s pre-built playbooks or build your own, and manage sessions from the Defender portal or from your terminal with the MCP plug-in. Keep token costs low with MAI Cyber Flash, a purpose-built security model inside MDASH.

Dave Weston, CVP Microsoft Security, shares how Microsoft’s threat intelligence and incident response expertise power agents you direct.

👥 Who it's for:
SOC analysts, security engineers, and red and blue teamers evaluating agentic AI for defense, plus AppSec and DevSecOps teams who own vulnerability remediation.

⏱️ Chapters:
00:00 Fight AI-powered attacks with AI agents
00:45 How AI attacks adapt mid-breach
01:39 Jailbroken and abliterated models
02:04 Inside the Project Perception security stack
03:28 Red, blue, and green agent teams
04:07 Playbooks that orchestrate agent workflows
04:43 Ask Perception if you're protected
06:06 Red team agents emulate a threat actor
06:59 Approve high-impact agent actions
07:26 MDASH findings confirm reachable vulnerabilities
08:22 Blue team agent writes KQL detections
08:54 WAF, auth check, and tested code fix
09:36 Pull request merged into production
10:14 Session reports and MCP terminal plugin
11:02 MAI Cyber Flash keeps token costs low
11:57 Join the Project Perception preview

AI helps attackers find, weaponize, and exploit vulnerabilities at a speed and scale no human team can match. Jailbroken and abliterated models generate custom tooling that adapts mid-breach, leaving defenses that hunt for known techniques chasing a target that changes every time.

Project Perception answers with a full agentic security stack. It starts with trillions of daily security signals, correlates them in the Microsoft security graph, and uses multiple AI models, including purpose-built ones, to reason over risk and prioritize what matters most. Specialized agents act on that reasoning: red team agents simulate attacks and prove where you're vulnerable, blue team agents investigate and build detections, and green team agents harden posture and remediate. Playbooks orchestrate them through proven SOC workflows, and codified actuators let agents perform the fix instead of only recommending it.

In the demo, one prompt, "Is my organization protected against Onyx Sleet?", launches threat intelligence, reconnaissance, and pen test agents. They pull MDASH code-scanning findings and confirm an internet-exposed SQL injection. A detection authoring agent writes KQL detections to cover the gap, and the posture remediation agent shields the app with a web application firewall, adds an authorization check, and produces a tested code fix merged through a pull request. Agents stop and ask before any high-impact action, so you stay in control.

Every session produces a shareable report with the attack path, remediation plan, and timeline. An MCP tool plugin runs the same work from your terminal, and MAI Cyber Flash, a dedicated cybersecurity model inside MDASH, handles most vulnerability work to keep token costs low.

🔗 Related links:
► Get started at https://microsoft.com/perception

► Unfamiliar with Microsoft Mechanics?
Microsoft’s Official Video Series for IT
— Subscribe https://www.youtube.com/c/MicrosoftMechanicsSeries
— Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
— Podcast: https://microsoftmechanics.libsyn.com/podcast

►Join us on social:
— https://twitter.com/MSFTMechanics
— https://www.linkedin.com/company/microsoft-mechanics/
— https://www.instagram.com/msftmechanics/
— https://www.tiktok.com/@msftmechanics

#Cybersecurity #MicrosoftDefender #AIAgents #SecOps

NetworkChuck: your house needs TWO networks (here's why)

Mon, 12 Oct 2026 21:58:05 +0200

YouTube Video

Try Flare for free: https://ntck.co/flare-opnsense

Your smart fridge could be the way a hacker gets into your home network. So in part two of Mike's network build, I use OPNsense and VLANs to split his one flat network into separate networks for work, users, and a quarantined IoT network that can't touch anything else. The firewall is the mini PC from Japan we built in part one, the switch is a QNAP I'd never used (it has a dent), and DHCP almost broke me over one hidden checkbox. Then I told Mike his IoT devices were finally locked down, and he asked me what an IoT device is.

In this video you'll learn what a VLAN actually is and how to create one in OPNsense, how trunk (tagged) and untagged ports work on a managed switch, how to give each new network its own gateway IP and DHCP range (plus the one DHCP setting Claude Code had to find for me), how deny-by-default firewall rules and an alias keep your IoT devices locked in their own corner, and what happens when you point an AI agent (Pig, running Hermes on a Raspberry Pi) at a switch with no CLI. Whether you've never heard the word VLAN or you already built the OPNsense box from part one, this is how you turn one network into as many as you need.

🎓 If "172.16.14.0/24" made your eyes glaze over, my CCNA course on NetworkChuck Academy will turn you into a subnetting ninja: https://ntck.co/NCAcademy

RESOURCES / LINKS:
📺 Part one: replacing Mike's router with OPNsense: https://www.youtube.com/watch?v=a3RI4DjFBzw
🛠️ Download OPNsense: https://opnsense.org/download/
📖 OPNsense VLAN setup docs: https://docs.opnsense.org/manual/how-tos/vlan_and_lagg.html
📖 OPNsense Dnsmasq DNS and DHCP docs (where the hidden checkbox lives): https://docs.opnsense.org/manual/dnsmasq.html
🤖 Claude Code: https://claude.com/product/claude-code
🤖 Hermes Agent: https://github.com/NousResearch/hermes-agent
📺 Set up your own AI agent (Hermes): https://www.youtube.com/watch?v=QQEgIo4Juxg

HARDWARE:
🖥️ The mini PC running OPNsense, Getorli (mine is the Ryzen 3 5300U from Japan; this US listing is the Ryzen 7 6800H): https://geni.us/bb9n6YE
🔀 The switch (QNAP QSW-L2110-10T, lite-managed): https://geni.us/I5Aumn

FEATURING:
👤 Bogdan Botezatu (IoT security expert and threat researcher): https://x.com/bbotezatu

Starring my editor Mike (whose network we just locked down) and Pig (the Hermes AI agent on a Raspberry Pi).

**Sponsored by Flare

SUPPORT NETWORKCHUCK:
☕☕ COFFEE and MERCH: https://ntck.co/coffee

READY TO LEARN??
🔥🔥Join the NetworkChuck Academy!: https://ntck.co/NCAcademy
📚 CCNA Course: https://ntck.co/ccna

FOLLOW ME EVERYWHERE:
Instagram: https://www.instagram.com/networkchuck/
X/Twitter: https://x.com/networkchuck
Facebook: https://www.facebook.com/NetworkChuck/
Join the Discord server: https://ntck.co/discord

Some links in this description are affiliate links. If you buy through them, I may earn a small commission at no extra cost to you. #sponsored
#opnsense #homelab #networkchuck

chisel v1.13.0

Mon, 12 Oct 2026 21:49:01 +0200

Fast TCP/UDP tunnel over HTTP with SSH encryption, supporting reverse port forwarding, SOCKS5 proxy, and client authentication for secure network traversal and firewall evasion. Weiterlesen

Making sure the checks get printed

Mon, 12 Oct 2026 21:48:44 +0200

Welcome to this week’s edition of the Threat Source newsletter. My name is Pierre Cadieux, and I’ll be helping contribute to these newsletters. A little about me: I’ve been working in the cybersecurity industry in many roles over the past 20+ years, first focusing on endpoint security, policies, and firewalls, then moving to risk management and... Weiterlesen

Is Your DDoS Protection Actually On?

