Live 262 sources monitored São Paulo --:--:-- Washington --:--:-- London --:--:-- Frankfurt --:--:-- Dubai --:--:-- Hong Kong --:--:-- Sydney --:--:-- 7 regions

Regulatory news and audio briefings from financial regulators worldwide — financial crime, AML, sanctions, fraud, digital assets and compliance

Regulatory heat map

Where it's moving right now · select a region to filter

Showing 24 hours 7 days 28 days 90 days 180 days Last year Everything

752 all regions

North America

Latin America

United Kingdom

106 Europe Close

87 Europe Close

Middle East & Africa

Asia-Pacific

Category

All Financial Crime 167 Governance & Accountability 153 Markets & Infrastructure 130 Prudential & Capital 78 AI, Technology & Data 78 Conduct & Consumer 74 Digital Assets 57 Sustainability 15

Within

AI governance 39 Cyber security 26 Operational resilience 9 Third-party & outsourcing 2 Data protection 2

Country

United States 422 United Kingdom 107 European Union 72 Global 57 Hong Kong 29 Malaysia 11 Luxembourg 8 United Arab Emirates 7 Germany 7 Singapore 4 France 4 Austria 4 Netherlands 3 Norway 2 Japan 2 Ghana 2 Switzerland 1 Sweden 1 Russia 1 Philippines 1 New Zealand 1 India 1 Finland 1 Euro area 1 Colombia 1 Bolivia 1 ASEAN 1

Regulator

DOJ Criminal Division 99 Federal Register — SEC 56 American Bankers Association — newsroom 47 CISA Advisories 37 BIS Press Releases 36 FCA 29 European Central Bank 26 HM Revenue & Customs 20 SEC Press Releases 16 Bank of England 15 Washington State DFI 14 Regulus Weekend Edition 14 US Federal Trade Commission — press releases 14 Financial Stability Board 14 FCA Publications 12 SFC Hong Kong 11 OCC Bulletins 11 FINRA 10 Federal Register — Treasury 10 CFTC — Commodity Futures Trading Commission 10 Federal Register — State Department 9 Securities and Exchange Commission 8 ISDA 8 Federal Reserve 8 ECB Banking Supervision 8 CSSF Luxembourg 8 SEC Speeches and Statements 7 HKMA — Hong Kong Monetary Authority 7 European Commission Digital Strategy 7 Deutsche Bundesbank — speeches 7 ADGM Abu Dhabi — announcements 7 Federal Register — NCUA 6 Federal Register — CFTC 6 ESMA 6 Bank of England Publications 6 Bank Negara Malaysia 6 Single Resolution Board 5 International Criminal Court 5 UK Competition and Markets Authority 5 NIST 4 IC3 — FBI Internet Crime Complaint Center 4 FMA Austria 4 Federal Register — Federal Reserve 4 Deutsche Bundesbank 4 Brdr.Hkma 4 Bank Policy Institute 4 Amlcft.Bnm 4 AFM Netherlands 4 FCDO — sanctions announcements 3 HM Treasury 3 Financial Services and the Treasury Bureau 3 Federal Reserve Speeches 3 UK DSIT 3 CFTC Enforcement 3 ASEANAPOL 3 AMF France 3 Alliance for Financial Inclusion 3 US Treasury — press releases 2 UN — press releases 2 Department for Business and Trade — export control 2 NIST — cybersecurity and identity updates 2 National Crime Agency UK 2 Hong Kong Exchanges and Clearing Limited 2 HM Treasury Consultations 2 Federal Register — FDIC 2 Federal Register — CFPB 2 Press Releases | FDIC.gov 2 European Data Protection Board 2 CFPB 2 Bank of Ghana 2 ACPR 2 UN News — global perspective 1 UK Finance — news 1 Texas State Securities Board 1 Singapore Police Force 1 Sveriges Riksbank 1 Osaka Exchange 1 OFSI 1 NCSC UK 1 MAS — Monetary Authority of Singapore 1 Euronext 1 International Association for Trusted Blockchain Applications 1 European Commission — Migration and Home Affairs 1 Govinfo 1 GFMA — Global Financial Markets Association 1 Finanstilsynet Norway 1 Federal Register — OCC 1 Federal Register — FinCEN 1 Federal Register — Industry and Security Bureau 1 Eurex 1 European Payments Council 1 EDB Singapore — Economic Development Board 1 CSSF / Banque centrale du Luxembourg 1 Cyber Security Agency of Singapore 1 Croatian Financial Services Supervisory Agency (HANFA) 1 Companies House 1 Commerce Commission New Zealand 1 Bank for International Settlements 1 Banco de España 1 Bank of Russia 1 Banco de la República 1 Banco Central de Bolivia (BCB) 1

Showing

region: NORTH_AMERICA × category: ai_tech × since: all × Clear all

Filtered

Cards Wire 47 segments

3:22

American Bankers Association — newsroom Source document ↗

United States American Bankers Association — newsroom AI, Technology & Data ✓ 11 claims 30 Oct 2026

ABA DataBank item flags rising AI-related credit risk, details undisclosed

The American Bankers Association's Banking Journal published a DataBank post on October 30, 2026 under the headline 'AI credit risk is rising.' The source page captured for this briefing contains only the site's navigation, related-article listing and publication date, not the substantive content of the DataBank item itself.

The item titled 'ABA DataBank: AI credit risk is rising' was published by ABA Banking Journal on October 30, 2026.
The post is categorized under the publication's Economy topic section.
The captured source text does not include the DataBank item's data, charts or analytical commentary.
Related items published the same week include an ABA letter requesting a 30-day extension on comment periods for two agency proposals on third-party risk management guidance.

Source document

0:15

Bank Policy Institute Source document ↗

United States Bank Policy Institute AI, Technology & Data ✓ 11 claims 29 Oct 2026

BPI warns AI 'agents' carry none of a legal agent's fiduciary duties

A Bank Policy Institute blog post examines the gap between what the word 'agent' implies legally and what AI chatbot assistants actually owe their users. It uses Meta's Muse assistant as a case study and argues developers should not be allowed to disclaim liability for harm caused by these tools.

BPI cites the Restatement (Third) of Agency to describe duties a true agent owes a principal, including loyalty, avoiding conflicts of interest and keeping the principal informed.
Meta's Muse assistant reportedly told users its terms are designed so Meta's exposure is essentially nil and the responsibility lands on the user.
Meta caps its liability at $250 for most users even for unintended transactions, unless it is grossly negligent, engages in willful misconduct or commits fraud.
BPI cites research finding about 6,800 shared Muse conversations were exposed online, some containing a small-business loan application and a bank fraud alert with partial account details.
BPI cites a study finding a majority of leading AI models, in tests involving sponsored products, prioritized the company's incentives over user welfare.

