Cybersecurity

US health-IT provider Aesto Health has confirmed a cyberattack that exposed the data of more than 9.5 million people, one of the largest healthcare breaches of 2026.

Sangoma’s Switchvox VoIP phone system has been under active attack since late August: the unpatched flaw CVE-2026-9586 (CVSS 9.3) lets attackers fully take over the server without authentication. A patch has been available since July.

Berlin’s administration confirms a data breach by the Rhysida ransomware gang. One department was hit – and a seven-day gap before isolation is now under scrutiny.

From 11 September 2026, manufacturers must report actively exploited vulnerabilities to ENISA and their CSIRT within 24 hours. What the first CRA deadline means — including for open source.

CVE-2026-0768 (CVSS 9.8) lets unauthenticated attackers run code as root in Langflow. Hundreds of exploit attempts since 30 August, with no vendor patch available yet.

ServiceNow has patched three vulnerabilities rated the maximum CVSS 10.0 in its AI and Now platforms. Unauthenticated attackers could execute code and manipulate the database – an emergency for tens of thousands of enterprise instances.

On August 28, 2026, PaperCut shipped a second emergency patch for NG and MF after researchers bypassed the first fix. Two chainable flaws are already being exploited for unauthenticated remote code execution.

Critical flaw CVE-2026-65641 (CVSS 9.3) in Veeam ONE lets attackers capture NTLM credentials. Patches are available.

The US cyber agency CISA has added the critical Gitea flaw CVE-2026-60004 (CVSS 9.8) to its Known Exploited Vulnerabilities catalog. As of late August, roughly 8,400 servers remained unpatched.

A ransomware attack on IT provider Miljödata hits 200+ Swedish municipalities – up to 1.5 million people and sensitive health data affected.