These news items are automatically aggregated from industry sources and are not individually reviewed. Any inaccuracies are unintentional —
let us know and we'll correct or remove it.
Researchers have identified SleeperGem, a supply chain attack in which hijacked maintainer accounts pushed malicious versions of three RubyGems packages, including one impersonating Microsoft’s git-credential-manager. The payload checks around 30 environment variables to detect GitHub Actions, GitLab, CircleCI, Jenkins and other CI runners and deliberately exits if it finds one, dropping a persistent backdoor only on real developer machines instead. That design choice means standard pipeline scanning will not catch it, and it is a pointed reminder that supply chain defence has to reach the developer’s own laptop, not stop at the build server.
CVE-2026-53412, rated 9.8, is an improper input validation bug in Zoom Workplace and the Zoom VDI Client for Windows that lets an unauthenticated attacker take over a user’s account over the network, with no credentials, no local access and no victim interaction needed. Zoom has shipped patches and there is no evidence of active exploitation yet, but the combination of remote, unauthenticated and zero-click is exactly the profile that turns into mass exploitation once a working technique circulates.
Lidl has notified online shop customers in Germany, Belgium and the Netherlands that attackers accessed a separately stored file containing personal data after breaching an IT service provider. Names, phone numbers, email addresses, dates of birth and customer numbers were exposed, though Lidl says passwords and payment details were not affected. The incident is another reminder that a retailer’s data protection obligations do not stop at its own firewall.
On July 16, 2026, a control-plane failure in a single Availability Zone in AWS’s Frankfurt eu-central-1 region cascaded into a global CloudFront outage affecting VPC Origins customers, knocking Canvas, Blackboard, Hugging Face and other sites offline for over three hours. The root cause was confined to one German data centre, but because CloudFront routes globally, the failure was felt everywhere at once. It is a clean illustration of why a single point of failure inside a global service is still a single point of failure.
CVE-2026-53359, dubbed Januscape, is a use-after-free in the shadow MMU code that Linux KVM shares across Intel and AMD, and it has gone unnoticed for roughly 16 years. A public proof of concept can already crash a multi-tenant host from inside a guest, and the researcher who found it says a full guest-to-host code execution exploit exists but has not been released. If you run, or rent, virtual machines on KVM anywhere in Europe, this is a patch to check today, not next sprint.
The IETF published RFC 9989, 9990, and 9991 in May 2026, formally replacing the 2015-era RFC 7489 and moving DMARC from an informational document to a proper Standards Track protocol. Existing v=DMARC1 records still work, but the update replaces the ageing Public Suffix List with a live DNS tree walk and formalises reporting rules that many senders have been guessing at for a decade. With Gmail, Yahoo, and Microsoft all now hard-rejecting non-compliant bulk mail, this is a good moment to have someone actually check your records instead of assuming they still hold up.
A supply chain attack disclosed this week compromised five npm packages in the AsyncAPI generator namespace without the attacker ever stealing an npm token. Instead, a misconfigured pull_request_target workflow let attacker-controlled code run inside AsyncAPI’s own CI pipeline, which then published trojanized packages carrying a Miasma RAT descendant with legitimate OIDC provenance attached.
Check Point’s Cloud Firewall and Rubrik Security Cloud have both launched on the AWS European Sovereign Cloud, the physically and logically separate AWS infrastructure operated entirely by EU residents from its first region in Brandenburg, Germany. For banks, utilities, healthcare providers, and public sector bodies weighing data residency against hyperscaler capability, the two launches close a real gap: familiar security and resilience tooling that stays inside the sovereignty boundary.
The EU Digital Omnibus package proposes a single entry point where organisations report a cyber incident once and the system routes it to every relevant authority, replacing today’s separate GDPR, NIS2, DORA, eIDAS, and CER notification processes on different timelines and templates. A new Article 23a NIS2 would establish the mechanism, GDPR’s breach deadline would move to 96 hours, and the whole regime would apply 18 to 24 months after the legislation enters into force.
CISA has added CVE-2026-46817, a CVSS 9.8 privilege management flaw in Oracle E-Business Suite’s Payments File Transmission component, to its Known Exploited Vulnerabilities catalogue after confirming active attacks. No authentication is required, exploitation happens over plain HTTP, and successful attacks give outsiders control of Oracle Payments and the financial workflows behind it. European organisations running EBS for finance or ERP should treat this as an active incident, not a routine patch.
This site uses cookies. By continuing to use this website, you agree to their use.
We’ll help you resolve your infrastructure challenges
Our team of experts is ready to help you with your infrastructure challenges. We’ll give you honest and personal treatment. Get in touch to learn more.
