Warnings and recommendations from national cyber security agencies, newest first. Each brief is at most 120 words, bottom line first, and links to the publication it was written from.
NCSC (UK) · Guidance ·
Using TLS to protect data
NCSC advises system administrators on configuring TLS securely.
The NCSC guidance covers configuring TLS 1.3 and TLS 1.2, managing deprecated protocol versions, and using certificates with TLS. TLS 1.1 and 1.0 have been deprecated by the IETF. The NCSC recommends disabling TLS features known to be insecure and transitioning to TLS 1.3 to adopt post-quantum cryptography.
Recommended by the publisher: The NCSC recommends using hybrid schemes as an interim measure when migrating to PQC. System administrators should keep servers and client software up to date.
Vulnerability in Sparx Systems Enterprise Architect software
Enterprise Architect has XXE vulnerability.
Sparx Systems Enterprise Architect version 17.1 is vulnerable to XML External Entity injection. An attacker can read arbitrary files from the victim's filesystem. The vulnerability may also affect other versions.
Recommended by the publisher: CERT Polska recommends updating Enterprise Architect.
Slican telephone exchanges have vulnerabilities, affecting IPx, CCT-1668, MAC-6400, CXS-0424.
CERT Polska has received a report about vulnerabilities in Slican telephone exchanges. The vulnerabilities are Inadequate Encryption Strength, SQL Injection and Plaintext storage of a password. Slican IPx series version 6.62.0100 fixes these issues. CCT-1668, MAC-6400, CXS-0424 will not receive updates.
Recommended by the publisher: The vendor recommends that users of End-Of-Life devices contact their service department to determine upgrade options.
2026-017: Critical Vulnerability in Cisco Secure Email Gateway
Cisco Secure Email Gateway has a critical vulnerability.
The vulnerability CVE-2026-76519 affects Cisco Secure Email Gateway running certain versions of Cisco AsyncOS Software. Cisco has confirmed exploitation. An attacker can write arbitrary files and execute commands with root privileges.
Recommended by the publisher: CERT-EU recommends updating the Content Scanner Tools package or upgrading Cisco AsyncOS Software as soon as possible.
Ivanti Connect Secure has zero-day vulnerabilities.
Ivanti Connect Secure has a zero-day vulnerability with CVE-2026-104935, allowing remote command execution. Ivanti reports limited attacks. The CVSS score is 8.6.
Recommended by the publisher: Ivanti published an advisory.
CERT-SE recommends installing October security updates.
Several vendors have released monthly security updates for October. Cisco, Microsoft, SAP, Ivanti, and Adobe are affected. CERT-SE recommends installing updates according to vendor instructions.
Recommended by the publisher: Install security updates as soon as possible.
Microsoft has published its monthly security updates. NSM has no specific vulnerabilities to highlight. The updates are available on Microsoft's website.
Recommended by the publisher: NSM recommends system owners to update their software to the latest version as soon as possible.
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
CISA advises patching Ivanti Connect Secure.
CISA is aware of cyber threat actors exploiting CVE-2026-104935 in Ivanti Connect Secure versions 25.1.1.1 and prior. This vulnerability allows remote execution of arbitrary commands. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities Catalog.
Recommended by the publisher: CISA urges organizations to update to the latest version.
GitLab fixes critical vulnerability in Community and Enterprise Editions.
GitLab Community Edition and Enterprise Edition versions before 19.2.8, 19.3.5, and 19.4.2 are affected. CVE-2026-97229 has a CVSS score of 10.0. Successful exploitation allows an unauthenticated user to run arbitrary code on the server. GitLab has published security updates for several vulnerabilities.
Recommended by the publisher: CERT-SE recommends installing security updates promptly, especially if the product is publicly exposed, and analyzing logs for potential intrusion.
2026-016: Critical Vulnerability in GitLab CE and EE
GitLab CE and EE have a critical vulnerability.
The vulnerability CVE-2026-97229 affects GitLab CE and EE versions before 19.4.2, 19.3.4 and 19.2.8. An unauthenticated attacker can execute arbitrary code on the server. GitLab also fixed other vulnerabilities, including CVE-2026-92883 and CVE-2026-16301.
Recommended by the publisher: CERT-EU recommends upgrading self-managed GitLab CE/EE instances to a fixed version.
