Comparing 2 October 2026 with the previous day 1 October 2026.
Switzerland is set to get its first standalone cybersecurity law; affected companies should track the consultation draft due by June 2027, as it may introduce reporting and operator obligations.
The report provides technical details on a Secure Boot bypass in GRUB where an insufficiently validated MMIO base address in the serial command allows loading unsigned modules despite active lockdown restrictions.
The report identifies the China-based APT Warlock as the attacker and shows that SharePoint exploitation has been active since July 2025 and is expanding to critical infrastructure.
No evidence of active exploitation or exploit code; the vulnerability allows code execution inside the Chrome sandbox but requires visiting a crafted web page.
The report only describes the vulnerability and provides no indication of active exploitation or attacker TTPs.
The report describes a pure vulnerability without indications of active exploitation or strategic implications.
The report contains no indication of active exploitation, threat actors, or affected sectors and does not go beyond the CVE description.
The report contains no information beyond the patch details about active exploitation or attack tactics.
Classifying an intrusion by ransomware payload alone obscures the affiliate behind it: Storm-2570 shows identical post-compromise tradecraft across Qilin, DragonForce, Anubis and BERT, providing a stable basis for detection.
A China-linked ransomware group uses SharePoint vulnerabilities as an initial access vector, confirming that collaborative Microsoft platforms are a favoured entry point for state-supported attackers.
The aggregated advisory lists no CVE IDs and no indication of active exploitation, so prioritisation must rely solely on the regular Chrome patch cycle.
The BSI advisory summarizes multiple vulnerabilities in GNU libc without providing specific CVE IDs or exploitation details.
This report contains no details beyond the pure patch information.
The alert updates previous OpenSSL advisories and points to multiple new vulnerabilities without providing specific CVE details.
The report lacks CVE IDs and details on active exploitation, so no prioritized patching order can be derived.
The report provides no patch information but a quarterly telemetry assessment of ICS-related malware campaigns and newly documented APT tooling for industrial environments.
No changes in this category.
No changes in this category.
CVE-2023-42793 is actively exploited by APT29 for supply-chain attacks, underlining its strategic relevance for Swiss industrial companies with software suppliers.
The vulnerability is a local privilege escalation in the DirectX graphics kernel and is therefore primarily relevant as a building block in attack chains after an attacker has already gained a foothold.
The analysis reveals two previously undocumented DPRK implants and an attack path abusing the HAProxy filter API, underscoring North Korean groups' continued willingness to target industry-adjacent supply chains.
The flaw is a ZDI-coordinated disclosure rated CVSS 7.8 for which neither exploit code nor in-the-wild exploitation is documented so far, with the fix arriving through Adobe's regular security bulletin.
Beyond the pure patch information, the report provides no indication of active exploitation or technical details.
Beyond the pure patch information, the report shows that in addition to remote code execution, bypassing session access restrictions is also possible, which expands the attack surface beyond classic RCE.
The report provides neither a CVE identifier nor a CVSS score or any indication of active exploitation, so the concrete urgency cannot be derived from the BSI text alone.
The zero-day nature suggests exploitation occurred prior to the patch release.
Device code phishing abuses Microsoft Entra ID's legitimate device code flow to bypass MFA, with the victim authorizing the attacker's sign-in on a genuine Microsoft page.
The report summarizes several unspecified vulnerabilities in Microsoft Edge and serves as a general patch reminder without providing specific CVEs or exploitation details.
The report is an update without new CVE details or evidence of active exploitation; the local attack surface remains.