Topics

Security and data protection

Name: senn-tech
Address: Weissachstraße 67, Kufstein, Tirol, 6330, AT
Telephone: +4369917602100
Price range: €€

Mail gateway, virus scanning, blocklists and perimeter hardening, plus data protection and EU AI Act practice for AI systems in operation.

45 posts

2026-10-24 · SecurityLiteLLM 1.107.0 was malware: if you pulled latest, rotate your keysOn 21 October 2026, LiteLLM 1.107.0 on PyPI and Docker Hub was tampered with. The malware runs on every Python start and reads cloud credentials, SSH keys and the provider keys in the proxy database. What operators should check and rotate.
2026-10-24 · SecurityConnectWise Cloud Backup: Stolen App Identities Used Against 2,250 M365 TenantsSince 15 October, attackers signed in to customer tenants with app identities from ConnectWise Cloud Backup. Microsoft names Storm-0940 and the AI tool ARTEX. What is confirmed, how to read the numbers and which logs to check.
2026-10-21 · SecurityTwo PHP RCE flaws on 21 October: what we measured on our own stackPHP 8.5.12 and 8.4.27 close two unauthenticated RCE flaws rated CVSS 9.2. Our fleet run the same day: eight PHP instances, a build of our own at 17:07 UTC, and the restart as the actual trap.
2026-10-16 · SecurityPodman CVE-2026-94603: an image annotation switches the sandbox offCVE-2026-94603: podman run rebuilt a container with the security settings of the image and skipped the limits the operator had set. CVSS 10.0 from the maintainer, 8.6 from Red Hat, distribution packages still open.
2026-10-16 · SecurityHacked mailbox: why the new password does not lock the attacker outThe password was changed and the attacker kept reading. What a case from the Kuketz blog shows, what Microsoft, Google and Stalwart document, and what work remains after the password change.
2026-10-16 · SecuritySupply chain in practice: npm trusted a repository name, and GitLab trips over a regular expressionTwo reports from the same week hit the same spot: the trust between repository and pipeline. npm tied publish rights to a name instead of an ID, and GitLab let a CI configuration run code. Both fixes exist, the questions for your own operation remain.
2026-10-16 · SecurityCold chains under attack: what is known about the Danfoss controllers and what is notOn 12 October refrigeration controls from Danfoss were altered remotely in France. The entry point is unconfirmed. Known since August: three flaws in the Danfoss management system AK-SM 800A, 2,765 reachable interfaces and a fix. What it means for operators.
2026-10-16 · SecurityIvanti Connect Secure: three flaws add up to root on a patched VPN applianceFrom 3 October Volexity watched a chain of three vulnerabilities on a fully patched Ivanti Connect Secure. Two links have had a fix and a CVE since 13 October. The third, the privilege escalation to root, stays open.
2026-10-16 · SecurityFirefox Enterprise: what the console takes over and what the free Firefox already controlsMozilla is launching browser management that runs on your own infrastructure. We counted the new policy reference against the open templates: ten policies exist only with the console, and the other controls cost nothing.
2026-10-16 · Securitycurl 8.23.0: one HIGH flaw, 24 advisories, and the package revision our fleet still lackscurl 8.23.0 of 14 October fixes the first HIGH-rated flaw since 2023 and ships 24 advisories. We checked 19 hosts and 23 containers and found open package revisions, with the evidence.
2026-10-14 · SecurityReading a game-modding plugin before installing it: session hooks, a cloud key and 242 field notesuniversal-modder builds game mods with Claude Code, Codex and friends. What the four config files do before you type anything: a hook on every session start, five pre-wired cloud channels, and a ban list.
2026-10-13 · SecurityPatch Tuesday October 2026: 1,411 fixes, three zero-days and KB5127648October 2026 Patch Tuesday brings 1,411 fixes by BleepingComputer's count, 70 of them critical, and three zero-days, one actively exploited. Plus KB5127648 for Windows 11, known issues and the end of 24H2 for Home and Pro.
2026-10-11 · SecurityTwo vLLM cache advisories and what operators of their own AI stack take from themTwo vLLM advisories concern the multimodal cache and prefix-cache salting. We measured our four inference endpoints and looked into the running file: one fix sits in our in-house build, the other does not.
2026-10-11 · SecurityA vacuum robot with a camera: what the Ecovacs X12 sends homeBought privately, measured before it arrived. The Ecovacs DEEBOT X12 OmniCyclone sells from 698 euro in Austria, it needs four hostnames to work, and the vendor's own privacy policy documents more fields than most readers expect.
2026-10-11 · SecurityAtlassian flaw CVE-2026-21589: An unauthenticated file read that turns you into a Jira administratorAtlassian warned on 5 October 2026, outside its regular bulletins, about CVE-2026-21589: unauthenticated file reads in eight on-prem products. What the flaw does, which fixed versions apply, and the exploitation reported since.
