❌

Normal view

Received — 15 October 2026 ⏭

Update Chrome: Google fixes 37 security flaws, including seven critical bugs

✇Malwarebytes Labs
15 October 2026 at 10:15

On October 13 and 14, Google issued several Chrome updates.

Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux. The update includes 37 security fixes, including seven rated Critical.

On the same day, Google released version 155.0.8059.79 for Android. It may not be available on Google Play for everyone yet but keep an eye out for it. Google says it also includes stability and performance improvements.

Updates will roll out over the coming days and weeks.

How to update Chrome

The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.

If you don’t want to wait for the rollout to reach you, manually updating is easy. Open About Google Chrome from Chrome’s settings or Help menu. Chrome will check for updates. If one is available, click Relaunch to apply it.

Chrome 155.0.8059.80 is up to date
Chrome 155.0.8059.80 is up to date

You can find an explanation of the version numbering system and step-by-step instructions in our guide: How to update Chrome on every operating system.

Technical details

Some of the security fixes deserve a closer look.

Mobile protection, anywhere, anytime.

.wp-block-kadence-advancedbtn.kb-btns400740_ab89fd-c4{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:center;align-items:center;}.kt-btns400740_ab89fd-c4 .kt-button{font-weight:normal;font-style:normal;}.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button:focus{background:#444444;}
ul.menu .wp-block-kadence-advancedbtn .kb-btn400740_68fb6a-2d.kb-button{width:initial;}.wp-block-kadence-advancedbtn .kb-btn400740_68fb6a-2d.kb-button{color:var(--color-neutral-10);background:var(--color-brand-blue-60);border-top-left-radius:40px;border-top-right-radius:40px;border-bottom-right-radius:40px;border-bottom-left-radius:40px;box-shadow:1px 1px 2px 0px rgba(0, 0, 0, 0.2);}.wp-block-kadence-advancedbtn .kb-btn400740_68fb6a-2d.kb-button:hover, .wp-block-kadence-advancedbtn .kb-btn400740_68fb6a-2d.kb-button:focus{box-shadow:0px 4px 0px 0px var(--color-brand-blue-90);}Try it now

The first is tracked as CVE-2026-110152, a buffer overflow in ANGLE in Google Chrome on Android. It could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.

ANGLE is Chrome’s graphics-translation layer. A buffer overflow occurs when a program puts more data into an area of memory than it can hold, overwriting data in adjoining memory. An attacker can exploit this to make the vulnerable process run malicious code.

Chrome vulnerabilities that enable remote code execution outside the browser sandbox are particularly valuable to attackers because they can turn a visit to a malicious or compromised website into direct code running on the underlying operating system, often without requiring additional exploitation steps.

Then I spotted two use-after-free vulnerabilities in the PDF component. CVE-2026-110136, rated Critical, could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. CVE-2026-110147, rated High, could allow an attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

A use-after-free vulnerability occurs when a program attempts to access a memory location after it has been freed. That can cause crashes or, in some cases, allow an attacker to run their own code.

Inside the sandbox means the malicious code would run in a restricted, sealed-off environment designed to limit access to the rest of your device. That limits what the attacker can do as it constrains them to the browser, lowering the impact compared with code running outside the sandbox. However, attackers often chain multiple vulnerabilities together to escape the sandbox and achieve a more serious compromise. So, the phrase describes an important security limitation, but it does not mean the vulnerability is harmless.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Received — 13 October 2026 ⏭

Microsoft Patches More Than 1,400 Security Flaws

✇Krebs on Security
By: BrianKrebs
13 October 2026 at 19:24

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.

Just one of the weaknesses patched this week is considered a “zero day,” or already exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions.

Windows 10 users might be wondering if they can still expect security updates after this month. Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A few months ago, Microsoft quietly extended that support for another year (until October 2027).

At least 78 of the flaws fixed this month are rated “critical,” meaning they could be exploited with little or no action by the user, and most of those critical bugs allow an attacker to execute code of their choice on the vulnerable system.

While Microsoft said there are no signs anyone is exploiting it yet, a security feature bypass in the .NET Framework (CVE-2026-108398) was publicly disclosed prior to today, potentially giving attackers advance time to work out how to exploit the bug.

