News & insights
The latest news, insights, and updates on information & cyber security, privacy, and AI governance from Taylor Baines.
Get the latest threats, vulnerabilities, and legal, standards, and AI updates in your inbox every Monday.
Get our weekly insights by email
Threat and vulnerability round-up: week ending 18 October 2026
Zero-days in Ivanti Connect Secure, Cisco Secure Email Gateway, BeyondTrust Remote Support, and PAN-OS lead this week, alongside ConnectWise Cloud Backup credentials used to break into Microsoft 365 tenants and attacks on supermarket refrigeration controllers.
Urgent: BeyondTrust Remote Support vulnerability under active attack
BeyondTrust Remote Support 26.2.3 and earlier has a critical flaw under attack (CVE-2026-102764): apply the BT26-05 patch now and check self-hosted appliances for compromise.
Urgent: Cisco Secure Email Gateway vulnerability under active attack
Cisco Secure Email Gateway flaw CVE-2026-76519 is under active attack: update Content Scanner Tools or AsyncOS now and check your appliances for compromise.
EU cites first harmonised AI Act standard on quality management
The European Commission has cited EN 18286:2026 in the Official Journal, the first harmonised standard under the AI Act, giving high-risk AI providers a presumption of conformity for the quality management requirements it covers.
ISO/IEC 27090 published to address security threats to AI systems
ISO and IEC have published ISO/IEC 27090:2026, guidance on understanding, detecting, and mitigating security threats specific to AI systems, designed to sit alongside ISO/IEC 27001 and 27002.
Urgent: Ivanti Connect Secure vulnerability under active attack
Ivanti Connect Secure CVE-2026-104935 is under active attack: upgrade to 22.8R2.5, 25.1.1.2, or 25.1.3.0 or later now and check appliances for compromise.
EDPB says smart glasses makers cannot pass GDPR duties to wearers
The European Data Protection Board has adopted a statement on smart glasses, saying transparency for bystanders is the central GDPR challenge and that manufacturers and service providers cannot shift their obligations onto users.
Cyber incident forces Ahold Delhaize to take systems offline
A security incident forced Ahold Delhaize to shut down systems across its European and US grocery brands, halting Albert Heijn’s online shopping and some of its distribution centres.
Hackers overheat refrigeration in hundreds of French supermarkets
Attackers took over internet-exposed refrigeration controllers in about 700 French supermarkets, pushing temperatures as high as 50°C and spoiling food, and prosecutors have opened an investigation.
UK AI Security Institute sets out priorities for frontier AI best practice
The UK AI Security Institute has identified eight areas where frontier AI developers most need common technical practices, including agentic AI incident reporting and independent auditing.
Threat and vulnerability round-up: week ending 11 October 2026
Attackers exploit new flaws in Atlassian Data Center and AhsayCBS backup servers, CISA adds five older flaws linked to Integrity Tech, the FBI warns FortiBleed attacks on FortiGate firewalls continue, and a GitHub Actions campaign steals cloud and AI keys.
UK and allies call out Chinese firm behind Flax Typhoon hacking tools
The NCSC and international partners call out China-based Integrity Tech for enabling attacks worldwide, as the FBI seizes domains behind its scanning and phishing tools.