Category: Organisation Types

Organisation Types for membership

Critical Vulnerabilities in PHP Require Immediate Patching

Cyber Security CII sector, Industry News

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.

CISA urges organizations to take the following actions:

  • Identify and inventory systems running any version of PHP across your organization.
    • PHP is often a component of other software and prevalence may not be directly observable.
  • Apply the patch immediately, prioritizing internet-facing systems.
  • Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
  • A web application firewall may provide some protection until systems are updated or patched.
  • Review the official PHP security advisory for guidance on patching.
  • Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.

CISA urges network defenders to review the following advisory and apply necessary updates:

Leave a comment

From Heatwaves To Blackouts: Why Europe Needs To Prepare For Cascading Disasters

Health & Social Care, Industry News, Power/Energy/Oil & Gas sector, Telecomms sector, Transport sector
As extreme events become increasingly interconnected, the EU-funded PARATUS project concludes with tools, methods, open-access research and new European guidelines to strengthen preparedness for compound and cascading disasters.
During the heatwave that hit Europe last June, one question became increasingly difficult to ignore: what happens when extreme heat does not only cause train failures and delays, but also ignites wildfires, triggers blackouts, disrupts communication networks and sets off a chain of further failures?
This is the reality of compound and cascading disasters: events in which different hazards occur simultaneously or successively, interacting with one another and potentially producing consequences far greater than those of a single event. As the IPCC defines it, “compound risk is the interaction of simultaneous or successive multiple hazards or events that combine to produce extreme disasters capable of generating widespread losses.”
Preparing for these scenarios is the focus of PARATUS, a European research project bringing together researchers and practitioners to develop new approaches, tools and methods for assessing and managing risks across hazards, infrastructures and communities.
As the project reaches its conclusion in September 2026, PARATUS leaves behind practical resources and recommendations designed to strengthen disaster preparedness in Europe and ensure that its knowledge and tools remain accessible beyond the project's lifetime.
Preparing for disasters that do not happen in isolation
A heatwave can increase the risk of wildfires and put pressure on energy systems. A wildfire can damage infrastructure and disrupt communications. An earthquake can simultaneously affect transport, energy and emergency response. When critical systems are interconnected, the failure of one can create consequences across others.
PARATUS addresses these challenges through a multi-hazard approach to disaster risk preparedness, combining risk assessment, scenario analysis, stakeholder engagement and innovative tools to support decision-making.
The project's results were presented on 29 June in Brussels, during the PARATUS Final Event at The Hotel, held one day before the European Commission's Disaster Resilience Days. The event brought together practitioners, first and second responders, policy experts, researchers and other stakeholders.
PARATUS showcased its tools, applications and methods in an interactive format and published a series of dedicated open-access papers, including lessons learned from its four case studies.
Opening the event, Funda Atun, PARATUS Project Coordinator and Associate Professor at the University of Twente, highlighted a key lesson: “No matter how good the assessment is, no matter how good the plan is, failures occur during disaster. This is why we shall focus on the role of society in mitigating or increasing the risk, and understand what didn’t work, but also what went well.”
For PARATUS, effective preparedness must therefore go beyond technical assessments and emergency plans. Socio-technical factors matter, including the role of citizens, children, older people and spontaneous volunteers.
From research results to long-term standards
One of PARATUS's key achievements is its contribution to a CEN Workshop Agreement (CWA), “Guidelines for Disaster Risk Preparedness Solutions – Project tools, platforms and processes – Good practice recommendations.”
The process began in early 2024 after stakeholders identified a need for greater standardisation and for sustainability to be considered from the earliest stages of disaster preparedness projects. “Already in year one we realized that most stakeholders involved were seeking higher standardization when it comes to Disaster Risk Preparedness,” says Cees Van Westen, Full Professor at the Faculty of Geo-Information Science and Earth Observation of the University of Twente. “They emphasised the need for sustainability planning from an early stage, including long-term hosting, preservation of web domains and continued access to documentation, datasets and training resources.”
The draft CWA highlights shared repositories, discoverability, interoperability, community engagement and collaborative networks, while providing guidance for effective long-term governance and custodianship.
Keeping preparedness alive beyond PARATUS
PARATUS will officially close in September 2026, but its work will continue through the Disaster Risk Stakeholder Hub (DRS Hub).
The Hub brings together results and open-access tools from several European projects and provides a space for continued dialogue and collaboration among people working on societal resilience and systemic risks. “As soon as we established the DRS Stakeholder Hub, members had immediate access to a broad and dynamic network of people engaged in Societal Resilience at various levels,” says Jon Hall, Crisis Management and Civil Protection Specialist at Resilience Advisory Network, responsible for the DRS Hub.
The Hub will help ensure that knowledge, tools and networks developed through European research remain available beyond the lifetime of individual projects.
Building resilience before the next cascading crisis
The conclusion of PARATUS comes as Europe faces increasingly complex emergencies in which extreme weather, critical infrastructure dependencies and societal vulnerabilities can interact. The project's message is clear: preparedness cannot stop at predicting the next hazard. Europe must also be ready for what happens next.
Through its multi-hazard tools and methods, four case studies, a series of open-access papers, CEN standardisation work, stakeholder networks and Disaster Risk Stakeholder Hub, PARATUS contributes to a more integrated approach to disaster preparedness – one capable of addressing not only individual hazards, but the complex chains of events they can trigger.
About PARATUS
PARATUS is a European research project focused on improving disaster preparedness and societal resilience by addressing multi-hazard, compound and cascading risks. The project brings together researchers, practitioners and stakeholders to develop and test tools, methods and approaches supporting risk assessment, preparedness, communication and decision-making across hazards and sectors.
Visit the DRS Hub at www.DRS-hub.eu and reach out for further collaboration.
Leave a comment

