https://halden.ee/en/blogThe cybersecurity news that matters: what happened, who it affects and what to do.en-GB https://halden.ee/en/blog/php2shell-critical-php-vulnerabilityhttps://halden.ee/en/blog/php2shell-critical-php-vulnerabilityWed, 21 Oct 2026 09:00:00 GMTOn 21 October 2026 PHP fixed two critical vulnerabilities, known as PHP2Shell, that let an attacker run code on a web server without logging in. Almost every WordPress, Joomla, Drupal or WooCommerce site runs on PHP. Ask your hosting provider to confirm PHP is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package with the fix. https://halden.ee/en/blog/rank-math-pro-malwarehttps://halden.ee/en/blog/rank-math-pro-malwareFri, 16 Oct 2026 09:00:00 GMTSome copies of the WordPress SEO plugin Rank Math PRO 3.0.123, downloaded or updated between 15 October 20:02 UTC and 16 October 07:12 UTC, contained malware. If that version was installed and activated, assume the site has been broken into. Restore from a backup taken before the window, change every password and key, and install the clean 3.0.124. https://halden.ee/en/blog/denmark-cpr-breach-weak-passwordhttps://halden.ee/en/blog/denmark-cpr-breach-weak-passwordMon, 12 Oct 2026 09:00:00 GMTNames, addresses and CPR numbers of about 8.8 million people were accessed through a Danish private company's lawful access to the population register. Media reports say the company's administrator password was "123456". Review who can access your systems and require multi-factor authentication from your IT partner as well. https://halden.ee/en/blog/french-supermarket-fridges-cyberattackhttps://halden.ee/en/blog/french-supermarket-fridges-cyberattackMon, 12 Oct 2026 09:00:00 GMTA cyberattack switched off refrigeration equipment in hundreds of French supermarkets, and some frozen food had to be thrown away. France's CERT-FR knows of numerous compromised remote controllers for refrigeration systems. Check with your maintenance contractor whether your fridges, heating or cameras can be reached directly from the internet. https://halden.ee/en/blog/estonia-record-data-breaches-magento-wordpresshttps://halden.ee/en/blog/estonia-record-data-breaches-magento-wordpressThu, 08 Oct 2026 09:00:00 GMTEstonia's Data Protection Inspectorate (AKI) received a record 123 personal data breach notifications in the third quarter of 2026. One of the causes was a set of Magento and WordPress vulnerabilities that criminals exploited quickly. Online shops should apply updates promptly and know the 72-hour notification rule. https://halden.ee/en/blog/bricksforge-vulnerability-cve-2026-85097https://halden.ee/en/blog/bricksforge-vulnerability-cve-2026-85097Thu, 08 Oct 2026 09:00:00 GMTA critical flaw in Bricksforge, an add-on for the Bricks WordPress builder, lets anyone upload and run code on a website without logging in. Patchstack saw the first attacks late on 7 October (UTC). Update Bricksforge to 3.1.8.10 or later and have the server checked for files that may already have been planted. https://halden.ee/en/blog/rkik-invoice-fraud-bank-detailshttps://halden.ee/en/blog/rkik-invoice-fraud-bank-detailsWed, 07 Oct 2026 09:00:00 GMTThe Estonian Centre for Defence Investments (RKIK) lost almost €60,000 to invoice fraud in 2024, and the case has only now become public. Criminals take over an email account, watch the conversation and swap the invoice at the right moment. Verify every change of bank details through a second channel and protect the mailboxes of the people who approve payments. https://halden.ee/en/blog/ria-september-2026-wordpress-ddos-login-outageshttps://halden.ee/en/blog/ria-september-2026-wordpress-ddos-login-outagesMon, 05 Oct 2026 09:00:00 GMTEstonia's Information System Authority (RIA) recorded 964 cyber incidents with impact in September. For businesses, the main items are critical WordPress vulnerabilities, DDoS attacks on Estonian websites and repeated outages of the state login services. Update WordPress to 7.1.2 or later, ask your hosting provider about DDoS protection, and don't leave e-service deadlines to the last hour. https://halden.ee/en/blog/fakturownia-breach-invoice-fraudhttps://halden.ee/en/blog/fakturownia-breach-invoice-fraudTue, 29 Sep 2026 09:00:00 GMTOn 29 September the Polish invoicing platform Fakturownia confirmed that an attacker had accessed its servers, possibly exposing account data, bank account numbers and invoices issued before 2023. That is exactly what invoice fraudsters need to send a convincing request to pay a new account. Confirm every change of bank details with the partner through a channel you already know. https://halden.ee/en/blog/tsc-data-breach-websitehttps://halden.ee/en/blog/tsc-data-breach-websiteWed, 23 Sep 2026 09:00:00 GMTAttackers copied names, phone numbers and email addresses of customers of the appliance repair firm TSC through its website, and a small share of the data belongs to Estonian customers. Latvian police have detained a suspect who, according to police, scanned websites automatically and then demanded money from the companies. Keep your website software updated and store as little customer data on the web server as you can. https://halden.ee/en/blog/wordpress-7-1-2-critical-vulnerability-exploitedhttps://halden.ee/en/blog/wordpress-7-1-2-critical-vulnerability-exploitedWed, 23 Sep 2026 09:00:00 GMTWordPress 7.1.2, released on 22 September, fixes a critical vulnerability (CVE-2026-87902) in every version from 4.7.0 to 7.1.1. Attackers started probing sites within hours of the fix. Update now and ask your IT partner to check the logs. https://halden.ee/en/blog/cyber-resilience-act-reporting-obligationshttps://halden.ee/en/blog/cyber-resilience-act-reporting-obligationsFri, 11 Sep 2026 09:00:00 GMTThe EU Cyber Resilience Act's reporting obligations apply from 11 September 2026. Manufacturers of software and connected devices must send an early warning within 24 hours of learning about an actively exploited vulnerability or a severe incident, through ENISA's platform. Work out whether your company is a manufacturer and decide who will report. https://halden.ee/en/blog/innovaatik-dental-data-leak-software-supplierhttps://halden.ee/en/blog/innovaatik-dental-data-leak-software-supplierThu, 03 Sep 2026 09:00:00 GMTPersonal and health data of patients was downloaded from the dental information system run by Innovaatik; initial estimates put the number of affected Estonian healthcare providers above 300. Police have detained a suspect. If a supplier holds your customers' data, ask how access is controlled and logged, and remember that a breach must be reported to AKI within 72 hours. https://halden.ee/en/blog/elementor-pro-vulnerability-exploitedhttps://halden.ee/en/blog/elementor-pro-vulnerability-exploitedWed, 02 Sep 2026 09:00:00 GMTA critical flaw in the Elementor Pro plugin for WordPress (CVE-2026-32475) lets anyone upload a malicious file through a form with a file upload field. Wordfence says attacks began on 19 August and it has blocked over 190,000 attempts. Update to Elementor Pro 4.2.2 and check the forms upload folder for PHP files. https://halden.ee/en/blog/ria-august-2026-fake-fine-sms-ransomwarehttps://halden.ee/en/blog/ria-august-2026-fake-fine-sms-ransomwareWed, 02 Sep 2026 09:00:00 GMTEstonia's Information System Authority (RIA) recorded 899 cyber incidents with impact in August. For businesses, the lessons are fake parking fine texts sent in the Transport Administration's name and a ransomware attack that encrypted a school's servers. Brief your staff on the texts and check that your backups can actually be restored.