Satnam Narang at Tenable said the number of flaws fixed this month far surpasses the previous record-setting year 2020, when Microsoft patched 1,261 CVEs.

“We’ve now crossed the 4,000 CVE mark with two months left to go,” he said.

Microsoft credits large language models for the high volume of bug discovery, and presumably AI gets credit for many of the patches used to fix these flaw. Meanwhile, security experts have been warning that these unusually large patch volleys from Microsoft are placing extra strain on corporate security teams, which often have to test individual updates before deploying them across a network to ensure the fixes don’t cause problems for other software.

Tyler Reguly, associate director of security research and development at Fortra, notes that just 26 Microsoft vulnerabilities appeared in the “Known Exploited Vulnerabilities” (KEV) catalog maintained by the U.S. Cybersecurity & Infrastructure Security Agency (CISA) so far this year, and security teams would do well to prioritize patching those 26 vulnerabilities first.

“Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act,” Reguly said.

Which vulnerabilities deserve the most scrutiny in your organization? The folks at Cisco Talos have a useful roundup of the more noteworthy flaws that Microsoft fixed today, and of course the SANS Internet Storm Center has a reliable roundup that indexes vulnerabilities by severity, CVE number and affected software.

Received — 24 September 2026 ⏭

Update Chrome: 108 security fixes for desktop, new release for Android

✇Malwarebytes Labs
24 September 2026 at 07:06

Over the last few days, Google issued several different Chrome updates.

On September 22, Google released a Stable Channel Update for Desktop. This is the most important one for desktop users. It brings Chrome to version 154.0.8037.57 for Linux and versions 154.0.8037.57/.58 for Windows and Mac. The update includes 108 security fixes including 11 rated Critical.

It will roll out over the coming days and weeks.

One day later, Google released Chrome 155 for Android, version 155.0.8059.16, to a small percentage of users. It may not be available on Google Play for everyone yet, but keep an eye out for it. Google says it includes stability and performance improvements.

On top of these, Chrome 155 is also available in the Beta channel. The Android release is an Early Stable rollout, meaning Google sends it to a small share of users first, to spot unexpected compatibility or reliability issues before expanding it to everyone. Beta is a separate prerelease version for people who want to try upcoming features roughly four to six weeks before Stable. It is relatively polished but can still contain bugs, so it is best suited to testing rather than everyday use.

How to update Chrome

The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.

If you don’t want to wait for the rollout to reach you, manually updating is easy. open About Google Chrome from Chrome’s settings or Help menu. Chrome will check for updates. If one is available, click Relaunch to apply it.

Chrome 154.0.8037.58 is up to date
Chrome 154.0.8037.58 is up to date

You can find an explanation of the version numbering system and step-by-step instructions in our guide: How to update Chrome on every operating system.

Technical details

Some of the desktop security fixes deserve a closer look.

Let’s start with CVE-2026-95350, a buffer overflow flaw in ANGLE, Chrome’s graphics-translation layer.

A buffer overflow is a bug in code that allows an attack to happen when a program puts more data into an area of memory than it can hold. Essentially, the attacker writes garbage data that fills up the memory, then writes code that overwrites existing code in adjoining memory, which later gets executed by the vulnerable process.

A crafted webpage could potentially trigger the flaw, which could lead to memory safety bugs, including browser crashes or possible code execution.

Another Critical buffer overflow bug in ANGLE is tracked as CVE-2026-95281. A malicious webpage could potentially reach vulnerable graphics-processing code, so the bug may enable serious impacts such as browser compromise, but Google has not provided exploitation details.

And then there is CVE-2026-95357, an out-of-bounds write in Chrome’s GPU component. This means a program could write data outside its intended area of memory.

