Global threat intelligence feed

CISA Adds Three Known Exploited Vulnerabilities to Catalog

<p>CISA has added three new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-42016" target="_blank">CVE-2026-42016</a> JFrog Artifactory Incorrect Authorization Vulnerability&nbsp;</li> <li><a href="https://www.cve.org

CISA Adds One Known Exploited Vulnerability to Catalog

<p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-85706" target="_blank">CVE-2026-85706</a> GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability</li> </ul> <p>This type of

CISA Adds Two Known Exploited Vulnerabilities to Catalog

<p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-67277" target="_blank">CVE-2026-67277</a> MikroTik RouterOS Missing Authentication for Critical Function Vulnerability</li> <li><a href="https:

Orthanc DICOM Server

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-253-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an authenticated remote attacker to write past the end of a heap allocation when Orthanc decodes an attacker-supplied PNG or JPEG image, resulting in a crash of the Orthanc process and a denial-o

AVEVA Pipeline Integrity Monitor

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-253-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to disclose information, brute-force hashes, or run arbitrary code in a browser session.</strong></p> <p>The following versions of AVEVA Pipeline Integrity Monitor are affected:</p>

ST Engineering iDirect iQ-Series Terminals (Update A)

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to device information or cause a denial-of-service condition.</strong></p> <p>The following versions of ST Engineering iDirect iQ-Series Terminals (Updat

NextGen Healthcare Mirth Connect

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-253-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to exfiltrate date or cause a denial-of-service condition.</strong></p> <p>The following versions of NextGen Healthcare Mirth Connect are affected:</p> <ul> <li>Mirth Connect <=v4.

FBI Cyber Strategy

CISA Adds Four Known Exploited Vulnerabilities to Catalog

<p>CISA has added four new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2025-25249" target="_blank">CVE-2025-25249</a> Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability</li> <li><a href="https:/

CISA Releases Updated Insider Threat Guide With New Insights to Mitigate Physical and Cyber Threats

China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies

China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies

<h2><strong>Executive summary</strong></h2> <p>China-based artificial intelligence (AI) companies are conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies’ models through industrial-scale knowledge distillation campaigns that form the core—not merely a supplement—of their AI development strategy. While “distillation” is recognized as a legitimate and useful technique i

CareCam Pro IP Cameras

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-251-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker to take full control of the device.</strong></p> <p>The following versions of CareCam Pro IP Cameras are affected:</p> <ul> <li>ANJIA AJL33PC0801 Firmware linux_linux_202008261138_svn1

CISA Adds Four Known Exploited Vulnerabilities to Catalog

<p>CISA has added four new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-75650" target="_blank">CVE-2026-75650</a> Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Eng

CISA, NSA and FBI Warn of China-Based AI Companies Targeting US AI Models with Industrial-Scale Knowledge Distillation Campaigns to Shortcut AI Development

The hidden risks of shadow AI

Understanding why staff use unapproved AI tools is key to managing the security challenges they can create.

CISA Adds One Known Exploited Vulnerability to Catalog

<p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-85046" target="_blank">CVE-2026-85046</a> Google Chromium V8 Type Confusion Vulnerability</li> </ul> <p>This type of vulnerability is a fr

IXON VPN Client

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-246-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker to perform remote code execution on the computer running the client with elevated privileges.</strong></p> <p>The following versions of IXON VPN Client are affected:</p> <ul> <li>VPN C

Inductive Automation Ignition

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-246-06.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow any authenticated user to create projects.</strong></p> <p>The following versions of Inductive Automation Ignition are affected:</p> <ul> <li>Ignition <=8.1.53 (CVE-2026-77393)</li> </ul> <div cla

Rockwell Automation ArmorStart LT

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-246-04.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could result in a loss of webserver availability or allow an attacker to inject malicious scripts that will be executed when other users access the affected page.</strong></p> <p>The following versions of

Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-169-07.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Schneider Electric is aware of a vulnerability in the following products: The Easergy C5 is a scalable and interoperable bay controller, protection and merging unit for large and critical infrastructure electrical distribution systems. The Easergy MiCOM

OPCFoundation OPC UA LocalDiscoveryServer (LDS)

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-246-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker to take control of a high-privilege terminal during installation and run arbitrary commands.</strong></p> <p>The following versions of OPCFoundation OPC UA LocalDiscoveryServer (LDS) a

Rockwell Automation ControlFLASH

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-246-03.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could give an attacker the ability to run any commands or code of the attacker&#039;s choice on a target machine at the logged-in user&#039;s permission level.</strong></p> <p>The following versions of Rockwe

Rockwell Automation 1756-ENBT Module

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-246-05.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could crash the module. The device requires a restart to recover.</strong></p> <p>The following versions of Rockwell Automation 1756-ENBT Module are affected:</p> <ul> <li>1756-ENBT module vers:all/* (CVE-202

Pyramid Solutions NetStaX EtherNet/IP Stack

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-246-07.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could result in memory corruption, a device crash, or a potential remote attack vector without the originating device receiving a CIP error indicating that the request could not be processed.</strong></p> <p>

Preparing for the Post-Quantum Era: A Call to Action

<p>CISA and the Group of Seven (G7) Cyber Security Working Group released <a href="https://urldefense.us/v3/__https:/cyber.gouv.fr/en/publications/jointly-led-international-publications/preparing-for-the-post-quantum-era-a-call-to-action/__;!!BClRuOV5cvtbuNI!A4T2ayZfcpa7J25BSkxtB9A-AHREvqT8FQmzhRjVarx8w3J-Vs-CBcKQcElRqsqsZqtIztYiIMY01My3HFmonToxreu7Z35ka6L8naw5xg$" target="_blank"><em>Preparing for the Post-Quantum E

