Global threat intelligence feed

From industry concern to practical action: the value of working with regulators

How industry, the NCSC and the FCA worked together to help organisations share information while protecting market integrity

CISA Adds Two Known Exploited Vulnerabilities to Catalog

<div class="OutlineElement Ltr SCXW42064574 BCX8"> <p class="text-align-justify">CISA has added two new vulnerabilities to its <a class="Hyperlink SCXW42064574 BCX8" href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" target="_blank" rel="noreferrer noopener"><u>Known Exploited Vulnerabilities (KEV) Catalog</u></a> and updated the PHP Alert, <a class="Hyperlink SCXW42064574 BCX8" href="https://www.cis

CISA Unveils New Strategy to Strengthen National Cyber Defense and Critical Infrastructure Security

Suspicious Letters Containing White Powder Mailed to State and Local Election Officials, Media Organizations, and Public and Private Polling Companies

Critical Vulnerability Alert: PHP Core

CISA Adds One Known Exploited Vulnerability to Catalog

<p>CISA has added one new vulnerability to its&nbsp;<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul type="disc"> <li><a class="Hyperlink SCXW162250516 BCX8" href="https://www.cve.org/CVERecord?id=CVE-2026-110447" target="_blank" rel="noreferrer noopener"><u>CVE-2026-110447</u></a> Collabora Onli

CISA Adds One Known Exploited Vulnerability to Catalog

<p>CISA has added one new vulnerability to its&nbsp;<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul type="disc"> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-114625" target="_blank">CVE-2026-114625</a> Arista VeloCloud Orchestrator SQL Injection Vulnerability</li> </ul> <p>This type of

Siemens SIMATIC S7 Webserver API

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-10.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>.NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET

Siemens APOGEE, TALON and Desigo PXC/PXM Products

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-08.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recom

Siemens RUGGEDCOM CROSSBOW

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-12.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such a

Siemens RUGGEDCOM APE1808 Devices

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-18.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update

Siemens Industrial Edge App Publisher

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the man

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-11_test.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations

Siemens WinCC

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-13.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for seve

Siemens Industrial Edge Device Kit

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-09.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains multiple path traversal vulnerabilities tha

Siemens Capital Embedded AR Classic

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-04.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recomm

InterSystems Corporation InterSystems IRIS for Health

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device.</strong></p> <p>The following versions of InterSystems Corporation InterSystems IRIS for Health are affected:</p> <u

Siemens PSS(R)SINCAL

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-06.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configur

Siemens Software Center

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-03.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execu

Siemens SIMATIC IPCs

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-07.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new ve

Siemens Industrial Edge Devices

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-17.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommend

Managing AI Token Consumption for Operational Resilience

<p>CISA, the Canadian Centre for Cyber Security (Cyber Centre), and partners are releasing joint guidance, <a href="https://www.cyber.gc.ca/en/guidance/managing-ai-token-consumption-operational-resilience-itsm00125" target="_blank"><em>Managing AI Token Consumption for Operational Resilience</em></a>, to help organizations understand and manage token usage in support of operations. As organizations adopt third-party

Siemens SIMATIC S7-1500 TM MFP

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-16.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.</strong></p> <

Kiloview E3 NDI Encoder

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device.</strong></p> <p>The following versions of Kiloview E3 NDI Encoder are affected:</p> <ul> <li>E3 Firmware <1.30 (CVE-2026-109122, CVE-2026-111100

Siemens SENTRON 3NA COM Fuse

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-05.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be re-e

Siemens SIMATIC S7 PLCs Web Server

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-14.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is

Siemens RUGGEDCOM CROSSBOW Station Access Controller

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-15.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has releas

Critical Vulnerabilities in PHP Require Immediate Patching

<p><strong>Update October 26, 2026:</strong>&nbsp;</p> <p><em>CISA has updated this Alert to reflect the addition of CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 26, 2026.&nbsp;</em>&nbsp;</p> <p><strong>Update October 23, 2026</strong>:&nbsp;</p> <p><em>CISA has updated this Alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activi

CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors

Critical security issue affecting PHP

Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

#StopRansomware: SafePay Ransomware

#StopRansomware: SafePay Ransomware

<h2><strong>Advisory at a Glance</strong></h2> <table> <tbody> <tr> <th>Title</th> <td>#StopRansomware: SafePay Ransomware</td> </tr> <tr> <th>Original Publication&nbsp;</th> <td>October 20, 2026</td> </tr> <tr> <th>Executive Summary</th> <td> <p>This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastruc

Introducing a new AI chapter in the NCSC research problem book

A revolution is underway at the intersection of AI and cyber security.

Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials

Scammers Exploit 2026 U.S. Midterm Election to Perpetrate Multiple Fraud Schemes

FBI Warns Voters on Election Crimes Ahead of the November 2026 Midterm Election

Using TLS to protect data

Recommended profiles to securely configure TLS for the most common versions and scenarios, with additional guidance for managing older versions.

Post-quantum updates to our TLS guidance

The NCSC publishes its recommendations for configuring post-quantum cryptography in TLS. Now is time to migrate.

Help the NCSC understand how organisations approach external attack surface risk

We're looking to hear from people involved in evaluating, selecting or adopting EASM.

Mitigating Insider Threats to U.S. Election Systems

Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide

China-linked malicious actors called out by UK and international partners for targeting sensitive data globally

Joint advisory with international partners highlights malicious targeting of organisations from a range of sectors across the globe.

FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts

Incident affecting ASOS customers

ASOS has said it is investigating a cyber incident and that some customer personal information may have been accessed.

CISA Launches Cybersecurity Awareness Month: Securing the Next 250

Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway

The NCSC is urging UK organisations to promptly mitigate vulnerabilities affecting Citrix NetScaler ADC and Gateway, two of which are being actively exploited.

Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators

CISA Whitepaper Charts Path to Establishing and Maturing CVE Program Quality

One does not simply defend agentically

Defenders can’t use AI in the same way attackers can, but there’s much they can do to unlock the potential of agentic cyber defence.

CISA Hosts Cyber Storm X, Nationwide Cybersecurity Exercise to Strengthen Resilience

Cyber Adversary Simulation (CyAS): scheme documents now available

Our view of good cyber adversary simulation – and how assured providers can deliver it.

Adversary simulation: what you need to know

Adversary simulation ('red teaming') tests your ability to prevent, detect and respond to cyber attacks.

New CISA Guidance Helps Critical Infrastructure Detect, Observe and Impede Malicious Cyber Activity

CISA and NIST Release Guidelines to Protect Federal Cloud Identity Systems from Token Theft, Forgery, and Misuse

UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists

UK and allies provide advice to help organisations and individuals at risk detect and counter the threat from CHOSEN BRICK malware.

Iranian cyber targeting of dissidents, activists and journalists

Advisory on CHOSEN BRICK malware, including technical analysis and advice to help individuals and organisations protect themselves.

CISA Releases Updated Insider Threat Guide With New Insights to Mitigate Physical and Cyber Threats

CISA, NSA and FBI Warn of China-Based AI Companies Targeting US AI Models with Industrial-Scale Knowledge Distillation Campaigns to Shortcut AI Development

The hidden risks of shadow AI

Understanding why staff use unapproved AI tools is key to managing the security challenges they can create.

Disruptive cyber activity highlights risk from internet-exposed systems and edge devices

Owners of operational technology encouraged to address avoidable vulnerabilities, and build long-term cyber resilience.

Managing the cyber risk of agentic AI

Use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity.

How BitLocker PINs help protect your data and devices

Using a PIN mitigates many BitLocker vulnerabilities. Make sure you’re ready for the next one...

Help shape the future of resilient private 5G

The NCSC wants to collaborate with organisations developing technologies and approaches for secure, resilient and deployable private 5G

Water sector example added to the NCSC’s Secure connectivity principles

New guidance is the first content authored by the Industrial Control System COI to appear on ncsc.gov.uk.

NCSC statement in response to recent incidents resulting from frontier AI evaluations

A statement from Ollie Whitehouse, Chief Technology Officer at the NCSC, on AI security following recent incidents.