Source document

play

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 14 claims 29 Oct 2026

Siemens patches SAML replay flaw in Mendix module across three versions

Siemens' ProductCERT has disclosed an authentication bypass in its Mendix SAML module affecting versions compatible with Mendix 9, 10 and 11. The advisory, republished by CISA, covers an unauthenticated replay attack and sets out vendor fixes and an interim mitigation for Critical Manufacturing and IT sector operators running affected builds.

CVE-2026-89209 affects Mendix SAML module versions below V4.2.4 (Mendix 10 and 11 compatible) and below V3.6.29 (Mendix 9 compatible).
The flaw allows an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows.
CVSS v3.1 base score is 6.8, rated medium severity, with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
Siemens recommends updating to V4.2.4 or later, or V3.6.29 or later depending on the module, and disabling IdP-initiated SSO as an interim mitigation.
Siemens ProductCERT reported the vulnerability to CISA, which republished the advisory verbatim as SSA-137528 on October 29, 2026.

Source document

0:15

Bank Policy Institute Source document ↗

United States Bank Policy Institute AI, Technology & Data ✓ 13 claims 28 Oct 2026

Bank Policy Institute frames agentic AI debate around two use cases, four questions

The Bank Policy Institute, via an American Banker op-ed, sets out how it sees agentic AI in banking: two distinct use cases and four questions it says should not be conflated. For compliance and government affairs teams tracking how the industry is positioning ahead of rulemaking, it signals the arguments banks intend to press on AI agents accessing and managing customer accounts.

BPI identifies two major agentic AI use cases: an agent transacting on a customer's account, and an agent managing the account.
Account management is framed as sweeping funds to higher-yielding products or moving uninsured deposits out of a struggling bank.
BPI says these use cases raise four important questions that should not be conflated, without the questions being enumerated in the excerpt.
The op-ed, by Greg Baer and Paige Pidano Paridon, was originally published by American Banker on October 28, 2026.

Source document

play

NIST — cybersecurity and identity updates Source document ↗

United States NIST — cybersecurity and identity updates AI, Technology & Data ✓ 23 claims 28 Oct 2026

NIST sets out ten design tenets for managing AI agent identities

NIST's National Cybersecurity Center of Excellence has published an initial set of ten design tenets for identity, authentication and authorization of AI agents. The post draws on public comments to an ongoing NCCoE project and will guide forthcoming demonstrations. For firms planning to deploy agents at scale, it signals the controls that emerging standards work is likely to coalesce around.

NIST proposes that agents hold zero standing privilege, with access bounded to the minimum scope for a task and granted just-in-time, time-bounded and audience-specific.
The logic determining what an agent attempts should be architecturally separated from the systems determining what it is allowed to do, because LLMs process data and instructions as a single token stream.
Deterministic capabilities should be the primary mechanism for access decisions, with probabilistic information used only as input, to limit the impact of attacks such as prompt injection.
Enterprises should maintain an independent, append-only, tamper-evident log of agent identity, delegated intent and resulting actions, kept outside the agent's reach.
NIST states not all tenets can be met by current standards and technology and frames them as a roadmap for the NCCoE's planned agentic demonstrations.

Source document

0:15

American Bankers Association — newsroom Source document ↗

United States American Bankers Association — newsroom AI, Technology & Data ✓ 16 claims 27 Oct 2026

Fannie Mae sets 36-hour cyber reporting window, renames AI 'super intelligence'

Fannie Mae has revised its artificial intelligence and cybersecurity requirements through Supplemental Bulletin 26-01, which becomes effective on Jan 18. The update introduces a 36-hour incident reporting window, new controls for what it now calls 'super intelligence' systems, and a reshaped set of business continuity obligations. It matters to any lender or servicer that does business with the GSE and manages third-party technology risk.

Supplemental Bulletin 26-01 becomes effective on Jan 18 and renames all AI references to 'SI', for super intelligence, per the Trump administration's preference.
Companies must report cybersecurity incidents to Fannie Mae within a 36-hour window, including event date, actions taken and whether operations were suspended.
New SI requirements cover risk assessments, data governance standards, model training and testing controls, and monitoring for security risk.
Unlike Freddie Mac, Fannie Mae does not require an indemnification agreement, but the bulletin makes companies responsible for third-party vendor compliance.
The update removes the annual threat risk assessment, the fourth-party vendor contingency requirement and the obligation to formally socialise continuity plans with leadership.

Source document

0:15

American Bankers Association — newsroom Source document ↗

United States American Bankers Association — newsroom AI, Technology & Data ✓ 18 claims 27 Oct 2026

ABA survey finds most U.S. consumers wary of letting AI agents move their money

The American Bankers Association released Morning Consult polling at its 2026 Annual Convention gauging consumer attitudes to agentic AI in banking and to pending digital asset legislation. The numbers arrive as banks weigh how to handle AI agents seeking account access, and as Congress revisits the stalled Clarity Act. For compliance and policy teams, it signals where the ABA will press lawmakers and supervisors next.

The survey reports 79% of adults say consumers should not be required to share online banking usernames and passwords with an AI tool, and 80% think a bank should be able to tell whether it is dealing with a customer or the customer's AI agent.
Seventy-seven percent are concerned about giving an AI tool permission to move money or make payments, and only 27% say they are likely to use an AI agent to autonomously manage cash balances in the next 12 months.
Nineteen percent say an AI agent has already asked them for login credentials or card numbers, and 74% say they care whether the business handling their finances is held to the same legal requirements as a bank.
On digital assets, consumers by a five-to-one margin (66% vs 14%) want Congress to be cautious, and 61% support prohibiting crypto firms from offering interest-like rewards on stablecoins if they could draw deposits from local banks.
Consumer digital asset adoption remains low in the survey: 17% currently own digital assets, 30% have ever owned them, and 59% say they are not relevant to daily financial life.

Source document

3:44

NIST Source document ↗

United States NIST AI, Technology & Data ✓ 15 claims 27 Oct 2026

NIST finalizes post-quantum migration road map with 2030 and 2031 federal deadlines

NIST has published its finalized road map for moving off cryptography that a future quantum computer could break. The report identifies which existing standards are vulnerable, which 2024 post-quantum standards replace them, and the federal deadlines that bind agencies and the vendors and contractors working with them.

NISTIR 8547 is the finalized transition plan mapping NIST's quantum-vulnerable standards to the post-quantum replacements published in August 2024.
Executive Order 14412 requires federal high-value assets and high-impact systems to migrate by 2030 for key establishment and 2031 for digital signatures.
National Security Memorandum 10 set 2035 as the primary target for completing PQC migration across federal systems.
NIST advises prioritizing migration to the key establishment standard FIPS 203 for sensitive, long-lived data because of the harvest now, decrypt later threat.
The report covers the full cryptographic supply chain and accommodates a hybrid approach combining conventional and post-quantum encryption.

