Data & infrastructure
-
Azure gateway failure hits hybrid connectivity
Microsoft says a gateway-management change combined with operating-system servicing disrupted Azure networking services across multiple regions, including several in Europe and the UK.
-
WatchGuard patches critical access-point flaws
WatchGuard has fixed two critical wireless access-point vulnerabilities that can provide unauthenticated API access or operating-system command execution.
-
OpenSSL fixes high-severity DTLS disclosure flaw
OpenSSL has released security updates for a high-severity DTLS flaw that can expose heap contents as plaintext or crash affected applications during handshake retransmission.
-
Kiteworks shutdown uncovered critical vulnerability
Kiteworks says its precautionary shutdown allowed it to identify and remediate a previously unknown critical vulnerability, with no evidence that attackers successfully exploited it.
-
One identity compromise reached Kubernetes clusters
Microsoft says an attacker turned a compromised account into Azure DevOps and Kubernetes access by abusing password recovery, authentication enrolment, and trusted development pipelines.
-
Zimbra flaw enabled deep mail-server compromise
Microsoft has documented exploitation of an unauthenticated Zimbra command-injection flaw that led to web shells, root access, credential collection, persistence, and attempted mailbox-data exfiltration.
-
New Spectre attack targets JIT engines
European researchers have demonstrated a Spectre-v2 technique that reuses stale branch-prediction entries in JIT environments, prompting mitigations in Linux and Oracle software.
-
FTAPI confirms ransomware on internal server
German secure file-transfer provider FTAPI says ransomware was deployed on an internal server, while its customer platform and transferred customer data were not affected.
-
Citrix exploitation reaches broad European sectors
Mandiant says exploitation of a NetScaler zero-day began weeks before disclosure and likely affected European organisations across government, finance, energy, education, technology, and legal services.
-
OpenInfra repository compromise puts packages in doubt
OpenInfra Europe has told users to remove packages downloaded from a compromised Artifactory repository after attackers obtained administrative access to the service.