Tycon Systems TPDIN-Monitor-WEB2 (Update A)

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-202-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could result in an attacker accessing sensitive credentials, disrupting connected infrastructure, or manipulating physical equipment, which could present a physical safety risk.</strong></p> <p>The followi

Tycon Systems TPDIN-Monitor-WEB3

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-246-08.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow for an attacker to perform a man-in-the-middle (MitM) attack, cause a factory reset, wipe credentials, or retrieve sensitive information.</strong></p> <p>The following versions of Tycon Systems

Communicating Under Pressure: Best Practices for Service Providers

Communicating Under Pressure: Best Practices for Service Providers

<p>Developed by CISA, the Federal Bureau of Investigation, and international partners, this <a href="https://www.cisa.gov/sites/default/files/2026-09/joint-guidance-communicating-under-pressure-508c.pdf" title="Communicating Under Pressure: Best Practices for Service Providers">guidance</a> describes how organizations can plan and execute clear, timely, accurate, and audience-appropriate communications during IT and

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

<p>CISA has added seven new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> <div class="ListContainerWrapper SCXW190820602 BCX8"> <ul type="disc"> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-9586" target="_blank"><u>CVE-2026-9586</u></a> Sangoma Switchvox SQL

Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing

Disruptive cyber activity highlights risk from internet-exposed systems and edge devices

Owners of operational technology encouraged to address avoidable vulnerabilities, and build long-term cyber resilience.

China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems

CISA Advisory Highlights Red Team Findings to Help Organizations Assess Risk, Identify Threats and Enable Effective Incident Response

CISA Releases Foundational, Flexible Guidance to Help Federal Agencies Implement Effective Logging, Visibility and Operational Standards

Managing the cyber risk of agentic AI

Use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity.

Defending Against an Active Threat to Siemens S7 Series PLCs

How BitLocker PINs help protect your data and devices

Using a PIN mitigates many BitLocker vulnerabilities. Make sure you’re ready for the next one...

CISA Unveils New Cybersecurity Resources for K-12 Schools and Districts

Help shape the future of resilient private 5G

The NCSC wants to collaborate with organisations developing technologies and approaches for secure, resilient and deployable private 5G

Water sector example added to the NCSC’s Secure connectivity principles

New guidance is the first content authored by the Industrial Control System COI to appear on ncsc.gov.uk.

Sexual Exploitation Actors Stealing and Leaking Explicit Content

CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors Targeting Multiple Critical Infrastructure Sectors

Ongoing Threats of Swatting and Indicators for Community Members

NCSC statement in response to recent incidents resulting from frontier AI evaluations

A statement from Ollie Whitehouse, Chief Technology Officer at the NCSC, on AI security following recent incidents.

Malicious Cyber Actors Targeting Water and Wastewater Sector Internet Facing Programmable Logic Controllers, Causing Operational Disruptions

CISA Guide Helps Federal Agencies Securely and Effectively Use Open Source Software

CISA and Partners Unveil Updated Software Bill of Materials Resource That Improves Transparency, Security and Risk-Informed Decision Making

Making forensic observability the norm for network devices

Progress is being made, but too many network devices still remain difficult to investigate after compromise

CISA Joins Australia and Others to Publish Guidance to Isolate Operational Technology and Enabling Systems in Critical Infrastructure

When cyber attacks happen: helping organisations recover

A highly disruptive incident can feel overwhelming. New guidance provides a framework for response and recovery.

CISA, NSA, FBI and Partners Warn Zimbra Collaboration Suite Users of Ongoing Russian State-Supported Malicious Threat Activity

UK and partners expose Russian state-supported actors for new ‘zero-click’ phishing campaign targeting Western organisations

GCHQ’s National Cyber Security Centre and international partners issue warning as ‘LAUNDRY BEAR’ cyber threat group exposed for targeted phishing campaign

Post-quantum cryptography (PQC) migration workshop report

No organisation can navigate the migration alone; key takeaways from our first PQC migration workshop.

FBI Warns of Scammers Impersonating the IC3

Helping small businesses with free, hands-on cyber consultancy

Cyber Advisors are offering free 30-minute consultations to help small businesses get started with cyber security.

UK and Allies urge critical sectors to improve defences against Russian intelligence targeting

New advisory highlights Russian state cyber actors’ global exploitation of poorly configured routers

Cyber Essentials Pathways: from proof of concept to cyber confidence

An alternative path to Cyber Essentials Plus certification, without compromising the integrity of the scheme.&nbsp;

Cyber Shield: The path to an agentic AI future for cyber defence

Why the UK is pioneering an initiative to develop a national scale, sovereign defence capability

Building more resilient CNI: what industry pen testers told us

Pen testers suggest what organisations can do to make their job more difficult.

The AI shift in cyber risk: why leaders must act now

Five Eyes cyber security agencies urge organisations to act on rapidly transforming cyber risk.

Alert: NCSC issues advice following global targeting of Fortinet firewalls and VPN gateways

Organisations using Fortinet services are being urged to take action following a campaign affecting firewalls and VPN gateways.

The 'vibe coding spectrum' approach to AI-assisted software development

Different code deserves different levels of oversight, so calibrate your approach to ‘vibe coding’ accordingly.

NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK's critical systems

Dr Richard Horne highlighted the scale of cyber threats against the UK’s critical infrastructure at RUSI’s Annual Security Lecture.