Mon, 12 Oct 2026 21:46:40 +0200

Readiness is a visibility problem, and it’s one many organizations don’t know they have. Most security controls tell you when they’re broken. A bad firewall rule lets traffic through that shouldn’t be there. An expired certificate generates alerts. A misconfigured WAF starts blocking legitimate users and someone notices pretty quickly. DDoS... Weiterlesen

FBI: FortiBleed attackers can lock organizations out of their own firewalls

Mon, 12 Oct 2026 21:43:21 +0200

Details from an FBI investigation into the ongoing FortiBleed attacks reveal that victims could be locked out of their own firewall even as attackers remain logged in. After gaining access to a backend server left exposed by the attackers, the FBI and US Secret Service have shared new details of an operation that has already affected more than... Weiterlesen

FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users

Mon, 12 Oct 2026 21:42:49 +0200

An initial access broker is working with various ransomware groups in a global campaign. Weiterlesen

The Zero-Day Blind Spot: Why Your Agentic SOC needs Retrospective Packet Replay

Mon, 12 Oct 2026 21:26:01 +0200

Learn how the .conf26 Agentic SOC paired Endace full PCAP with Cisco Secure Firewall and Talos rules to retrospectively replay wire data against zero-days. Weiterlesen

Admin in the Loop: Firewalls and the Agentic SOC

Mon, 12 Oct 2026 21:26:00 +0200

Discover how Cisco Secure Firewall and Cloud Control stream structured Snort 3 and EVE telemetry into Splunk ES to power the .conf26 Agentic SOC pipeline. Weiterlesen

Fix Brother Scan to PC Not Working on Windows 11 Wi-Fi

Mon, 12 Oct 2026 20:56:57 +0200

Key TakeawaysYour Brother printer might fail to scan to a Windows 11 PC over Wi-Fi even if it prints fine due to different software components used for scanning, including network drivers, firewall settings, and Brother software, rather than printer faults. Common issues arise after updates, software reinstallations, or network changes.To fix the... Weiterlesen

OWASP Top 10 For LLM Applications: Complete Guide

Mon, 12 Oct 2026 20:56:18 +0200

By HOC Team | Updated: October 2026 | Read time: ~18 min Large Language Models (LLMs) have fundamentally changed how software is built, shifting the paradigm from deterministic code execution to probabilistic natural language processing. However, this shift introduces an entirely new attack surface. Traditional web application firewalls and... Weiterlesen

Ørsted builds compliance into automation, speeds firewall changes

Mon, 12 Oct 2026 20:55:30 +0200

When Ørsted set out to automate its network operations, speed wasn’t the primary goal. The energy company first needed to get its network data under control and establish processes that would consistently meet its security and compliance requirements. João Soares, lead IT security consultant at Ørsted in Copenhagen, joined the company nearly five... Weiterlesen

FortiBleed still a bleeding nuisance as FBI confirms ongoing attacks

Mon, 12 Oct 2026 20:53:35 +0200

The FBI and US Secret Service (USSS) say criminals using credentials linked to the FortiBleed campaign are locking organizations out of their Fortinet firewalls. The agencies published a joint advisory on Tuesday, citing SOCRadar's verification of more than 86,644 compromised devices across 194 countries. "Based on initial responses, some victims... Weiterlesen

Understanding Asymmetric Routing Risks in Modern Firewall Deployments

Mon, 12 Oct 2026 20:53:31 +0200

FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials

Mon, 12 Oct 2026 20:40:55 +0200

The U.S. Federal Bureau of Investigation (FBI) and Secret Service (USSS) on Tuesday warned that the FortiBleed credential harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways. "The campaign exploits reused or leaked credentials and... Weiterlesen

GitHub Release: NousResearch/hermes-agent v0.21.7 (12.10.2026)

Mon, 12 Oct 2026 20:38:54 +0200

NousResearch/hermes-agentv0.21.712.10.2026@teknium1

Hermes Agent v0.21.7

Release Date: October 11, 2026

Patch release. This tag rolls up the ~204 PRs merged since v0.21.6 into a stable release for the desktop app (macOS Apple silicon, Windows), the Microsoft Store and MSIX, the installer, Docker and Hermes Cloud. Full curated notes for this window ship with v0.22.0.

What this patch ships for source installs (hermes update and the desktop app's updater on a git checkout):

Updates now follow tagged releases. A source install of the official repository updates to the latest published vX.Y.Z release instead of every commit on main. An install already newer than the latest release stays where it is and waits for the next one; nothing is moved back. To keep following every commit: hermes update --set-channel main. Forks and mirrors keep following main. Store, MSIX and bundled desktop installs are unchanged.
Choose the channel in the desktop app. Settings ▸ About ▸ Updates has an Update channel switch (Stable releases / Every commit) for source installs, and the update dialog now shows which channel you are on.
Reasoning survives resume. Signed thinking replays after hermes chat --resume and on the next gateway turn, and Bedrock Converse reasoning models no longer get rejected on resumed sessions.
Updates no longer fail behind some firewalls. Installs on main no longer fetch a release record that regional firewalls could answer with 403. The stable check uses your GitHub token when one is set (GITHUB_TOKEN or gh auth login) and reports a GitHub rate limit as a rate limit.

About this release

Measured at commit 1fd18277267152893a8a24792b79213e7ca3f899, the window since v0.21.6 contains 740 non-merge commits across 4,156 changed files (+86,775 / −26,980), 204 merged PRs and 69 closed issues.

Also in the window, undocumented here on purpose: plugins running built-in Desktop app actions (ctx.runAction) and a plugin SDK pet bubble (ctx.pet.say); core-made Codex requests so plugins never hold the token; skills installed mid-session reaching the model without a prompt rebuild; Krea 2 Medium Turbo as the default image lane for new paid subscribers, with a FAL fallback when managed Krea refuses a request; faster desktop updates (the React Compiler pass cached by content, the compiled renderer reused when only the install stamp changed, unchanged native inputs left in place); pinned installs that check out only the pin; compaction marks emitted to Relay; and new community plugins including memory-shield, command-ledger, Memoria, Model Router, wyoming-voice-bridge, codex-account-switch and redline.

Full curated release notes for this window ship with v0.22.0, which will document everything from v0.21.0 onward — highlights, feature areas, and complete contributor credits. Nothing in this window is skipped.

Updating

Desktop app: updates itself. Microsoft Store installs update through the Store.
CLI: hermes update, or re-run the installer one-liner.
Docker / Hermes Cloud: nousresearch/hermes-agent:stable (or :latest).

Full Changelog: v0.21.6...v0.21.7

TCP proxy over MQTT using a cheap ESP32 microcontroller

Thu, 01 Oct 2026 16:00:51 +0200

Full info and code : https://github.com/hack-tramp/ESP-MQTTunnel/ A working PoC that turns an ESP32 into a hardware proxy that tunnels traffic over MQTT. Because it connects to a MQTT broker, you can bypass firewalls/censorship without open ports/public IP (which would be needed for direct ESP32 - laptop comms). All traffic is relayed raw — no TLS... Weiterlesen

ModSecurity Vulnerabilities Let Attackers Bypass Web Application Firewall Protections

Thu, 01 Oct 2026 11:53:01 +0200

Multiple newly disclosed vulnerabilities in OWASP ModSecurity could let attackers bypass web application firewall protections by exploiting parsing differences, malformed input, transformation errors, and resource limits. The flaws affect functions commonly used to inspect HTTP requests and responses, raising concerns for organizations that rely... Weiterlesen

Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests

Thu, 01 Oct 2026 11:17:12 +0200

OWASP ModSecurity has disclosed multiple vulnerabilities that could let attackers bypass web application firewall rules, evade request and response inspection, or trigger denial-of-service conditions. Not all of the newly published advisories currently have CVE identifiers; the project has indicated that CVE requests have been submitted via GitHub... Weiterlesen

Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests

Thu, 01 Oct 2026 10:23:32 +0200

Sophos Firewall v23 is now in early access

Wed, 30 Sep 2026 16:40:55 +0200

Delivering over 30 of your top-requested features Weiterlesen

Stop SSH-ing into 50 Servers: Why We Rewrote Our Python Infra Tool in Go (And Open-Sourced It)

Wed, 30 Sep 2026 15:03:09 +0200

Hey folks. I work in infrastructure and infosec, and today I want to share the story behind an internal project we recently open-sourced: nkt (NetKnownsThat). TL;DR: It’s an all-in-one control plane for Linux hosts. It parses nginx/haproxy configs, manages certs, controls firewalls, handles Docker/Podman/LXD/K8s, and gives you a web terminal and... Weiterlesen