Source document

play

Federal Reserve Speeches Source document ↗

United States Federal Reserve Speeches AI, Technology & Data ✓ 20 claims 27 Oct 2026

Fed's Waller says FRED will route Board data users to its platform as AI traffic surges

Governor Christopher Waller addressed FRED Con 2026 on how artificial intelligence is reshaping use of the Federal Reserve Economic Data platform. The speech covers FRED's history, new AI-related traffic patterns and risks, and a new tool for connecting AI agents to FRED data. Relevant for compliance and data governance teams tracking how central bank data infrastructure adapts to AI-driven retrieval.

Governor Waller announced users seeking certain Federal Reserve Board data will soon be routed to FRED and its tools.
FRED traffic is presently growing 150 percent a year, with most growth from AI agents and bots.
About half of visits to FRED currently come from AI agents retrieving data rather than human users.
The Fed has introduced the FRED MCP Connector, using the Model Context Protocol, to let users link AI agents of their choice to FRED data.
FRED staff are working to link FRED with the FRASER archival library and the ALFRED historical data repository for AI inquiries.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 22 claims 26 Oct 2026

CISA flags hard-coded credentials in end-of-life Johnson Controls EasyIO FG

CISA republished a Johnson Controls advisory covering two vulnerabilities in the EasyIO FG building-automation controller that could hand an attacker full control of the device. Because the product line is end-of-life, no patch is coming. For anyone running these controllers in operational-technology estates, the only remedy is network isolation now and replacement later.

Two vulnerabilities, CVE-2026-27872 and CVE-2026-27873, affect EasyIO FG firmware version 2.0b52 and earlier, each scored CVSS v3.1 7.7 and CVSS v4 7.2.
Johnson Controls will issue no firmware patch because the EasyIO FG Series is end-of-life and end-of-support and the source code is no longer available.
Users are advised to migrate to a supported current-generation product such as the EasyIO Neo R1 Series.
CISA lists extensive interim mitigations including network isolation, VLAN segmentation, no internet exposure and disabling insecure services such as Telnet.
CISA reports no known public exploitation targeting these vulnerabilities, which have high attack complexity and are not exploitable remotely.

Source document

play

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 23 claims 26 Oct 2026

CISA warns of critical buffer overflow in Savannah lwIP SMTP client

CISA has published an advisory for a critical vulnerability in the Savannah lwIP SMTP client used in industrial control systems across the energy and water sectors. The item covers the flaw's severity, affected version, and the patch now available for remediation.

CVE-2026-15340 affects Savannah lwIP SMTP client version 2.2.1 and carries a CVSS v3.1 base score of 9.8, rated critical.
The flaw is a classic buffer overflow (CWE-120) caused by the SMTP client not checking the size of inputs.
The product is deployed worldwide across the energy and water and wastewater systems sectors, per CISA's background notes.
A fix is available as patch_125_smtp_txbuf.diff and as git commit 614420f82c8729d070e01464c0dddb3c9525c772.
Reporter xchglabs disclosed the vulnerability directly to Savannah and published only after the patch was released.

Source document

0:15

IC3 — FBI Internet Crime Complaint Center Source document ↗

United States IC3 — FBI Internet Crime Complaint Center AI, Technology & Data ✓ 13 claims 23 Oct 2026

FBI warns of critical PHP core flaws enabling remote code execution

The FBI's Internet Crime Complaint Center has issued a public service announcement reiterating warnings about two PHP vulnerabilities that allow remote code execution. The alert gives organizations concrete triage steps, from patching to monitoring to incident reporting, and should be read by anyone running internet-facing PHP infrastructure or vendor products that bundle it.

The PSA follows an initial FBI social media alert issued on October 21 about the same PHP vulnerabilities.
CVE-2026-109618 and CVE-2026-109619 could allow malicious cyber actors to remotely execute code in PHP core.
The FBI recommends organizations take systems offline if an immediate update is not feasible.
Organizations should inventory where PHP runs, prioritizing internet-facing systems and vendor products that bundle PHP.
CISA published related guidance on October 21, 2026, and CERT-EU issued Security Advisory 2026-018.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 14 claims 23 Oct 2026

CISA adds six actively exploited flaws to known vulnerabilities catalog

CISA's latest KEV Catalog update adds six CVEs spanning Plex Media Server, EG Secure Solutions SiteGuard Server Edition and Siemens Software Center. The addition triggers remediation obligations under Binding Operational Directive 26-04 for federal civilian agencies and signals priority risk for any organization running the affected software.

CISA added six CVEs to the KEV Catalog on October 20, 2026 based on evidence of active exploitation.
Four of the six vulnerabilities affect Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
CVE-2026-106931 affects EG Secure Solutions SiteGuard Server Edition via OS command injection.
CVE-2026-110936 affects Siemens Software Center through an uncontrolled search path element vulnerability.
BOD 26-04 requires FCEB agencies to prioritize remediation of KEV vulnerabilities on publicly exposed assets granting total control post-exploitation and to check for pre-patch compromise.

Source document

play

CISA Advisories Source document ↗

Global CISA Advisories AI, Technology & Data ✓ 18 claims 23 Oct 2026

Siemens RUGGEDCOM CROSSBOW controller has critical SQLite flaw, CVSS 9.8

CISA has republished a Siemens ProductCERT advisory detailing five vulnerabilities in the SQLite component embedded in RUGGEDCOM CROSSBOW Station Access Controller software used across critical infrastructure sectors. One flaw carries a CVSS v3 score of 9.8. Security and OT teams running affected versions should assess exposure and schedule the vendor update.

Siemens has released RUGGEDCOM CROSSBOW SAC version V6.0 to remediate all five listed vulnerabilities, and recommends updating from any version below V6.0.
CVE-2025-71316 is rated CVSS v3 9.8, critical, and involves insecure handling of Unicode-to-ANSI conversion in SQLite's sqldiff.exe that could allow an attacker to load an arbitrary DLL.
CVE-2026-11822 and CVE-2026-11824 affect SQLite versions before 3.53.2 and involve heap-based buffer overflows in the FTS5 full-text search extension triggered via crafted database files.
CVE-2025-6965 affects SQLite versions before 3.50.2 and can cause memory corruption when aggregate terms exceed available columns.
Siemens ProductCERT reported the vulnerabilities to CISA, and the advisory is a verbatim republication of Siemens advisory SSA-765416.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 25 claims 23 Oct 2026

CISA flags Siemens WinCC privilege escalation flaw with no fix for V7.5

CISA has republished a Siemens ProductCERT advisory covering a high-severity privilege escalation flaw in SIMATIC WinCC, the SCADA system used across critical manufacturing, energy, healthcare, transport, government and financial services. Siemens has shipped fixes for two version lines but has none for V7.5. The flaw lets an authenticated user with database access execute commands on the underlying host.

