What is the current situation in German offices?
Last 7 days: from 24.10.2026 until today. Applies to the situation map, the trend and the lists; the world map has fixed periods, noted below each map.
Where the current vulnerabilities sit in a business
35 reports in the last 7 days: BSI warnings and vulnerabilities the US agency CISA reports as exploited. If a CISA vulnerability already appears in a BSI warning, I count it once. Not counted are 189 older BSI warnings that were only updated in the period.
Click a circle or area to see the individual advisories. Image: AI-generated.
The larger the circle, the more warnings red border: at least one critical or known exploited
- 16 Server room of which 1 critical of which 2 known exploited Linux Kernel (4) · VMware (1) · Grafana (1) View details →
- 7 Website, hosting and cloud of which 1 critical of which 3 known exploited PHP (3) · Adobe Commerce and Magento (1) · Drupal Erweiterungen (1) View details →
- 4 Central AI services MLflow (2) · Langflow (1) · vllm (1) View details →
- 4 Software development of which 1 known exploited GitLab (1) · Jenkins (1) · Python (1) View details →
- 3 Firewall, VPN and router Juniper Session Smart Router (1) · Cisco Secure Firewall Threat Defense und Cisco ASA (1) · Sophos Unified Threat Management (UTM) Software (1) View details →
- 1 Mobile working and remote access Android (1) View details →
- 0 Office workstations View details →
How I assign them: each warning goes into exactly one area, depending on which software is affected. Rented cloud services such as Microsoft 365, SharePoint Online or Google Workspace do not appear here. Their providers have to close the same vulnerabilities, but they install the fixes themselves, so it does not fall back on your business. The map only shows what you or your IT service provider have to update yourselves. A web server on the internet can appear in two areas: with its website software under “Website, hosting and cloud”, with Linux, database and backup under “Server room”.
Source: BSI, Warning and Information Service (CERT-Bund). General libraries found in almost every piece of software (such as OpenSSL or glibc) are not assigned to any area. The classification is mine, not the BSI’s. This week’s situation in detail ↓
Period: last 7 days, from 24.10.2026 until today, as selected above.
Advisories per day and area
Each bar shows how many warnings the BSI first published that day, stacked by severity. Later updates count on the day of the first release. Hover over a bar to see the numbers.
| Sa 24.10. | So 25.10. | Mo 26.10. | Di 27.10. | Mi 28.10. | Do 29.10. | Fr 30.10. | total | |
|---|---|---|---|---|---|---|---|---|
| Server room | 6 | 4 | 1 | 3 | 14 | |||
| Central AI services | 2 | 2 | 4 | |||||
| Website, hosting and cloud | 1 | 1 | 2 | 4 | ||||
| Firewall, VPN and router | 3 | 3 | ||||||
| Software development | 1 | 1 | 1 | 3 | ||||
| Mobile working and remote access | 1 | 1 | ||||||
| Office workstations | 0 | |||||||
| All areas | 11 | 5 | 2 | 11 | 29 |
criticalhighmediumlow
Period: last 7 days, from 24.10.2026 until today, as selected above. One bar per day.
State-backed attackers named by CISA
The US cybersecurity agency CISA attributes some of its advisories to state-backed attackers from a particular country. The map shows how often it did so over the last three years. This is a snapshot from the US point of view, not a statistic of attacks on Germany: most advisories name no country at all, including every advisory on ransomware groups (box below the map).
Number in the circle: CISA advisories from the last three years that name actors from the country Arrow: a vulnerability from these advisories also appears in a BSI advisory in the period, so it affects software that is common here too
29 of the 48 CISA advisories from the last three years name no country, 13 of them concern ransomware groups. Such groups work for money, often across borders, and can rarely be tied to a state. For businesses in Germany they are the more common danger: according to the BSI, ransomware is the biggest threat to companies.
No BSI advisory with one of these vulnerabilities in the period.
The CISA advisories
- A Tale of Two SOCs: Insights From Two Red Team Assessments 08/2026
- Defending Against an Active Threat to Siemens S7 Series PLCs 08/2026
- #StopRansomware: Gunra Ransomware 08/2026 · 2 CVE
- CISA Shares Lessons Learned from an Incident Response Engagement 09/2025 · 2 CVE
- CISA and USCG Identify Areas for Cyber Hygiene Improvement After Conducting Proactive Threat Hunt at US Critical Infrastructure Organization 07/2025
- #StopRansomware: Interlock 07/2025
- Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider 06/2025 · 1 CVE
- Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations 05/2025
- Fast Flux: A National Security Threat 04/2025
- #StopRansomware: Medusa Ransomware 03/2025 · 4 CVE
- #StopRansomware: Ghost (Cring) Ransomware 02/2025 · 11 CVE
- Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications 01/2025 · 7 CVE
-
Russia
8 CISA advisories since 10/2023 · 20 vulnerabilities named
No BSI advisory with one of these vulnerabilities in the period.
