Warnings and recommendations from national cyber security agencies, newest first. Each brief is at most 120 words, bottom line first, and links to the publication it was written from.
SAMSIK (DK) · News ·
Truslen fra destruktive cyberangreb hæves til høj
SAMSIK raises threat level for destructive cyberattacks to high in Denmark.
SAMSIK assesses that Russia will attempt destructive cyberattacks against Denmark. The threat concerns critical infrastructure and may impact authorities, businesses, and citizens. Destructive cyberattacks can take the form of wiper attacks or manipulation of operational technology.
Recommended by the publisher: The Styrelsen for Samfundssikkerhed recommends taking measures to counter the increased threat.
Version 1.0: Check Point - Angreifer nutzen Schwachstellen seit Sommer aus
Check Point products are affected by critical vulnerabilities.
Check Point's Spark Firewall and Security Gateway Appliances are affected by CVE-2026-85102 and CVE-2026-93616. These vulnerabilities allow authentication bypass and remote code execution. The BSI assesses that exploitation is confirmed by the source.
Recommended by the publisher: The BSI recommends checking the advisory for Spark Firewall and Security Management Server products.
Inside a multi stage toll fraud operation targeting Poland
CERT Polska found toll fraud operation targeting Poland.
Messenger Pro app on Google Play was used for toll fraud. The app sent Polish users to premium SMS services. CERT Polska reported the app to Google. The operation used multiple layers to execute toll fraud.
Recommended by the publisher: CERT Polska recommends caution with suspicious ads and apps.
F5 BIG-IP APM has a critical vulnerability, CVE-2026-94127.
The vulnerability affects BIG-IP APM versions 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3. F5 has confirmed exploitation. An unauthenticated attacker can execute arbitrary code.
Recommended by the publisher: CERT-SE recommends applying the vendor's security update immediately.
MikroTrick: technical analysis, disclosure process, and the use of LLM agents
MikroTik patches vulnerabilities in RouterOS.
CERT Polska reported vulnerabilities to MikroTik, which released patches for RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. The patches fixed CVE-2026-86060 and CVE-2026-67279, which allowed an attacker to obtain full administrative privileges without authentication. The vulnerabilities were likely being exploited before the patches were released.
Recommended by the publisher: Install a patched version of RouterOS as soon as possible.
SAMSIK conducted a national crisis management exercise in 2025. The exercise tested cooperation between participants. Seven recommendations were identified to strengthen crisis management.
Cisco publicerar säkerhetsuppdateringar för flera sårbarheter
Cisco releases security updates for several vulnerabilities.
Cisco has released security updates for several vulnerabilities, some of which are being actively exploited. An example is CVE-2026-76460, a vulnerability in Cisco Identity Services Engine API. Successful exploitation allows an unauthenticated attacker to bypass authentication. Cisco Identity Services Engine is affected.
Recommended by the publisher: CERT-SE recommends installing security updates and analyzing logs.
NCSC guides organisations on adversary simulation.
The NCSC guides organisations on adversary simulation, also known as 'red teaming', to test defences against cyber attacks. It is designed for medium to large-sized organisations. Adversary simulation tests technical defences and reveals security gaps. The NCSC expects teams to ensure safety features to minimise risks.
Vulnerabilities in WNC T-Mobile 5G Box IDU routers
WNC T-Mobile 5G Box IDU routers have vulnerabilities.
WNC T-Mobile 5G Box IDU routers with firmware before 1.1.0.651412 have authentication bypass, command injection, and CSRF vulnerabilities. An attacker can bypass authentication or execute arbitrary commands. CERT Polska has received a report about these vulnerabilities.
Recommended by the publisher: Update to firmware version 1.1.0.651412.
Kritisk sårbarhet i Cisco Secure Email Gateway utnyttjas aktivt
Cisco Secure Email Gateway has a critical SQL injection vulnerability.
Cisco Secure Email Gateway versions 16.5, 16.0, and 15.5 are affected. An attacker can execute code with high privileges. Cisco AsyncOS is also affected. CISA has added the vulnerability to the KEV catalog.
Recommended by the publisher: CERT-SE recommends upgrading to a safe version as soon as possible.
Version 1.0: Cisco Secure Email Gateway - Aktive Ausnutzung einer Zero-Day-Schwachstelle
Cisco Secure Email Gateway has a zero-day vulnerability.
Cisco Secure Email Gateway is affected by CVE-2026-76461, a vulnerability in E-Mail Parsing of AsyncOS. The BSI reports that an attacker could execute SQL commands with root rights. Cisco has confirmed exploitation of the vulnerability.
Recommended by the publisher: The BSI recommends reviewing the Cisco advisory.
UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists
Iranian state actors target dissidents with CHOSEN BRICK spyware.
The NCSC assesses that Iran uses cyber activity to repress individuals. CHOSEN BRICK malware collects information and includes screen capture functionality. It targets Windows operating systems.
Recommended by the publisher: The NCSC recommends individuals at risk to follow the mitigation steps in the advisory.
Iranian cyber targeting of dissidents, activists and journalists
Iranian cyber actors target dissidents, activists and journalists with CHOSEN BRICK malware.
CHOSEN BRICK enables Iranian state cyber actors to collect information on a target’s contacts, emails and social media messages. The malware is delivered via social engineering on social messaging platforms. It has a wide range of functionality, including enumerating running processes and capturing screen content.
Recommended by the publisher: The NCSC shares technical information and advice to help individuals and organisations protect themselves.
Version 1.0: GitLab - Schwachstellen bereits kurz nach Veröffentlichung im Fokus von Angreifern
GitLab has security vulnerabilities.
GitLab Enterprise and Community editions have 18 security vulnerabilities. The CVSS shows 2 critical, 6 high, 9 medium and 1 low severity. Attacks were observed shortly after publication.
Recommended by the publisher: The BSI recommends updating GitLab.
Vulnerabilities in Alior Bank "raty" module for PrestaShop
Alior Bank's raty module has SQL injection vulnerabilities.
The vulnerabilities affect versions 8.0.0 to 8.1.11 and 8.1.9 to 8.1.12. An attacker can inject arbitrary SQL, potentially allowing unauthorized access to database contents. CERT Polska has received a report about these vulnerabilities.
Recommended by the publisher: Update to fixed versions 9.0.7, 9.0.8, 8.1.11 or 8.1.12.
GitLab fixes critical vulnerabilities in Community and Enterprise Editions.
GitLab Community Edition and Enterprise Edition have critical vulnerabilities CVE-2026-85706 and CVE-2026-87719. CVE-2026-85706 is actively exploited. An attacker can read arbitrary files from the GitLab server. Affected products include GitLab Community Edition and Enterprise Edition versions from 18.7 to 19.1.8, 19.2 to 19.2.6, and 19.3 to 19.3.2.
Recommended by the publisher: CERT-SE recommends installing security updates and analyzing logs for potential intrusions.
Nu skal virksomheder i hele EU underrette om digitale sårbarheder i produkter
EU companies must report digital vulnerabilities in products.
The Cyber Resilience Act requires companies to report digital vulnerabilities in products with digital elements. This includes products available on the European market, such as software and hardware. Companies must report to the national CSIRT and ENISA.
Recommended by the publisher: SAMSIK recommends reporting digital vulnerabilities and serious IT security incidents.