Why firewall migrations frighten the people who have done one

Tue, 29 Sep 2026 15:25:15 +0200

Why firewall migrations frighten the people who have done one Companies replace firewalls for ordinary reasons: the hardware reaches end of support, the vendor changes, a contract ends. Management takes the decision in a single meeting. What does not come up in that meeting: the old firewall carries a rule base — the list of rules about who may... Weiterlesen

983,992 Indexed FortiGate Instances: Reading an Edge-Appliance Count Against CVE-2025-25249

Tue, 29 Sep 2026 13:48:05 +0200

983,992 Indexed FortiGate Instances: Reading an Edge-Appliance Count Against CVE-2025-25249 Edge appliances are difficult to measure honestly, because exposure and importance are unrelated properties. A firewall with a pre-authentication packet-processing flaw and a firewall that has never been reachable from an untrusted network can appear in the... Weiterlesen

CVE-2016-20091 | Binisoft Windows Firewall Control 4.8.6.0 wfcs.exe unquoted search path (Exploit 40443 / EDB-40443)

Tue, 29 Sep 2026 13:15:40 +0200

A vulnerability has been found in Binisoft Windows Firewall Control 4.8.6.0 and classified as problematic. The affected element is an unknown function of the file wfcs.exe. The manipulation leads to unquoted search path. This vulnerability is traded as CVE-2016-20091. An attack has to be approached locally. Furthermore, there is an exploit... Weiterlesen

Nextcloud Talk TURN-Server einrichten: Schritt-für-Schritt-Anleitung

Tue, 29 Sep 2026 08:37:00 +0200

Ein eigener TURN-Server sorgt dafür, dass Nextcloud Talk auch hinter Firewalls, NAT und in restriktiven Netzwerken zuverlässig funktioniert. In dieser Schritt-für-Schritt-Anleitung erfahren Sie, welche Voraussetzungen Sie benötigen und ob sich ein VPS oder Dedicated Server für Ihren Einsatzzweck besser eignet. Weiterlesen

Cloudflare outage 2019: how one regex caused 27 minutes of 502s

Tue, 29 Sep 2026 06:10:10 +0200

On July 2, 2019, at 13:42 UTC, one new firewall rule went live on every Cloudflare server at once. It contained a regular expression that backtracked so hard it pushed every CPU core serving HTTP to 100 %, and for 27 minutes the sites behind Cloudflare returned 502 errors. The Cloudflare outage was not an attack; it was a regex, a missing CPU... Weiterlesen

Day 52: Undo Rolls Forward, and the Disk Already Mounted Is the One Not to Trust

Tue, 29 Sep 2026 00:15:51 +0200

Day 52 of DevOps, Day 2 of Azure. Both tasks today were about commands that do something a little different from what their names suggest. kubectl rollout undo sounds like a rewind. It is not one; it rolls forward to an old template. And az vm create sounds like it creates a VM. It does, along with a network, a firewall rule, a public address and... Weiterlesen

SemperVideo: Der lange Abend des Datenschutz (IoT Firewall Teil 1)

Mon, 28 Sep 2026 23:16:23 +0200

YouTube Video

Vielen Dank für Ihre Unterstützung:

http://SemperVideo.de/spende

Fragen und Antworten auf
https://twitch.tv/sempervideo

http://www.patreon.com/sempervideo?ty=c

https://amzn.to/37WtJq5

https://github.com/RPiList/specials

SemperVideo: Der lange Abend des Datenschutz (IoT Firewall Teil 1)

Mon, 28 Sep 2026 23:04:34 +0200

YouTube Video

ShinyHunters Exploits Oracle PeopleSoft Vulnerability CVE-2026-35273 in New Attack Wave

Mon, 28 Sep 2026 19:39:40 +0200

ShinyHunters has resumed large-scale attacks against Oracle PeopleSoft, using a small change to its exploit to get past some web application firewall (WAF) rules. Mandiant and Google Threat Intelligence Group (GTIG) say the group, tracked as UNC6240, has deployed web shells on dozens of systems worldwide. The latest targets span higher education,... Weiterlesen

ShinyHunters Bypasses WAF Protections to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

Mon, 28 Sep 2026 19:37:54 +0200

ShinyHunters has renewed attacks against Oracle PeopleSoft systems by slipping past web application firewall protections and planting web shells. The campaign shows how a small change in an attack request can reopen exposure that administrators believed had been contained. The activity targets CVE-2026-35273, a critical PeopleSoft flaw previously... Weiterlesen

The Breach that Never Touches your Network

Mon, 28 Sep 2026 19:19:08 +0200

Your firewall held. Your SOC stayed quiet. And a customer still lost money to a company that looked exactly like yours. Picture a Monday morning. A long-time customer calls your helpline, upset. Over the weekend she paid to “renew” her account on your website. It had your logo, your colours, your tone of voice. She even got a confirmation SMS.... Weiterlesen

Beyond the Box: Future-Proofing Branch Firewall Security for the AI Era

Mon, 28 Sep 2026 19:10:47 +0200

Discover how Cisco Secure Firewall 200 Series modernizes branch security with AI-powered threat detection, encrypted visibility, SD-WAN, and simpler management. Weiterlesen

ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

Mon, 28 Sep 2026 18:52:39 +0200

The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. [...] Weiterlesen

Absicherung von OT-Umgebungen

Mon, 28 Sep 2026 18:49:45 +0200

Um OT-Umgebungen besser abzusichern, haben Consistec und Ads-Tec eine strategische Partnerschaft geschlossen. Gemeinsam wollen sie eine Lösung für Betreiber kritischer Anlagen bereitstellen, die Angriffserkennung, Firewalling und sicheren Fernzugriff bündelt. (Bild: Ads-Tec / Consistec / bearbeitet mit Canva) Weiterlesen

I tested Microsoft’s secret tool that debloats Windows 11 and makes you a power user

Thu, 24 Sep 2026 17:19:24 +0200

If you’re a developer and you just got your new PC, setting up Windows is a nightmare that takes almost an hour, and even if you skip the updates in OOBE, you will still be bombarded with a number of upsells, all of which you must deny, and when you finally reach the desktop, you’ll still have to deal with a lot of bloatware and defaults, most of which you don’t ever need in your line of work.

And the next hour would be spent on a number of things like turning on Developer Mode, file extensions and hidden files, turning off Start recommendations, disabling Widgets, cleaning up Search, and then installing PowerShell 7, Git, VS Code, WSL, and a dozen other tools one by one.

Well, Microsoft has now automated this whole ritual. Windows Developer Config is Microsoft’s open-source project for turning a fresh Windows 11 install into a ready-to-code machine with a single command.

A fresh Windows 11 install after going through Windows Developer Conifg. Credit: Windows Latest

We previously covered Project Zenith, Microsoft’s developer-focused Windows setup coming to specially configured hardware needing 64GB of RAM. Windows Developer Config is the version anyone can run on an ordinary PC, no special hardware required.

I installed a fresh copy of Windows and tested Windows Developer Config. Here is what it changes in the OS, and what it does not tell you until you have already committed to it.

Fresh Windows 11 setup. Credit: Windows Latest

Windows Developer Config rebuilds a fresh Windows 11 install in one command

Microsoft calls this an “opinionated” developer workstation setup. It is idempotent, meaning every change is checked against the current state before running anything, so re-running it on a machine that already has these settings just confirms them instead of repeating work. The current build runs 50 individual steps across 11 phases, each structured as a check, an apply, and a second check.

The launch command is a single PowerShell one-liner. You don’t have to clone the repository, but make sure you have at least 15GB of free space.

