Threat Intel

Threat Advisories

When an actor or an incident becomes relevant for companies in Germany, Austria and Switzerland, we write down what is known: who is attacking, what the attack chain looks like, which techniques can be detected early and which actions take priority. Every report names its sources and separates what is proven from the perpetrators’ claims.

All reports are cleared for sharing (TLP:CLEAR or TLP:WHITE), with no form and no sign-up. They contribute to your evidence under NIS2 Art. 21, DORA and ISO 27001 A.5.7.

Threat Advisory
October 21, 2026
TLP:CLEAR · 12 pages

PHP2Shell: What the Critical PHP Vulnerabilities Mean for Your Organization

On October 21, 2026, the PHP project patched two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) that let adversaries execute code on any PHP web server without authentication. Germany's Federal Office for Information Security (BSI) rates the situation as Orange. Version 1.4 (October 23, 9:00 a.m.): attempts are widespread and automated, successful attacks are difficult and not yet confirmed; NCSC-NL is examining first signals, and the BSI knows of no compromise. New: the status for PAN-OS, Fortinet, Cisco, pfSense, OPNsense, QNAP and Synology, a corrected distribution table, and a regression in 8.4.27 and 8.5.12. Includes the attack flow as a graphic and the brief for IT on what to look for from October 17 onward.

VulnerabilityWeb ApplicationsPatch Management
Whitepaper
September 17, 2026
TLP:CLEAR · 10 pages

AI in the Cyber Kill Chain: Weapon or Target?

Where do adversaries actually use AI today, and where only in the lab? The whitepaper rates all 14 ATT&CK tactics by evidence and reach, drawing on the GTG-1002 campaign (MITRE C0062), the phishing field studies from Harvard and Berlin, and the first incident caused by an AI agent that was reported to the Spanish data protection authority (AEPD). The result: three zones, and two stages without any evidence from the field.

Artificial IntelligenceMITRE ATT&CKThreat-Informed Defense
Threat Advisory
September 4, 2026
TLP:CLEAR · 17 pages

Rhysida: What the Attack on Berlin Means for Your Organization

On September 4, 2026, Rhysida published 5.8 terabytes of data from the government network of the State of Berlin. The advisory describes the actor, its attack chain that has remained unchanged since 2023, and the measures that now take priority. Version 1.1 of September 7: Germany's Federal Office for Information Security (BSI) confirms initial access via the TerminalFix campaign, a fake CAPTCHA rather than stolen credentials.

RansomwarePublic AdministrationCritical Infrastructure Supply Chain
Special Situation Report
March 4, 2026
TLP:WHITE · 6 pages

Hybrid Warfare, Iran and What It Means for Your Organization

After the military operation against Iran on February 28, 2026, pro-Iranian hacktivists and state-sponsored APT groups escalated their cyber operations. The report describes Handala, APT33 and APT35, their techniques and the countermeasures that take priority.

State ActorsHacktivismEnergy and Finance