What has changed?

'Djinn' Stealer Targets Cloud, AI Credentials

The campaign demonstrates that attackers leverage RMM tools as entry points to steal cloud and AI credentials using admin privileges, enabling broad network compromise.

CVE-2026-58281: Deserialization of Untrusted Data in Microsoft Edge Allows Remote Code Execution

A critical deserialization vulnerability in Microsoft Edge allows unauthenticated remote code execution, requiring immediate patch prioritization across all Edge installations.

Iran, Russia, China Target Water Systems for Sabotage

State-sponsored APT groups exploit simple attack vectors such as weak passwords and lack of network segmentation rather than sophisticated malware,an operational concern for European manufacturing facilities with similar OT configurations.

Comment: The BSI must not become the BND's zero-day supplier

The draft intelligence service law reform could force the BSI to hand over zero-day vulnerabilities to the BND,a step that could endanger the cybersecurity of German organisations if flaws are not promptly disclosed to vendors.

Espionage Operation: NATO Transport Routes Surveilled Using Hacked Cameras

Russia is using compromised private IP cameras for reconnaissance of NATO military logistics infrastructure,an example of the instrumentalization of consumer IoT devices in state-sponsored espionage operations.

Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain

Dropping Elephant leverages legitimate binaries (Fondue.exe) for DLL side-loading and Donut shellcode for in-memory RAT placement to bypass disk-based security controls; operational approaches change slower than the tooling itself.

ZDI-26-331: (Pwn2Own) Microsoft Edge Feedback Log File Handling Directory Traversal Remote Code Execution Vulnerability

A directory-traversal vulnerability in Edge feedback logging enables remote code execution when a user visits a malicious page or opens a malicious file.

[UPDATE] Mozilla Firefox, Firefox ESR and Thunderbird: Multiple Vulnerabilities

Mozilla Firefox, Firefox ESR and Thunderbird: Multiple Vulnerabilities

BSI warns of multiple vulnerabilities in Firefox/ESR and Thunderbird with high exploitation potential; exact CVE numbers and version details are absent from this generic announcement.

CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure

CISA warns of active credential exposure incidents in Fortinet devices and recommends hardening measures, indicating ongoing threat exploitation in the wild.

Google Chrome / Microsoft Edge: Multiple Vulnerabilities Enable Unspecified Attack

BSI warns of multiple undisclosed vulnerabilities in Chrome and Edge; details are limited until patches become available.

[UPDATE] GNU libc: Multiple Vulnerabilities

BSI advisory for multiple GNU libc vulnerabilities with potential code execution , directly affects all Ubuntu systems in DACH environments.

New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever

ClickOnce applications provide threat actors with a built-in update mechanism and reliable persistence method through .appref-ms files in the Start Menu, executable on every user launch.