Threats & incidents
-
RouterOS chain gave attackers unauthenticated admin access
CERT Polska has detailed two RouterOS vulnerabilities that can be chained to obtain full administrative-console access without completing SSH authentication.
-
Device-code phishing targets European Microsoft 365 users
A phishing operation targeting organisations in Europe and the US is abusing Microsoft 365 device-code authentication before deploying legitimate remote-management software on compromised endpoints.
-
KDDI launches agentic MDR across EMEA
KDDI has launched a managed detection and response service for the US and EMEA using Exaforce technology to automate parts of security triage, investigation, and response.
-
F5 flaw exploited against exposed access systems
F5 has confirmed exploitation of a critical BIG-IP APM vulnerability that can allow unauthenticated remote code execution in specific OAuth server configurations.
-
Talos finds autonomous AI command implant
Cisco Talos has analysed a Windows implant that delegates command decisions to commercial AI models, although researchers have not confirmed that the malware has been deployed in live attacks.
-
Arista says VeloCloud flaw actively exploited
Arista has disclosed active exploitation of a critical VeloCloud Orchestrator vulnerability that can expose privileged internal functionality and compromise the management system and data it controls.
-
Attackers compromise 996 Zyxel switches
GreyNoise says an attacker compromised 996 Zyxel GS1900 switches across 48 countries through CVE-2026-7273, a vulnerability Zyxel patched in June.
-
Ribon compromise exposes BigCommerce customer data
Compromised credentials belonging to third-party BigCommerce applications were used to access merchant data and inject malicious scripts, exposing the dependency risk created by privileged ecommerce integrations.
-
Microsoft disrupts EvilTokens cybercrime platform
Microsoft has disrupted EvilTokens, an AI-assisted phishing and fraud service linked to more than 12,000 compromised inboxes, while UK police investigate two men arrested in connection with the alleged operation.
-
ENISA maps Europe’s cyber dependency risk
ENISA’s 2026 threat landscape puts ransomware, geopolitical activity, and shared digital dependencies at the centre of a European threat environment concentrated heavily on essential and important organisations.