The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the U.K.’s National Cyber Security Centre (NCSC) are releasing this fact sheet to urge defensive action against malicious cyber activity by nation-state threat actors.
Nation-state threat actors exploit end-of-support (EOS) edge devices—including, but not limited to, load balancers, firewalls, routers, and virtual private network (VPN) gateways—to gain network access, maintain presence, and compromise sensitive data. Organizations using EOS devices are particularly vulnerable to compromise, especially if they are using EOS devices exposed to the public internet or external systems at the network’s “edge.”
Read more…
Source: U.S. Federal Bureau of Investigation Cyber Division
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Government websites in Europe and elsewhere go dark as software flaw sparks security scramble
October 21, 2026
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems. Developers of the PHP programming language said Tuesday they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix ...
- GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
October 16, 2026
On October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8 to fix CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar. GitLab assigned it a CVSS score of 10.0 and described possible code execution by an unauthenticated user. The advisory states that CVE-2026-97229 affects GitLab CE and EE ...
- Bank of America had to hire 1,000 contractors to patch software flaws spotted by Anthropic Mythos
October 15, 2026
Bank of America, one of the largest financial institutions in the United States, was forced to hire a thousand people on contractor roles, and spend north of a $100 million dollars to fix all of the bugs found by the famed Mythos, Anthropic’s generative artificial intelligence (GenAI) model. When Anthropic first unveiled Mythos in April 2026, ...
- AI systems are fully capable of carrying out attacks against infrastructure
October 11, 2026
Autonomous AI systems are fully capable of carrying out a nightmare cyberattack scenario – finding and attacking critical operational technology and industrial equipment, and shutting down access to water, power, and other daily life necessities. If this happens, defenders may only have minutes to detect and block it, according to a Booz Allen Hamilton report. The consulting ...
- Citrix gives NetScaler admins another critical reason to patch
October 9, 2026
Citrix is urging customers to patch another critical NetScaler vulnerability after weeks of disclosures involving actively exploited flaws. CVE-2026-107406 affects NetScaler ADC and NetScaler Gateway and can lead to remote code execution (RCE) or denial of service (DoS). It carries a CVSS v4.0 score of 9.5. The affected configurations depend on the software version. Older builds are ...
- UK and Germany launch joint-partnership to counter sabotage and cyber attacks
October 8, 2026
Prime Minister Andy Burnham will travel to Berlin today for talks with Chancellor Friedrich Merz, as the UK and Germany work together on technologies and industries that will drive growth in every UK postcode, and build resilience against shared threats. The UK and Germany are Europe’s two largest economies and biggest investors in defence and today ...