Comparing 9 November 2026 with the previous day 2 November 2026.
The report confirms active exploitation of CVE-2026-123158, allowing attackers to log into Linux accounts with password authentication disabled, going beyond a pure patch reminder.
The report shows that state actors are deliberately sabotaging OT and cooling systems in Europe, increasing the strategic relevance of OT security beyond classic IT patching.
The report shows that state-backed actors are deliberately attacking OT and cooling systems, and France attributes this to Iran's Revolutionary Guard,an indication of growing cyber-warfare risks for European infrastructure.
The NCSC assessment frames AI as a long-term enabler of cyber intrusion and thus provides a strategic planning basis through 2028.
The report shows that Iranian state-backed actors are not only stealing data but can cause physical damage and fires through networked refrigeration systems , a direct OT/IoT risk beyond classic critical infrastructure.
The report shows that the patched OpenSSH flaw is already being actively exploited by botnets and crypto miners, increasing priority for exposed SSH services.
The BSI advisory aggregates several Windows vulnerabilities without listing specific CVE IDs, so the actual patch level can only be determined via the Microsoft security bulletins.
The BSI advisory describes a privilege escalation in Microsoft Entra Device Registration but provides no CVE ID, CVSS score, or exploitation details.
No changes in this category.
No changes in this category.
The warning indicates an ongoing targeted attack on political officeholders in Germany that goes beyond general patch information and suggests state actors as the perpetrators.
The report shows that Chinese actors are using AI-powered penetration-testing frameworks for automated attacks against hundreds of organizations, increasing the scalability of state-supported campaigns.
The report adds to patch information only the insight that exploitation requires local access and a concurrent privileged module unload, and no active campaign is known.
The report describes an attack path without any software vulnerability: help-desk impersonation over Teams combined with misconfigured AD CS certificate templates (ESC1/ESC8) leads all the way to DCSync execution on a domain controller.
The report documents an ongoing exploitation campaign: according to Volexity's analysis, the Ivanti Connect Secure attacks have been running since early October and only became widely visible through the CISA KEV listing, while Synology DSM flaws are being actively abused in parallel.
The BSI advisory aggregates multiple vulnerabilities without CVE IDs; specific CVSS scores and exploitation status remain unclear, which complicates prioritization.
The report provides no CVE ID or exploit status, which limits operational prioritization.