Comparing 21 September 2026 with the previous day 20 September 2026.
The report provides a public exploit for an incomplete Windows patch and describes a novel technique for abusing dangling COM object registrations.
The report shows that North Korean APT groups deliberately abuse IT service providers as a stepping stone into their customers' networks, meaning the real risk lies less with the compromised provider than with its clients.
The campaign shows that North Korean actors use fake recruitment and coding-test processes to target IT and engineering professionals and trick them into executing malicious code , a social-engineering vector that can also reach non-crypto engineering teams in DACH organizations.
The flaws allow not only reading but also writing to the NAS, enabling manipulation or persistence on storage systems , patches are available.
The 'PAYLOAD' ransomware uses tampered Group Policy Objects as a distribution mechanism, so a single compromised AD account can trigger infection across an entire domain network.
The BSI WID does not provide CVE IDs or severity ratings; the report is an aggregated patch update for Chrome and Edge.
Microsoft announces the end of SMS first-factor authentication in Entra ID starting February 2027, requiring early migration to passkeys to avoid sign-in disruptions.
The report contains no CVE ID, no CVSS score, and no exploitation status, which complicates prioritization for patch processes.
No changes in this category.
No changes in this category.
No changes in this category.