The CISA advisories
- Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite 07/2026 · 1 CVE
- Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting 07/2026 · 3 CVE
- Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure 12/2025
- Russian GRU Targeting Western Logistics Entities and Technology Companies 05/2025 · 5 CVE
- Russian Military Cyber Actors Target US and Global Critical Infrastructure 09/2024 · 10 CVE
- SVR Cyber Actors Adapt Tactics for Initial Cloud Access 02/2024
- Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally 12/2023 · 1 CVE
- Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spearphishing Campaigns 12/2023
-
China
6 CISA advisories since 10/2023 · 20 vulnerabilities named
No BSI advisory with one of these vulnerabilities in the period.
The CISA advisories
- Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data 10/2026 · 8 CVE
- China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies 09/2026
- Defending Against China-Nexus Covert Networks of Compromised Devices 04/2026
- Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System 08/2025 · 6 CVE
- People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action 07/2024 · 5 CVE
- PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure 02/2024 · 1 CVE
-
Iran
4 CISA advisories since 10/2023 · 7 vulnerabilities named
No BSI advisory with one of these vulnerabilities in the period.
The CISA advisories
- Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure 04/2026
- Iranian Cyber Actors’ Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations 10/2024 · 1 CVE
- Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations 08/2024 · 6 CVE
- IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities 12/2023
-
North Korea
1 CISA advisory since 10/2023 · 44 vulnerabilities named
No BSI advisory with one of these vulnerabilities in the period.
The CISA advisories
Source: CISA cybersecurity advisories (origin according to the advisory title); BSI warning and information service. Map data: Natural Earth. Attribution to a country is a statement by CISA, not evidence of an attack on Germany.
Period: The circles do not follow the selection above: they count CISA advisories from the last three years, because CISA names state-backed attackers only a few times a year. The BSI warnings that appear when you click a country, however, follow the period above.
In the last 7 days the BSI published 5 new warnings about software that runs in businesses every day.
The official reporting situation, tailored to your office workstations. I fetch it twice a day from the German Federal Office for Information Security and show here only what runs on ordinary office computers and in almost every business. Every line leads to the original BSI advisory. The situation map above counts every area in the building, which is why its number is larger.
0
critical3
high1
medium25
older, only updatedOnly warnings the BSI published for the first time in the period are counted. Older, only updated are earlier warnings the BSI amended in the period, for example because the vendor released an update. They are not in the figures; choose “With updates” in the situation map to include them.
What’s affected is what runs at your business
- high Cisco Secure Firewall Threat Defense und Cisco ASA
- high Sophos Unified Threat Management (UTM) Software
- high Oracle Java
- medium Nextcloud
- low Android
Source: BSI, Warning and Information Service (CERT-Bund). As of 30.10.2026, 08:43.
Period: last 7 days, from 24.10.2026 until today, as selected above.
The warnings come from German-language sources and are shown in the original.
And this is already being attacked
A vulnerability is one thing. These ones are demonstrably being exploited — the US cybersecurity agency keeps a public catalogue of them, and its own federal agencies have to act within a deadline.
-
exploited
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
How it is exploited: Crafted input makes the software do something it should not. The details are in the linked description. These devices sit at the edge to the internet. Attackers find them through automated scanning, without any action by your staff.
-
exploited
Broadcom VMware ESX
How it is exploited: Crafted input makes the software do something it should not. The details are in the linked description. If a server sits only inside the building, it is usually the second step: anyone already inside the network, for example after a phishing email, moves on from here to data and backups. Mail and file servers such as Exchange, SharePoint Server or Nextcloud, however, are often connected directly to the internet and are then just as exposed as a website.
-
exploited
Adobe Commerce and Magento
How it is exploited: Unchecked upload: attackers upload a file containing malicious code and then call it. The application is reachable from the internet and is scanned automatically around the clock.
-
exploited
Google Brotli
How it is exploited: Memory flaw: crafted data – a web page, a file or a network packet – makes the program execute injected code.
Source: CISA, Known Exploited Vulnerabilities Catalog. The links lead to the description of the vulnerability in the US National Vulnerability Database; the explanation above is my classification of the type of flaw named there.
Period: last 7 days, from 24.10.2026 until today, as selected above. Shown are the six newest entries from this period.
This list doesn’t answer one question: whether your accountant will approve the fake invoice tomorrow. Updates close gaps in software. The gap my training addresses sits between a credible request and a click — and no patch closes it.
The attacker no longer needs to know you. AI does that part.
