Policy, Regulation & Enforcement

CISA warns ransomware actors are exploiting a critical JetBrains TeamCity vulnerability patched in July to gain footholds.

Japan dismantled a North Korean laptop farm; allied report details WaterPlum campaign and large-scale credential theft.

CISA orders federal agencies to patch an actively exploited Zyxel GS1900 switch vulnerability used for data theft.

Turkish authorities dismantled a transnational investment fraud network, arresting 201 suspects and seizing significant assets.

CISA added multiple Linux kernel CVEs (including CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV for immediate remediation.

Spanish regulator AEPD reports first AI-agent-powered multi-stage data breach exfiltrating personal data via automated agent.

CISA warns ransomware gangs are exploiting a critical VMware vCenter RCE to spread ransomware; patch vCenter immediately.

US Treasury sanctions Xinbi Guarantee for facilitating scams and money laundering, targeting its infrastructure and operators.

Cisco and CISA warn CVE-2026-20079 in Secure FMC is exploited in the wild to gain elevated access and persist.

CISA warns WatchGuard Firebox RCE is being exploited by ransomware gangs to deploy encryptors and extort victims.

CISA added CVE-2026-19490 (NetScaler authentication bypass) to KEV after in-the-wild exploitation; urgent mitigations required.

CISA warns CVE-2026-85046 is actively exploited in the wild against Chromium-based browsers; update browsers and apply mitigations.

Aesto data breach leaked sensitive health information of more than 9.5 million people, reported to regulators after discovery.

Ransomware group claims Nutex Health breach; SEC filing says patient, employee, provider, business, and financial information accessed.

US Coast Guard creates centralized Office of Maritime Cybersecurity Policy to govern port, vessel, and maritime facility cybersecurity.

SANS highlights 100+ US water system attacks, OWASP GenAI LLM Top 10, and ten CVEs added to CISA KEV catalog.

CISA added six actively exploited vulnerabilities to its KEV catalog affecting Microsoft, Linux, Red Hat and Citrix products.

CISA added a Microsoft SQL Server RCE (CVE-2019-1068) to KEV after observed exploitation allowing code execution under SQL Server service.