What has changed?

Federal Council plans to create a new cybersecurity law

Switzerland is set to get its first standalone cybersecurity law; affected companies should track the consultation draft due by June 2027, as it may introduce reporting and operator obligations.

CVE-2026-97876

The report provides technical details on a Secure Boot bypass in GRUB where an insufficiently validated MMIO base address in the serial command allows loading unsigned modules despite active lockdown restrictions.

Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks

The report identifies the China-based APT Warlock as the attacker and shows that SharePoint exploitation has been active since July 2025 and is expanding to critical infrastructure.

CVE-2026-103623

No evidence of active exploitation or exploit code; the vulnerability allows code execution inside the Chrome sandbox but requires visiting a crafted web page.

CVE-2026-103621

The report only describes the vulnerability and provides no indication of active exploitation or attacker TTPs.

CVE-2026-103624

The report describes a pure vulnerability without indications of active exploitation or strategic implications.

CVE-2026-103626

The report contains no indication of active exploitation, threat actors, or affected sectors and does not go beyond the CVE description.

CVE-2026-103625

The report contains no information beyond the patch details about active exploitation or attack tactics.

CVE-2026-103631

Beyond the ransomware: Tracking Storm-2570's consistent tradecraft across deployments

Classifying an intrusion by ransomware payload alone obscures the affiliate behind it: Storm-2570 shows identical post-compromise tradecraft across Qilin, DragonForce, Anubis and BERT, providing a stable basis for detection.

Warlock ransomware breach SharePoint in water, telecom operator attacks

A China-linked ransomware group uses SharePoint vulnerabilities as an initial access vector, confirming that collaborative Microsoft platforms are a favoured entry point for state-supported attackers.

Google Chrome: Multiple Vulnerabilities

The aggregated advisory lists no CVE IDs and no indication of active exploitation, so prioritisation must rely solely on the regular Chrome patch cycle.

[UPDATE] GNU libc: Multiple Vulnerabilities

The BSI advisory summarizes multiple vulnerabilities in GNU libc without providing specific CVE IDs or exploitation details.

CVE-2026-103629

This report contains no details beyond the pure patch information.

[UPDATE] OpenSSL: Multiple Vulnerabilities

The alert updates previous OpenSSL advisories and points to multiple new vulnerabilities without providing specific CVE details.

Google Chrome: Multiple Vulnerabilities

The report lacks CVE IDs and details on active exploitation, so no prioritized patching order can be derived.

Threat landscape for industrial automation systems. Q2 2026

The report provides no patch information but a quarterly telemetry assessment of ICS-related malware campaigns and newly documented APT tooling for industrial environments.

UPDATE Microsoft Windows Products: Multiple Vulnerabilities