Warnings and recommendations from national cyber security agencies, newest first. Each brief is at most 120 words, bottom line first, and links to the publication it was written from.
CERT Polska · Warning ·
Vulnerabilities in boneIO products
boneIO products have vulnerabilities.
CERT Polska reports vulnerabilities in boneIO products, including missing authentication and cleartext storage of sensitive information. Vulnerable versions range from 1.0.0 to 1.6.0. An attacker can deploy malicious flows or gain full control over devices. Issues were fixed in version 1.6.0.
Recommended by the publisher: Update to version 1.6.0.
Ny vejledning: Råd til borgere med behov for ekstra sikkerhed ved læk af personoplysninger
SAMSIK advises citizens on extra security after leaks of personal data.
Leaked personal data can be misused for fraud or threats. Citizens can take special precautions to protect themselves. The Styrelsen for Samfundssikkerhed has issued a guide with advice.
Recommended by the publisher: Citizens concerned about their security can contact the police.
PHP vulnerabilities concern all PHP versions from 5 onwards.
The PHP foundation announced two critical vulnerabilities in PHP that could lead to remote code execution. CERT-EU advises organisations to prepare for immediate patching. The vulnerabilities affect all PHP versions from PHP 5 onwards.
Recommended by the publisher: CERT-EU recommends identifying PHP-based applications and preparing to patch as soon as fixed versions become available.
CGM CLININET versions before 2026.MS3 are vulnerable to Missing Authentication for Critical Function and Deserialization of Untrusted Data. An attacker can retrieve patient documents and execute arbitrary code with root privileges. CGM has fixed these issues in version 2026.MS3.
Recommended by the publisher: Update to version 2026.MS3 or later.
CVE-2026-16477 affects CleanShot X versions 4.0.0 to 4.5.2. An attacker can execute arbitrary code via a malicious .cleanshot file. Exploitation requires the target to open the file. The vulnerability was fixed in versions 4.5.2, 4.6.3, 4.7.8 and 4.8.10.
Recommended by the publisher: Update to a fixed version.
GitLab fixes critical vulnerability CVE-2026-110264 affecting all versions from 7.0.
GitLab has published security updates for CVE-2026-110264, which has a CVSS score of 10.0 and can be exploited by an unauthenticated user to run arbitrary code. GitLab has fixed the vulnerability in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 of GitLab Community Edition and Enterprise Edition. The vulnerability affects all versions from 7.0.
Recommended by the publisher: CERT-SE recommends organisations to upgrade to the latest version as soon as possible and to search for abnormal behaviour in the product.
2026-019: Critical Vulnerability in GitLab Community and Enterprise Editions
GitLab servers are vulnerable to code execution.
The vulnerability CVE-2026-110264 affects GitLab Community and Enterprise Editions from 7.0 before 18.11.13. GitLab has fixed this critical integer overflow vulnerability. An unauthenticated user could execute arbitrary code on the affected server.
Recommended by the publisher: CERT-EU recommends updating affected assets as soon as possible.
Organisationer skal være opmærksomme: Kritisk sikkerhedsopdatering til PHP
PHP users should update due to critical vulnerabilities.
PHP has two critical vulnerabilities that can be exploited to execute arbitrary code. The PHP developers have released security updates for all supported versions. These vulnerabilities can compromise a PHP installation.
Recommended by the publisher: System owners should update their systems as soon as possible.
NCSC advises UK organisations to update PHP systems immediately.
The PHP Foundation announced an upcoming security release addressing two critical vulnerabilities in PHP. The NCSC encourages organisations to prepare for immediate updating of systems using PHP. Organisations should identify systems running any version of PHP and monitor for malicious activity.
Recommended by the publisher: The NCSC recommends applying PHP updates as they become available and continuously monitoring for security updates from third-party software vendors.
PHP.net has published security updates for CVE-2026-109618 and CVE-2026-109619. The vulnerabilities have a CVSS score of 9.2 and can be exploited for unauthenticated code execution. PHP 5 and later versions are affected.