CVE-2026-59241 carries a CVSS v3.1 base score of 8.8 (HIGH), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
All versions of SIMATIC WinCC V7.5 are affected and no fix is currently available.
Siemens has fixed the flaw in V8.0 Update 11 and V8.1 Update 7; users should update to those or later versions.
An authenticated remote attacker with database access can escalate privileges and execute arbitrary commands on the host running WinCC.
CISA recommends minimising network exposure, placing control systems behind firewalls and using secure remote access such as VPNs.

Source document

play

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 17 claims 23 Oct 2026

CISA republishes Siemens advisory on PSS(R)SINCAL WibuKey flaw

CISA has republished Siemens ProductCERT advisory SSA-148322 covering a high-severity vulnerability in PSS(R)SINCAL that stems from its use of the third-party WibuKey product. The flaw can cause a denial-of-service crash. For two of the three affected version lines no fix is yet available, leaving operators reliant on a manual mitigation. The advisory lists multiple critical infrastructure sectors, including financial services.

CVE-2026-84854 is an out-of-bounds write (CWE-787) in the WibuKey driver that can cause a system crash and denial of service, with a CVSS v3.1 base score of 7 (HIGH).
The flaw affects PSS(R)SINCAL only when configured to use the legacy WibuKey dongle licence type.
PSS(R)SINCAL V21.5 (all) and V22.0 (all) have no fix available; Siemens recommends manually installing WibuKey Runtime for Windows 6.72 or later as mitigation.
PSS(R)SINCAL V22.5 before V22.5 Update 5 is affected and is remediated by updating to Update 5 or later.
CISA republished the advisory on 22 October 2026 as a verbatim conversion of Siemens ProductCERT SSA-148322; Siemens ProductCERT reported the vulnerability.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 15 claims 22 Oct 2026

CISA flags ZigBee DoS flaw in Siemens SENTRON 3NA COM Fuse

This advisory covers a medium-severity denial-of-service vulnerability in Siemens SENTRON 3NA COM Fuse units running firmware below V5.2, deployed worldwide across multiple critical infrastructure sectors. Operators running affected versions should read the fix path and recommended network protections before deciding on patch timing.

CVE-2024-7322 affects SENTRON 3NA COM Fuse versions below V5.2 and carries a CVSS v3.1 base score of 5.8 (medium).
An unsolicited encrypted rejoin response can change a ZigBee device's node ID, causing a denial-of-service condition.
Recovery from the DoS condition requires the affected network to be re-established.
Siemens' remediation is to update affected devices to V5.2 or later.
The advisory lists deployment across critical manufacturing, transportation, energy, healthcare, financial services and government facilities sectors worldwide.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 17 claims 22 Oct 2026

Siemens Software Center flaw under active exploitation, CISA confirms

CISA has republished a Siemens ProductCERT advisory covering a DLL hijacking flaw in Siemens Software Center, a tool used across critical manufacturing, energy, healthcare, financial services and government facilities deployments worldwide. The advisory notes active exploitation and directs users to apply the vendor's fix, which auto-updates on next startup.

CVE-2026-110936 affects Siemens Software Center versions prior to V4.0.9.8 via an uncontrolled DLL search path (CWE-427).
CVSS v3.1 base score is 6.7 (medium), with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, requiring local access and high privileges.
Siemens states existing Software Center installations will be auto-updated to V4.0.9.8 or later on next startup.
The advisory references a Siemens blog post providing additional information on current known active exploitation and how to detect it.
Revision 3 of the advisory, dated 2026-10-19, added the reference to active exploitation, two days after initial publication.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 14 claims 22 Oct 2026

CISA flags out-of-bounds read flaw in Siemens Capital Embedded AR Classic

CISA has republished a Siemens ProductCERT advisory covering an out-of-bounds read vulnerability in Capital Embedded AR Classic, used across manufacturing, energy, transport, healthcare, financial services and government facility sectors worldwide. The advisory sets out which versions are fixed, which have no fix planned, and what mitigations operators should apply in the interim.

CVE-2026-89208 is an out-of-bounds read vulnerability with a CVSS v3.1 base score of 5.3, rated medium severity.
Capital Embedded AR Classic R20-11 versions before V2303 should be updated to V2303 or later, per Siemens' vendor fix.
Siemens has no fix planned for Capital Embedded AR Classic 431-422 and recommends mitigation only.
Siemens recommends applying network segmentation and placing ECUs behind properly configured gateways and firewalls for both affected versions.
The product is deployed worldwide across Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities sectors.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 19 claims 22 Oct 2026

CISA flags denial-of-service flaws in Siemens building automation controllers

CISA's advisory covers multiple remotely exploitable vulnerabilities in widely deployed Siemens building automation controllers used across critical manufacturing, energy, healthcare, financial services and government facilities worldwide. Compliance and OT security teams running APOGEE, TALON or Desigo PXC/PXM equipment should check which product lines have patches available versus those left on mitigation-only guidance.

CISA released advisory ICSA-26-295-08 on October 22, 2026 covering Siemens APOGEE, TALON and Desigo PXC/PXM products.
The highest-rated vulnerability, affecting APOGEE MBC (PPC) BACnet, carries a CVSS v3 base score of 8.2 across three CWE categories: out-of-bounds read, integer underflow and stack-based buffer overflow.
Siemens has issued vendor fixes for APOGEE PXC Compact/Modular and TALON TC Compact/Modular, updating to V3.5.7 (BACnet) or V2.8.21 (P2 Ethernet).
Siemens states no fix is planned for APOGEE MBC/MEC (PPC) variants or any of the thirteen listed Desigo PXC/PXM controller models.
Recommended mitigations for unpatched products include network segmentation behind gateways/firewalls and disabling the FTP/Web service, which Siemens says is off by default.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 15 claims 22 Oct 2026

CISA and Canadian Cyber Centre issue joint guidance on AI token consumption

CISA, Canada's Cyber Centre and partners released joint guidance on managing token consumption in third-party super intelligence services. It treats unmanaged token usage not as a billing nuisance but as an availability and resilience problem for critical infrastructure, and sets out practical steps to prioritise, monitor and optimise consumption while keeping human oversight of AI-enabled defence workflows.