How to install Windows Developer Config

To activate Windows Developer Config, open any PowerShell window. Microsoft says it doesn’t have to be elevated, but my PC showed an error, and it worked only when I ran PowerShell as administrator. Then paste the following command:

$url = ‘https://raw.githubusercontent.com/microsoft/WindowsDeveloperConfig/main/src/windows-dev-config/bootstrap.ps1’

& ([scriptblock]::Create((irm $url)))

Windows Developer Configuration command in PowerShell. Credit: Windows Latest

The command will then download the bootstrap script, request UAC elevation if needed, verify the Microsoft Corporation signature on every script it runs, copy everything into an administrator-protected folder under %ProgramData%\CalmOS, and start working (yes, I too find it funny that it’s called Calm OS).

Calm OS setup begins

Microsoft estimates 30 minutes on a clean machine with a decent connection, most of it downloading VS Code, the .NET SDK, PowerToys, and Ubuntu. My PC took the same amount of time.

All packages that are installed with Windows Developer Config. Credit: Windows Latest

Ten of the eleven phases run first: packages, system settings, Explorer, taskbar and search, Edge policy, fonts, Terminal, PowerShell profile, and GitHub Copilot.

All system settings that are changed by Windows Developer Config. Credit: Windows Latest

WSL and Ubuntu install last, since enabling WSL needs a Windows optional feature that requires a restart. A 10-second warning precedes the reboot, a scheduled task named WindowsDevConfigResume resumes the run about 30 seconds after you sign back in, and a second UAC prompt finishes the job. Unlike some Windows updates, you’ll only see your PC restart once.

Resuming Calm OS setup after reboot. Credit: Windows Latest

Every system setting Windows Developer Config changes

Before you get disappointed, I want to stress that this is not a Windows de-bloating tool that is popular online, nor is this a Windows AI removal tool, and we would recommend avoiding those as they are not officially supported by Microsoft.

The changes by Windows Developer Config are the small defaults every developer wishes Windows had. Things like Developer Mode, Windows Sudo in inline mode, Win32 long-path support, and Remote Desktop all get enabled system-wide.

Windows 11 after Windows Developer Configuration. Credit: Windows Latest

Microsoft groups all 24 registry changes into six categories across Phases 3 through 9, plus the package installs in Phase 2. Everything below follows that same order.

Phase 2/11: Packages

All 15 packages install through winget from the winget source, silently, with agreements pre-accepted. A package only counts as done once winget reports it both installed and current, which is why a re-run also catches available updates.

Windows Terminal – the modern terminal host, set as default later in Phase 8
PowerShell 7 – installed if missing; the whole setup relaunches itself on this once installed
Git – the version control client
GitHub CLI – the gh command-line tool
GitHub Copilot CLI – command-line Copilot access, later linked to a Terminal profile
Visual Studio Code – the code editor
.NET SDK 10 – the current .NET SDK
Python 3.14 – the current Python release
uv – the fast Python package and project manager
js LTS – installed alongside nvm for Windows in the same pass (see the note below)
nvm for Windows – a separate Node version manager, installed at the same time as Node.js LTS itself
Coreutils for Windows – GNU-style command line utilities
Oh My Posh – the prompt theming engine, wired into PowerShell in Phase 9
Windows App CLI – the Windows App Development CLI
PowerToys – Microsoft’s power-user utility suite

Phase 3/11: System settings

Windows Sudo is enabled in inline mode.
Developer Mode is switched on system-wide.
Win32 long-path support is enabled, removing the old 260-character path limit.
Remote Desktop connections are allowed. The Windows Firewall rule for RDP is not opened automatically, so this does not expose the machine to the network.

File Explorer shows file extensions and hidden files, displays the full path in the title bar, opens to This PC instead of Quick Access, and drops frequent folders, recent files, cloud recommendations, and sync-provider tips from the sidebar.

https://www.windowslatest.com/wp-content/uploads/2026/09/File-Explorer-changes-in-Windows-Developer-Config.mp4

On the taskbar and Start side, End Task gets added to the right-click menu, web results and search highlights disappear, Start recommendations turn off, Widgets gets disabled through the OS policy value (the per-user toggle no longer works on 24H2 and later), and PowerToys stops sending always-on-top toasts.

End task button added automatically. Credit: Windows Latest

Cleaner Search and No Widgets. Credit: Windows Latest

Do Not Disturb goes on globally. Edge gets a blank new tab page, and its first-run experience is suppressed. These steps aren’t removing any Windows component. They suppress defaults that exist to sell or show you something.

Edge opens to a cleaner tab with no MSN. Credit: Windows Latest

Dark mode switches on for both apps and the system, Windows Terminal gets PowerShell 7 as its default profile and Cascadia Mono Nerd Font as its default face, and Oh My Posh initializes straight from your PowerShell profile. Microsoft pins a specific Cascadia Code release, 2407.24, verified against a known SHA-256 hash before installing it system-wide, instead of pulling whatever the newest release is.

Oh My Posh and other additions

It installs almost everything a developer needs

The package list is not small: Windows Terminal, PowerShell 7, Git, GitHub CLI, GitHub Copilot CLI, VS Code, .NET SDK 10, Python 3.14 with uv, Node.js LTS, nvm for Windows, Coreutils for Windows, Windows App CLI, Oh My Posh, and PowerToys, all through winget. A package only counts as done once winget reports it installed and current, so a re-run also catches available updates.

https://www.windowslatest.com/wp-content/uploads/2026/09/Everything-Windows-Developer-Config-changed.mp4

Note that the base configuration installs both Node.js LTS and nvm for Windows in the same pass. Those are two different ways of managing Node, and Microsoft recommends you uninstall the direct Node.js install if you want nvm to own your PATH.

GitHub issue #55, filed June 3, 2026, documents this conflict between the main configuration installing nvm4w and the TypeScript workload installing Node.js LTS. So, decide which manager you want before both show up on the same machine.

The configuration also reaches into two developer-specific extras. It can add WinUI templates for dotnet new, and register Microsoft’s Windows Development Skills and WinUI plugin with GitHub Copilot CLI, which is part the native code push that lets Copilot scaffold a native WinUI app in about 30 minutes without Visual Studio.

Then it hands you Linux, a shell overhaul, and eleven language toolchains

Windows Dev Config installs the WSL platform and Ubuntu as its final phase, but Microsoft mentions that the base configuration does not touch anything inside Ubuntu, which is a job that belongs to a separate tool in the same repository called WSL Comfort.

Windows Dev Config gets you the workstation, the tools, and a working WSL plus Ubuntu. What WSL Comfort does is make that Ubuntu environment feel like a proper developer shell instead of a bare distro. I’m definitely understating the addition of Linux components here. Microsoft is well aware of how developers reject Windows to go for Linux or macOS.

https://www.windowslatest.com/wp-content/uploads/2026/09/Windows-Developer-Configurations.mp4

WSL Comfort runs interactively by default and lets you pick pieces: zsh or bash, an optional Starship prompt, modern CLI tools including fzf, ripgrep, fd, bat, eza, zoxide, and jq, optional clipboard shims, optional Homebrew, sensible Git defaults, and a themed Terminal profile with the same Cascadia Code Nerd Font.

It also runs unattended with -NonInteractive and a smaller –minimal mode, which is part of the good direction in WSL Containers that can replace Docker Desktop, and now has faster file access and networking.

Interestingly, Canonical has said that Ubuntu usage through WSL now grows faster than native Ubuntu desktop installs, which makes this repository a contributor.

For anyone who wants just one language, the repository also ships eleven standalone workloads, each a configuration.winget file with a matching install script that refreshes PATH afterward.

TypeScript installs Node.js LTS plus global typescript.
PHP installs 8.5.
.NET installs SDK 10.
Go installs the current rolling release.
Java installs the Microsoft Build of OpenJDK 25 LTS.
Rust installs stable via rustup.
Python installs 3.14 with uv.
SQL installs a lightweight SQL Server setup with sqlcmd and the VS Code extension.
PowerShell installs 7 with VS Code tooling.
WinForms installs .NET plus the Windows Forms workload.
WinUI 3 installs .NET, Visual Studio Community, and the Windows App SDK together.

