Threat and vulnerability round-up: week ending 30 September 2026
30 Sep 2026
Citrix NetScaler and Check Point VPN flaws under active attack, a WordPress core fix, a SharePoint exploit, and an Apple zero-day.
Global
Insights that apply internationally, including most vulnerabilities, threats, and international standards.
PCI SSC publishes new key management standard and Secure SLC v2.0
28 Sep 2026
The PCI Security Standards Council has published a new Key Management and Operations Standard, Secure Software Lifecycle Standard v2.0, and guidance on AI systems.
NIST releases draft update to its OT security guide (SP 800-82 Rev. 4)
21 Sep 2026
NIST has published the initial public draft of SP 800-82 Rev. 4, its guide to operational technology security, for comment until 30 November 2026.
Australian police arrest two over TeamPCP supply-chain hacks
27 Aug 2026
Australian Federal Police arrest two men in Perth over the TeamPCP hacking spree that compromised open source tools to steal credentials from over 1,000 organisations.
ISO/IEC 27017:2026 cloud security standard published
27 Jul 2026
ISO and IEC publish the second edition of ISO/IEC 27017, updating cloud security controls to align with ISO/IEC 27002:2022.
Hackers steal data from Canvas learning platform used by thousands of schools
1 May 2026
ShinyHunters claims a breach of Instructure’s Canvas platform, affecting nearly 9,000 schools and universities, then defaces login pages during exams.
Anthropic withholds Claude Mythos model over its hacking capabilities
7 Apr 2026
Anthropic says its Claude Mythos Preview model can find serious software flaws at scale and gives access only to selected defenders through Project Glasswing.
Iran-linked hackers wipe devices at medical technology firm Stryker
11 Mar 2026
A pro-Iran group claims a destructive attack on Stryker that wiped tens of thousands of company devices and disrupted operations worldwide.
Ofcom investigates X over Grok-generated sexualised images
12 Jan 2026
Ofcom opens a formal Online Safety Act investigation into X after its Grok AI tool was used to create sexualised images of real people, including children.
ISO/IEC 27001:2013 certificates expire today
31 Oct 2025
The three-year transition to ISO/IEC 27001:2022 has ended; certificates against the 2013 edition are no longer valid.
ISO/IEC 27701:2025 published as a standalone privacy standard
15 Oct 2025
The revised ISO/IEC 27701 can now be implemented and certified independently of ISO/IEC 27001.
ISO/IEC 27018:2025 published for PII in public clouds
26 Aug 2025
ISO and IEC publish the third edition of ISO/IEC 27018, aligned to ISO/IEC 27002:2022, for protecting PII in public clouds.