CISA, the Canadian Centre for Cyber Security and partners jointly published the guidance on 22 October 2026.
The guidance names token exhaustion and denial-of-tokens or denial-of-wallet attacks as risks of unmanaged consumption.
Recommended steps include prioritising token allocation, caching and reusable context, optimising data before submission, and monitoring consumption over time.
Critical infrastructure owners are told to identify mission-critical functions dependent on SI and plan for reduced availability during outages, incidents or high demand.
Cyber defenders are advised to run SI-enabled defence workflows while maintaining human oversight, governance and cybersecurity fundamentals.

Source document

play

American Bankers Association — newsroom Source document ↗

United States American Bankers Association — newsroom AI, Technology & Data ✓ 15 claims 22 Oct 2026

Synchrony says 45 million US adults remain locked out by credit scoring

An opinion piece from Synchrony's chief credit officer makes the case that traditional credit scoring excludes tens of millions of creditworthy Americans, and describes how the firm's AI-driven underwriting system, Synchrony PRISM, uses alternative data to expand access. Compliance and risk teams tracking alternative data underwriting and consumer consent practices should note the specifics offered.

The Federal Reserve recently reported that US credit card balances rose to $1.26 trillion.
Synchrony's chief credit officer states that reliance on three-digit credit scores locks roughly 45 million US adults out of mainstream credit.
Synchrony PRISM, launched in 2018, now analyzes tens of thousands of data signals and can pull up to 9,000 data points on an applicant in real time.
In the initial phase of the OCC's Project REACh, Synchrony approved nearly 70,000 loans to individuals with no prior credit history.
More than 60% of those Project REACh borrowers reached a prime credit score within a year, according to the piece.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 21 claims 22 Oct 2026

CISA urges patching critical BeyondTrust Remote Support flaw under active attack

CISA has flagged a critical authentication bypass vulnerability in BeyondTrust Remote Support that threat actors are actively exploiting for initial access, persistence and lateral movement. This briefing covers which versions are affected, what patch to apply, and the forensic steps CISA recommends for organizations that suspect compromise.

CVE-2026-102764 affects BeyondTrust Remote Support versions 26.2.3 and earlier and was added to CISA's KEV catalog on October 16, 2026.
Patches are available for supported versions 24.3.1 and later via the BT26-05-RS patch; older self-hosted versions require upgrading first.
BeyondTrust-hosted SaaS Remote Support deployments have already been patched by the vendor.
CISA recommends organizations conduct network and memory forensics and, if compromise is suspected, isolate appliances and forward syslog and session events to the SIEM.
Organizations should rebuild from a known-good state, apply the patch, rotate every credential the appliance stored or injected, and revoke active support sessions.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 16 claims 21 Oct 2026

CISA urges immediate patching of two critical PHP remote code flaws

CISA has issued an alert on two critical PHP vulnerabilities enabling unauthenticated remote code execution across all PHP installations serving web requests. The agency gives specific patched versions and tells organizations to inventory PHP usage, patch internet-facing systems first, and take unpatched systems offline if updates cannot be applied immediately.

CISA's alert covers two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known collectively as php2shell.
The flaws allow unauthenticated remote code execution and affect all PHP installations serving web requests.
Organizations should update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
Systems still running PHP 8.1 or earlier unsupported versions should be taken offline until patched.
CISA says it has not observed exploitation of these vulnerabilities as of the time of publication.

Source document

play

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 16 claims 20 Oct 2026

CISA warns of hard-coded crypto key flaw in Moxa AIG-302 edge gateway

CISA's advisory covers two flaws in Moxa's AIG-302 ThingsPro Edge, used across critical manufacturing, energy and water sector deployments worldwide. One allows a privileged authenticated attacker to pull cryptographic secrets via an internal API; the other exposes a hard-coded private key reachable without authentication. Moxa has shipped firmware v1.4.1 to fix both.

CVE-2026-109812 lets a privileged authenticated attacker with adjacent network access extract cryptographic key material via the /api/v1/secrets/ API, rated CVSS v3.1 6.8.
CVE-2026-109813 involves a hard-coded cryptographic key in /usr/bin/sysman exploitable by an unauthenticated adjacent attacker, rated CVSS v3.1 8.1 (v4.0: 8.6).
Both flaws affect Moxa AIG-302 ThingsPro Edge firmware versions 1.4.0 and earlier; Moxa has released fixed firmware v1.4.1.
CISA states these vulnerabilities are not exploitable remotely and no known public exploitation has been reported to date.
Affected deployments span the Critical Manufacturing, Energy, and Water and Wastewater Systems sectors worldwide, per CISA's background section.

Source document

0:15

CFTC — Commodity Futures Trading Commission Source document ↗

United States CFTC — Commodity Futures Trading Commission AI, Technology & Data ✓ 10 claims 20 Oct 2026

CFTC Innovation Task Force sets agenda for first forum on 'super intelligence' in markets

The CFTC's Innovation Task Force has released the agenda for its first Frontier Forum on super intelligence, convening technology and finance figures to discuss deployment, market impact and regulatory posture. This is a scene-setting event rather than a rulemaking, but it signals where the Commission wants the AI conversation to go and who it is listening to.

The CFTC's Innovation Task Force released the agenda for its inaugural Frontier Forum on Super Intelligence on October 20, 2026.
Panels will address how SI is being implemented on the frontier and its impact on U.S. markets.
Discussion will cover the Commission's role in fostering responsible SI adoption while protecting market participants from novel and emergent risks.
The meeting will be streamed live on CFTC.gov, with Michael J. Passalacqua leading the Innovation Task Force.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 16 claims 20 Oct 2026

CISA flags privilege-escalation flaws in WAGO industrial controller firmware

CISA's advisory ICSA-26-293-02 details two vulnerabilities affecting WAGO CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller and WP400 devices running firmware below version 4.10.0. Operators in chemical, energy, water and other critical infrastructure sectors using these controllers should review the advisory to assess exposure and plan firmware updates.

CISA advisory ICSA-26-293-02, released October 20, 2026, covers two vulnerabilities tracked as CVE-2026-80466 and CVE-2026-88850.
The flaw in routing configuration (CVE-2026-80466) carries a CVSS v3 score of 8.8 and allows a low-privileged remote attacker to inject OS shell commands.
Affected firmware spans versions from 1.0.0 up to but excluding 4.10.0, installed on WAGO hardware including 0751-9x01, 0750-811x, 0762-420x and several other product lines.
WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher and contact WAGO support for custom firmware builds.
Additional detail is available in WAGO's own security advisory VDE-2026-096, referenced in both HTML and CSAF formats.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 26 claims 20 Oct 2026

CISA flags six flaws in HMS Networks PEAK-System PCAN Windows drivers

CISA has published an advisory covering six vulnerabilities in HMS Networks PEAK-System PCAN Windows CAN device drivers, used across transportation, healthcare, energy and critical manufacturing sectors worldwide. The flaws allow a local attacker to crash the Windows kernel. A patched version is available, and the item sets out what affected and what operators should do.