Note that WinForms and WinUI 3 both pull down several gigabytes of Visual Studio components.

Although it looks like Redmond is forcing some predetermined defaults, it is not trying to get every developer onto the same setup. The company is building a shelf of reproducible starting points.

A PowerToys Command Palette extension is also coming, reading the same flow list so every workload becomes a launchable entry instead of a file path to remember, though it lives under src/future/cmdpal today and is not shipped yet.

PowerToys extensions in File Explorer Context Menu. Credit: Windows Latest

Since Windows Developer Config is, in fact, for software development, some configurations may not be ideal for daily use. It enables Remote Desktop system-wide, though the firewall rule stays closed. It writes two Edge settings as policy, so Edge shows “managed by your organization.”

Global Do Not Disturb silences every app’s notifications, at all times. Windows Terminal’s settings.json gets round-tripped through JSON, so any comments you had are gone, though Microsoft writes a .bak copy first.

As for the command, there is no automatic uninstall, no runtime screen to pick pieces, and no dry-run mode.

About the debloating part, it does remove MSN, Widgets, and a few other upsells as well. But the interesting part is that while installing Windows, it shows a page to customize Windows where you can choose Development, Entertainment, Gaming, and more. I do hope that, in the future, choosing Development alone would bring the same changes that Windows Developer Config brought.

Customization options during Windows setup. Credit: Windows Latest

Windows Developer Config is not another script that deletes a couple of preinstalled apps and flips a few registry keys. This is Microsoft finally writing down, in public, what developers have been doing to Windows by hand for years.

The post I tested Microsoft’s secret tool that debloats Windows 11 and makes you a power user appeared first on Windows Latest

De-Google Your Digital Life: The Self-Hosted Linux Guide

Thu, 24 Sep 2026 17:13:14 +0200

Learn how to replace Google and Microsoft services with a complete self-hosted Linux stack using Nextcloud, Vaultwarden, Syncthing, and ONLYOFFICE. This hands-on guide walks through Docker deployment across Ubuntu, Fedora, and Arch, plus data migration from Google Drive and OneDrive, security hardening with HTTPS and firewalls, and automated... Weiterlesen

Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616

Thu, 24 Sep 2026 17:07:36 +0200

As part of Check Point’s Frontier AI Readiness Program, we continue to release Jumbo hotfixes with security fixes and hardening improvements for our Firewall and Management products. This advisory addresses the active exploitation described below, and the immediate steps customers should take to protect affected systems. Check Point Research has... Weiterlesen

CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch

Thu, 24 Sep 2026 17:06:44 +0200

Yesterday we wrote up CVE-2026-87902, the unauthenticated local file inclusion in WordPress page template resolution fixed in 7.1.2. That post covered the sink, the preconditions and the fix. This is the follow-up on what we are seeing hit our firewall. Update, 23 September 2026: when this post first went up, every request we had seen was... Weiterlesen

I found a firewall GUI for KDE Plasma that’s way better than the default – and it’s free

Thu, 24 Sep 2026 16:45:16 +0200

If you use KDE Plasma on Fedora, you should consider switching to this firewall GUI, especially if you’re new to Linux. Weiterlesen

SASE Converges Network & Security Into One Cloud Solution

Thu, 24 Sep 2026 15:07:02 +0200

Enterprise computing is moving to the edge. Keeping it secure requires tactics far beyond putting up firewalls. Weiterlesen

[NEU] [hoch] Forcepoint Next Generation Firewall: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Thu, 24 Sep 2026 13:25:42 +0200

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Forcepoint Next Generation Firewall ausnutzen, um Sicherheitsvorkehrungen zu umgehen. Weiterlesen

Check Point gehackt – das ist jetzt zu tun

Thu, 24 Sep 2026 12:54:34 +0200

Die Sicherheitslücken in der Software von Check Point verdeutlichen, dass Security Software selbst zunehmend als attraktives Angriffsziel wahrgenommen wird. Teo K | shutterstock.com Eine Firewall soll eigentlich eine Barriere zwischen Angreifern und Unternehmensnetzwerken bilden – kann jedoch auch selbst zum Tool für Angreifer werden. So warnt der... Weiterlesen

IT Security News Hourly Summary 2026-09-24 08h : 5 posts

Thu, 24 Sep 2026 08:08:48 +0200

5 posts published in the last hour 05:31Fake Firefox Extension Hijacks Google Accounts Without Stealing Passwords First 05:31What to do first when you get 90 days to secure AI agent data 05:02Your security program knows about the firewall, but does it know about the elevator? 05:01Ubuntu kernel CVE fixes are moving to a weekly release schedule... Weiterlesen

Your security program knows about the firewall, but does it know about the elevator?

Thu, 24 Sep 2026 06:36:16 +0200

By early August, attackers had hit water systems in at least seven U.S. states. The FBI and EPA said the intruders remotely accessed internet-facing programmable logic controllers, the small industrial computers that run pumps and valves. Operators lost monitoring or control, and in some cases water operations degraded. Federal investigators are... Weiterlesen

Check Point hacked: The security software protecting your network has become a prime attack target

Thu, 24 Sep 2026 04:08:06 +0200

A firewall is supposed to be the barrier between attackers and the enterprise network, but that barrier can itself become a threat actors’ tool. Check Point has revealed that attackers are actively exploiting two vulnerabilities in its Security Gateway and Security Management products. The security software provider has warned that attackers are... Weiterlesen

UniFi Gateways und Firewalls: Ubiquiti schließt DoS-Lücken

Wed, 23 Sep 2026 14:33:08 +0200

In UniFi-Firewalls und -Gateways klaffen hochriskante Denial-of-Service-Lücken. Aktualisierte Firmware stopft die Lecks. Weiterlesen

Hub-and-spoke Azure networking checklist (DNS, routing, NSGs, firewalls)

Wed, 23 Sep 2026 14:07:39 +0200

Hub-and-spoke is one of the most common Azure networking patterns and one of the easiest to get “mostly right” while still shipping a design that breaks under real traffic, real DNS needs, and real security requirements. This guide is a practical checklist you can use to validate (or design) a hub-and-spoke network in Azure, with the failure... Weiterlesen

IT Security News Hourly Summary 2026-09-23 13h : 8 posts

Wed, 23 Sep 2026 13:59:59 +0200

8 posts published in the last hour 10:32ShinyHunters Claims FBI Hack Via PeopleSoft Zero Day 10:31Outerlimit Raises $16 Million to Stop Rogue AI Agents From Causing Harm 10:31Microsoft Warns of EvilTokens AI Phishing Service Hijacking Thousands of Accounts 10:31Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM... Weiterlesen

Ubiquiti schließt Denial-of-Service-Lücken in Firewalls und Gateways

Wed, 23 Sep 2026 13:59:03 +0200

In UniFi-Firewalls und -Gateways klaffen hochriskante Denial-of-Service-Lücken. Aktualisierte Firmware stopft die Lecks. Weiterlesen

How I Bypassed Campus Firewall Port Blocks for Low-Ping Gaming Without a Laggy VPN

Tue, 22 Sep 2026 23:21:17 +0200

Every student who lives in a university hostel or works behind an enterprise firewall knows the exact nightmare: you connect to the campus Wi-Fi, fire up Valorant or Counter-Strike 2, and hit an immediate wall. Either the client refuses to authenticate, your in-game microphone (Vivox) completely fails to connect, or the game won't find a server at... Weiterlesen

Security Weekly - A CRA Resource: Patch Less, Mitigate More

Tue, 22 Sep 2026 21:55:51 +0200

YouTube Video

A large vulnerability count does not automatically mean every vulnerability deserves the same response. The discussion argues for prioritizing vulnerabilities that are actually being exploited and applying compensating controls where appropriate.

That can mean using firewall, identity, or other controls while root-cause fixes are developed. The approach shifts the focus from patch volume to overall enterprise risk.