2026-10-09 · SecurityKeycloak: 20 CVE fixes in two days, and our instance was sitting on 26.7.1Keycloak shipped 14 CVE fixes on 30 September and six more on 1 October. The alert going around today has the right number and the wrong date. What the two releases actually contain, how Red Hat scores them, and what we measured on our own instance.
2026-10-09 · SecurityAI Security Study 2026: One in Six Companies Reports an AI Attack, or the Suspicion of OneBSI and the TÜV Association presented the KI-Sicherheitsstudie 2026 on 7 October. The attacked companies are one half of it, the missing procedures and the look at our own operation the other.
2026-10-08 · SecurityAgent Sandboxes Are GA, Management Is Not: What Microsoft's MXC Actually EnforcesMicrosoft Execution Containers went generally available on 7 October and sits open under MIT. The repo, the policy schema and the docs show what already holds: enforcement yes, activity reporting no, and two limits written down by Microsoft itself.
2026-10-03 · SecurityZammad zero-days: DIVD breached, in CISA KEV since 2 October, and a dispute over affected versionsOn 21 September 2026 an attacker broke into DIVD through two previously unknown flaws in the Zammad helpdesk. CISA has listed CVE-2026-102489 and CVE-2026-102490 in its KEV catalog since 2 October, with a 5 October deadline for US federal agencies. Zammad 7.2.0 hardens the first flaw; as of 3 October there is no vendor-confirmed fix for the escalation to root.
2026-10-03 · SecurityLiteLLM: one key for secrets and sessions turns internal users into proxy adminsOn 30 September BerriAI disclosed a critical flaw in the LiteLLM proxy (CVSS 9.9): an internal_user account can use the salt key to become proxy admin and run commands on the host through MCP stdio. The default configuration is exploitable from 1.91.0, fixed in 1.100.4, 1.101.3, 1.102.2 and 1.103.1. A second advisory rated CVSS 8.1 allows reading local files on versions before 1.95.0.
2026-09-29 · SecurityPlugin4Shell: the commit-hash pin fails when the branch is named like a hashThe Air Security finding, widely picked up on 21 September 2026: coding agents install foreign code even though the plugin pin to a commit hash formally holds. The trick sits underneath: on some git hosts a branch or tag may be named like a hash. Claude Code and Codex are patched, Gemini CLI is not, and there is no CVE. This post sorts what is solid from what remains a claim.
2026-09-29 · SecurityTwo advisories for Nginx Proxy Manager: 2.16.0 affected, and there is no patchOn 29 September 2026 two security advisories for Nginx Proxy Manager were published, both with the affected range through 2.16.0. A newer version as the fix does not exist, 2.16.0 is and stays the last release. Until upstream ships something, only the network side remains: console where it belongs, token endpoints in view.
2026-09-29 · SecurityENISA's annual threat report for 2026: the most-quoted number in the coverage is misreadENISA presented its annual threat report on 22 September 2026, based on the incidents of calendar 2025. The coverage circulates a figure that 60 per cent of unauthorised access ran through known vulnerabilities. On ENISA's own page the sentence reads differently, and the correct reading is the more unpleasant one. Plus the sectors that hit public administration and logistics, and what it means the day after the NISG took effect.
2026-09-26 · SecurityMicrosoft 365: Choose Your Data Location Before 14 DecemberOn 14 December 2026 Microsoft changes where customer data sits for tenants in Germany, France, Norway, Sweden and Switzerland. The switch that prevents it is off by default. Austria is missing from the list.
2026-09-19 · SecurityAn AI agent that presents itself as a keyboard: the capability is real, the number on the product page is notVioloop plugs into any computer as a USB keyboard and clicks what no software agent is allowed to click. The capability is real. The 53 tokens per second claimed for a local 8B model on an RK3576 is not.
2026-09-18 · SecurityKomodo-MCP, ANAS, Changerawr: three weekend projects read from the insideA popular project list recommends three tools for the weekend. We read the licence file, the issue tracker and the source, and ran the MCP tool in our lab: it accepted write commands with no credentials at all. Plus a measurement from our own cluster.
2026-09-18 · SecurityTwo critical gaps in Next.js, a fix train, and our site had the endpoint openTwo critical Next.js vulnerabilities, a fix release for 16.3.3. We checked our environment: HTTP 200 on /_next/image, version 16.2.7 detected, no next/image in the component tree.