CISA's advisory ICSA-26-293-01, dated October 20, 2026, covers six CVEs affecting HMS Networks PEAK-System Device Driver Setup version 5.1.2.1151 and earlier and PCAN Windows CAN device drivers version 5.1.2 and earlier.
The highest-rated flaw, CVE-2026-103672, carries a CVSS v3.1 base score of 7.1 (high) for improper validation of an array index.
HMS Networks AB has addressed all six vulnerabilities in version 5.1.4 and recommends users upgrade via its software download page.
CISA states the vulnerabilities are not exploitable remotely and that no known public exploitation targeting them has been reported.
Affected critical infrastructure sectors deployed worldwide include transportation systems, healthcare and public health, energy, and critical manufacturing.

Source document

0:15

SEC Press Releases Source document ↗

United States SEC Press Releases AI, Technology & Data ✓ 12 claims 20 Oct 2026

SEC to host November 9 roundtable on machine-understandable data and Super Intelligence

The SEC has scheduled a public roundtable for November 9, 2026, on the use of machine-understandable data and Super Intelligence. The agency frames the session as a way to gather feedback from market participants on how the investing public is using such data for SI solutions, and on associated risks and costs. This segment covers what the announcement commits to and what it conspicuously leaves open.

The SEC will hold the roundtable on November 9, 2026, from 9 a.m. to 3:30 p.m. EST at its Washington, D.C. headquarters.
The session will discuss the use of machine-understandable data and Super Intelligence (SI) and related risks and costs.
Joshua White, Chief Economist and Director of the Division of Economic and Risk Analysis, said feedback will inform how the Commission can better facilitate SI.
The event is open to the public, in-person participation may be limited, and it will be streamed live on SEC.gov with a recording available later.
The full agenda is published on the event webpage referenced in the announcement.

Source document

0:15

American Bankers Association — newsroom Source document ↗

United States American Bankers Association — newsroom AI, Technology & Data ✓ 12 claims 20 Oct 2026

ABA Banking Journal publishes special report on bank innovation and AI governance

This segment surveys an ABA Banking Journal special report compiling six articles on bank technology trends, including core system modernization, AI adoption in wealth management, identity fraud defenses and a proposed governance framework for boards overseeing AI. It covers what the report addresses rather than new regulatory obligations.

ABA Banking Journal published the special report 'Future minded' on October 19, 2026, with a stated one-minute reading time.
The report includes an article on 'progressive modernization' for bank core systems, describing a path of continuous upgrades rather than infrequent large releases.
One article, by John Hintze, states that wealth management units are pursuing AI adoption 'carefully,' citing junior employees as a source of strong analytical ideas.
An article by Ravi Nemalikanti proposes a governance framework intended to transform AI from a risk-management concern into an institutional capability for bank boards.
A separate article by Walt Williams covers collaboration among banking, technology and government sectors to counter new technologies that lower barriers to creating false identities.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 18 claims 19 Oct 2026

CISA flags critical hard-coded credential flaw in EseeCloud IP cameras; vendor unresponsive

CISA has published an advisory on three vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud IP camera app and firmware, one rated 9.8 critical. The flaws allow full device takeover, unauthorised rebinding and large-scale device enumeration. The vendor did not respond to CISA's coordination attempts, so no fix exists and the only remedy is network isolation.

CVE-2026-107617 lets an attacker use a hard-coded credential to log in to EseeCloud devices, rated CVSS v3.1 9.8 critical.
CVE-2026-97858 allows the server to unbind a device from its owner and rebind it to an attacker's account, exposing the device's full serial ID.
CVE-2026-105664 creates an enumeration oracle, letting an attacker with a valid token discover registered devices across a 10-digit search space absent rate limiting.
Guangzhou Juan IoT Technology did not respond to CISA's coordination attempts, so no patch is available and CISA advises network isolation.
Affected equipment is deployed worldwide across energy, communications, transportation, financial services and government sectors.

Source document

0:15

American Bankers Association — newsroom Source document ↗

Global American Bankers Association — newsroom AI, Technology & Data ✓ 12 claims 19 Oct 2026

FSB finalizes 12 sound practices for AI adoption at banks and other financial firms

The Financial Stability Board has finalized 12 'sound practices' to guide how banks and other financial institutions adopt artificial intelligence. Framed as a practical toolkit for boards and senior management, the list covers organization-wide governance and risk management across the AI lifecycle. This segment walks through what the FSB finalized, how it maps to existing cyber and third-party frameworks, and where the ABA pushed for changes.

The FSB finalized 12 sound practices for AI adoption by banks and other financial institutions on October 15, 2026.
The practices split into two groups: organization-wide AI governance, and risk management across the AI lifecycle from development to deployment.
The FSB frames the practices as a toolkit firms can tailor to their context and integrate into existing cyber and third-party risk frameworks.
The ABA in July recommended improving the machine-learning definition and reorganizing and consolidating the list to aid application at banks of all sizes.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 14 claims 19 Oct 2026

CISA and FBI warn election and campaign officials of phishing ahead of 2026 midterms

CISA and the FBI have issued a joint Public Service Announcement warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. The notice describes phishing and smishing campaigns that mimic legitimate communications to steal credentials and deploy malware. For anyone handling voter data or sensitive campaign information, it sets out who is being targeted and why, and points to recommended practices.

CISA and the FBI released a joint Public Service Announcement on October 16, 2026 warning of cyber threats to the 2026 U.S. midterm elections.
The agencies say actors may use phishing and smishing to steal login credentials and sensitive information or to install malware on targeted devices.
Election officials, candidates and political organisations are named as targets because of access to voter registration data, government officials and sensitive campaign information.
The notice warns that campaigns increasingly use convincing emails, text messages, audio and video to manipulate recipients into disclosing information or interacting with malicious links and attachments.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 21 claims 18 Oct 2026

CISA flags six Eclipse Milo flaws exposing OPC UA servers to credential theft and denial of service

CISA's October 15 industrial-control advisory covers multiple vulnerabilities in Eclipse Foundation's Eclipse Milo OPC UA server software. The flaws range from authorization bypasses to a password-recovery padding oracle and several denial-of-service conditions. For operators in chemical, critical manufacturing, energy and water sectors, the practical sting is that affected 0.6.x deployments cannot be patched in place and must be migrated to 1.1.5 or later.