Recommended by the publisher: CERT-SE recommends identifying PHP-based applications and following the vendor's recommendations.
Critical Vulnerabilities in PHP Require Immediate Patching
CISA urges organizations to patch PHP vulnerabilities.
CVE-2026-109618 and CVE-2026-109619 affect all PHP installations serving web requests, allowing unauthenticated remote code execution. CISA has not observed exploitation. PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 fix these vulnerabilities.
Recommended by the publisher: CISA recommends updating to a patched PHP version immediately, prioritizing internet-facing systems.
PHP versions 5 to 8 are vulnerable to code execution.
PHP versions 5, 6, 7 and 8 are affected by two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing an unauthenticated actor to execute arbitrary code. Technical details are not available yet. PHP will release a patch on October 21. Versions older than 8.2 will not receive security updates.
Recommended by the publisher: NSM recommends installing security updates as soon as they are available.
Ni nationale råd til digital sikkerhed i små virksomheder
SAMSIK issues nine national cyber security guidelines for small businesses.
The guidelines concern small businesses with fewer than 50 employees. They cover basic digital security topics such as security updates and password security. The guidelines are intended to help small businesses strengthen their digital robustness against cyber attacks. SAMSIK has developed the guidelines in collaboration with Cybersikkerhedspagten.
Recommended by the publisher: Small businesses can follow the guidelines on sikkerdigital.dk.
CISA warns of SafePay ransomware targeting businesses and infrastructure.
SafePay actors gain access by stealing passwords, exploiting vulnerabilities, and using phishing. They use CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. SafePay actors encrypt files and demand payment.
Recommended by the publisher: CISA recommends patching systems, implementing Zero Trust, and restricting administrative tools.
BeyondTrust Remote Support has a critical vulnerability.
BeyondTrust Remote Support versions before 26.2.3 are affected by CVE-2026-102764, which can be exploited to gain control over a device. The vulnerability has a CVSS score of 9.3. A security update has been implemented for Remote Support SaaS customers. CERT-SE has not mentioned exploitation.
Recommended by the publisher: CERT-SE recommends updating instances and restoring them if intrusion is suspected.
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CISA urges patching BeyondTrust Remote Support vulnerability CVE-2026-102764.
CISA is aware of a critical authentication bypass vulnerability affecting BeyondTrust Remote Support versions 26.2.3 and earlier. Cyber threat actors are actively exploiting the vulnerability. Patches are available for supported versions.
Recommended by the publisher: CISA recommends applying the BT26-05-RS patch and reviewing BeyondTrust’s security advisory.
Version 1.0: BeyondTrust Remote Support - Zero-Day Schwachstelle seit mindestens August ausgenutzt
BeyondTrust Remote Support has a zero-day vulnerability.
BeyondTrust Remote Support has a critical vulnerability tracked as CVE-2026-102764. BeyondTrust has rated it 9.3 out of 10. The Google Threat Intelligence Group and BeyondTrust report exploitation since August.
Recommended by the publisher: BSI recommends updating BeyondTrust Remote Support.
NordVPN software vulnerability affects Windows users.
NordVPN for Windows versions before 8.12 are vulnerable to Incorrect Authorization. A local attacker can stop unprotected Windows system services. The issue was fixed in version 8.12. CERT Polska received the vulnerability report.
Recommended by the publisher: Update NordVPN to version 8.12.
Version 1.0: Cisco Secure Email Gateway - Zero-Day Schwachstelle wird aktiv ausgenutzt
Cisco Secure Email Gateway has a zero-day vulnerability.
CVE-2026-76519 affects Cisco Secure Email Gateway, allowing remote attackers to write files and execute commands with root privileges. Cisco has confirmed exploitation. The vulnerability is caused by a flawed processing of email attachments with the Advanced Malware Protection feature enabled.
Recommended by the publisher: BSI recommends updating the product.