Mumin Guvendi MG CYBER
Briefings

The cyber news that matters to a CISO

Regulation and threat news, summarised for CISOs and leadership. Every summary links to its official source.

Filtre
Threats and vulnerabilities

PHP: two critical flaws allow remote code execution

On 21 October, CERT-FR issued an alert about two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution. Proofs of concept have been circulating since 22 October. All 5.x to 8.1.x versions are affected, as are the 8.2 to 8.5 branches before 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Branches 5.x to 8.1.x are no longer maintained, so migrating is the only fix.

What it means for you: List your internet-facing PHP servers, patch them first, and treat outdated versions as a risk to decide on, not a permanent exception.

Source: CERT-FR ↗
Regulation

NIS2: France's Resilience bill pulled from the agenda again

On 6 October, the French National Assembly removed the bill transposing NIS2, along with the CER and DORA directives, from its 7 and 9 October sittings. No new date has been set. The Senate passed the text in March 2025 and it has been waiting for a floor debate since September 2025, although the transposition deadline was 17 October 2024. Until the law is passed, NIS2 obligations do not apply under French law.

What it means for you: The delay changes nothing of substance: use the time to confirm whether you are an essential or important entity and measure your gaps, rather than waiting for the final text.

Source: Assemblée nationale ↗
Risk and governance

Cyber threats in Europe: ENISA flags the weakness of dependencies

The ENISA Threat Landscape 2026 report, covering 2025, highlights continued attacks through supply chains and service providers, which often cause high-impact incidents. 73% of targeted organisations are essential or important entities under NIS2. More than 48,000 CVEs were published in 2025, up 22% on 2024, and 60% of intrusions with a known entry point exploited a vulnerability.

What it means for you: Your suppliers are part of your attack surface: assess their cyber maturity and write security requirements into your contracts.

Source: ENISA ↗