CISA and FBI Release Fact Sheet to Help Critical Infrastructure Organizations Working With Third-Party ICS Integrators Reduce Risk

Agency News, Cyber Security CII sector, Industry News
The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) have released a fact sheet, Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators, to help critical infrastructure (CI) organizations work with their third-party industrial control systems (ICS) integrators to establish secure practices and frameworks that protect the operational environment.
ICS is an umbrella term for the network of hardware and software used to monitor and automate physical processes and includes specialized control systems and devices like supervisory control and data acquisition (SCADA) systems and programmable logic controllers (PLCs). Third-party ICS integrators provide various services that support CI organizations, such as design, installation, operational data analysis, device support and services, and daily operational control. CI owners and operators should apply the principle of least privilege within their operational environments to help ensure integrators can complete their assigned tasks while reducing the risk of threat actors exploiting third-party access to compromise equipment and critical functions.
Key Recommendations:
• Prepare contracts and service agreements that include cybersecurity and supply chain cybersecurity with requirements on key areas like data storage, remote access, patch policies, authorized personnel lists, and engineering controls to limit integrator lock-in.
• Evaluate devices with external internet exposure and work with integrators to understand and minimize exposure by disconnecting devices from public-facing internet (see CISA’s Internet Exposure Reduction Guidance).
• Ensure integrators access equipment through routes the organization is able to monitor.
• Request an inventory of all software and hardware supplied by the integrator, including documentation describing how it connects to infrastructure and how it will be updated.
• Practice procedures and maintain capabilities for manual operations, keeping in mind, and accounting for, where third parties fit into the environment and recovery procedures.
Read the fact sheet to learn more about how to work with third-party integrators to reduce risk in shared operational environments.
Leave a comment

AI Agent Breaches Australian Government System

Cyber Security CII sector, Industry News
The Australian Government has revealed that an artificial intelligence agent developed by OpenAI gained unauthorised access to a government website containing Medicare statistics, highlighting a new and potentially significant cybersecurity threat for critical infrastructure operators.
The incident occurred in June when an AI agent was given what was described as a benign task to research Australian health and medical statistics. While interacting with several government websites, the agent encountered the Medicare Statistics Reporting Service portal. When information it sought was not provided, the agent subsequently found a way to gain unauthorised access to the system.
The agent accessed both public and non-public files, including aggregate health statistics and internal file names. Australian authorities currently say there is no evidence that personal Medicare records were accessed, and a forensic investigation remains underway.
The significance of the incident, however, extends beyond the data involved. It demonstrates how increasingly autonomous AI systems can interact with external websites and systems, adapt when their initial requests are unsuccessful, and potentially discover security weaknesses without being explicitly instructed to do so. Australian officials have described the incident as the first known case of an AI agent gaining unauthorised access to an Australian Government IT system.
For critical infrastructure operators, the incident provides an important warning. AI-enabled threats do not necessarily require an attacker to deliberately direct an AI system towards a specific target. Autonomous agents may be capable of reconnaissance, navigating websites, interpreting information, attempting alternative approaches and interacting with systems at a speed and scale that is difficult for conventional security controls to anticipate.
As organisations increasingly introduce AI agents into operational, corporate and security environments, questions around permissions, network segmentation, authentication, monitoring, sandboxing and human oversight become increasingly important.
The Australian incident therefore raises a broader question for critical infrastructure operators: if an AI agent can unexpectedly cross a security boundary while performing a legitimate task, are existing security controls designed to recognise and contain that behaviour?
The incident remains under investigation, but it provides a timely reminder that the security implications of AI extend beyond how organisations use the technology. AI itself is becoming an active participant in the cyber environment – creating new opportunities, but also new attack surfaces and unpredictable behaviours that critical infrastructure operators will need to understand and manage.
Leave a comment

