During the September 2026 Patch Tuesday, Microsoft resolved no fewer than 964 CVEs: 104 critical and 860 important. Extra urgent: two zero-days (CVE-2026-81963 and CVE-2026-85880) are already being actively exploited and can grant attackers SYSTEM privileges. Serious vulnerabilities in Remote Desktop, Windows DNS, Kerberos, and Exchange Server, among others, have also been addressed. With 44.7% […]
Many cyberattacks are not sophisticated, but instead exploit known and often easily preventable security issues. CISA primarily observes the exploitation of vulnerabilities such as SQL Injection, command injection, missing authentication, and poor input validation. Publicly accessible services such as RDP, SMB, and Telnet also frequently provide an easy entry point for attackers. Organizations must patch […]
AI drastically shortens the time between the discovery of a vulnerability and actual exploitation: from an average of 771 days in 2018 to potentially just 4 hours by 2026. Traditional patch cycles can no longer keep up with this pace; organizations must therefore transition from periodic security to continuous risk management. An up-to-date inventory of […]
New research from Black Kite shows that attackers primarily exploit internet-exposed systems, stolen credentials, and vulnerabilities in supply chains. More than half of the mid-market victims studied had revenues between $10 and $50 million; manufacturing is the hardest hit. Read the Helpnetsecurity.com article for more information.
CISA and international cybersecurity agencies have updated the minimum requirements for a Software Bill of Materials (SBOM), significantly strengthening software supply chain transparency. New mandatory elements, such as author digital signatures, hashes, licensing information, and the context of SBOM generation, ensure much better code integrity and traceability. A robust SBOM must map all components and […]
The European Union Agency for Cybersecurity (ENISA) has released a practical Cyber Resilience Maturity Assessment Model to help SMEs prepare for the Cyber Resilience Act (CRA) before it becomes fully applicable in December 2027. The model focuses on five key domains: governance, secure-by-design risk management, vulnerability & patch management, product lifecycle management, and cybersecurity skills. […]