How should security teams balance root-cause remediation with broader risk mitigation when the number of vulnerabilities exceeds what an organization can realistically patch?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#AppSec #RiskManagement #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec

AI Firewall vs. Traditional NGFW: What's Actually Different?

Tue, 22 Sep 2026 18:38:51 +0200

If you look at most blogs about AI firewalls, they all say the same thing: “uses AI, more intelligent, next-gen.” That sounds appealing, but it doesn't help you decide what to buy or deploy. Weiterlesen

[UPDATE] [hoch] Cisco Secure Firewall Management Center: Mehrere Schwachstellen

Tue, 22 Sep 2026 10:25:18 +0200

Ein Angreifer kann mehrere Schwachstellen in Cisco Secure Firewall Management Center ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebige Befehle als Root auszuführen, Berechtigungen auf Root zu erweitern, SQL-Injection durchzuführen, Anmeldedaten für Administratorsitzungen zu erlangen, sensible Daten zu manipulieren und offenzulegen oder... Weiterlesen

NIS2: Die Tür als erste Verteidigungslinie

Tue, 22 Sep 2026 09:04:57 +0200

Im Zuge von NIS2 rücken auch physische Zutrittskontrolle zu Serverräumen und Rechenzentren in den Fokus. Wie können IT und Corporate Security dabei enger zusammenwachsen? Das allgegenwärtige Thema NIS2 rückt häufig Firewalls, Netzwerksicherheit, Software-Updates und den Schutz vor digitalen Angriffen in den Mittelpunkt des Geschehens. Jedoch... Weiterlesen

The same drift bug that breaks your Terraform state also breaks your login form

Mon, 21 Sep 2026 17:05:16 +0200

What infrastructure drift, frontend validation, and shared engineering patterns have in common. Somewhere in your infrastructure right now, a resource doesn't match what your Terraform state file claims. I'd put money on it. Maybe it's a firewall rule someone added through the portal during an incident at 2 a.m. and never ticketed. Maybe it's a... Weiterlesen

Fastly gives enterprises real-time control over AI models and agents

Mon, 21 Sep 2026 15:29:09 +0200

Fastly has announced AI Runtime Control, AI Firewall, and new API Security capabilities designed to give organizations real-time visibility and control across their AI systems. Expanding the Fastly for AI portfolio, these new capabilities help organizations govern AI model access and usage, protect the AI applications powering their business, and... Weiterlesen

Managed Security Services: Remote Work 2.0 mit fachkundiger Unterstützung - it-daily.net

Mon, 21 Sep 2026 12:24:34 +0200

Hier spielt SASE als Sicherheitskonzept, das Funktionen wie „Firewall as a Service“, „Secure Web Gateway“ sowie DNS-Sicherheit und Zero Trust ... Weiterlesen

VMware has quietly walked back its SmartNIC ambitions

Mon, 21 Sep 2026 10:19:53 +0200

VMware has quietly stopped selling firewalls for SmartNICs. SmartNICs, aka data processing units (DPUs), are network cards that include a modest processor. Hyperscale clouds routinely use the devices to handle security and networking chores, by running network functions as VMs on the SmartNIC’s processor. Cloud operators like SmartNICs because... Weiterlesen

VMware has quietly walked its SmartNIC ambitions

Mon, 21 Sep 2026 09:20:12 +0200

How to choose a used FortiGate firewall (without getting burned)

Mon, 21 Sep 2026 02:42:05 +0200

Used enterprise firewalls are one of the best deals in homelab and small-office hardware. A FortiGate 100F that retailed for €4,000 can be had for €400–600 on the secondary market. But unlike a used switch or server, a firewall has pitfalls specific to the platform that can turn a bargain into a headache. This guide focuses on FortiGate because... Weiterlesen

What breaks when you self-host a TURN server (coturn — symptom, cause, fix)

Sun, 20 Sep 2026 05:58:21 +0200

The first article in this series was the traps inside the code. The second was the layer underneath — the candidates that lie, the UDP firewall nobody looks at, the reverse proxy that reaps an idle socket. This one is about the piece people reach for when those two are not enough: the relay. TURN is the part of WebRTC that gets configured last, in... Weiterlesen

bunkerweb v1.6.15-rc3

Sat, 19 Sep 2026 10:37:11 +0200

🛡️ Open-source and cloud-native Web Application Firewall (WAF) Weiterlesen

Building GeneSign: Synthetic DNA Watermarking and Biosecurity Firewall with NVIDIA Nemotron

Sat, 19 Sep 2026 05:08:13 +0200

Biosecurity verification in synthetic biology is often treated as an afterthought. With modern DNA synthesis pipelines accelerating worldwide, validating genetic sequence provenance and detecting hazardous biological threats in real-time is critical[cite: 13, 14]. To solve this, I built GeneSign — a zero-drift wobble codon DNA watermarking... Weiterlesen

The Cisco FMC Authentication Bypass Shows Why Management Planes Are the Real Perimeter

Sat, 19 Sep 2026 02:53:07 +0200

The Cisco FMC Authentication Bypass Shows Why Management Planes Are the Real Perimeter Cisco Secure Firewall Management Center (FMC) is the console that pushes policy to every managed firewall in a large network. When an authentication bypass there reaches root, the blast radius is not one device. It is every device the console controls. That is... Weiterlesen

CVE-2026-20344 | Cisco Secure Firewall Management Center up to 10.0.1 Web-based Management Interface sql injection (EUVD-2026-81129)

Fri, 18 Sep 2026 09:09:53 +0200

A vulnerability has been found in Cisco Secure Firewall Management Center and classified as problematic. This affects an unknown function of the component Web-based Management Interface. Performing a manipulation results in sql injection. This vulnerability is reported as CVE-2026-20344. The attack is possible to be carried out remotely. No... Weiterlesen

CVE-2026-20336 | Cisco Secure Adaptive Security Appliance Software resource control (EUVD-2026-81119)

Fri, 18 Sep 2026 09:09:53 +0200

A vulnerability, which was classified as very critical, was found in Cisco Secure Adaptive Security Appliance Software, Secure Firewall Management Center and Secure Firewall Threat Defense Software. This issue affects some unknown processing. The manipulation results in improper control of resource through lifetime. This vulnerability is reported... Weiterlesen

CVE-2026-20340 | Cisco Secure Firewall Management Center up to 10.0.1 deserialization (EUVD-2026-81116)

Fri, 18 Sep 2026 09:09:53 +0200

A vulnerability marked as very critical has been reported in Cisco Secure Firewall Management Center. Affected is an unknown function. This manipulation causes deserialization. This vulnerability is tracked as CVE-2026-20340. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component. Weiterlesen

Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root

Fri, 18 Sep 2026 05:49:11 +0200

A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy and administrator access. Check Point has released a fix through its LivePatch update... Weiterlesen

Linux Firewall and Security Quiz: Test Your ufw, iptables and nftables Knowledge

Fri, 18 Sep 2026 05:46:43 +0200

Test your Linux firewall knowledge with 15 questions covering ufw, iptables, nftables, firewalld zones, and netfilter concepts from beginner to expert level. Weiterlesen

Web Application Firewall Rule Bypass in Jetpack WAF Runtime

Thu, 17 Sep 2026 23:16:22 +0200

Jetpack's bundled Web Application Firewall did not clear its cached MATCHED_VAR/MATCHED_VARS metadata between rule evaluations, so a rule referencing those targets kept receiving a previous rule's stale match data. A remote attacker could craft a request that makes later firewall rules evaluate the wrong content, masking malicious input and... Weiterlesen

Cisco schließt über 20 Sicherheitslücken – kritische Firewall-Lücke wird bereits aktiv angegriffen

Thu, 17 Sep 2026 20:10:36 +0200

All About Security Das Online-Magazin zu Cybersecurity (Cybersicherheit). ... Featured image for “Patch-Apokalypse: Wenn IT-Teams den Angreifern ... Weiterlesen

