The latest information security news and announcements
From 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents. An early warning is due within 24 hours, a full notification within 72 hours and a final report within 14 days of a corrective measure becoming available. Reports go to the relevant CSIRT through the Single Reporting Platform (SRP).
Read more →On 19 August 2026 Citrix patched two flaws: CVE-2026-19490 (CVSS 9.3) allows an authentication bypass on Gateway or AAA virtual server configurations, and CVE-2026-19489 (CVSS 8.8) causes a memory overflow. Versions before 14.1-73.32 and 13.1-63.21 are affected. CERT-EU advises installing the updates without delay.
Read more →On 18 August 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of exploitation: CVE-2026-33824 (Microsoft IKE), CVE-2026-55040 (Microsoft SharePoint), CVE-2026-59310 (Broadcom VMware vCenter) and CVE-2026-65400 (Apple macOS). These are widely deployed enterprise systems and patching them should be treated as a priority.
Read more →On 6 August 2026 ENISA announced that the NATO Communications and Information Agency (NCIA) and the AI and cybersecurity company AISLE began operating as CVE Numbering Authorities (CNAs). Twenty CNAs now sit under the ENISA root — 12 onboarded directly and 8 transferred from the MITRE root — strengthening European vulnerability management.
Read more →RIA recorded 1,044 cyber incidents with impact in July. More than a hundred Estonian websites were defaced during the month, mostly through vulnerabilities in Joomla CMS plugins. The business register website went down twice, storm warnings on 11 July overloaded weather portals, and a damaged data cable cut Telia services in Tartu county.
Read more →On 1 August 2026 Mai Kraft became director of RIA's National Cyber Security Centre and deputy director general for cyber security, succeeding Gert Auväärt, who was appointed Estonia's ambassador to Canada. Kraft spent eight years as head of information security at Elisa Estonia. She stresses that security must be built into systems and highlights quantum-readiness preparation.
Read more →On 24 July 2026 ENISA opened a public consultation on the draft certification scheme for managed security services. It combines a horizontal layer covering five domains — secure design, deployment management, availability, operational management and continuous improvement — with a vertical layer for incident response, across three assurance levels. Feedback is open until 13 September 2026.
Read more →ENISA surveyed 194 organisations across 31 countries: 66% of respondents had heard of the Cyber Resilience Act, but understanding of its practical requirements remains weak. Incident response and product life cycle management are the weakest areas, particularly for micro-enterprises. The new maturity model covers five domains at three levels — basic, intermediate and advanced — with a self-assessment tool.
Read more →Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force from 27 July, amends the AI Act. Obligations for stand-alone Annex III high-risk systems move from 2 August 2026 to 2 December 2027, and for systems embedded in regulated products to 2 August 2028. The deferral reflects harmonised standards and national supervisory capacity not being ready.
Read more →ENISA's third NIS360 report assesses the cybersecurity maturity and criticality of every sector of high criticality under Annex I of the NIS2 directive. Maturity has improved overall — banking, electricity and telecommunications remain the most mature, while trust services, aviation and financial market infrastructures joined the top tier. Health, public administration and water face greater challenges.
Read more →ENISA ran the eighth Cyber Europe exercise on 10–11 June 2026, with a scenario of coordinated attacks on European port logistics, navigation systems and railway networks. More than 100 cybersecurity experts from national agencies took part, with over 5,000 participants in total from the public and private sectors across the EU and EFTA.
Read more →The amendments to Estonia's Cybersecurity Act that entered into force on 1 January 2026 transposed the NIS2 directive and widened the set of obliged entities from about 3,500 to 6,500. Companies must register with RIA, assess cyber risks regularly and apply protective measures, with accountability sitting clearly at management-board level. Fines reach €7 million for essential entities and €10 million for critical ones.
Read more →