Cyber Security Blog

Blog posts about Cyber Security, Pentesting, Cloud Security and Red Teaming from our team.

Penetration Test

CVE-2026-90848: One Missing Escape in the AusweisApp and Its Consequences

An unescaped eID server error message in AusweisApp 2.5.4 led to XSS, manipulated dialogs and crashes. Root cause, attack and fix.
Jan Kahmen
Jan Kahmen
6 min read
Penetration Test

Lost Device Pentest: What a Lost Laptop Really Reveals

Laptop left on the train? A lost device pentest shows what an attacker reaches with and without credentials and whether BitLocker and hardening hold up.
Jan Kahmen
Jan Kahmen
9 min read
ISMS

The Commission's CRA Guidance: What C(2026) 5252 Settles for Manufacturers

The Commission published its CRA guidance on 27 July 2026. What it settles on scope, substantial modification, support periods and open source.
Jan Kahmen
Jan Kahmen
3 min read
Incident Response

Preparing for Zero Days: Resilience Over Prevention

Time-to-exploit sits at minus 7 days and the KEV catalog grows weekly. How organizations prepare for vulnerabilities without a patch.
Jan Kahmen
Jan Kahmen
3 min read
Penetration Test

CRA and Pentests: What the Cyber Resilience Act Requires in Security Testing

The CRA demands effective, regular security testing. What Annex I requires, how BSI TR-03183 makes it concrete, and where pentests fit in.
Jan Kahmen
Jan Kahmen
3 min read
Social Engineering

ClickFix: How Fake CAPTCHAs Trick Users Into Self-Infection

ClickFix makes users run malicious code themselves. How the fake-CAPTCHA scheme works and how organizations can defend against it.
Jan Kahmen
Jan Kahmen
6 min read