Salt Security expands CrowdStrike integration to tackle AI agent security

Thu, 17 Sep 2026 15:00:14 +0200

Salt Security has expanded its integration with CrowdStrike to give security teams greater visibility into how AI agents connect to enterprise systems, use APIs and exercise their permissions. The expanded partnership brings together Salt’s Agentic API platform with CrowdStrike Falcon Foundry, Falcon Next-Gen SIEM and Falcon Firewall Management.... Weiterlesen

[NEU] [hoch] Cisco Secure FTD und ASA: Mehrere Schwachstellen

Thu, 17 Sep 2026 13:28:29 +0200

Ein Angreifer kann mehrere Schwachstellen in Cisco Secure Firewall Threat Defense und Cisco ASA (Adaptive Security Appliance) ausnutzen, um erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen oder Denial-of-Service-Zustände herbeizuführen. Weiterlesen

[NEU] [hoch] Cisco Secure Firewall Threat Defense: Mehrere Schwachstellen

Thu, 17 Sep 2026 13:28:28 +0200

Ein Angreifer kann mehrere Schwachstellen in Cisco Secure Firewall Threat Defense ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um seine Privilegien zu erhöhen. Weiterlesen

Jetzt patchen! Angreifer knipsen Firewalls von Cisco aus

Thu, 17 Sep 2026 10:22:32 +0200

Der Netzwerkausrüster Cisco hat zahlreiche Sicherheitslücken in seinen Produkten geschlossen. Es laufen bereits Attacken. Weiterlesen

Jetzt patchen! Angreifer knipsen Firewalls von Cisco aus

Thu, 17 Sep 2026 10:21:37 +0200

Der Netzwerkausrüster Cisco hat zahlreiche Sicherheitslücken in seinen Produkten geschlossen. Es laufen bereits Attacken. Weiterlesen

Kontrolle, Transparenz, Souveränität - it-daily.net

Thu, 17 Sep 2026 06:38:46 +0200

Gerade Firewalls, VPNs und Lösungen für kritische Infrastrukturen sitzen an besonders sensiblen Stellen. Deshalb gehören für uns zur Cybersicherheit ... Weiterlesen

CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance Software Remote Access SSL VPN service denial of service

Thu, 17 Sep 2026 05:41:34 +0200

A vulnerability was found in Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software and classified as critical. Affected by this issue is some unknown functionality of the component Remote Access SSL VPN service. The manipulation results in denial of service. This vulnerability is cataloged as... Weiterlesen

CVE-2026-20316 | Cisco Secure Firewall Management Center up to 10.0.1 Web Interface information disclosure (EUVD-2026-50404)

Thu, 17 Sep 2026 03:40:51 +0200

A vulnerability was found in Cisco Secure Firewall Management Center. It has been classified as problematic. Affected is an unknown function of the component Web Interface. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2026-20316. The attack is possible to be carried out remotely. Moreover, an... Weiterlesen

ZDI-26-709: Cisco Secure Firewall Management Center CommandSinkRmi Deserialization of Untrusted Data Remote Code Execution Vulnerability

Thu, 17 Sep 2026 02:16:02 +0200

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Secure Firewall Management Center. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-20242. Weiterlesen

easywall v2.20.1

Thu, 17 Sep 2026 02:05:40 +0200

Web interface for the nftables firewall on Linux, written in Go. The apply undoes itself after 120 seconds unless you confirm it — you cannot lock yourself out. Debian & Docker install. Weiterlesen

[NEU] [mittel] Red Hat Enterprise Linux (firewalld, leapp-repository, tesseract: Mehrere Schwachstellen

Wed, 16 Sep 2026 15:15:43 +0200

Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Code auszuführen, einschließlich der Ausführung von Code mit Root-Rechten, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen. Weiterlesen

Data-Shield_IPv4_Blocklist

Wed, 16 Sep 2026 15:10:06 +0200

Data-Shield IPv4 Blocklist Community provides an official, curated registry of IPv4 addresses identified as malicious. Updated continuously, this resource offers vital threat intelligence to bolster your Firewall and WAF instances,... Weiterlesen

Security-Insider: Zero Trust Vereinfacht Cloud Systeme und Abhängigkeiten

Wed, 16 Sep 2026 09:31:54 +0200

YouTube Video

Cloud‑Migrationen scheitern oft nicht an der Cloud – sondern an vergessenen Firewall‑Ports, fehlenden Freigaben und komplexen Abhängigkeiten.

Christoph Schuhwerk beschreibt im Podcast, wie Zero Trust diese Probleme bei Cutovers in seiner damaligen Umgebung vereinfachte. Statt Verbindungen primär über Netzwerkstandort und Firewall‑Regeln zu organisieren, meldet ein Connector die Anwendung. Ob sie in AWS, Azure oder im eigenen Rechenzentrum läuft, spielt dann für den Verbindungsaufbau keine zentrale Rolle.

Für Schuhwerk war das eine enorme Erleichterung bei der Migration großer Systeme in die Cloud.

#ZeroTrust #CloudMigration #CloudSecurity #CyberSecurity #AWS #Azure #ITSecurity #SecurityInsiderPodcast

Cisco-FMC-Sicherheitslücke ermöglicht Root-Zugriff ohne Anmeldung

Wed, 16 Sep 2026 08:06:18 +0200

Eine aktiv ausgenutzte Schwachstelle in Cisco Secure Firewall Management Center ermöglicht Angreifern die Umgehung der Anmeldung und Root-Zugriff. Cisco hat Hot Fixes veröffentlicht, die eine bestehende Kompromittierung jedoch nicht beseitigen. (Bild: Gemini / Vogel IT-Medien GmbH / KI-generiert) Weiterlesen

Black Hills Information Security: AI Wire Cutters Make the Best AI Firewall

Wed, 16 Sep 2026 03:00:55 +0200

YouTube Video

🔗 Register for this FREE Infosec webcast and more! –
https://poweredbybhis.com

What Black Hills Information Security does to protect our operational offensive AI environment.

For this free, one-hour webcast, I’ll be joined by Derek Banks, Principal AI Research Scientist at Black Hills Information Security, to talk about how BHIS protects our customers—and ourselves—while using offensive AI for security assessments.

This is a conversation we need to have now. We’re already seeing AI agents break containment and do very bad things, followed by everyone acting horribly surprised.

And to be blunt, I’m surprised that they’re surprised.

We’ll show you what BHIS is actually doing: monitoring AI activity, enforcing restrictions, defining scope, setting clear objectives, and building controls around our AI penetration testing environment. And yes, there will probably be a rant—and possibly some AI wire cutters.

More importantly, we’ll share what we’ve learned about keeping offensive AI restricted, monitored, scoped, and still useful. We also want to hear what others are trying and which controls are working.

Somebody has to start sharing how we secure this stuff.

This webcast is a first step.

John Strand

freeCodeCamp.org: How to Deploy, Secure, and Automate Full-Stack Web Apps – Course for Beginners

Tue, 15 Sep 2026 15:35:03 +0200

YouTube Video

Learn how to take a web application from local development to a secure, live production environment. You will learn how to manually configure an Ubuntu server, set up essential runtimes, establish automated CI/CD pipelines, and secure your site using HTTPS and Cloudflare. By tackling everything hands-on before introducing automation, you will gain a deep, foundational understanding of full-stack deployment and how to reliably host complex systems.