CISA Publish Updated Insider Threat Mitigation Guide

Agency News, Cyber Security CII sector, Industry News
The Cybersecurity and Infrastructure Security Agency (CISA) has released a newly updated Insider Threat Mitigation Guide. This effort continues CISA’s commitment to raising awareness of risks posed by insider threats to the Nation’s critical infrastructure and empowering our partners with effective mitigation strategies for these threats.
Originally published by CISA in late 2020, the Guide has been updated in response to frequent partner requests for expanded guidance on this critical topic. The Guide provides critical infrastructure stakeholders with practical information about insider threats, their various forms, and recommended practices for developing or improving mitigation programs. An established program serves to protect key assets, prevent violence, minimize unintentional incidents, reduce losses related to revenue or intellectual property, safeguard sensitive data, and save lives.
Key updates in the Guide include:
• New case studies, statistics, and improvements designed to enhance the original content, streamline information delivery, and ensure continued relevance
• Expanded insights on emerging workplace trends such as increased hybrid and remote work, advances in Artificial Intelligence (AI), and other pertinent considerations relating to insider threats
• Access to newly released CISA resources supporting preparedness and early risk detection
What’s Inside:
- Types of Insider Threats: Learn about intentional and unintentional insider threats in an organization.
- Detection Strategies: Identify behaviors and indicators of potential insider incidents.
- Assessment Guidelines: Best practices for insider threat assessments to inform mitigation strategies.
- Threat Management: Intervention best practices balancing organizational protection and individual care.
- Mitigation Program: Steps to create or improve an insider threat mitigation program.
Resources: Tools, resources, and a glossary for program development.
CISA published the updated guide to coincide with National Insider Threat Awareness Month (NITAM). Each September, NITAM brings together security professionals from government and industry to promote detection, assessment, and proactive management of insider threats.
Leave a comment

CISA, FBI, and International Partners Release Guidance on Effective Communication During Service Outages

Agency News, Cyber Security CII sector, Industry News
The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Federal Bureau of Investigation (FBI) and international partners, released joint guidance Communicating Under Pressure: Best Practices for Service Providers to help organizations plan to communicate clearly and effectively during service outages impacting IT and operational technology (OT) systems.
Whether caused by cyber threat actors, human error, equipment failure, or natural hazards, service outages can create disruption and societal panic even without speculation from end users and the public as added factors. Outages at one organization may cascade across interconnected systems, increasing the uncertainty and potential for panic. This guidance describes how service providers can prepare and execute clear, timely, and audience-appropriate messaging that articulates accurate information while still aligning with operational security, law enforcement, and containment efforts.
Key actions for communicating during service outages:
• Lead with confirmed facts, scope, and affected systems
• Tailor updates to each audience
• State what is known, unknown, and under investigation
• Explain operational impact and any customer actions
• Avoid vague language, speculation, and public relations “spin”
• Provide frequent, time-stamped updates
• Align messaging with legal, regulatory, and law enforcement requirements
CISA’s CI Fortify initiative provides information and resources that help critical infrastructure organizations prepare to isolate and recover their vital OT systems during a major cyber incident or crisis. Changes in service availability, whether from outages or isolation as a defensive strategy, require transparent and ongoing communication to help end users minimize operational impact, limit speculation, and preserve trust. For emergency planning purposes, critical infrastructure owners and operators should assume that telecommunications services may be disrupted or otherwise unreliable, making it crucial for organizations to have crisis communications plans in place that integrate backup communication methods and understand the type of communication they should expect from their service providers.
Leave a comment

Nepal Landslide Triggers Catastrophic Flash Flood on Tibet Border

Health & Social Care, Industry News, Power/Energy/Oil & Gas sector, Telecomms sector, Transport sector
Nepal flood (library pic)

A catastrophic flash flood has struck Nepal’s northern Rasuwa district after a massive landslide and glacial collapse in the Himalayas triggered a devastating surge of water, ice and debris through valleys along the Nepal–Tibet border.

