Comparing 13 July 2026 with the previous day 6 July 2026.
EU-wide coordinated sanctions against Turla/FSB signal escalated counter-measures against Russia's cyber operations targeting critical infrastructure, with direct relevance to DACH security posture and regional cyber-warfare.
Russian intelligence cyber actors are globally exploiting poorly configured routers and network devices as attack vectors against critical infrastructure and industrial enterprises in DACH regions.
The first joint cyber sanctions by the UK and EU against Russia's FSB signal escalated geopolitical tensions and heightened nation-state cyber threats to European critical infrastructure and supply systems.
EU sanctions confirm an ongoing, coordinated Russian cyber-attack ecosystem comprising intelligence services, cybercriminals, and hacktivists with documented access to European defense ministries and industrial enterprises.
Coordinated warning from Western allies of Russian critical infrastructure attacks signals escalated cyber-warfare activity with potential implications for European industrial operations and supply chains.
CISA warns of Russian state actors actively targeting router infrastructure , a critical risk for European manufacturing enterprises relying on distributed sites and VPN-dependent remote-access scenarios.
First joint UK-EU sanctions against Russian cyber actors signal escalation of coordinated Western response to state-sponsored Russian cyber and disinformation campaigns, with direct implications for European critical infrastructure.
US sanctions against VPN service providers and operators signal escalation in combating ransomware infrastructure and efforts to disrupt financing flows affecting European and DACH organizations.
EU sanctions against Russian GRU hackers underscore coordinated Western response to state-sponsored cyberattacks and elevate geopolitical cyber risk for European manufacturing enterprises.
Russian state actors are conducting sustained campaigns against network infrastructure in critical sectors, which is relevant for European manufacturing operations with dependencies on energy supply and supply chains.
The discovery of a misconfigured Evilginx infrastructure with three active phishing campaigns targeting Microsoft 365 demonstrates the operational reality of reverse-proxy phishing with advanced MFA-bypass capabilities.
A critical vulnerability in 7-Zip enables bypassing security measures, which in production environments could lead to uncontrolled data manipulation.
BSI warns of multiple vulnerabilities in Chrome enabling active exploitation; as Chrome is widely deployed, timely patching to the released fix version should be prioritized.
Forg365 demonstrates the industrialization of phishing-as-a-service with AI-assisted lure generation, SMTP rotation via Amazon SES/Twilio SendGrid, and post-compromise mailbox operations for under €400 per month, enabling even low-skill threat actors to orchestrate scaled campaigns against Microsoft 365.
BSI warns of multiple unspecified vulnerabilities in Microsoft Edge enabling code execution and privilege escalation; exploitation requires user interaction.
Threat actors leverage AI-generated tools for automated AD enumeration, lowering the skill barrier for less-experienced attackers and representing a new dimension of post-compromise reconnaissance.
Microsoft introduces AI-powered security tools (MDASH for vulnerability scanning, extended threat detection for databases, Entra Backup) relevant to organizations with hybrid-cloud and multi-cloud infrastructure.
Microsoft is making passkeys the default authentication method in Entra ID beginning September 1, 2026, to reduce phishing, SIM swapping, and MFA bypass attacks.
No changes in this category.
No changes in this category.
The PolinRider campaign demonstrates a coordinated North Korean supply-chain attack model that has compromised over 100 legitimate open-source packages and directly endangers developer environments and CI/CD credentials.
Chinese state-sponsored actors conducted an AI-assisted espionage campaign against approximately 30 organizations in September 2025, with the AI system autonomously executing 80,90% of tactical operations and reducing human decision-making to only 4,6 points per campaign.
North Korea-aligned PolinRider campaign distributes 100+ malicious packages across open-source registries and Chrome extensions; targets developer supply chains critical to manufacturing environments (CAD, ERP integrations).
A 16-year-old use-after-free vulnerability in the Linux KVM hypervisor enables the first reliable guest-to-host escape with full code execution on both Intel and AMD x86 systems.
BSI advisory on multiple Windows/Windows Server vulnerabilities without specific CVE listing indicates current patch-cycle warning or aggregation of concurrent exposures.
BSI warns of multiple critical vulnerabilities in widely deployed PDF software enabling remote code execution and requiring immediate patching.
A generic BSI warning about multiple Edge vulnerabilities without specific CVE numbers, indicating a routine update-cycle advisory.
BSI warns of multiple vulnerabilities in Adobe Creative Cloud applications without specific CVE numbers, suggesting an aggregated patch advisory; exploitation requires user action (malicious files).
The release of PoC code for a Linux kernel vulnerability enabling local root access significantly increases exploitation risk and requires urgent patching on affected Ubuntu systems.
EtherRAT is being distributed via fake IT support calls through Microsoft Teams,a social engineering campaign that exploits trusted-contact impersonation to install remote access trojans on Windows systems.
BSI warning on multiple unspecified Linux kernel vulnerabilities without CVE references; update details required for concrete risk assessment.