The GPU component is the part of Chrome that handles how graphics work with your computer’s graphics processor.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Received — 22 September 2026 ⏭

EU Cybersecurity Response Hampered by Critical Information Gaps

✇Cybersecurity News and Magazine
By: Samiksha Jain
22 September 2026 at 02:08

EU cybersecurity incidents

The European Union’s ability to detect and respond to EU cybersecurity incidents faces significant gaps, particularly in information-sharing and coordination between national and EU-level bodies, according to a new report by the European Court of Auditors (ECA). The auditors said the EU has made progress in developing a cybersecurity cooperation framework, but several measures needed to support an effective response to significant and large-scale incidents are still incomplete. Cybersecurity incidents can disrupt public services, businesses, critical infrastructure and the EU’s internal market. While member states remain primarily responsible for responding to such incidents, the EU has a role when attacks cause major disruption, significant financial losses or substantial harm, or when incidents affect several countries and exceed the response capacity of a single member state.

EU Cybersecurity Incidents Face Information-Sharing Gaps

The ECA identified insufficient information exchange as a major weakness in the EU’s cybersecurity response system. The Cyber Blueprint, adopted in 2025, largely clarifies roles and responsibilities for managing major cybersecurity crises. However, the cooperation between two key EU cyber networks has not yet been formally defined. The auditors said this affects cooperation between the CSIRTs network, which brings together national teams responsible for handling cyber incidents, and EU-CyCLONe, which supports cooperation during EU-level cyber crises. Information-sharing is also affected by differences in national security laws and the ongoing implementation of updated EU cybersecurity rules, including the NIS 2 Directive. According to the auditors, these factors can make it harder for EU networks to identify threats early and coordinate an effective response. “The EU has made progress in building a cybersecurity cooperation framework, but it is not yet working as effectively as it should,” said George-Marius Hyzler, the ECA Member responsible for the audit. “When a serious cyber incident occurs, timely and actionable information is essential. Without it, networks and mechanisms lose much of their added value.”

European Cybersecurity Alert System Still Delayed

The audit also found that the European Cybersecurity Alert System was not operational at the time of the assessment. Two hubs examined by the auditors, ATHENA and ENSOC, had not started operating because of procurement delays. The system also lacked several elements needed for operation, including cooperation agreements, a common classification system and technical standards. The findings come as the EU continues to invest in cybersecurity. Under the 2021-2027 EU budget, €1.4 billion has been allocated to cybersecurity through the Digital Europe Programme, the EU’s main source of cybersecurity funding.

Overlap Among EU Cybersecurity Bodies

The ECA also identified overlapping responsibilities among some EU bodies involved in monitoring cybersecurity threats. The European Commission’s cyber situation centre, established in 2022 and largely supported by external providers, carries out work that the auditors said partly duplicates existing capabilities at the European Union Agency for Cybersecurity (ENISA). These capabilities include monitoring threats and developing cybersecurity situational awareness. The auditors called for better coordination to reduce duplication and strengthen the overall effectiveness of the EU’s cybersecurity framework.

Funding Checks Raise Security Concerns

The report also highlighted weaknesses in checks on some organisations receiving EU cybersecurity funding. These checks are intended to reduce risks linked to intrusion or influence by non-EU states and prevent sensitive security information from being shared with non-EU authorities. However, while grant beneficiaries are responsible for assessing the ownership and control of third parties receiving financial support, the European Cybersecurity Competence Centre does not verify those assessments. The ECA warned that this could expose sensitive infrastructure, operational data and security-critical technologies to security risks. The audit covered the period from 2022 to 2025 and assessed whether EU actions effectively supported the detection of and response to significant and large-scale cybersecurity incidents. Audit missions were conducted in Ireland, Greece and Italy.
Received — 18 September 2026 ⏭

Children Under 13 Could Be Barred From Social Media Under New EU Plan

✇Cybersecurity News and Magazine
By: Samiksha Jain
18 September 2026 at 01:18

EU KIDS Act

The European Commission has adopted the EU KIDS Act, a proposal that would introduce new age restrictions and safety requirements for online platforms used by children across the European Union. The proposal would prevent social media platforms from allowing children under 13 to access their services and establish an EU-wide minimum age of 15 for minors to open accounts independently.

The EU KIDS Act would also shift the burden of proof to online service providers, requiring them to demonstrate that their services are safe by design and appropriate for younger users.

Commission President Ursula von der Leyen said the proposal is intended to give parents greater control over how children use digital services.