The disaster on 26 August swept through communities and infrastructure near the Bhote Koshi River, destroying homes, roads, bridges and other critical infrastructure. The impact has extended into neighbouring Tibet, including the strategically important Gyirong border area.

The US Geological Survey has determined that seismic activity initially thought to indicate an earthquake was instead generated by the collapse of a glacier and associated landslide/debris flow. Satellite analysis indicates that a large mass of ice and rock descended thousands of metres, generating an exceptionally powerful and rapid flood.

The human cost remains uncertain, with at least 160–180 deaths reported across Nepal and Tibet and more than 1,000 people potentially missing. Among those unaccounted for are foreign tourists, pilgrims, local residents, police officers and workers at infrastructure projects.

Rescue operations have been severely complicated by damaged roads and bridges, disrupted communications and power supplies, and difficult mountainous terrain. Authorities are also monitoring rivers for the possibility of further flooding caused by unstable debris blockages.

For the security and resilience community, the disaster highlights the vulnerability of critical infrastructure and transport corridors to cascading natural hazards, particularly in mountainous regions where climate-driven glacial instability can create rapid, low-warning threats to communities, energy infrastructure and cross-border connectivity.

Leave a comment

OSCE expands access to its technical guidance on the physical security of critical infrastructure

Agency News, Industry News, Power/Energy/Oil & Gas sector, Telecomms sector, Transport sector
The OSCE Centre in Ashgabat and the OSCE Transnational Threats Department launched the Turkmen version of their Technical Guide on Physical Security Considerations for Protecting Critical Infrastructure from Terrorist Attacks. The launch event was accompanied by a training course on enhancing the physical security of critical infrastructure from terrorist attacks, using the Technical Guide as a training aid.
Developed under the OSCE’s Project PROTECT with support from Germany and the United States of America, the Technical Guide provides practical guidance to policymakers, critical infrastructure owners and operators, and security practitioners on enhancing the protection of critical infrastructure sites from terrorist attacks. The publication consolidates publicly available practices and examples from across the OSCE area and is designed to support stakeholders in developing security measures tailored to their specific risk environment. It was released in November 2025 in the English and Russian. The launch of the Turkmen language version of this Guide, initiated by the OSCE Centre in Ashgabat, is a testament to the Guide's growing value in OSCE participating States.
A representative of the Ministry of Internal Affairs of Turkmenistan presented the country's approach to protecting critical infrastructure, highlighting current practices, the national legislative framework and ongoing efforts to strengthen the security and resilience of critical infrastructure.
The training course brought together government officials responsible for critical infrastructure protection to strengthen their understanding of physical security principles and practices. Participants examined approaches to security system design as well as technical measures including perimeter protection, intrusion detection systems, security lighting, video surveillance, access control and security screening. During the event, participants explored practical ways to apply the Guide’s principles through security assessments, emergency planning, business continuity measures and training exercises.
“The Organization for Security and Co-operation in Europe serves as a vital pillar in global counter-terrorism efforts by actively strengthening the resilience and protection of critical infrastructure across its 57 participating States. Bearing in mind that security is not a task for a single agency or nation, we designed this training programme to build our collective resilience. It is our firm belief that this programme, together with the Guide, will strengthen inter-agency communication and help upgrade security protocols to more effectively protect critical infrastructure from terrorist attacks,” said William Leaf, Head of the OSCE Centre in Ashgabat.
The event featured contributions from international experts and practitioners, as well as the Government of Kazakhstan, another key stakeholder in the OSCE’s Project PROTECT. A representative of the Anti-Terrorism Centre of the Committee of National Security of the Republic of Kazakhstan delivered a presentation on the country's approach to protecting critical infrastructure from terrorist threats.
The event forms part of the OSCE Centre in Ashgabat's project Building Capacity of Law Enforcement and Security Officials of Turkmenistan in Countering Transnational Threats Related to Organized Crime and Terrorism – 2026 and the OSCE's extrabudgetary Project PROTECT, which supports participating States in strengthening national approaches to protecting vulnerable targets from terrorist threats and other hazards.
Leave a comment

INTERPOL report finds AI linked to more than half of cybercrime in Africa

Agency News, Cyber Security CII sector, Industry News

Artificial intelligence is enabling 55 per cent of reported cybercrimes across Africa making attacks faster, more scalable, and increasingly difficult for victims and platforms to detect, according to INTERPOL’s African Cyberthreat Assessment Report 2026.

With more than 1.1 billion mobile subscribers recorded in 2025, Africa’s digital transformation is expanding rapidly.

However, cybercrime legislation is fragmented and AI readiness in law enforcement agencies remains alarmingly low.

