Regulatory & Compliance Intelligence Desk

[DEADLINE] NIS2 Italy: baseline security measures due by October 2026

Mon, 28 Sep 2026 06:00:00 GMT

What changes: ACN set October 2026 as the deadline for NIS entities to complete the baseline cybersecurity measures, after incident notification obligations started in January 2026. It applies to every entity that received the NIS designation from ACN.

Recommended action: Run a gap check of your controls against the ACN baseline measures now and document the evidence for each one before the deadline.

ACN (Agenzia per la Cybersicurezza Nazionale) | D.Lgs. 138/2024 Art. 24 | Original advisory

[CRITICAL VULNERABILITY] Citrix NetScaler ADC and Gateway: 8 vulnerabilities fixed, 2 already exploited

Sun, 27 Sep 2026 06:00:00 GMT

Impact: Citrix reports exploitation of CVE-2026-88771 and CVE-2026-88772 on unpatched NetScaler appliances. These devices usually sit on the internet edge and handle remote access.

Recommended action: Apply the Citrix updates to every ADC and Gateway instance, then review appliance logs and active sessions for signs of access before the patch date.

CSIRT Italia (ACN) | CVE-2026-88771, CVE-2026-88772 | Original advisory

[CRITICAL VULNERABILITY] Microsoft SharePoint code injection exploited in the wild

Fri, 25 Sep 2026 06:00:00 GMT

Impact: CISA confirms active exploitation: an authorized attacker can execute code over the network on SharePoint servers.

Recommended action: Apply the Microsoft mitigations to all on-premises SharePoint farms and check whether any farm is reachable from the internet.

CISA Known Exploited Vulnerabilities | CVE-2026-65660 | Original advisory

[CRITICAL VULNERABILITY] Adobe Commerce and Magento authorization flaw exploited in the wild

Thu, 24 Sep 2026 06:00:00 GMT

Impact: An unauthenticated attacker can gain elevated access to sensitive resources without user interaction.

Recommended action: Patch per the Adobe bulletin, then check the storefront and checkout pages for unexpected script changes.

CISA Known Exploited Vulnerabilities | CVE-2026-71362 | Original advisory

[CRITICAL VULNERABILITY] F5 BIG-IP APM: unauthenticated remote code execution with OAuth profiles

Tue, 22 Sep 2026 06:00:00 GMT

Impact: Heap overflow exploitable without credentials when an access policy and an OAuth profile are configured on a virtual server. BIG-IP APM usually fronts VPN and SSO.

Recommended action: Identify virtual servers with both an access policy and an OAuth profile and apply the F5 fix or mitigation.

CISA Known Exploited Vulnerabilities | CVE-2026-94127 | Original advisory

[HIGH VULNERABILITY] containerd CRI plugin: 5 vulnerabilities affecting EKS, ECS, Fargate and Bottlerocket

Tue, 22 Sep 2026 06:00:00 GMT

Impact: The issues in containerd 1.7 to 2.3 include image cache poisoning and command execution, with CVSS up to 8.8. AWS patches managed runtimes; self-managed nodes and custom AMIs are the customer's responsibility.

Recommended action: Inventory containerd versions on self-managed EKS node groups and custom AMIs, upgrade to the patched upstream release, and roll the nodes.

AWS Security Bulletins | CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262 | Original advisory

[GUIDANCE] AWS guidance for a secure landing zone in the European Sovereign Cloud

Wed, 16 Sep 2026 06:00:00 GMT

What changes: The European Sovereign Cloud is a separate AWS partition (aws-eusc) operated in the EU, with its own control plane and IAM. Accounts, policies and tooling built for commercial Regions do not carry over automatically.

Recommended action: If you plan EU sovereign workloads, design the account structure, SCPs and logging for the aws-eusc partition from scratch instead of copying the commercial setup.

AWS Security Blog | AWS European Sovereign Cloud | Original advisory

[GUIDANCE] PCI SSC publishes an information supplement on AI system security

Tue, 15 Sep 2026 06:00:00 GMT

What changes: The supplement covers the security of AI used inside payment environments and the defence of traditional systems against AI-assisted attacks. It is guidance, not a new requirement, but assessors are likely to use it as a reference.

Recommended action: List any AI components that touch the CDE or cardholder data and check them against the supplement before your next assessment.

PCI Security Standards Council | PCI SSC Information Supplement | Original advisory

[GUIDANCE] AWS STS replaces session token limits with a single 4,096-byte limit

Tue, 15 Sep 2026 06:00:00 GMT

What changes: STS replaced the packed policy and session token size limits with one 4,096-byte token limit and now reports token size in API responses. Teams using large session policies or many session tags get more room and a way to monitor it.

Recommended action: Review federation and role-assumption flows that previously hit the packed policy limit and add monitoring on the reported token size.

AWS Security Blog | AWS STS | Original advisory

[NEW RULE] New PCI Key Management and Operations (KMO) Standard v1.0

Mon, 14 Sep 2026 06:00:00 GMT

What changes: A new PCI standard with security and test requirements for entities that operate systems using cryptographic keys to protect account data. It is relevant to processors, HSM operators and key custodians.

Recommended action: Map your current key management procedures (PCI DSS Requirements 3.6 and 3.7) against KMO v1.0 and list the gaps before your next assessment cycle.

PCI Security Standards Council | PCI KMO Standard v1.0 | Original advisory