Cyberattack halts GSW direct debit collections
GSW says its supply remained unaffected. Payment processes were nevertheless severely restricted.
SecurityToday - The security briefing for IT decision-makers
The Briefing/Critical vulnerabilities · 14 days/Actively exploited/0 new · 7 days
Threat Trend
Critical vulnerabilities · 14 days8
0
0
1
1
1
3
1
7
6
4
7
5
1
Sat
Mon
Wed
Fri
Sun
Tue
Today
Actively exploitedCritical (CVSS ≥ 9)
Source: CISA KEV · NVD · As of 12.11.2026
Our analysis
Practice & Implementation
All articles
Attacker accounts remain active after the Artifactory patch
Admin accounts, backdoors and remote access services survive the update. Attacks on Artifactory and PaperCut show what still needs to be checked after patching.
Rehearse the IT outage before no one is left to decide
Two hours analog, fixed roles and an annual calendar let you rehearse a real outage before operations stop.
N-central: Remote takeover possible without a patch
CISA lists CVE-2026-86218 as exploited since September 8. Build 2026.3.1.14 fixes the N-central server flaw; self-hosted systems need Hotfix 4.
Strategy & Governance
All articles
When the Security Stack Outgrows the Strategy
Martin Buck of Axians explains why extra tools rarely add more protection and which three layers support a security strategy.
When Paid AI Routers Inject Malicious Code
One paid and eight free LLM routers injected malicious code into AI agents in a test. A filter with a perfect detection rate can …
Cyber insurance: lack of evidence puts the policy at risk
Underwriters require reliable evidence of security controls. False statements about MFA, endpoint protection or backups can jeopardise coverage.
Case Studies
All articles
Northern German Workshop Adopts DataManagement as a Service for M365 Backup from Pink Elephant
M365 Backup via DataManagement as a Service: A social institution uses Pink Elephant for data backup, recovery and German hosting.
DORA in Practice: First Experiences from the Financial Sector
DORA has been fully applicable since January 17, 2025. After the first few months, it is clear: The technical requirements for ICT risk management, …
Why Every Relaunch Needs a Security Audit – Lessons from 50 Web Projects
Over 50 web projects - each post-launch audit found vulnerabilities. Open admin accesses, forgotten staging servers, standard passwords. A relaunch without a security check …
Most Read
- 01
- 02
- 03
- 04
- 05
Security Glossary
All termsKey security terms explained in a compact, citable format: definition, context and the questions that keep coming up.
NIS2
The EU directive that turns cybersecurity into a boardroom matter for thousands of companies. Who it covers and when evidence falls due.
Read the entry →
DORA
The resilience standard for the financial sector. Which artefacts the regulator wants to see and who shares liability in the supply chain.
Read the entry →
Zero Trust
No device and no user is trusted automatically. What the principle really means in daily practice.
Read the entry →
Ransomware
Extortion through encryption, increasingly even without it. How a modern attack unfolds and what stops it.
Read the entry →
Passkey / FIDO2
The passwordless login, bound to device and biometrics. Why it pulls the ground out from under phishing.
Read the entry →
Post-quantum cryptography
Encryption that holds up even against the quantum computer. Why the transition starts now.
Read the entry →
