The cabinet sees no scientific evidence that superintelligent AI can be developed at this time. This was stated by State Secretary Aerdts for Digital Economy in response to parliamentary questions from SGP member Stoffer regarding the security risks of increasingly powerful AI systems. However, the cabinet does observe a significant concentration of computing power and […]
During the September 2026 Patch Tuesday, Microsoft resolved no fewer than 964 CVEs: 104 critical and 860 important. Extra urgent: two zero-days (CVE-2026-81963 and CVE-2026-85880) are already being actively exploited and can grant attackers SYSTEM privileges. Serious vulnerabilities in Remote Desktop, Windows DNS, Kerberos, and Exchange Server, among others, have also been addressed. With 44.7% […]
AI drastically shortens the time between the discovery of a vulnerability and actual exploitation: from an average of 771 days in 2018 to potentially just 4 hours by 2026. Traditional patch cycles can no longer keep up with this pace; organizations must therefore transition from periodic security to continuous risk management. An up-to-date inventory of […]
Microsoft confirms that CVE-2026-69836, a critical RCE vulnerability in Entra ID, has been actively exploited by attackers. The flaw enabled remote code execution without authentication or user interaction via insecure deserialization. As Entra ID is central to Microsoft 365, Azure, and SSO, exploitation could potentially grant access to tokens, policies, and linked cloud environments. Microsoft […]
CISA and international cybersecurity agencies have updated the minimum requirements for a Software Bill of Materials (SBOM), significantly strengthening software supply chain transparency. New mandatory elements, such as author digital signatures, hashes, licensing information, and the context of SBOM generation, ensure much better code integrity and traceability. A robust SBOM must map all components and […]
The NCSC has withdrawn a warning for an alleged SQLite vulnerability (CVE-2026-51302) after it appeared that the bug was likely hallucinated by an LLM. Security researchers, SQLite developers, and Red Hat were unable to reproduce the vulnerability and have labeled it as fictitious. Notably, MITRE accepted the CVE despite a lack of sufficient verification, leading […]
The European Commission has published official guidelines for the application of the Cyber Resilience Act (CRA), helping manufacturers, suppliers, and open-source projects better understand how the law should be applied in practice. The guidance clarifies when software, hardware, and combinations thereof fall under the CRA and when software is considered to be “placed on the […]
The AIVD and MIVD warn that Russian state hackers are exploiting vulnerable IP cameras for espionage, including a small number in the Netherlands. The primary recommendations are: disable UPnP, avoid port forwarding, use a VPN, and restrict internet access to the camera. Replace default passwords, install firmware updates, and disable unnecessary protocols such as Telnet […]
The NCSC warns that vulnerable WordPress websites are currently being exploited by a botnet. Attackers are placing malicious code on compromised websites, causing visitors to be unknowingly used for cyberattacks on other systems. The attack operates through the visitors’ browsers: as soon as someone visits an infected website, their device is temporarily used to send […]
Microsoft warns of an active cryptojacking campaign in which AI chatbots lead users to malicious download sites. Attackers are now managing more than 150 fake websites that imitate popular Windows tools such as CrystalDiskInfo, HWMonitor, and DDU. For the first time, it has been publicly established that AI chatbots, alongside search engines, are being exploited […]
- 1
- 2