China-linked malicious actors called out by UK and international partners for targeting sensitive data globally
China-linked actors target sensitive data globally.
China-linked company Integrity Technology Group enables cyber actors to target organisations worldwide, using AI-enabled tools and large-scale botnets to compromise networks and steal sensitive data, affecting critical sectors.
Recommended by the publisher: Organisations are being urged to strengthen their cyber resilience and defend against this evolving threat.
Ollama software vulnerability affects versions 0.34.2 to 0.35.0.
CVE-2026-103663 is a Relative Path Traversal vulnerability in Ollama software. An unauthenticated remote attacker can write a malicious binary outside the model store. CERT Polska has received a report about this vulnerability. The issue was fixed in version 0.35.0.
Recommended by the publisher: Update to version 0.35.0 or later.
2026-015: Critical Vulnerability in Multiple Atlassian Products
Atlassian products have a critical arbitrary file access vulnerability.
The vulnerability CVE-2026-21589 affects Bitbucket Data Center, Confluence Data Center, and other products. An unauthenticated attacker can access specific files. Atlassian notes that some configurations may contain sensitive files.
Recommended by the publisher: CERT-EU recommends upgrading affected installations to a fixed version as soon as possible.
Guidelines on Artificial Intelligence Risk Management for Financial Institutions
The Monetary Authority of Singapore (MAS) has issued guidelines on AI risk management for all financial institutions, including generative AI and AI agents, taking effect on 7 October 2027.
MAS expects the board and senior management to oversee risks from AI use. Institutions should identify their AI use, keep an inventory and assess the risk materiality of each use case by impact, complexity and reliance. Life cycle controls cover data management, fairness, human oversight, third-party AI, testing, cybersecurity, monitoring and change management, in proportion to risk.
Recommended by the publisher: Meet the expectations on oversight, AI identification, inventory and risk materiality assessment from 7 October 2027, and those on life cycle controls and capabilities by 7 October 2028.
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Chinese government-linked actors target organizations worldwide.
Chinese government-linked cyber threat actors exploit vulnerabilities in Microsoft Exchange servers using scanning tools and cross-site scripting attacks. They establish persistence through VPN software and exfiltrate emails and credentials using scripts. Affected products include those with CVE-2014-6278, CVE-2015-3306, and other vulnerabilities.
Recommended by the publisher: CISA recommends disabling unused services and ports, sanitizing web application inputs, and implementing multifactor authentication.
ASOS customers' personal info may have been accessed.
ASOS is investigating a cyber incident where some customers received an unauthorised push notification. Basic personal information including name and contact details may have been accessed. The company does not believe payment card information or account passwords were affected. ASOS customers should assume they are affected.
Recommended by the publisher: The NCSC recommends seeing their data breach guidance and looking out for suspicious messages.
GNU Aspell software has vulnerabilities, affecting versions before 0.60.8.3.
CVE-2026-75818, CVE-2026-75819, and CVE-2026-75820 are heap-based buffer overflow, out-of-bounds read, and integer overflow vulnerabilities. An attacker can trigger memory corruption or denial of service via crafted files. These issues were fixed in version 0.60.8.3.
Recommended by the publisher: Update to version 0.60.8.3 to fix vulnerabilities.
Myndigheder, organisationer og virksomheder bør supplere deres identitetskontrol efter læk fra CPR-registeret
SAMSIK advises authorities to supplement identity control.
The SAMSIK assesses that authorities, organisations and companies should review their identification processes. Unauthorised access to the CPR register has occurred. The SAMSIK recommends using additional information for identity control.
Recommended by the publisher: The SAMSIK recommends supplementing identity control.
Uvedkommende har fået adgang til borgeres CPR-oplysninger: Sådan skal du forholde dig
Uvedkommende har fået adgang til borgeres CPR-oplysninger.
Forsknings-, Uddannelses og Digitaliseringsministeriet har oplyst, at uvedkommende har skaffet sig uautoriseret adgang til bl.a. navne og adresser samt CPR-numre gennem CPR-systemet. Personoplysninger kan misbruges i forbindelse med svindel.
Recommended by the publisher: Myndigheder og borgere bør være opmærksomme på forsøg på svindel.