Newsroom
Announcements, analysis and Indene in the press, published by our newsroom.
14 storiesUpdated
FeaturedAlertas de segurança
CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) affect the PHP core, from old versions up to 8.5.11. The patch was released on October 21, ahead of schedule, after a leak. Updating and restarting workers is the only complete fix.
Compliance e regulatório
The draft of ANPD's new inspection regulation, open for public consultation until October 26, incorporates incident investigation into the process, creates precautionary measures, and presumes against those who fail to provide requested information. The burden of proof now shifts to the data processor.
Alertas de segurança
Between September 22 and 24, 2026, CISA added five critical vulnerabilities in VPN, API gateways, and corporate access to its catalog of exploited flaws. All are located at the network edge and all have patches: the remaining task is to apply them and confirm no prior unauthorized access.
Artigos
Microsoft says AI gives attackers the edge and that an exploit for a flaw is ready in under 24 hours. Few flaws are exploited, but the ones that matter arrive before the monthly patch cycle.
Compliance e regulatório
The annual cybersecurity report with a December 31 reference date is the first under CMN 5.274 and BCB 538. It must include the independent penetration test, the scans and the remediation plan, and go to the board by March 31.
Inteligência de ameaças
Symantec and Carbon Black report that the group behind the Warlock ransomware has attacked at least four organizations in two months, including a water company and a telecommunications operator, by exploiting unpatched SharePoint servers. Learn how the attack works and what to check.
Inteligência de ameaças
Two independent reports show the highest ransomware quarter on record. Comparitech counted 2,627 alleged attacks and 199 in finance, a 72% increase. GuidePoint recorded 2,760 victims and 112 active groups. Brazil is not included in the data.
Alertas de segurança
Ivanti confirmed the exploitation of CVE-2026-104935 in its Connect Secure VPN, with attacks since early October and theft of Active Directory credentials. The update fixes two of the three flaws in the chain: organizations need to patch and look for signs of intrusion.
Alertas de segurança
On October 13, Microsoft released a record-breaking package of fixes, addressing approximately 1,400 vulnerabilities. CVE-2026-96951, in Windows Shell, is already being exploited and is listed in CISA's KEV catalog, with a remediation deadline of October 16. See what to prioritize.
Inteligência de ameaças
The attack on IDC Frontier on October 7 left 495 companies and local governments without access to their own machines, including a card issuer. A week later, only some clients had a clear path to recover their data.
Alertas de segurança
Three critical vulnerabilities in NetScaler, used as a VPN, and Catalyst SD-WAN Manager, which controls branch networks, are being actively exploited. For NetScaler, attacks began before the public advisory: updating is necessary but does not guarantee that no unauthorized access occurred.
Artigos
Cyber claims range from less than $1,000 to over $500 million, and fewer than 44% of organizations have a tested continuity plan (NetDiligence and Gartner, 2026). For the board, the average is not enough: decisions require a loss range supported by proven controls.
Inteligência de ameaças
The August minutes of Comef and the ESAs' autumn report reach the same diagnosis: the financial system's risk increasingly lies with technology providers. Institutions can outsource services, but not responsibility or proof that their controls are effective.
Press
Stories, interviews and brand use.
The press team replies within 2 business days.