German University Breach Exposes 52,000 Students

Ludwig Maximilian University of Munich, one of Germany's largest universities with more than 52,000 students, confirmed a cyberattack on Saturday, according to The Record.

An attacker accessed a server holding enrollment records. The university's own assessment: the data was almost certainly taken.

The compromised records span names, dates of birth, contact details, LMU email addresses, and bank account information. Health insurance numbers and identifiers tied to Germany's student financial aid programme may also be in the mix. In some cases, the stolen data could include reasons students applied for a leave of absence — information most people would consider deeply private.

Exam results and academic performance records were not affected.

LMU spotted the breach on Wednesday but has not yet confirmed when the attacker first got in, how long they had access, or how many students are affected. No ransom demand has been publicly disclosed. The compromised server is now offline, external security specialists are involved, and the university is monitoring dark web forums for signs the data has surfaced.

Universities make attractive targets precisely because they hold large volumes of sensitive personal and financial records while running complex, sprawling networks.

What to do: If you are or were recently enrolled at LMU Munich, watch your bank account for unusual activity and consider placing a fraud alert with your bank. Be wary of any unexpected emails or calls referencing your student details — attackers who hold this kind of data often use it to craft convincing phishing attempts.

A newly discovered Android trojan called RatHat takes mobile malware further than most, according to SecurityWeek.

RatHat spreads through smishing (SMS-based phishing) and malicious ads. Once installed, it does the expected — stealing passwords and overlaying fake banking app screens — but it also connects to a generative AI assistant that reads what's on your screen and navigates the phone's interface automatically, without needing a human operator. It captures PINs by recording exactly where your finger touches the screen at the hardware level.

The part that makes removal particularly painful: even if you delete the app, a hidden background service left behind will silently reinstall it.

What to do: Only install Android apps from the official Google Play Store. If your phone begins behaving strangely — apps opening on their own, unfamiliar services running in the background — run a scan with a trusted security app and consider a factory reset.

CVE ID not confirmed in source — check the original advisory before acting.

What the Linux Kernel is: The Linux kernel is the core software layer that sits between hardware and the operating system — it manages memory, processes, and communication across virtually every Linux-based server, device, and cloud system in the world.

What it is: A flaw in the kernel's handling of TLS (Transport Layer Security — the technology that encrypts data in transit) receive-path logic allows a specially crafted zero-length record to cause improper memory handling. It is like a gate that assumes no one will ever push it from an unusual angle — and falls open when they do.

Who's at risk: Any system running a vulnerable Linux kernel version where a local user or process can interact with TLS sockets. Cloud servers, enterprise Linux hosts, and shared computing environments face the greatest exposure.

CVSS: 9.8 (Critical — patch today. Stop reading, go patch.)

Root cause: The recvmsg() function — which handles incoming data from the network — assumes that after a zero-copy decryption operation on a DATA record, no record-type change can follow. A zero-length record injected into the receive queue breaks that assumption, sending the kernel down a logic path it was never designed to handle safely. The developer failed to validate that assumption against all possible input sequences.

Attack vector: A local attacker on the same system sends a crafted sequence of TLS records that includes a zero-length entry positioned to exploit the type-check gap. The kernel mishandles the decryption step, either exposing contents of memory it should not, or crashing the process — a denial-of-service (DoS — making a system unavailable) condition. No network-level access is required; a shell account on the target machine is sufficient.

Detection strategies: Look for unexpected kernel panics or crash logs referencing TLS or recvmsg. Monitor for unusual local user processes making high volumes of TLS socket calls. On shared systems, flag any process repeatedly opening AF_TLS sockets with anomalous record patterns.

Recommended actions:

1. Apply the latest Linux kernel security update from your distribution immediately — CISA has directed federal agencies to patch within three days.
2. Restrict local shell access on multi-user systems to only those who genuinely need it.
3. Review kernel logs for signs of unexpected crashes or memory errors in the TLS receive path.

The fake LastPass Authenticator campaign, detailed by SecurityWeek, used SEO tricks to push a malicious download page near the top of search results. Victims who searched for a legitimate security tool found a convincing fake instead.

The fix here is not a new tool — it is a habit. Before downloading any software, go directly to the official website by typing the address yourself, or use the link from the vendor's verified social media profile. Never trust a download that came from a search result alone, even if it appears at the top.

LastPass is a password manager — software that stores and organises your login credentials securely. If you use one, download it only from lastpass.com directly.

What to do: Bookmark the official download pages for any security software you use regularly. One extra step now is considerably easier than removing a kernel-level malware driver later.

Ireland's Data Protection Commission has fined Google 403 million euros ($463 million) for failing to handle users' location data lawfully under GDPR (the General Data Protection Regulation — the EU's main privacy law), according to SecurityWeek. The investigation covered Google's Web & App Activity, Location History, and Android's Location Accuracy features between 2018 and 2020.

What to do: Review your Google account's location settings at myaccount.google.com and turn off any location tracking you do not actively want.