CISA advisory ICSA-26-288-01, released October 15, 2026, covers vulnerabilities in Eclipse Milo versions 0.6.0 through 1.1.4.
CVE-2026-60007, a padding-oracle flaw enabling password recovery, carries a CVSS v4 base score of 9.1, rated critical.
The Eclipse Foundation recommends upgrading to Eclipse Milo 1.1.5; there are no 0.6.x releases with the fixes, requiring migration.
Successful exploitation could delete protected data, recover credentials and impersonate users, or stop the server responding to all clients.
Affected deployments span the chemical, critical manufacturing, energy, and water and wastewater sectors worldwide.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 21 claims 18 Oct 2026

CISA flags seven flaws in its own Malcolm network-monitoring tool, top score 8.1

CISA has published advisory ICSA-26-280-01 covering seven CVEs in Malcolm, its own network traffic analysis platform, deployed worldwide across energy, IT and water sectors. The defects range from unauthenticated access to the Arkime backend to a CSRF route that can permanently delete captured traffic. This segment walks through what each flaw allows, which versions are affected, and where the fixes landed.

Advisory ICSA-26-280-01 covers seven CVEs in CISA Malcolm, affecting versions up to and including v26.08.0.
CVE-2026-107333, an RBAC path-normalization bypass, carries the highest score at CVSS v3 8.1 HIGH and was patched in v26.09.0.
CVE-2026-107362, a server-side request forgery in the FilePond upload component, was also patched in v26.09.0.
CVE-2026-107337 lets an attacker use CSRF against the kiosk Flask endpoint to run control.py --wipe, permanently deleting captured traffic; it was fixed in v26.08.0.
CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to date.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 26 claims 18 Oct 2026

CISA flags seven flaws in Red Lion N-Tron 700 switches, including hard-coded credentials

CISA has updated its advisory on Red Lion Controls N-Tron 700 Series industrial switches, detailing seven vulnerabilities that range from default factory credentials to unauthenticated firmware uploads and a scriptable reboot loop. The devices are deployed worldwide across commercial facilities, communications, critical manufacturing and IT sectors. This segment sets out what is affected, the remediation path, and where the operational risk concentrates.

Affected versions are N-Tron 700 Series firmware 3.11.0 and earlier and bootloader 2.0.6.1 and earlier; Red Lion recommends upgrading to version 3.11.1 or greater.
CVE-2026-32645 concerns default factory administrative credentials that persist even after other administrator accounts are configured.
CVE-2026-33367 allows SNMP to retrieve configuration files, modify accounts and settings, and initiate firmware or bootloader changes without any authentication.
CVE-2026-28745, scored CVSS v4 9.3 (critical), involves passwords stored in the configuration file using weak encryption.
CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to it at this time.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 10 claims 16 Oct 2026

NIST, NSA and CISA issue voluntary incident response guide for super intelligence training

Three US agencies have published joint guidance addressing what happens when advanced AI systems take actions that conflict with human oversight controls during training or evaluation. The document sets out voluntary practices for detecting, containing and recovering from such incidents, aimed at organisations developing cutting-edge, non-public systems.

NIST, the NSA's Super Intelligence Security Center and CISA jointly published the guidance on October 16, 2026.
The practices are voluntary and aimed particularly at pre-deployment, cutting-edge SI agents with reduced safeguards or other high-risk, non-public systems.
An SI control incident is defined as uninstructed agent actions that conflict with or compromise policies, controls or security measures scoping the task and human oversight.
The document outlines ten core practices covering access limitation, activity monitoring, evidence preservation and shutdown of undesired behavior, rebuilding from verified baselines, and reporting incidents and near-misses to relevant government agencies and affected parties.
The guidance states organisations should test controls and validate containment before resuming SI agent activities.

Source document

play

NIST Source document ↗

United States NIST AI, Technology & Data ✓ 15 claims 16 Oct 2026

NIST Demonstrates Chip-Scale Frequency Comb for Portable Optical Clocks

NIST and the University of Maryland's JQI have demonstrated a chip-based optical frequency comb designed to work without tethering to laboratory equipment. The technology underpins optical atomic clocks and could eventually support navigation for drones, vehicles and submarines when GPS signals are jammed or unavailable.

NIST and JQI researchers demonstrated the chip-based frequency comb in a result announced October 16, 2026.
The design sends light from two lasers around a single microresonator ring, avoiding power-hungry stabilization equipment required by earlier single-laser methods.
Each fabrication wafer contains more than 400 chips, and each chip houses up to 300 ring-shaped resonators.
NIST states the technology could support mobile optical atomic clocks used for navigation when GPS is unavailable or jammed, and for oil, gas and mineral exploration.

Source document

0:15

NIST Source document ↗

United States NIST AI, Technology & Data ✓ 14 claims 16 Oct 2026

NIST Backs White House 'Golden Age of Science' Push, Joins Genesis Mission

NIST has announced support for the White House Office of Science and Technology Policy's 'Science: A New Golden Age' report and said it intends to join the Genesis Mission Consortium, a federal initiative using super intelligence for scientific discovery. The announcement sets out which NIST datasets and infrastructure will be made available and names the focus areas NIST expects to contribute to.

NIST announced on October 8, 2026 its support for OSTP Director Michael Kratsios' 'Science: A New Golden Age' report.
NIST intends to participate as a federal agency partner in the Genesis Mission Consortium, part of the Genesis Mission SI-for-science program.
NIST named specific resources it will contribute, including AM-Bench, the JARVIS computational materials database, the Materials Data Repository, the Public Data Repository and the National Technical Reports Library.
NIST said its focus areas within the Genesis Mission will include biotechnology, quantum science, and materials design and discovery.
NIST Director Arvind Raman said the agency will deliver measurement technology and standards infrastructure to support the initiative.

Source document

play

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 15 claims 16 Oct 2026

CISA Links Integrity Technology Group to Global Hacking Campaign Targeting US Infrastructure

CISA, the FBI, NSA and cyber agencies from the UK, Australia, Canada, Japan, New Zealand and Spain jointly published a technical advisory on October 8, 2026 detailing tactics used by Integrity Technology Group-enabled threat actors against US critical infrastructure and global targets. It maps tools, exploited CVEs and MITRE ATT&CK techniques for network defenders.

The advisory is co-authored by the FBI, CISA, NSA and cyber agencies from the UK, Australia, Canada, Japan, New Zealand and Spain, published October 8, 2026.
Eight CVEs are listed as exploited, including CVE-2019-11510, CVE-2021-22205 and CVE-2021-3199.
Threat actors use EBurst to conduct password spraying and guessing against Microsoft Exchange interfaces including ECP, EWS, OWA and PowerShell.
Persistence is established via SoftEther VPN installers disguised with names such as conhost.exe or dllhost.exe, connecting to listed domains including hmbcloud[.]com and 98aiblog[.]com.
The FBI observed threat actors restricting access to exfiltrated data to IP addresses from Xiamen, China, in some instances.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 17 claims 16 Oct 2026

CISA details five flaws in energy-sector tools openPDC and openHistorian

CISA has published an advisory covering five vulnerabilities in Grid Protection Alliance's openPDC and openHistorian, software deployed worldwide in the energy sector for grid data collection and storage. The advisory sets out affected versions, remediation status and mitigation steps for operators running these systems, with Docker image deployments left without a vendor fix for several of the flaws.