“Today, our children are engaging with the most sophisticated technologies ever created. Technology that was never created with their wellbeing in mind. Our KIDS Act is reversing the burden of proof - it is for platforms to show they are safe by design. And we put parents back in the driving seat, giving them the tools to help their children navigate a safer online world,” von der Leyen said.

EU KIDS Act Sets New Social Media Age Limits

Under the EU KIDS Act, children between 13 and under 15 would not be able to create autonomous social media accounts. Instead, they could use mini accounts managed through a parent or guardian's account, with access limited to age-appropriate social media and video-sharing services.

These mini accounts would include safeguards such as restricted social contacts and screen time of up to one hour per day.

Children between 3 and under 13 would not be permitted to access social media. They could, however, use specially designed child-friendly video-sharing services through guardian-managed accounts. Parents would also receive tools to restrict an adult device to those services when it is given to a child, with exposure limited to a maximum of one hour per day.

Safety-by-Design Rules Target Addictive Features

The proposal would introduce safety-by-design obligations for online services offering social media, video sharing, online video games, AI companions and chatbots to users under 18.

The proposed rules would prohibit addictive features and profiling-based recommendation feeds that can draw minors toward harmful content. Infinite scrolling without stopping points, reward mechanisms and push notifications during sleeping hours would also be restricted.

The proposal would further prohibit unsolicited contact from strangers. AI companions and chatbots would have to be turned off by default and could not simulate interpersonal relationships in ways that create emotional dependency.

Minor profiles would be private by default, while geolocation, camera and microphone access would be turned off. Platforms would also need to provide tools allowing minors to block or mute users, manage their time and control, tune and reset recommender systems.

Privacy-Preserving Age Assurance Proposed

The EU KIDS Act would require online services and app stores to use age assurance tools. The proposal points to the EU age verification app as one possible approach, with the system designed not to retain identity documents or biometric data.

Social media and video-sharing platforms would be expected to perform age verification when users create new accounts. For existing accounts, providers would estimate a user's age using reasonable indicators, such as the account creation date or credit card details.

EU Plans Faster Enforcement

The proposal would require very large online platforms to prove that their services are safe by design. Providers would submit compliance plans to the European Commission and an independent auditor, which would assess new services, features or functionalities.

If the Commission identifies shortcomings based on an auditor's report, it could require providers to propose corrective measures. The enforcement framework would build on existing structures under the Digital Services Act and Artificial Intelligence Act.

For noncompliance, the proposal includes expedited enforcement procedures under which the Commission should conclude investigations within 90 days.

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, said the proposal would allow children to use digital services while increasing safeguards and accountability for platforms.

“With our EU KIDS Act, we make sure our children can enjoy their rights online - to learn, stay connected and explore. We also give parents the tools to accompany their kids to navigate a safe digital world. All of this by keeping the pressure high on platforms, because they must prove their services do not harm,” Virkkunen said.

EU KIDS Act Moves to Parliament and Council

The legislative proposal has now been submitted to the European Parliament and the Council for examination and adoption.

The proposal follows recommendations from the European Commission's Special Panel on Child Safety Online, which included more than 60 experts from areas including civil society, education, public health, child psychiatry and technology.

The Commission said public support for stronger online protections is also growing. According to the 2026 Special Eurobarometer on the Digital Decade, 92% of Europeans consider strengthening protection for children and young people online a top policy priority.

US House Passes Bill to Help Police Track Down Scammers Targeting Seniors

✇Cybersecurity News and Magazine
By: Samiksha Jain
17 September 2026 at 03:40

GUARD Act

The U.S. House of Representatives has passed the bipartisan GUARD Act, legislation aimed at strengthening law enforcement efforts against elder financial fraud, cryptocurrency investment scams and other financial crimes targeting older Americans. The bill, H.R. 2978, passed on September 15, 2026, and now heads to the Senate.

The GUARD Act, or Guarding Unprotected Aging Retirees from Deception Act, was co-led by Representatives Josh Gottheimer, Zachary Nunn and Scott Fitzgerald. The legislation would provide state, local and Tribal law enforcement agencies with additional resources to investigate fraud, track stolen funds and pursue criminals involved in increasingly complex financial schemes.

