Vulnerabilities
EU makes progress towards PHP patching, UK lags behind
Five days into the PHP2Shell incident, and patch rates are creeping upwards, but the majority of publicly visible PHP hosts remain exposed
Latest
Vulnerabilities
Vulnerabilities in boneIO products
CERT Polska has received a report about 11 vulnerabilities (from CVE-2026-77052 to CVE-2026-77062) found in boneIO products.
Vulnerabilities
2026-018: Critical Vulnerabilities in PHP
On 20 October 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities in PHP. Public reports indicated that these vulnerabilities could lead to remote code execution (RCE)…
Vulnerabilities
Vulnerabilities in CGM CLININET software
CERT Polska has received a report about 11 vulnerabilities (CVE-2025-30043 and from CVE-2025-30045 to CVE-2025-30047, from CVE-2025-30049 to CVE-2025-30054 and CVE-2025-58403) found in CGM CLININET software.
Vulnerabilities
Node.js corrige fallos graves de TLS y Brotli en sus ramas 26, 24 y 22
Node.js publicó el 21 de octubre de 2026 versiones de seguridad para 26.x, 24.x y 22.x. El lote corrige vulnerabilidades de severidad alta que afectan a la validación TLS y al decodificador Brotli, además de actualizar…
Vulnerabilities
Vulnerability in MTW CleanShot X software
Deserialization of Untrusted Data vulnerability (CVE-2026-16477) has been found in MTW CleanShot X software.
Node.js corrige un fallo en Brotli que abre la puerta a ejecución remota de código
Un fallo de alta severidad en el decodificador Brotli de Node.js puede provocar una escritura fuera de límites y acabar en ejecución remota de código al procesar datos manipulados. Node.js ya ha publicado versiones…
Vulnerabilities
2026-019: Critical Vulnerability in GitLab Community and Enterprise Editions
On 21 October 2026, GitLab published a security advisory addressing several vulnerabilities among which a critical flaw that could allow an unauthenticated user to execute arbitrary code on a GitLab server. CERT-EU…
Vulnerabilities
Flaw in PHP computer language leads to shutdown of websites around world
Precautionary takedowns come as experts say bad actors could exploit vulnerability in language used by 70% of sitesWebsites around the globe have gone dark after a serious vulnerability was found in a computer language…
Vulnerabilities
PHP publica parches de urgencia por dos fallos críticos PHP2Shell con intentos de explotación
PHP ha lanzado parches de urgencia para dos vulnerabilidades críticas agrupadas como PHP2Shell que permiten ejecución remota de código sin autenticación. Ya se han detectado intentos de explotación activa, así que la…
Cyberattack on French supermarkets tells us more about food security than AI safety
Experts know little about the motives of the hackers who remotely turned up the temperature on French supermarket refrigerators. Their methods, however, are far from science fiction.
Not cool: who hacked France’s supermarket fridges?
Whether it was youngsters proving their skills or state sabotage, Europe’s most hacked country was left with a mountain of waste after food began cooking in freezersShortly before midnight last Sunday, the digital…
Vulnerabilities
Vulnerability in NordVPN software
Incorrect Authorization vulnerability (CVE-2026-106030) has been found in NordVPN software.
Vulnerabilities
Vulnerability in Sparx Systems Enterprise Architect software
Improper restriction of XML external entity reference vulnerability (CVE-2026-88794) has been found in Sparx Systems Enterprise Architect software.
Data Breaches
Millions of phones exposed to Israeli spyware operation through online ads, researchers say
EU and NATO websites displayed online ads linked to Israeli hacking software.
Vulnerabilities
Vulnerabilities in Slican telephone exchanges
CERT Polska has received a report about 3 vulnerabilities (CVE-2026-35088, CVE-2026-63314 and CVE-2026-63315) found in Slican telephone exchanges.
Malware
2026-017: Critical Vulnerability in Cisco Secure Email Gateway
On 14 October 2026, Cisco published a security advisory addressing a critical vulnerability affecting the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. This vulnerability could allow an…
Un ciberataque apaga vitrinas frigoríficas en supermercados franceses
Un ciberataque permitió manipular a distancia sistemas de refrigeración en supermercados de Francia, elevó temperaturas al activar ciclos de desescarche y obligó a retirar producto. El caso vuelve a señalar un punto…
EU’s cyber unit turns to AI to fend off ‘high-risk’ hacks
European Commission IT department wants to use AI to defend its systems from the most serious cyberattacks.
Data Breaches
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
Unit 42 dissects a cyberattack targeting a European bank's IT infrastructure, delivering concrete defense strategies to help organizations detect and counter comparable threats.
Vulnerabilities
Vulnerability in Payload CMS software
SQL Injection vulnerability (CVE-2026-63316) has been found in Payload CMS software.
French supermarkets face food crisis after cyberattack hits refrigerators
France's cyber agency coordinating with European counterparts in response to hackers.
Vulnerabilities
2026-016: Critical Vulnerability in GitLab CE and EE
On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an…
Vulnerabilities
Vulnerability in Ollama software
Relative Path Traversal vulnerability (CVE-2026-103663) has been found in Ollama software.
Vulnerabilities
Atacantes aprovechan un fallo crítico en Atlassian Data Center tras publicarse una prueba de concepto
La vulnerabilidad CVE-2026-21589 en productos Atlassian Data Center ya registra intentos de explotación pocas horas después de difundirse una prueba de concepto. El defecto permite leer ficheros concretos sin…
Vulnerabilities
2026-015: Critical Vulnerability in Multiple Atlassian Products
On 5 October 2026, Atlassian published a security advisory addressing a critical arbitrary file access vulnerability. It affects Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira…
Vulnerabilities
Dos fallos en LibreOffice y OpenOffice permiten ejecutar código al abrir hojas de cálculo sin avisos de macros
Dos vulnerabilidades permiten ejecutar código al abrir documentos ofimáticos manipulados sin depender de los avisos clásicos de macros. LibreOffice Calc ya cuenta con corrección, mientras que en Apache OpenOffice la…
Vulnerabilities
Vulnerabilities in GNU Aspell software
CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-75818 to CVE-2026-75820) found in GNU Aspell software.
Vulnerabilities
Una vulnerabilidad crítica en Rejetto HFS permite falsificar sesiones de administrador y ejecutar código
Se explota activamente CVE-2026-61500 en Rejetto HTTP File Server (HFS), un fallo crítico que permite falsificar una sesión de administrador y acabar en ejecución remota de código. Afecta a HFS 3.0.0 a 3.2.0 y se…
Un fallo en Steam para Windows permite escalar privilegios a SYSTEM sin UAC
Un proof of concept llamado BrokenPipe muestra cómo un usuario estándar en Windows puede elevar permisos hasta NT AUTHORITY\SYSTEM a través de Steam Client Service, sin contraseña de administrador ni aviso de UAC. Es…
