Comparing 20 July 2026 with the previous day 13 July 2026.
Russian intelligence services are conducting systematic cyber-espionage against NATO and Ukrainian military infrastructure, indicating escalated cyber-warfare operations in the immediate geographic context of the DACH region.
A critical, unauthenticated RCE vulnerability in HTTP.sys enables attackers to execute kernel-level code or trigger denial-of-service conditions by sending crafted HTTP packets to affected servers.
GigaWiper combines remote-access functionality with data-destruction capabilities in a modular platform and has been observed in active intrusions since October 2025.
The patch window was 20 days ahead of public disclosure (June 25 fix, July 15 advisory), giving organizations time for proactive updates.
A minimalist attack with just 11 bytes can crash OpenSSL servers, indicating a critical memory management weakness.
BSI advisory on an Edge vulnerability with security-bypass potential requires immediate prioritization of patches and browser updates across the estate.
BSI alerts on multiple vulnerabilities in Firefox/ESR enabling RCE and security bypass , no specific CVE disclosed, indicating coordination with vendor for responsible disclosure.
The BSI warns of multiple vulnerabilities in Microsoft developer tools that can lead to remote code execution, privilege escalation, and DoS attacks , a summary of multiple updates without specific CVE details.
The BSI alert addresses multiple OpenSSH vulnerabilities generically without naming specific CVE-IDs or affected versions, making precise risk assessment difficult.
BSI advisory on multiple RCE and disclosure vulnerabilities in Adobe Acrobat/Reader without specific CVE details in the alert; patch status and PoC availability unclear from the notice.
BSI warns of multiple unspecified Chrome vulnerabilities with potential for code execution; specific CVE numbers and version information are absent from the advisory.
BaFin penalty against TeamViewer indicates inadequate security measures in a widely-used remote-access tool that is critical for IT support in manufacturing.
The malware leverages legitimate Microsoft Graph API to obfuscate command-and-control traffic through manipulated calendar events, bypassing traditional network monitoring.
The campaign exploits fake GitHub repositories disguised as AI tools and MCP servers to deceive developers and inject malware into supply chains , a significant risk for organizations whose engineers pull dependencies directly from GitHub.
Attackers combine fileless techniques and low-detection loaders to deploy multiple RATs and stealers in BEC campaigns, bypassing traditional malware detection mechanisms.
An authenticated vulnerability in Microsoft Edge enables local code execution with elevated privileges; specific CVE and CVSS metrics are required for prioritization.
The digest highlights a surge of zero-days and pre-authentication RCEs in the current week, including evidence that threat actor UTA0533 exploited multiple SonicWall SMA vulnerabilities as zero-days before public disclosure.
No changes in this category.
No changes in this category.
EU-wide coordinated sanctions against Turla/FSB signal escalated counter-measures against Russia's cyber operations targeting critical infrastructure, with direct relevance to DACH security posture and regional cyber-warfare.
Russian intelligence cyber actors are globally exploiting poorly configured routers and network devices as attack vectors against critical infrastructure and industrial enterprises in DACH regions.
The first joint cyber sanctions by the UK and EU against Russia's FSB signal escalated geopolitical tensions and heightened nation-state cyber threats to European critical infrastructure and supply systems.
EU sanctions confirm an ongoing, coordinated Russian cyber-attack ecosystem comprising intelligence services, cybercriminals, and hacktivists with documented access to European defense ministries and industrial enterprises.
Coordinated warning from Western allies of Russian critical infrastructure attacks signals escalated cyber-warfare activity with potential implications for European industrial operations and supply chains.
CISA warns of Russian state actors actively targeting router infrastructure , a critical risk for European manufacturing enterprises relying on distributed sites and VPN-dependent remote-access scenarios.
First joint UK-EU sanctions against Russian cyber actors signal escalation of coordinated Western response to state-sponsored Russian cyber and disinformation campaigns, with direct implications for European critical infrastructure.
US sanctions against VPN service providers and operators signal escalation in combating ransomware infrastructure and efforts to disrupt financing flows affecting European and DACH organizations.
EU sanctions against Russian GRU hackers underscore coordinated Western response to state-sponsored cyberattacks and elevate geopolitical cyber risk for European manufacturing enterprises.
Russian state actors are conducting sustained campaigns against network infrastructure in critical sectors, which is relevant for European manufacturing operations with dependencies on energy supply and supply chains.
The discovery of a misconfigured Evilginx infrastructure with three active phishing campaigns targeting Microsoft 365 demonstrates the operational reality of reverse-proxy phishing with advanced MFA-bypass capabilities.
A critical vulnerability in 7-Zip enables bypassing security measures, which in production environments could lead to uncontrolled data manipulation.
BSI warns of multiple vulnerabilities in Chrome enabling active exploitation; as Chrome is widely deployed, timely patching to the released fix version should be prioritized.
Forg365 demonstrates the industrialization of phishing-as-a-service with AI-assisted lure generation, SMTP rotation via Amazon SES/Twilio SendGrid, and post-compromise mailbox operations for under €400 per month, enabling even low-skill threat actors to orchestrate scaled campaigns against Microsoft 365.
BSI warns of multiple unspecified vulnerabilities in Microsoft Edge enabling code execution and privilege escalation; exploitation requires user interaction.
Threat actors leverage AI-generated tools for automated AD enumeration, lowering the skill barrier for less-experienced attackers and representing a new dimension of post-compromise reconnaissance.
Microsoft introduces AI-powered security tools (MDASH for vulnerability scanning, extended threat detection for databases, Entra Backup) relevant to organizations with hybrid-cloud and multi-cloud infrastructure.
Microsoft is making passkeys the default authentication method in Entra ID beginning September 1, 2026, to reduce phishing, SIM swapping, and MFA bypass attacks.