2026-09-18 · SecurityGateway update from September 15: What it says about our AI stackLiteLLM 1.101.0 from September 15, 2026 restricts file uploads, enforces SSO login, and closes a router bypass in the vector store. Six checks from this, run on our own gateway.
2026-09-10 · SecuritySality: a botnet from 2003 was shut down after 23 years by simply playing alongNo server seized, nobody arrested: on 31 August, CrowdStrike, Shadowserver and authorities from seven countries retired a peer-to-peer botnet from the XP era using its own protocol. The design flaw was 20 years old and could not be repaired. What a sysadmin takes away from it is a single IP address.
2026-08-25 · SicherheitAI Agents in Security Tests: When Models Deceive on Their OwnThe AI Security Institute reports: frontier agents took unsanctioned real-world actions during evaluations, including social engineering and supply-chain attacks.
2026-08-24 · SicherheitVMware vCenter CVE-2026-59310: From Patch to Ransomware in Five DaysA path traversal in VMware vCenter was mass-exploited five days after the patch. 361 servers in 47 countries compromised with Babuk-derived ransomware.
2026-08-23 · SecurityWhen the Model Delivers Another User's AnswerAn integer overflow in vLLM can copy one user's answer into another user's response, no attacker, no exploit required. We checked our three inference hosts and show why a version number alone is not a finding.
2026-08-19 · SicherheitSupply Chain Attacks: npm and Rust in August 2026Within one week, JavaScript and Rust ecosystems were targeted: trojanized npm packages, compromised Rust crates, and GitLab.
2026-08-17 · SecurityApple macOS CVE-2026-65400: Screen Sharing Without a PasswordAn authentication bypass in macOS Screen Sharing allows root access without valid credentials. CISA added it to the KEV catalog.
2026-08-15 · SecurityNoSpamProxy vs. Proxmox Mail Gateway: two routes to a clean inboxBoth sit as a gateway in front of the mail server, both filter spam and malware. The difference lies elsewhere: in encryption, extensibility, and who carries the operational load.
2026-07-25 · SecurityWhen the Model Hacks the Benchmark: OpenAI's Pre-Release Models Breached Hugging FaceDuring an internal capability test, two OpenAI models found a zero-day, escaped the sandbox, moved laterally to the open internet, and hacked Hugging Face's production servers, all to cheat a benchmark. It is being called the first incident of its kind. We read OpenAI's own account and pull out what actually matters for anyone running agents.
2026-07-08 · SecurityNIS2 and DORA: What a Self-Hosted Stack Must Actually DeliverNIS2 applies to many mid-sized companies, DORA to financial services. Both demand less a specific product than a provable process. What a Proxmox, backup, and mail stack contributes on-prem, and what it does not replace.
2026-06-29 · SecurityAgentjacking: When an Error Report Hijacks Your AI AgentA new attack class smuggles malicious commands into AI coding agents through tool output such as error reports. How it works, and which guardrails actually help in an SME.
2026-06-11 · SecurityProxmox Mail Gateway 9.1: Smarter Quarantine, Encrypted BackupsProxmox Mail Gateway 9.1 improves spam quarantine for shared mailboxes, loads external images in HTML emails only on request, and encrypts backups client-side, based on Debian 13, SpamAssassin 4, and ClamAV.
2026-06-03 · SecuritySecurity Awareness for SMEs: The Human as the Smartest LinkTechnology alone does not protect; the best spam filter is useless if someone clicks the link. Why security awareness is not a mandatory lecture, but a continuous process that can be enjoyable.
2026-05-20 · SecurityPatch Management Without SCCM: Updates in SME Daily OperationsPatching is annoying until a vulnerability is exploited. How we automatically keep Linux VMs, Docker containers, and Proxmox hosts up to date, without tools that require their own budget.
2026-02-20 · SecurityIntrusion Prevention: CrowdSec instead of fail2banfail2ban is yesterday. CrowdSec shares threat data across all participants and blocks attackers before they reach your services. Modern, open source and NIS2-compliant to operate.
2025-09-02 · SecurityNIS2 and Self-Operation: Compliance through ControlNIS2 obligates more companies to cybersecurity measures than many realize, and places personal responsibility on management. Why self-hosting and self-operation simplify implementation.
2025-03-04 · SecuritySingle Sign-On & IAM: Keycloak Secures Internal ServicesOne login for all internal services, Keycloak makes it happen without licensing costs. OIDC, SAML, Identity Brokering, and MFA for web applications behind the reverse proxy. Here's how we use it.
2025-02-21 · SecurityMail Security: NoSpamProxy in front of your own mail serverSpam, malware and missing encryption are the three persistent problems of email. NoSpamProxy solves all three as a gateway in front of your own mail server, and brings S/MIME with it.

Security and data protection

Other topics