What the national cyber security agencies have published, in at most 120 words each, bottom line first, with a link to the original. Nothing else: no accounts, no cookies, no trackers.
Warnings and recommendations from national cyber security agencies: BSI (DE), CERT Polska, CERT-EU, CERT-SE, CISA, MAS (SG), NCSC (UK), NSM (NO), SAMSIK (DK). Joint advisories by NSA and FBI arrive through CISA.
CERT Polska · Warning ·
Vulnerabilities in boneIO products
boneIO products have vulnerabilities.
CERT Polska reports vulnerabilities in boneIO products, including missing authentication and cleartext storage of sensitive information. Vulnerable versions range from 1.0.0 to 1.6.0. An attacker can deploy malicious flows or gain full control over devices. Issues were fixed in version 1.6.0.
Recommended by the publisher: Update to version 1.6.0.
Ny vejledning: Råd til borgere med behov for ekstra sikkerhed ved læk af personoplysninger
SAMSIK advises citizens on extra security after leaks of personal data.
Leaked personal data can be misused for fraud or threats. Citizens can take special precautions to protect themselves. The Styrelsen for Samfundssikkerhed has issued a guide with advice.
Recommended by the publisher: Citizens concerned about their security can contact the police.
PHP vulnerabilities concern all PHP versions from 5 onwards.
The PHP foundation announced two critical vulnerabilities in PHP that could lead to remote code execution. CERT-EU advises organisations to prepare for immediate patching. The vulnerabilities affect all PHP versions from PHP 5 onwards.
Recommended by the publisher: CERT-EU recommends identifying PHP-based applications and preparing to patch as soon as fixed versions become available.
CGM CLININET versions before 2026.MS3 are vulnerable to Missing Authentication for Critical Function and Deserialization of Untrusted Data. An attacker can retrieve patient documents and execute arbitrary code with root privileges. CGM has fixed these issues in version 2026.MS3.
Recommended by the publisher: Update to version 2026.MS3 or later.
CVE-2026-16477 affects CleanShot X versions 4.0.0 to 4.5.2. An attacker can execute arbitrary code via a malicious .cleanshot file. Exploitation requires the target to open the file. The vulnerability was fixed in versions 4.5.2, 4.6.3, 4.7.8 and 4.8.10.
Recommended by the publisher: Update to a fixed version.
GitLab fixes critical vulnerability CVE-2026-110264 affecting all versions from 7.0.
GitLab has published security updates for CVE-2026-110264, which has a CVSS score of 10.0 and can be exploited by an unauthenticated user to run arbitrary code. GitLab has fixed the vulnerability in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 of GitLab Community Edition and Enterprise Edition. The vulnerability affects all versions from 7.0.
Recommended by the publisher: CERT-SE recommends organisations to upgrade to the latest version as soon as possible and to search for abnormal behaviour in the product.
2026-019: Critical Vulnerability in GitLab Community and Enterprise Editions
GitLab servers are vulnerable to code execution.
The vulnerability CVE-2026-110264 affects GitLab Community and Enterprise Editions from 7.0 before 18.11.13. GitLab has fixed this critical integer overflow vulnerability. An unauthenticated user could execute arbitrary code on the affected server.
Recommended by the publisher: CERT-EU recommends updating affected assets as soon as possible.
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
Plex Media Server External Control of File Name or Path Vulnerability
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
From security media and vendors' research teams. Not authorities: read the claims as theirs.
The Hacker News · News ·
Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
CERT-UA reports Dahua IP cameras hijacked in Ukraine.
CERT-UA warns of unauthorized access to Dahua video surveillance systems. Attackers can access video streams and change device configurations. The State Special Communications Service of Ukraine reports cases of compromise.
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
CISA confirms exploitation of PHP2Shell flaws.
CISA reports active exploitation of PHP2Shell flaws, including CVE-2026-109618, allowing remote code execution. The vulnerabilities are rated 9.2 on the CVSS scoring system. They affect PHP2Shell deployments. CISA added them to its Known Exploited Vulnerabilities catalog.
Recommended by the publisher: The Hacker News does not recommend any action.
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
Sansec reports 953 online stores infected with JavaScript malware.
Sansec says the malware targets mostly Magento stores, adding code to serve malicious JavaScript. The campaign has been active since July 2025. Sansec reports this as a long-running campaign.
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP fixes Brotli code execution flaw in Windows packages.
The Hacker News reports PHP rebuilt its Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when it decompresses HTTP responses automatically.
Recommended by the publisher: The Hacker News does not recommend any action.
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Attackers use Microsoft Teams to deploy malware and ransomware.
The Hacker News reports attackers use Microsoft Teams' external chat feature to conduct scams or deliver malware. A consistent pattern of attacker behavior has emerged across incidents. The same throwaway tenants and IT themes are used.
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
Hackers find critical bugs everywhere.
The Hacker News reports critical bugs are showing up everywhere, letting attackers run code remotely. Hackers are scanning for targets and some flaws are already being used in attacks. Security teams have more urgent patches than they can keep up with. A leaked key led to a software supply-chain issue.
Recommended by the publisher: Security teams should patch urgently.
AI risk assessment: a step-by-step assessment of one AI system against the EU AI Act and ISO/IEC 42001, in English or Danish, with export to PDF, Word and Markdown. It runs entirely in your browser; nothing is sent or stored.
AI security maturity assessment: rate how well your organisation governs and secures its use of AI, in eight areas on a scale from 0 to 5, against a target, and get a plan for the gaps.
GRC
Information security risk assessment: a step-by-step risk assessment following the process in ISO/IEC 27005, on a 4×4 or 5×5 risk matrix, in English or Danish, with export to PDF, Word and Markdown. It runs entirely in your browser; nothing is sent or stored.
Statement of Applicability: go through the 93 controls of ISO/IEC 27001:2022 Annex A, decide and justify each, and export the statement. It can start from the risk assessment's draft, and it too stays in your browser.
ISO/IEC 27001 gap analysis: where the management system stands on clauses 4 to 10, with a result per clause and an action plan for the gaps.
Business impact analysis: how long each activity can be down, how fast it must be back, and whether what it depends on can keep up.
Threat model (STRIDE): a system as parts and data flows, drawn for you, and what can go wrong for each part.
NIS 2 self-assessment: whether you are likely to be covered, where you stand on management’s responsibility, the ten security measures and incident reporting, and an action plan for the gaps. In your browser, like the others.
Cyber risk report for the board: scenarios in business language, loss in money held against appetite and capacity, a few indicators and the decisions you ask for, as a short paper.
NIS 2 incident report: the three deadlines after a significant incident, and drafts of the early warning, the notification and the final report.
Supplier security management: how critical each supplier is, what to ask and what a good answer looks like, what the contract gives you, and what is decided about the gaps.
Ransomware
Groups, victims, techniques and detection coverage are tracked on a site of their own: Grayfox Ransomware Tracker ↗