Cyber intelligence

De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à l'intégrité des données et un contournement de la politique de sécurité.

CERT-FR has grouped several Mattermost Server flaws that can disrupt service remotely or expose confidential data. The affected branches are 11.7 before 11.7.11, 11.8 before 11.8.6, 11.9 before 11.9.2 and 11.10 before 11.10.2. Its September 23 advisory links Mattermost's security-update notices for the corresponding fixes and identifies three associated CVEs.

CERT-FR reports that WordPress versions earlier than 7.1.2 are affected by CVE-2026-87902, a vulnerability it describes as permitting remote code execution. The September 23 notice points to WordPress's 7.1.2 release announcement and the project's GitHub security advisory for correction details. Its affected-version statement concerns WordPress itself, without naming a separate plugin or theme.

Une vulnérabilité a été découverte dans Check Point Security Management Server. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance et une atteinte à l'intégrité des données. L'éditeur indique que la vulnérabilité CVE-2026-93616 est activement exploitée.

CERT-FR's September 23 Chrome notice lists Windows and Linux builds before 154.0.8037.57 and macOS builds before 154.0.8037.58 as affected by multiple vulnerabilities. It links Google's September 22 stable-channel update and the associated CVE records. The notice leaves the security impact unspecified and refers readers to Google's bulletin for the relevant fixes.

Une vulnérabilité a été découverte dans F5 BIG-IP. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance. L'éditeur indique que la vulnérabilité CVE-2026-94127 est activement exploitée. Des indicateurs de compromission sont disponibles dans l'avis de l'éditeur.

De multiples vulnérabilités ont été découvertes dans les produits FoxIT. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et une atteinte à la confidentialité des données.

On 22 September 2026, F5 published an advisory addressing a critical vulnerability affecting its BIG-IP APM product. The vendor confirmed active exploitation in the wild. CERT-EU recommends taking appropriate actions as soon as possible.

CERT-FR identifies a remote code execution flaw in SolarWinds Access Rights Manager releases before 2026.2.1. The issue is tracked as CVE-2026-28326 and is covered by a SolarWinds security advisory dated September 17. The French agency's September 22 notice directs administrators to that vendor guidance for the required correction details.

CERT-FR warns of SQL injection and security-policy bypass vulnerabilities in Moodle. Its September 22 advisory covers releases earlier than 4.5.14, plus the 5.0, 5.1 and 5.2 branches before 5.0.10, 5.1.7 and 5.2.3 respectively. It links two Moodle security notices published that day and directs site administrators to them for the corresponding fixes.

EFF's analysis of the European Commission's proposed Kids Act questions whether age checks and restricted platform access would adequately protect children. It argues that these measures could also undermine privacy and access to information. The organization calls for stronger safeguards around data collection and meaningful participation by young people as the proposal develops.

De multiples vulnérabilités ont été découvertes dans Synology DSM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

EFF has published a guide to limiting which personal information Apple's updated Siri can use in iOS 27. It distinguishes search access, app personalization and on-screen content, explaining that their controls do different jobs. The guide also warns that some AI requests may involve cloud processing and describes options for reducing access or disabling the new features.

EFF examines the tension between encrypted messaging and AI services that process conversations in the cloud. Its analysis says trusted execution environments can offer safeguards but do not preserve the same privacy boundary as keeping messages on participants' devices. The authors call for clear user choices and caution against automatically sending private conversations to external AI systems.

v0 can now install private npm or custom-registry packages using shared Vercel environment variables scoped to Development or Preview. Teams can supply NPM_TOKEN for npm's registry or NPM_RC for custom and multiple registries, bringing internal libraries into their builds. Vercel says these credentials are neither shown to the model nor written to the sandbox filesystem; integration status appears in v0 settings.

EFF is urging lawmakers to base AI cybersecurity rules on demonstrated risks and established security practices. Its recommendations include isolating high-risk testing, recording system activity and investigating incidents independently. The organization argues that public incident reports can help improve defenses while cautioning against inflexible requirements that assume today's AI systems and threats will remain unchanged.

New Zealand's NCSC survey found rising concern about cyber exposure among smaller businesses, with medium-sized respondents reporting particularly high levels of threats or attacks. The findings also show gaps in staff training and incident reporting. These are survey results, not a measurement of every business; the agency urges firms to turn concern into routine protective action.

Kubernetes v1.37 brings important storage security features: emptyDir permission modes and bind mount options. They help application programmers and security professionals implement rigorous security policies, for example, prohibiting deletion of files across containers or execution of arbitrary binaries from writable volumes, directly in Kubernetes without any complicated circumvention. Linux storage and permission fundamentals Before diving into the new Kubernetes features, let us briefly review the low-level Linux security mechanisms that make them possible. Bind mount flags When Linux mounts or remounts a directory, Virtual File System (VFS) flags control what actions are permitted on that filesystem: noexec: Do not permit direct execution of any binaries on the mounted filesystem. nosuid: Do not allow set-user-identifier or set-group-identifier bits to take effect.

Vercel's AI SDK harness can now use native coding-agent subscriptions when the underlying agent supports them. Explicit provider credentials take priority in direct mode; automatic mode can use a subscription only without Gateway credentials. Gateway mode never reads subscriptions. Vercel says tokens remain managed on the host, with placeholder injection available only where the sandbox supports it.

EFF's review of Ring's temporary-key encryption approach acknowledges a privacy improvement while arguing that it still falls short of end-to-end encryption. The authors describe how cloud processing and features that restore access can preserve exposure beyond the initial storage window. They call for independent auditing and stronger default protection for the contents of users' recordings.

On 9 September 2026, Check Point released emergency security updates addressing two critical vulnerabilities affecting Check Point Security Gateway, Security Management Server, and Spark Firewall deployments configured to use Remote Access VPN or Site-to-Site VPN. Both vulnerabilities carry a CVSS score of 9.8 and could allow an unauthenticated, remote attacker to execute arbitrary code on affected appliances. CERT-EU strongly recommends applying the available hotfixes as soon as possible, prioritising internet-facing and perimeter appliances.

Le 06 août 2026, Metabase a publié un avis de sécurité concernant une vulnérabilité critique permettant à un attaquant non authentifié de provoquer une injection SQL (SQLi) dans la base de donnée de l'application Metabase.

EFF highlights reporting that some police agencies use vague descriptions when documenting searches involving surveillance tools such as automated license plate readers. The organization argues that this can obstruct public oversight and scrutiny of evidence in court. Its article calls for clearer disclosure of surveillance practices and connects the issue to earlier disputes over investigative technologies.

EFF examines the competing meanings of digital sovereignty, from government control of infrastructure to individuals' ability to choose and maintain their own tools. The authors argue that reducing dependence on dominant vendors requires more than moving data between countries. Their discussion emphasizes open systems, interoperability and local technical capacity as foundations for meaningful user control.