⭐️ Links and resources ⭐️
Course handbook and documentation: https://github.com/ImadSaddik/FullStackDeploymentHandbook
Project source code: https://github.com/ImadSaddik/ImadSaddikWebsite
DigitalOcean ($200 free credit): https://m.do.co/c/4f9010fc5eb3
SSH config documentation: https://www.ssh.com/academy/ssh/config
Porkbun domain registrar: https://porkbun.com/
Let's Encrypt: https://letsencrypt.org/
Certbot: https://certbot.eff.org/
Cloudflare: https://www.cloudflare.com/
Nmap network scanner: https://nmap.org/
Pre-commit framework: https://github.com/pre-commit/pre-commit
Pipx: https://github.com/pypa/pipx
GitHub Actions documentation: https://docs.github.com/en/actions
Meilisearch UI dashboard: https://github.com/eyeix/meilisearch-ui
GoAccess log analyzer: https://goaccess.io/
Btop resource monitor: https://github.com/aristocratos/btop
Locust load testing framework: https://docs.locust.io/
NCDU disk usage analyzer: https://dev.yorhel.nl/ncdu/man
OWASP ZAP scanner: https://www.zaproxy.org/
Crontab Guru: https://crontab.guru/
Mozilla HTTP Observatory: https://observatory.mozilla.org/
Security Headers audit: https://securityheaders.com/
Nginx Playground: https://nginx-playground.wizardzines.com/

To connect with Imad Saddik, check out his social accounts:
LinkedIn: https://www.linkedin.com/in/imadsaddik/
YouTube: https://www.youtube.com/channel/UC1VK2jL-sTIBUK2riD0DkKw

❤️ Support for this channel comes from our friends at Scrimba – the coding platform that's reinvented interactive learning: https://scrimba.com/freecodecamp
Links mentioned in the course:

⭐️ Contents ⭐️
- 0:00:00 Introduction
- 0:01:50 Problem statement & philosophy
- 0:06:23 Module overview & roadmap
- 0:16:25 Repo & handbook resources
- 0:17:21 Module 1: Foundation
- 0:20:30 Droplet provisioning
- 0:25:33 SSH keys & ED25519 generation
- 0:35:15 First login & package updates
- 0:40:05 Sudo users & disable root login
- 0:49:56 SSH configs & client shortcuts
- 0:57:00 UFW firewall lockdown
- 1:07:59 Fail2ban defense setup
- 1:14:24 DigitalOcean recovery console
- 1:19:28 Module 2: Application runtime
- 1:21:40 SCP code transfer & permissions
- 1:27:48 Python virtualenv & FastAPI
- 1:34:14 Node.js, NVM & pnpm setup
- 1:38:16 Fix OOM errors with swap memory
- 1:46:53 Local tests via SSH tunneling
- 1:52:01 Gunicorn & Uvicorn workers
- 2:00:46 Supervisord process monitoring
- 2:06:01 Memory & zombie processes via Btop
- 2:21:08 Sync URLs with Vite proxy
- 2:31:58 Nginx reverse proxy installation
- 2:50:28 Fix 502 Gateway & permissions
- 3:01:55 Security headers & CSP
- 3:23:20 Module 3: Data & search
- 3:26:51 Self-host Meilisearch on Ubuntu
- 3:28:30 Standard vs system users
- 3:34:26 DB dumps, snapshots & migration
- 3:41:40 Secure keys & systemd service
- 3:51:55 Seed search & connect FastAPI
- 4:05:40 Automate daily snapshots
- 4:08:45 Meilisearch UI dashboard
- 4:16:52 Module 4: Global delivery
- 4:19:00 Custom domain registration
- 4:23:43 Configure DNS A & CNAME records
- 4:29:07 SSL via Let's Encrypt & Certbot
- 4:36:50 Automate 90-day SSL renewals
- 4:42:09 Cloudflare CDN edge caching
- 4:59:47 Restore real visitor IPs in Nginx
- 5:14:37 Eliminate SPA soft 404 traps
- 5:23:48 Port scanning with Nmap
- 5:29:37 Module 5: Automation pipeline
- 5:34:11 GitHub Rulesets branch protection
- 5:39:14 Local hygiene via pre-commit
- 5:57:31 Modular GitHub Actions CI
- 6:30:07 Software Composition Analysis
- 7:03:15 SAST scanning with Bandit
- 7:13:40 Live Meilisearch integration testing
- 7:26:55 E2E testing via Playwright
- 7:41:48 DAST scanning with OWASP ZAP
- 8:00:43 Frontend build & artifact generation
- 8:03:34 Automated backup & cleanup scripts
- 8:07:28 Passwordless visudo configuration
- 8:11:05 Secrets & manual deployment reviews
- 8:41:35 Sync production files via rsync
- 8:46:26 Dynamic env file generation
- 8:50:26 Atomic venv swap & rollbacks
- 8:58:56 Rolling restarts (Supervisor/Nginx)
- 9:09:23 Module 6: Optimization & maintenance
- 9:10:22 Parsing Nginx logs via GoAccess
- 9:14:58 Password-protected analytics dashboard
- 9:20:51 Solving CSP restrictions via nonces
- 9:29:57 Aggregating compressed logs via zgrep
- 9:33:05 Hourly automated dashboard updates
- 9:34:21 Real-time server monitoring via Btop
- 9:42:26 Block malicious bots with UFW
- 9:50:30 Load testing & latency via Locust
- 10:05:38 Disk usage analysis via NCDU
- 10:08:14 JournalD & Nginx log retention
- 10:10:40 Monthly cron maintenance scripts
- 10:14:10 Scheduled deep DAST scanning
- 10:25:19 Conclusion

Netzwerksegmentierung mit VLANs und Open Source

Tue, 15 Sep 2026 12:42:22 +0200

In mittelständischen Unternehmen ist Netzwerksegmentierung ein wichtiger Faktor. VLANs zerlegen ein Netzwerk in Segmente, um sensible Systeme zu isolieren und internen Datenverkehr gezielt zu kontrollieren. Mit einer Firewall wie OPNsense oder dem Windows-Server-Dienst RRAS lässt sich diese Trennung umsetzen, was Sicherheit und Übersicht erhöht.... Weiterlesen

Little Snitch unter macOS 27: Netzwerkwächter braucht dringendes Update

Tue, 15 Sep 2026 12:40:03 +0200

Die Macher der beliebten Outbound-Firewall warnen: Little Snitch blockiert ohne Update Verbindungen in macOS 27. Daher sollte man dringend vorab tätig werden. Weiterlesen

MESH v0.2.0-beta

Tue, 15 Sep 2026 11:36:20 +0200

Encrypted peer-to-peer mesh VPN for remote mobile forensics, enabling wireless ADB and libimobiledevice acquisition, network monitoring, and intrusion detection across NAT and firewalls. Weiterlesen

Multiple Vulnerabilities in Mikrotik Routers Could Allow for Admin Hijacking

Mon, 14 Sep 2026 23:44:59 +0200

Multiple vulnerabilities have been discovered in MikroTik Routers, the most severe of which could allow for admin hijacking. MikroTik routers are network devices that use the RouterOS operating system to provide advanced routing, firewall, wireless, VPN, bandwidth management, and network security features for homes, businesses, and internet... Weiterlesen

A Firewall for AI Agents: Enforce Authority at Every Tool Call

Mon, 14 Sep 2026 23:42:46 +0200

The right firewall for an AI agent goes between the model and every tool that can cause a side effect. Not a prompt filter, an action firewall. An AI agent is a model-driven program that chooses and calls external tools. Once it can send email, update a ticket, run code, query a database, or approve a payment, a wrong answer stops being just text... Weiterlesen

Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning

Mon, 14 Sep 2026 19:45:06 +0200

Cyclops Blink has returned in a form that gives attackers a deeper view inside corporate networks. The malware was found on compromised Cisco Firewall Management Center devices, where it can maintain remote access, inspect traffic, and map systems behind the network edge. The activity is concerning because management appliances occupy trusted... Weiterlesen

Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities

Mon, 14 Sep 2026 12:13:37 +0200

A newly identified Cyclops Blink variant has resurfaced on compromised Cisco Secure Firewall Management Center (FMC) appliances, adding active internal-network scanning and programmable packet-sniffing capabilities to an already mature modular implant. Assessed with high confidence that the activity has a Russian nexus, with a moderate-confidence... Weiterlesen

Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities

Mon, 14 Sep 2026 11:39:02 +0200