The 40-page report draws on survey data from 36 African member countries and highlights a defining shift: cyber-criminality has evolved from isolated incidents into an industrialized, borderless ecosystem.

East Africa emerged as a hub of mobile money fraud and infrastructure-targeted ransomware.

Business email compromise and romance scams targeting both corporate and individual victims were prolific in Central and West Africa.

Southern Africa’s ultra-high connectivity makes it a magnet for global threat actors seeking maximum disruption.

The financial toll of cybercrime in Africa is significant.

Since 2024, cybercrime-related losses have more than doubled, from USD 192 million to USD 484 million, driven primarily by AI-facilitated scams, credential harvesting, and automated social engineering campaigns.

According to the report, in 2025, online scams continued to be the most reported type of cybercrime, with attackers leveraging mobile money platforms, social media and AI to reach their targets.

Notably, 72 per cent of surveyed countries reported the presence of scam centres, with the highest concentration in Southern and West Africa.

AI-enabled cyberthreats
Digital sextortion and online harassment, often facilitated by AI-generated deepfakes and synthetic media, remained pervasive, with some 600,000 sextortion detections recorded by TrendAI, one of several partners working with INTERPOL.

Similarly, the sophistication of Business E-Mail Compromise (BEC) schemes increased dramatically, with AI used to generate highly convincing e-mail correspondence, with Africa-based threat actors targeting victims in Europe and North America using infrastructure located across multiple jurisdictions.

The report reveals that the absence of real-time, inter-agency data sharing between banks, telecoms and law enforcement creates a dangerous blind spot in efforts to combat financial fraud.

This vulnerability is being exploited by criminals who have moved beyond simply stealing existing credentials to creating entirely synthetic identities.

Combining real personal data with fabricated elements, these AI-generated digital personas can bypass even advanced biometric verification systems and have been used to open bank accounts, secure mobile loans and register SIM cards under false names.

Neal Jetton, Director of INTERPOL’s Cybercrime unit said, “Cybercrime has emerged as one of the most significant criminal threats to the region. AI is automating every stage of a cyberattack from reconnaissance and phishing to extortion and evasion.

“However, we see that when countries work together, cybercriminal infrastructure can be identified, disrupted and dismantled.”

Meaningful transnational progress is visible. In 2025, 17 countries enacted or amended cybercrime legislation, including the launch of an online reporting platform in Senegal aimed at enhancing the response to online violations affecting children.

At the same time, regionally coordinated capacity building initiatives continue to strengthen long-term cyber resilience.

Operational cooperation is also delivering noteworthy results.

Four high impact cybercrime operations coordinated by INTERPOL including Operation Serengeti 2.0, Operation Contender 3.0, Operation Sentinel and Operation Red Card 2.0 collectively led to more than 1,500 arrests, the seizure of hundreds of devices and the recovery of over USD 100 million.

In its recommendations, the report calls for standardized digital forensic capabilities, enhanced cross-border cooperation, investment in AI literacy among law enforcement officers and formal-public private partnership to support effective prevention, detection and response.

Leave a comment

CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs

Agency News, Cyber Security CII sector, Industry News, Water sector

CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible. Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in boil water notices and sustained manual operations.

These threat actors are targeting water entities of all sizes. Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans. OT assets exposed to the internet have an increased risk of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage.

CISA recommends organizations implement the following mitigations:

- Disconnect the PLC from the internet. Remote access for operational purposes should go through a VPN or gateway device, not directly to the PLC.
- Enable password protection and change default passwords.
- Allowlist IPs to only allow remote access from known engineering laptops or other critical OT assets.

After disconnecting PLCs from the internet, operators should ensure they have a known clean backup of the PLC image in case they are locked out by a modified password. Note: Owners, operators, and integrators of Rockwell Automation MicroLogix 1400 PLCs should see Rockwell Automation’s IMPORTANT NOTICE: Restoring Access to a MicroLogix™ 1400 Controller When the Password Is Unknown for guidance addressing this activity.

To securely enable remote access to your OT systems, CISA recommends system owners, operators, and integrators see the following resources for guidance:

- CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- United Kingdom's National Cyber Security Center: Secure Connectivity Principles for Operational Technology
- Federal Bureau of Investigation (FBI): Malicious Cyber Actors Targeting Water and Wastewater Sector Internet Facing Programmable Logic Controllers, Causing Operational Disruptions

For additional support, contact the Environmental Protection Agency’s Cybersecurity Technical Assistance Program for the Water Sector.

Leave a comment
1 2 3 … 60