GUARD Act Targets Elder Financial Fraud and Crypto Scams

Under the GUARD Act, law enforcement agencies could use existing federal grant funding to investigate elder financial fraud, general financial fraud and pig butchering crypto scams.

The funding could support the hiring of analysts and other experts, as well as specialized training for investigators handling complex and often transnational financial crimes.

The bill would also clarify that federal law enforcement agencies can assist state, local and Tribal law enforcement partners and fusion centers with blockchain tracing tools and related technology. The goal is to help investigators follow the movement of funds and identify individuals involved in cryptocurrency-related scams.

The legislation also directs the Treasury Department, FinCEN and federal partners to report to Congress on the scale of financial scams in the United States. The report would examine how much Americans lose each year, how many scams are linked to overseas actors and organized crime, and the effectiveness of existing enforcement efforts.

‘Pig Butchering’ Scams Under Focus

The legislation specifically addresses pig butchering crypto scams, a form of financial fraud in which criminals build trust with victims before persuading them to put money into fraudulent investment opportunities.

The term refers to the process of building up a victim's confidence and encouraging larger investments before the criminals steal the funds.

According to the information provided with the legislation, the FBI's 2025 Internet Crime Complaint Center report recorded $20.9 billion in total internet crime losses in 2025, a 26% increase from 2024. Cryptocurrency-related losses reached $11.37 billion across 181,565 complaints, while investment fraud accounted for more than $8.6 billion in losses.

Bill Moves to Senate

Gottheimer said the legislation would give investigators tools and resources to pursue fraudsters, recover stolen money and address criminal networks operating from overseas.

Nunn said the bill followed concerns raised by an Iowa sheriff's deputy about local officers lacking the tools needed to track criminals and recover victims' money.

The GUARD Act has received support from organizations including AARP, the Iowa State Police Association, the Financial Technology Association, Consumer Bankers Association, America’s Credit Union Association, Digital Chamber, National Police Association, Crypto Council for Innovation and Iowa Bankers Association.

With House passage complete, the legislation now moves to the Senate for consideration.

EU Plans ‘Article 4’-Style Security Protocol for Cyberattacks and Hybrid Threats

✇Cybersecurity News and Magazine
By: Samiksha Jain
17 September 2026 at 02:40

Emergency Security Protocol

European Commission President Ursula von der Leyen has proposed an Emergency Security Protocol that would allow any European Union member state to trigger a coordinated response to security incidents including cyberattacks, sabotage and drone incursions. The proposal was announced during von der Leyen’s 2026 State of the Union address in Strasbourg, where she called for a new European security strategy in response to what she described as rising threats across the bloc. Recent incidents in Denmark, Lithuania and Poland, along with an attempted drone attack in Leipzig, were cited as examples of the changing security environment.

Emergency Security Protocol Would Bring EU Governments Together

Under the proposed Emergency Security Protocol, a single member state could trigger the mechanism, prompting all 27 EU governments to convene. The proposed framework would be designed to coordinate a European response, deter further escalation and mitigate the consequences of an incident. Von der Leyen presented the mechanism as a European counterpart to NATO’s Article 4, which allows alliance members to consult when the territorial integrity, political independence or security of a member is threatened. The EU proposal, however, was presented as a mechanism for incidents that fall below the threshold of armed aggression but still pose a national security threat. The proposal does not yet specify what decisions would follow such a meeting or whether the mechanism would create predetermined responses to specific types of incidents.

Cyberattacks and Hybrid Threats Drive Security Push

The Emergency Security Protocol comes as the EU considers how to respond to a broader range of hybrid threats. Von der Leyen cited cyberattacks, sabotage, arson and drone incursions as threats that are increasing across Europe. She argued that existing EU institutions and decision-making processes have not kept pace with the changing security environment. As part of the proposed European security strategy, she called for a European counter-hybrid playbook and greater agreement on how member states should respond to incidents that threaten national security without amounting to conventional armed aggression. The EU already has mutual-assistance and solidarity provisions. Article 42(7) of the Treaty on European Union provides for mutual assistance when a member state is the victim of armed aggression, while Article 222 of the Treaty on the Functioning of the European Union contains a separate solidarity provision.