For years, poor language was the most reliable sign of a scam email. That sign is gone. What else has shifted, and why your firewall can’t answer the decisive question.
Attacks took time
Anyone targeting a company had to do research, write texts and rebuild websites. That only paid off for big targets; small businesses slipped through the net.
Attacks cost next to nothing
Research, writing and copying are automated. The same effort that used to be needed for one target now covers a thousand — and so it also hits the craft business with twelve employees.
“Too small and unknown” no longer protects you
Assuming you’re of no interest to attackers was always risky. Now it’s simply wrong, because there’s no longer any target selection that protects you.
What has actually changed
Four shifts, all pointing the same way: attacks are becoming more credible, more personal and more frequent.
Language no longer gives anything away
Spelling mistakes, clumsy grammar, odd greetings: those were the signs we were all trained to spot. Today a language model writes flawless text in the tone of your industry, including the correct technical terms and the right level of formality.
The attack knows your context
Legal notice, LinkedIn, company register, press releases, job ads: publicly available information is enough to know who approves invoices at your company, who’s new and which project is currently running. Nobody does this research by hand any more.
Voice and face are no longer proof
A few seconds of audio are enough for a convincing voice clone, and any video on the company website provides the material. The best-known case: an employee of a large corporation transferred around 25 million US dollars after a video conference in which every participant except him was fake.
Attacks run in steps, not as a single email
First a harmless contact, then a reference back to your reply, then the actual request. Such multi-step sequences used to need a person who kept at it. Today they run on automatically, even over weeks.
Technology can’t decide whether a request is legitimate.
Spam filters recognise patterns: known senders, suspicious attachments, reported domains. A flawlessly written email from a newly registered, inconspicuous domain that refers to a real process at your company and asks for a plausible action contains not a single technical feature a filter could stop it on.
No product answers the question “Is it right for me to approve this payment now?”. A person answers it, under time pressure and between forty other emails.
That’s why awareness isn’t an add-on to technology, but the layer that starts exactly where technology structurally stops.
What technology reliably does
- Intercept known malware
- Block reported senders and domains
- Isolate suspicious attachments
- Log access and keep backups
What it cannot do
- Judge whether a request is plausible in context
- Recognise that the familiar voice on the phone is synthetic
- Stop someone from entering their password voluntarily
- Replace a quick call-back when in doubt
How many vulnerabilities can you spot in an office?
Before talking about training, it helps to feel the problem once rather than have it explained. In “Operation ORION” you walk through an ordinary office and look for the places an attacker would use: the sticky note on the monitor, the open mailbox, the USB stick from the trade fair stand. In five minutes it becomes tangible what can’t be fixed technically and why it’s worth training for exactly that. That’s where awareness training comes in.
Operation ORION, the office game
Take on the role of an investigator and uncover the security gaps at a workstation. A playful start with no prior knowledge needed — also ideal for passing on to colleagues.
Start the game →The real target is rarely the computer
Anyone with login details doesn’t need malware. A hijacked mailbox reads along, knows your processes, replies in ongoing threads and requests further access in your name. To colleagues and customers it looks like you, because technically it is you.
That’s why protecting your own identity is at the heart of my training: passwords, two-factor authentication, handling confirmation requests, and what to do if it happens anyway.
Resilience is measurable, or it’s just a claim.
“Our people are aware” is an assumption. A number showing how many actually click in a realistic situation is a foundation.
For the German economy, becoming resilient here is now a strategic need: with Cybernation Deutschland, the BSI is pursuing exactly this goal — resilience as the normal state rather than a project after an incident. For an individual business that means: know where you stand, improve, measure again.
Free, three simulated attacks, anonymised results.
And yes, it’s also mandatory.
Two laws, one consequence: train and prove it. Many businesses only associate training obligations with NIS2 and consider themselves unaffected. But the GDPR applies to everyone who processes personal data.
Certain sectors above a certain size
The directive obliges management bodies of affected entities to take part in training and to regularly offer training to all employees. Management is explicitly addressed.
Generally affects companies with 50 or more employees or €10 million in turnover in energy, transport, health, water, digital infrastructure, IT services, postal services, waste, chemicals, food and mechanical engineering.
Practically every business
Article 32 requires “appropriate technical and organisational measures”. Training and raising staff awareness are organisational measures; Article 39 names them explicitly.
Anyone who processes customer data, job applications or personnel files is affected. That’s every business.
What must be provable
- That training took place
- Who took part
- When it happened
- That it is repeated
What isn’t documented is, if in doubt, considered not to have happened. With me, all four proofs are created automatically as a by-product of the training.
Five questions, instant assessment.
Obligations check: ISO 27001, NIS2, cyber insurance →