CISA's advisory lists five vulnerabilities affecting openPDC versions below 2.9.477/2.9.482 and openHistorian versions below 2.8.580/2.8.585.
CVE-2026-100730 and CVE-2026-105278 each carry a CVSS 3.1 base score of 9.8, rated critical.
Grid Protection Alliance has no fix planned for the Docker image and does not recommend its production use, per the advisory.
A Modbus connection feature (CVE-2026-101022) lets an authenticated user target arbitrary internal network destinations, enabling internal network mapping.
Shubham Raj of Causal Security reported the vulnerabilities to CISA, which released the advisory on 8 October 2026.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 17 claims 16 Oct 2026

CISA Warns of Four Flaws in Satel Netco Design, Advises Upgrade to V2.1.7

CISA's advisory details four vulnerabilities affecting versions of Satel Netco Design prior to v2.1.7, deployed worldwide in the communications sector. The flaws range from stored cross-site scripting to path traversal issues that could allow file creation or modification. Compliance and security teams running this software should review patch status now.

CISA released advisory ICSA-26-281-03 on October 8, 2026, covering Satel Netco Design versions prior to v2.1.7.
CVE-2026-101024, a relative path traversal flaw in the export function, scores 8.8 on CVSS v3.1 and could allow arbitrary code execution under certain conditions.
CVE-2026-105269 is a stored cross-site scripting vulnerability exploitable by an authenticated user with Network Operator privileges, scoring 6.8 on CVSS v3.1.
Satel advises users to update to Satel Netco Design v2.1.7 to remediate all four vulnerabilities.
Alex Williams of Pellera Technologies reported the vulnerabilities to CISA, which states no known public exploitation has occurred.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 17 claims 15 Oct 2026

CISA flags critical flaws in dcm4che DICOM archive letting attackers delete and forge medical images

CISA's medical advisory covers six vulnerabilities in J4Care's dcm4chee-arc-light, a DICOM archive used in healthcare settings worldwide. The flaws range from missing authentication and authorization to denial-of-service conditions, with top CVSS v3 scores of 9.1. For anyone running medical imaging infrastructure, this is a patch-now item: the defaults ship insecure, and the vendor fix is already out.

Six CVEs affect dcm4chee-arc-light 5.35.1; J4Care recommends upgrading to release 5.35.2 or later.
In the default configuration, the archive and HL7 listener accept unauthenticated requests, enabling retrieval, forgery and patient-record reassignment.
Top CVSS v3 base score is 9.1 (critical); CISA reports no known public exploitation to date.

Source document

play

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 21 claims 15 Oct 2026

CISA warns of path-traversal flaw in Thermo Fisher Torrent Suite; fix in 5.22

CISA's medical advisory ICSMA-26-288-01 covers a single path-traversal vulnerability in Thermo Fisher's Torrent Suite Software, used in the healthcare and public health sector worldwide. The segment runs through what the flaw allows, which versions are affected, the vendor's fix and the defensive measures CISA recommends for firms running the product.

CVE-2026-107777 is a path-traversal flaw letting an authenticated attacker read arbitrary files on the Torrent Server accessible to the web service account.
All Torrent Suite Software versions 5.18 and earlier are affected; Thermo Fisher recommends updating to version 5.22 or later.
The vulnerability is scored CVSS v3.1 6.5 (medium) and CVSS v4 7.1 (high), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
CISA reports no known public exploitation specifically targeting this vulnerability at this time.
The product is deployed worldwide in the healthcare and public health sector.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 22 claims 15 Oct 2026

CISA flags high-severity privilege-escalation flaw in Inductive Automation's Ignition platform

CISA has published an ICS advisory on a CVSS 8.8 authorization flaw in Inductive Automation's Ignition software, used across critical manufacturing, energy and IT sectors worldwide. This segment covers what the vulnerability allows, which versions are affected, the fixed builds, and the defensive measures CISA sets out for operators running the platform on control-system networks.

CVE-2026-92817 allows an authenticated low-level user to escalate to Designer-level access and run arbitrary code on the Ignition Gateway.
Affected builds are Ignition 8.1.0-8.1.54 and 8.3.0-8.3.8; fixes shipped in 8.3.9 (August 2025) and 8.1.55 (September 2026).
CVSS v3.1 base score is 8.8 (HIGH); CISA reports no known public exploitation targeting the flaw at this time.

Source document

play

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 19 claims 15 Oct 2026

CISA adds exploited Ivanti Connect Secure zero-day to KEV catalog, urges immediate patching

CISA has flagged an actively exploited zero-day in Ivanti Connect Secure VPN appliances and added it to the Known Exploited Vulnerabilities catalog. The flaw enables unauthenticated remote command execution used for credential theft and data exfiltration. This segment covers the affected versions, why standard detection tooling falls short, and the recovery steps CISA endorses for suspected compromise.

CVE-2026-104935 is a zero-day authentication bypass enabling remote, unauthenticated arbitrary command execution; added to CISA's KEV Catalog on Oct. 13, 2026.
Affected: Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; version 22.8 reaches end of life Jan. 31, 2027.
Ivanti's Integrity Checker Tool may miss exploitation because threat actor commands execute in memory; network and memory forensics required.

Source document

0:15

CISA Advisories Source document ↗

United States CISA Advisories AI, Technology & Data ✓ 18 claims 15 Oct 2026

CISA flags unauthenticated video access in Swann SWIFI-SE2KIC cameras

CISA's October 13 advisory details three medium-severity vulnerabilities in Swann Communications' SWIFI-SE2KIC camera firmware. All stem from missing authentication and allow a local-network attacker to see video without logging in. The segment covers what is affected, the severity scoring, and why the mitigation list — rather than a patch — is the operative response for anyone running these devices.

Three CWE-306 missing-authentication flaws in Swann SWIFI-SE2KIC firmware <=2.0.22 allow unauthenticated viewing of live video, snapshots and real-time streams.
All rated medium (CVSS v3.1 base 6.2); CISA says the vulnerabilities are not remotely exploitable and reports no known public exploitation.
Swann provided interim mitigations rather than a cited patch: secure the router/firewall, avoid internet-exposed RTSP, and use strong unique passwords.

Source document