EU Security Council Also Proposed

Alongside the Emergency Security Protocol, von der Leyen proposed creating a European Security Council focused on the security of the continent. The proposed format would include EU leaders and partners such as Canada, Norway, Ukraine and the United Kingdom. The initiative is intended to provide a broader forum for discussions on European security as the bloc reassesses how it responds to emerging threats. The Commission is also expected to outline further details through its forthcoming European security strategy.

Decision-Making Questions Remain

The proposed mechanism comes as questions remain over how quickly the EU can reach collective decisions during security crises. Many decisions under the bloc’s common foreign and security policy require unanimity, meaning individual governments can block measures supported by other member states. EU sanctions are also adopted unanimously. Von der Leyen did not specify whether the proposed protocol would change those decision-making rules, establish agreed responses in advance or primarily provide a framework for consultation. She also announced a European Instrument for Strategic Enablers, covering capabilities including air and missile defence, strategic transport, air-to-air refuelling, space systems and cyber capabilities. The initiative is intended to be aligned with NATO. The Emergency Security Protocol, European security strategy and proposed European Security Council form part of a wider effort outlined in the 2026 State of the Union address to strengthen coordination around Europe’s changing security environment. Further details are expected as the Commission develops its proposed security strategy.
Received — 10 September 2026 ⏭

EU’s 24-Hr Vulnerability Reporting Rules Take Effect Friday, a Year Before the Rest of the Cyber Resilience Act

✇Cybersecurity News and Magazine
By: Mihir Bagwe
10 September 2026 at 07:09

Cyber Resilience Act, CRA, EU, EU Sanctions, Iran, Chinese Hacking,

Manufacturers selling connected products in the European Union face a new legal duty starting Sept. 11. Report actively exploited vulnerabilities to authorities within 24 hours of confirming them. The obligation arrives 15 months ahead of the Cyber Resilience Act's full application date of Dec. 11, 2027, making it the regulation's first hard deadline.

The CRA covers products with digital elements placed on the EU market, a category broad enough to take in enterprise software, consumer IoT devices, industrial controllers and much of the component software beneath them.

Under Article 14, manufacturers must file an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident affecting product security, a fuller notification within 72 hours, and a final report within 14 days of a corrective measure becoming available — one month in the case of severe incidents.

Reports go through a Single Reporting Platform operated by ENISA. A manufacturer submits once to a designated national computer security incident response team, which then shares the notification with CSIRTs in other member states where the product is sold, with ENISA receiving it in parallel. The European Commission has said the platform will be operational by the September date and has been undergoing functional and security testing.

Where the Deadline Bites

The awareness standard is what will generate arguments. The trigger is a reasonable degree of certainty that a vulnerability is being exploited or that an incident has severely compromised product security — a judgment call that must be made in hours, often on partial telemetry, and one that manufacturers cannot defer by declining to investigate.

Two further wrinkles are drawing attention from compliance advisers. Reporting duties survive end of support, unlike most of the CRA's other vulnerability-handling requirements, which means legacy product lines remain in scope. And importers or distributors that rebrand a product or substantially modify it inherit manufacturer obligations outright.

Penalties for breaching core manufacturer obligations reach €15 million or 2.5% of global annual turnover, whichever is higher.

Readiness Questions on the Cyber Resilience Act

Practitioners have raised two gaps. The reporting platform is scheduled to be ready by the deadline rather than in advance of it, leaving little room for manufacturers to rehearse submissions. And the harmonised standards that will define what adequate compliance looks like are still working through public enquiry, so companies are building processes against a moving target. The CRA's requirement that manufacturers publish a coordinated vulnerability disclosure policy does not apply until December 2027.

The effects reach past manufacturers. Enterprises that buy connected products will begin receiving vendor notifications on the vendor's clock rather than their own, and will need a route from a supplier advisory into incident triage — plus a fast assessment of whether the same event triggers separate duties under NIS2 or DORA.

Friday's start date has an immediate real-world test case. Adobe confirmed this week that a maximum-severity Magento flaw, CVE-2026-75650, has been exploited against merchants since Sept. 4. Had the same sequence begun a week later, the 24-hour clock would have applied.

