The useful signal in cybersecurity noise.
Incidents, vulnerabilities and European policy explained clearly — separating facts, claims and the actions that matter to your team.
Latest article
French Supermarket Fridges Heated Remotely: What Is Confirmed, What Is Not, and What to Check on Third-Party-Managed Controllers
In the night of 11 to 12 October, refrigeration controllers reachable from the internet were used to heat display fridges in hundreds of stores in France. CERT-FR confirms multiple compromises, but the way in has not been made public. Romania's DNSC also published an alert.
October 2026 Patch Tuesday: A Record Over 1,400 Vulnerabilities, but the Priority Is Exploited Edge Devices: Ivanti and Cisco
Microsoft fixed a record number of vulnerabilities, but only one is exploited. The same week, Ivanti Connect Secure and Cisco Secure Email Gateway have exploited zero-days, and CISA added PAN-OS and Ahsay to the KEV catalogue. How to choose what to fix first.
Denmark's Population Register: 8.8 Million People Exposed Through a Supplier's Legitimate Access. What Is Confirmed and What Is Not
Danish authorities say someone misused a private company's legitimate access to the CPR register and obtained names, addresses and identification numbers for about 8.8 million people. The "123456" password remains only a hacker's claim. The lesson for leadership: who can query your data, and who notices when the volume explodes?
Who Sits Between You and the Ransomware Attacker? Three Cases From the Same Week, With Three Different Levels of Certainty
Federal charges against the owner of a recovery firm who allegedly paid attackers in secret, a reported arrest of a negotiator linked to the ShinyHunters investigation, and a Qilin member extradited from Japan to Germany. They are not the same case, but they answer the same leadership question: on the day of the incident, whom do you trust and on what basis?
Advisory AA26-281A: China-Linked Actors Use Vulnerabilities That Are Years Old, With the UK NCSC and Spain's CNI Among the Signatories
CISA, the FBI and the NSA, together with partners from the UK, Spain, Australia, Canada, Japan and New Zealand, describe Chinese government-linked actors who combine automated scanning with hands-on intrusions. The firm named, Integrity Technology Group, has been sanctioned by the EU since March. The most practical part of the advisory is the list of exploited vulnerabilities: most are more than five years old.
Atlassian CVE-2026-21589: Eight Data Center Products Affected, a Public PoC and Exploitation Attempts. What an Attacker Without a Password Can Read
On 5 October Atlassian published a 9.3-scored vulnerability that lets an unauthenticated attacker read files from the web root of eight self-hosted products, including Jira, Confluence and Bitbucket. watchTowr published a PoC, and a honeypot recorded attempts within about two hours. For Romanian organisations running Jira or Confluence on premises, patching is not all.
The .gh, .sl and .as Registries Hijacked, Fake HTTPS Certificates for Google Domains. Who Actually Controls the DNS of Your Domains?
Google says attackers compromised third-party operators of the registries for Ghana, Sierra Leone and American Samoa, modified authoritative DNS records and obtained unauthorised HTTPS certificates for several Google domains and other organisations'. As far as is known, .ro domains are not involved. The lesson is about the chain of trust behind any domain.
The FBI Blames a Contractor's Unapplied PeopleSoft Patch for the Breach. The Question for Your Own Supplier: Who Holds the "Patch Button"?
Two weeks after ShinyHunters' claim, the FBI says the incident occurred because a contractor failed to apply a patch issued explicitly for the platform. According to Reuters, the platform was Oracle PeopleSoft and the contractor Accenture. The case turns an abstract supply chain discussion into one question: who applies the patch and who checks?
ASOS: Attackers Sent the Message Straight Into Customers' App. What Is Confirmed and What to Check on Platforms That Speak in Your Name
On 6 October, ASOS customers received a notification titled "ASOS HACKED". The company confirms unauthorised activity at third-party platforms it uses to communicate with customers. A previously unknown group claims to have compromised a Snowflake instance, and Snowflake says it found no compromise of its platform. The practical lesson is about the message channel, not the claims.
KillSec: A 16-Year-Old Romanian Minor Detained in Alicante. What Authorities Confirmed, What They Did Not, and How to Write About a Case Involving a Minor
The press called a 16-year-old Romanian detained in Alicante province KillSec's "leader". The authorities use more careful wording: suspected of leading the group, or one of its principal administrators. The difference matters, and the case also has a side concerning students, parents and schools.
Citrix NetScaler: A Third Exploited Vulnerability in Seven Days. The Versions You Installed Last Week Are No Longer Enough
On 3 October Citrix published a new bulletin, for CVE-2026-88779, a flaw in SAML authentication handling. CISA added it to KEV on 4 October, with a 7 October deadline. Versions 14.1-73.37 and 13.1-64.23, which we recommended in our 29 September and 1 October analyses, are affected.
Garante Fines IQVIA EUR 7 Million: The "Anonymous" Health Data of a Million Patients Was Not Anonymous
Italy's data protection authority concluded that IQVIA's database, with data from 800 family doctors, could be used to identify patients. The case is about a claim heard in many organisations: "our data is anonymised".
Warlock and SharePoint: Ransomware at a Water Operator and a Telecom Provider in European Countries. Why Patching Is Not Enough
Symantec says a China-linked actor has attacked four organisations in Portuguese- and Spanish-speaking countries in the past two months, including a water operator and a telecom provider, through old and new SharePoint vulnerabilities. For Romanian organisations with on-premises SharePoint, the question is not only the version but what was taken before the patch.