https://turingpoint.de/en/blog/ Articles on pentesting, ISMS, security awareness and cyber security trends by turingpoint. en-US https://turingpoint.de/en/blog/clickfix-how-fake-captchas-trick-users-into-self-infection/ https://turingpoint.de/en/blog/clickfix-how-fake-captchas-trick-users-into-self-infection/ Tue, 11 Aug 2026 00:00:00 GMT ClickFix makes users run malicious code themselves. How the fake-CAPTCHA scheme works and how organizations can defend against it. https://turingpoint.de/en/blog/traffic-light-protocol-tlp-sharing-sensitive-information/ https://turingpoint.de/en/blog/traffic-light-protocol-tlp-sharing-sensitive-information/ Wed, 05 Aug 2026 00:00:00 GMT How Traffic Light Protocol (TLP) 2.0 governs the exchange of sensitive security information: labels, marking rules, and common pitfalls in practice. https://turingpoint.de/en/blog/penetration-testing-in-the-bsi-c5-attestation/ https://turingpoint.de/en/blog/penetration-testing-in-the-bsi-c5-attestation/ Thu, 09 Jul 2026 00:00:00 GMT BSI C5 requires penetration testing explicitly. Which frequency, tester qualification, and report are needed for the C5 attestation. https://turingpoint.de/en/blog/cra-reporting-obligation-from-september-2026/ https://turingpoint.de/en/blog/cra-reporting-obligation-from-september-2026/ Tue, 07 Jul 2026 00:00:00 GMT From 11 September 2026 the Cyber Resilience Act reporting obligation applies. What manufacturers must report, which deadlines apply and why the 24-hour clock fails in practice. https://turingpoint.de/en/blog/ad-cs-escalation-esc9-to-esc16/ https://turingpoint.de/en/blog/ad-cs-escalation-esc9-to-esc16/ Wed, 24 Jun 2026 00:00:00 GMT ESC9 through ESC16 in Active Directory Certificate Services: the escalation techniques that classic ESC1–ESC8 guides leave out, with precondition and hardening. https://turingpoint.de/en/blog/what-is-a-security-advisory/ https://turingpoint.de/en/blog/what-is-a-security-advisory/ Wed, 10 Jun 2026 00:00:00 GMT A security advisory documents a vulnerability with its severity, affected versions and patch. How an advisory is structured and how it comes to be. https://turingpoint.de/en/blog/the-availability-vector-in-cvss/ https://turingpoint.de/en/blog/the-availability-vector-in-cvss/ Thu, 04 Jun 2026 00:00:00 GMT In CVSS, availability is a standalone security objective. How the availability vector works and why a flaw with no data exposure still reaches CVSS 7.5. https://turingpoint.de/en/blog/cvss-10-out-of-10-the-perfect-score/ https://turingpoint.de/en/blog/cvss-10-out-of-10-the-perfect-score/ Wed, 27 May 2026 00:00:00 GMT A clean 10.0 in CVSS is rare and follows an exact combination of metrics. What makes the perfect score, and why most findings stall at 9.8. https://turingpoint.de/en/blog/stored-xss-dangers-cve-2026-45738-argo-cd/ https://turingpoint.de/en/blog/stored-xss-dangers-cve-2026-45738-argo-cd/ Wed, 20 May 2026 00:00:00 GMT Stored XSS persists in the backend and fires on every render. The anatomy of the sink, trust context, and privilege escalation of an underrated XSS class. https://turingpoint.de/en/blog/authentik-sfe-xss-cve-2026-42849/ https://turingpoint.de/en/blog/authentik-sfe-xss-cve-2026-42849/ Wed, 13 May 2026 00:00:00 GMT Found during a customer pentest: CVE-2026-42849 lets attackers take over an Authentik session via a crafted link. Finding, impact, and patch. https://turingpoint.de/en/blog/hardening-npm-supply-chains-lessons-from-mini-shai-hulud/ https://turingpoint.de/en/blog/hardening-npm-supply-chains-lessons-from-mini-shai-hulud/ Tue, 12 May 2026 00:00:00 GMT Mini Shai-Hulud compromised 42 TanStack packages via GitHub Actions. Three hardening layers against npm supply chain attacks in practice. https://turingpoint.de/en/blog/secure-mfa-despite-reverse-proxy/ https://turingpoint.de/en/blog/secure-mfa-despite-reverse-proxy/ Mon, 04 May 2026 00:00:00 GMT Reverse proxy phishing bypasses classic MFA. ENISA Q1 2026 and §38 BSIG now require phishing-resistant factors. What actually defends today and how migration looks. https://turingpoint.de/en/blog/owasp-top-10-mapping-2021-to-2025/ https://turingpoint.de/en/blog/owasp-top-10-mapping-2021-to-2025/ Mon, 20 Apr 2026 00:00:00 GMT The OWASP Top 10:2025 introduces two new categories, one rename, and a quiet goodbye to SSRF. What that means for pentest scopes and finding templates. https://turingpoint.de/en/blog/grundschutz-plus-plus-oscal-catalog-analysis/ https://turingpoint.de/en/blog/grundschutz-plus-plus-oscal-catalog-analysis/ Fri, 10 Apr 2026 00:00:00 GMT We analyzed the Grundschutz++ OSCAL catalog: 998 requirements, penetration tests only optional. What this means for organizations under NIS-2. https://turingpoint.de/en/blog/cloud-attacks-2026-ibm-x-force-report/ https://turingpoint.de/en/blog/cloud-attacks-2026-ibm-x-force-report/ Fri, 20 Mar 2026 00:00:00 GMT IBM X-Force 2026: 44% more attacks on cloud applications, 16M infected devices, identity as the primary risk. What organizations must do now. https://turingpoint.de/en/blog/bsi-certified-pentest-providers/ https://turingpoint.de/en/blog/bsi-certified-pentest-providers/ Fri, 20 Feb 2026 00:00:00 GMT Who is authorized to perform IS penetration tests according to BSI? Personal certification, company requirements, and the current BSI list. https://turingpoint.de/en/blog/din-spec-27076-preparation-and-implementation-for-smes/ https://turingpoint.de/en/blog/din-spec-27076-preparation-and-implementation-for-smes/ Sun, 01 Feb 2026 00:00:00 GMT What companies need to know about the CyberRisikoCheck based on DIN SPEC 27076: topic areas, scoring, funding, and the path to ISO 27001. https://turingpoint.de/en/blog/protection-requirement-categories-in-cyber-security/ https://turingpoint.de/en/blog/protection-requirement-categories-in-cyber-security/ Thu, 01 Jan 2026 00:00:00 GMT How organizations use BSI IT-Grundschutz protection requirement categories to prioritize IT security and allocate resources effectively. https://turingpoint.de/en/blog/security-testing-in-the-context-of-the-mitre-attandck-framework/ https://turingpoint.de/en/blog/security-testing-in-the-context-of-the-mitre-attandck-framework/ Thu, 11 Dec 2025 00:00:00 GMT Cyberattacks follow recurring patterns. The MITRE ATT&CK Framework systematically catalogs these patterns and provides organizations with a common language. https://turingpoint.de/en/blog/bsi-tr-03161-comprehensive-security-standard-for-healthcare-applications/ https://turingpoint.de/en/blog/bsi-tr-03161-comprehensive-security-standard-for-healthcare-applications/ Thu, 30 Oct 2025 00:00:00 GMT BSI TR-03161: Security standard for healthcare applications with mobile, web and backend components