Read: Attackers Exploit Unpatched Magento Zero-Day to Backdoor Online Stores
Received — 20 July 2026 ⏭
Received — 15 July 2026 ⏭

Australia-India PACTS to Deepen Cybersecurity and Tech Collaboration

✇Cybersecurity News and Magazine
By: Samiksha Jain
15 July 2026 at 04:27

Australia-India PACTS

Australia and India have unveiled the Australia-India PACTS, a new framework designed to deepen bilateral cooperation on cybersecurity, critical technologies, supply chain resilience, digital resilience, and defence research.

The new partnership replaces the 2020 Framework Arrangement on Cyber and Cyber Enabled Critical Technology Cooperation and aims to strengthen national security, economic growth, and regional stability across the Indo-Pacific.

The two countries said the Australia-India Partnership on Cyber, Critical Technologies and Supply Chains (PACTS) builds on two decades of research collaboration, operational coordination, and policy engagement. It also reflects their shared commitment to creating secure digital ecosystems while promoting trusted technology partnerships.

Australia-India PACTS Built on Five Pillars

The Australia-India PACTS is structured around five pillars that will drive collaboration between governments, research institutions, universities, and the private sector. The framework is intended to increase two-way investment in emerging technologies while supporting innovation and the commercialisation of research.

The first pillar focuses on supply chain resilience by strengthening trusted technology supply chains and promoting secure trade. Both countries will establish a bilateral mechanism for trusted vendor frameworks and work together to improve undersea cable security through the Quad Partnership for Cable Connectivity and Resilience. The partnership also includes collaboration on semiconductor research, critical minerals, and trade diversification.

Australia-India PACTS Expands Critical Technology Collaboration

The second pillar focuses on critical technologies, with Australia and India planning to strengthen cooperation in artificial intelligence, telecommunications, biotechnology, advanced materials, and space technologies.

The framework also supports the development of international standards for trustworthy AI and encourages collaboration between academic institutions and industry to promote responsible AI deployment. The two countries will also explore joint research, investment initiatives, and commercial partnerships in emerging technologies to strengthen long-term economic security across the Indo-Pacific.

Australia-India Prioritises Cybersecurity

A major component of the partnership is Australia India cybersecurity cooperation. Under the third pillar, both governments will work together to counter cybercrime, deter malicious cyber activity, strengthen cyber policy coordination, and protect critical infrastructure.

The framework proposes a consolidated bilateral mechanism for cyber and ICT cooperation, expanded engagement in United Nations cyber processes, increased trade opportunities for cybersecurity businesses, and practical workshops involving government agencies and industry stakeholders.

The partnership will also establish a cyber technology skills incubator to promote knowledge exchange and workforce development.

Australia-India PACTS Advances Digital Resilience

The fourth pillar focuses on digital resilience across the Indo-Pacific. Australia and India will collaborate on trusted Digital Public Infrastructure initiatives and promote scalable digital solutions that support connectivity, healthcare, education, renewable energy, critical infrastructure, and digital transformation.

The partnership also seeks to expand pilot projects that help countries across the region build adaptable digital ecosystems while strengthening regional capabilities.

Defence Research and Governance Framework

The fifth pillar strengthens defence science collaboration through joint research, innovation partnerships, and greater engagement between Australia's Defence Science and Technology Group and India's Defence Research and Development Organisation.

Areas of cooperation include maritime surveillance, advanced materials, defence innovation, and stronger links between defence start-up ecosystems.

The Australia-India PACTS will be jointly overseen by the Australian Deputy Secretary of the International and Security Group within the Department of the Prime Minister and Cabinet and the Indian Deputy National Security Advisor. Annual Senior Officials Meetings will review progress, assess emerging cyber and technology risks, and identify future collaborative projects under each pillar.

With the launch of Australia-India Partnership on Cyber, Critical Technologies and Supply Chains (PACTS), both countries have outlined a long-term roadmap that brings together cybersecurity, critical technologies, supply chain resilience, digital resilience, and defence cooperation under a single strategic framework aimed at strengthening security and technology collaboration across the Indo-Pacific.

❌